PROTECTED MOBILE MESSAGING

Description

[0001] The invention relates to a method for mobile message transmission over a network. More specifically, the invention relates to a telecommunications method and a network node of a mobile radio network for the secure transmission of a message, in particular an email, from a message client of a mobile radio device.

[0002] Mobile devices for sending and receiving messages via telecommunications have become an indispensable part of modern everyday life. A wide variety of different devices are used for this purpose, such as smartphones or tablets with radio interfaces. Using corresponding mobile devices, different types of electronic messages can be sent and received via corresponding mobile networks. Users of these mobile devices want to communicate freely and securely, regardless of which service provider or transmission path is involved in the message transmission. Although programs for encrypting and decrypting messages are known, these usually have to be implemented and configured in addition to the programs that enable message transmission, or they have to be adapted to the user's system environment. However, many users are unfamiliar with such programs and their handling.In particular, they are usually not familiar with how to configure the relevant programs.

[0003] US 2006 / 259761 A1 describes a modified PKI encryption method and system for securing information transmitted between a sender system and a receiver system. An intermediate system that transmits the information between the sender and receiver systems is configured to encrypt unencrypted information sent by the sender system. The intermediate system can be configured by a user of the sender system to encrypt unencrypted information sent by the sender system before it is delivered to the receiver system, or to encrypt unencrypted information received from a sender system before the intermediate system stores the received information.

[0004] WO 2007 / 006815 A2 describes a method and system for transmitting secure messages to and from a mobile phone. A method is described for providing encrypted messaging on mobile phones that is independent of SMS messaging and does not require significant amounts of memory on the mobile phone for its operation. For this purpose, a suitable encryption algorithm is selected and then optimized. All encryption and decryption functions are performed on the mobile phone, providing enhanced security without the need for external encryption servers.

[0005] The invention is based on the object of enabling a protected mobile transmission of electronic messages.

[0006] The object underlying the invention is achieved by the features of the independent patent claims. Embodiments of the invention are specified in the dependent patent claims.

[0007] Embodiments include a telecommunications method for the protected transmission of a message from a message client of a mobile device, wherein the message client is assigned a message server which implements a protocol for receiving the message from the message client and for sending the message to another message server, to which the message recipient specified in the message is assigned, wherein the transmission of the message from the message client to the message server takes place via a network node, wherein the network node emulates the message server to the message client, and wherein the network node emulates the message client to the message server, comprising the following steps: a) Receiving the message from the message client by the network node, b) Checking by the network node whether the content of the message to be transmitted is encrypted, and, c) If this is the case, sending the message from the network node via the message server to the message recipient specified in the message, and, d) If this is not the case, protecting the message by the network node and sending the protected message to the message recipient, where the network node is a node of a mobile network.

[0008] An electronic message refers to a data construct for electronic data processing that includes digitally encoded data. This can, in particular, be an electronic file of any file format, such as a text, spreadsheet, audio, image, and / or video file. The message can, for example, also be contained in a container file or a file folder or be a component of such a file. Furthermore, the message can be an electronic attachment to another message, such as a file attachment to an email, or a message with an attachment. Depending on embodiments, the electronic file can be executable or non-executable.

[0009] For example, the message is sent in the form of an email, an instant message, a text document, a presentation, an audio message, a video message, a picture message, an SMS (in particular landline SMS), EMS (in particular landline EMS) or MMS (in particular landline MMS) or is included in one of the aforementioned message types.

[0010] Instant messaging is a communication method in which two or more participants communicate with each other via digitally encoded text, voice, image, and / or video messages. The sender initiates the transmission of the message, i.e., a so-called push process is used so that the messages reach the intended recipient as quickly as possible.

[0011] A mobile radio device is a mobile, portable electronic device with a mobile radio interface to a digital cellular mobile radio network, which can be based on a mobile radio standard such as GSM, UMTS, LTE, CDMA, or another standard. The mobile radio interface can also be a WLAN radio interface, with a radio cell being formed by a WLAN, for example, according to the IEEE 802.11 family standard. The mobile radio device can, in particular, be a battery-operated terminal device, such as a so-called cell phone, in particular a smartphone, a tablet, notebook, or laptop computer, or even a smartwatch or smartglasses.

