Mechanism to avoid expensive double-encryption in mobile networks

A base station (BS) for enabling a mobile node to access a remote terminal over a datapath having a first link between the MN and said BS and a second link between said BS and said remote terminal, comprising:

• means for allocating to said MN a first plurality of identifiers for marking datagrams which must be HL encrypted during transmission over said second link;
• means for allocating to said MN a second plurality of identifiers for marking datagrams which must be L2 encrypted during transmission over said first link and need not be HL encrypted during transmission over said second link;
• means for determining whether an identifier carried by a datagram received from the MN belongs to said first plurality of identifiers or to said second plurality of identifiers;
• and
• an L2 decryption mechanism for L2 decrypting only datagrams determined to carry an identifier belonging to said second plurality of identifiers.

A mobile node (MN) for communicating with a remote terminal over a datapath with a first link between the MN and a base station (BS) and a second link between said BS and said remote terminal, comprising:

• means for requesting from said BS a first plurality of identifiers and a second plurality of identifiers, wherein each identifier of said first plurality of identifiers corresponds to a HL encryption standard and each identifier of said second plurality of identifiers corresponds to an L2 encryption standard;
• marking datagrams which must be encrypted during transmission over said second link with an identifier belonging to said first plurality of identifiers;
• marking datagrams which need not be encrypted during transmission over said second link with an identifier belonging to said second plurality of identifiers;
• an application specific mechanism for HL encrypting datagrams marked with an identifier belonging to said first plurality of identifiers;
• and
• an L2 encryption mechanism for L2 encrypting datagrams marked with an identifier belonging to said second plurality of identifier.

A method of avoiding double encryption of packets sent by a mobile node over an untrusted network to a remote terminal, comprising the steps of:

• a) establishing a datapath over a first link between the MN and an intelligent base station (iBS) and a second link between said iBS and said remote terminal, wherein said iBS is trusted by said MN;
• b) Layer 2 (L2) encrypting datagrams at said MN using an L2 encryption mechanism;
• c) transmitting said L2 encrypted datagrams from said MN to said iBS, along said first link;
• d) L2 decrypting said L2 encrypted datagrams at said iBS;
• e) Higher Level (HL) encrypting said L2 decrypted datagrams, at said iBS on behalf of said MN, using an application-specific security mechanism, wherein said HL encrypting occurs at a layer higher then L2;
• and
• f) transmitting the HL encrypted traffic from said iBS to said remote terminal, along said second link.

An intelligent base station (iBS) for enabling a mobile node (MN) to access a remote terminal over a datapath having a first link between said MN and said iBS and a second link between said iBS and said remote terminal, comprising

• means for creating and managing secure channels on behalf of said MN;
• means for Layer 2 (L2) decrypting datagrams arriving from said MN;
• means for Higher Level (HL) encrypting said L2 decrypted datagrams on behalf of said MN, wherein said HL encrypting occurs at a layer higher than L2;
• means for HL decrypting, for said MN, datagrams arriving from said remote terminal;
• and
• means for L2 encrypting said HL decrypted datagrams.