[0012] A network is understood here to be any transmission medium with a connection for communication, in particular a local connection or a local network, in particular a PAN (Personal Area Network), LAN (Local Area Network), a private network, in particular an intranet, and a virtual private network (VPN). A network can be configured entirely or partially as a cellular network. For example, a computer system or mobile device can have a cellular interface for connecting to the cellular network. Furthermore, it can be a public network, such as a MAN (Metropolitan Area Network), WAN (Wide Area Network), GAN (Global Area Network), or the Internet. Depending on the embodiment, this connection can also be established via a cellular network.

[0013] A network node is a hardware component of a network that connects two or more transmission paths or communication links of a telecommunications network. Furthermore, a network node is addressable via the network. In particular, this can be a network node of a mobile network.

[0014] A client or client application is an electronic data processing program that is executed on a terminal device in a network and communicates with a server or server application on a central computer in the network.

[0015] A message client is an electronic data processing program that can receive, display, play, create, and send electronic messages. The message client receives the corresponding messages from a message server or sends them to the message server.

[0016] A server or server application is an electronic data processing program that runs on a computer on a network and provides functionality such as utilities, data or other resources that a client or client application can access over the network.

[0017] A message server is an electronic data processing program by means of which messages can be received, forwarded, stored or sent.

[0018] An emulator is a program application that replicates a computer or the software it runs, allowing that software to be used on another computer with a different architecture.

[0019] According to embodiments, the network node receives the message from the message client and ensures that the message is sent in a protected format to the intended recipient. To do this, the network node checks whether the message content is encrypted. If the message content is encrypted, it is forwarded. If the content of the message to be transmitted is unencrypted, the network node protects the message and sends the protected message to the message recipient.

[0020] Embodiments can have the advantage of enabling protected or encrypted communication from the user's messaging client to the message recipient without the user having to configure the messaging client and / or additional programs in their terminal device to encrypt messages. The present method can, in particular, enable automatically secured communication, for example, through encryption, without the communicating user having to take action and control the security.

[0021] Service providers that offer message transmission and / or a network infrastructure for this purpose can offer the corresponding method, for example, as secure mobile network access. The network node is a network node of the mobile network provided by the service provider that serves as access to the mobile network for the user. The network node can check the validity of certificates from other network nodes of the mobile network or from another network communicatively connected to the mobile network (for example, via a gateway). The other network nodes can be web servers, for example. Component providers can offer subsystems that serve as network nodes or are comprised of a network node and implement the corresponding method.

[0022] According to embodiments, the message is an email, the message client is an email client, and the message server is an email server. Embodiments may have the advantage of ensuring secure email communication between the sender's email client and the intended recipient of the email.

[0023] According to embodiments, the message is an instant message, the message client is an instant messaging client, and the message server is an instant messaging server. Embodiments may have the advantage of enabling a secure exchange of instant messages.

[0024] According to embodiments, the network node is one of the following nodes: base station, BTS node, BSC node, Node-B, STP node, MSC node, SMSC node, PCU node, SGS node, GGS node, RNC node, CBC node, mobile router, SGW node, PGW node, MME node. Embodiments can have the advantage that automated security, in particular encryption, of messages can be integrated into message transmission via a mobile network.

[0025] A base station is a stationary transmission device for radio signals in a mobile radio network or wireless network. For example, in a GSM (Global System for Mobile Communications) network, a BTS (Base Transceiver Station) node is a base transceiver station, also known as a GSM base station. A BTS node is a network element in a base station subsystem of a digital GSM mobile radio network. It serves one or more radio cells of the mobile radio network via the antennas connected to it and is communicatively connected to a BSC (Base Station Controller). A BSC node is a central control unit of a base station subsystem of a digital GSM mobile radio network, which monitors radio connections and initiates cell handovers if necessary.

[0026] A Node-B is a base station in a UMTS mobile network that serves multiple UMTS cells. The Node-B is controlled by an RCN node. The Node-B and RNC nodes together form a UMTS Terrestrial Radio Access Network, i.e., a hierarchically structured radio access network to a mobile network based on the UMTS standard. An RNC node is a radio network control device that manages the connected Node-Bs and their radio resources.

[0027] STP nodes (Signalling Transfer Point) are central switching nodes for signaling traffic, i.e. in the subnetwork for the signaling traffic of a mobile network.

[0028] MSC nodes (Mobile Services Switching Centers) are fully digital switching centers in a mobile network, such as GSM, UMTS, or LTE. An SMSC node (Short Message Service Center) is a component of a GSM, UMTS, or LTE mobile network and is responsible for storing, forwarding, converting, and delivering messages from a Short Message Service.

[0029] A PCU (Packet Control Unit) node controls communication between a GS node (GPRS Support Node), i.e., an SGS node or GGS node, and the mobile device via a base station. An SGS node (Serving GPRS Support) manages GPRS data traffic, i.e., the data traffic of the general packet-oriented radio service or the packet-oriented service for data transmission in a GSM network. An SGS node organizes the registration of subscribers for GPRS services, the switching of radio cells and SGSN areas, and the routing of GPRS data. GGS nodes (Gateway GPRS Support) establish the GPRS data connections to network-internal service platforms or data networks.

[0030] CBC node (Cell Broadcast Centre) provides a mobile service for sending short messages, which are sent from the base station to all devices that have this service activated and are located in the same radio cell.

[0031] A mobile router provides mobile access to the Internet for one or more Internet-enabled devices via a mobile network.

[0032] Serving Gateway (SGW) nodes provide router functionality and forward packets between networks. Packet Data Network Gateway (PGW) nodes provide interfaces to data networks, such as the internet. A PGW node manages communication when a device connects to multiple networks and assigns IP addresses. Management Mobility Entity (MME) nodes are network components of the LTE mobile communications standard that provide paging functions and signaling for control purposes.

[0033] Furthermore, in the case of a satellite-based mobile network, the network node can also be a satellite.

[0034] According to embodiments, the message is transmitted from the message client to the network node using a transport layer security protocol. Embodiments can have the advantage that the use of the transport layer security protocol can ensure secure communication between the message client and the associated network node.

[0035] According to embodiments, the unencrypted content of the message is encrypted by the network node for protection, the protected message being the message encrypted by the network node, and the message encrypted by the network node being sent to message recipients via the message server.

[0036] Embodiments can have the advantage that the message content is encrypted independently by the network node, thus ensuring that only encrypted messages are forwarded by the network node. This encryption can ensure that the messages are effectively protected against unauthorized access. For example, a symmetric, asymmetric, and / or hybrid encryption method can be used for encryption.

[0037] According to embodiments, the message is encrypted using a public key of the message recipient specified in the message.

[0038] The public key can be a public key of a cryptographic key pair, which includes a public key and an associated private key. The public key can, for example, be contained in and provided by a certificate of the message recipient. The certificate confirms, for example, the authenticity of the public key and its assignment to the message recipient.

[0039] A certificate is understood here as a digital certificate, also known as a public key certificate. Such certificates based on asymmetric key pairs create a so-called public key infrastructure (PKI). Such a certificate consists of structured data that serves to assign a public key of an asymmetric cryptosystem to an identity, such as a person or a device. A certificate can, for example, contain a public key and be signed. Alternatively, certificates based on zero-knowledge cryptosystems are also possible. For example, the certificate can conform to the X.509 standard or another standard.

[0040] Digital certificates are a proven means of proving authorization in securing electronic communication using asymmetric cryptographic methods and are confirmed by an independent, credible authority (certification service provider / CSP), generally the certification authority that issued the certificate. Certificates are typically made available to a wide audience, for example, to provide them with a public key for encrypted communication.

[0041] Embodiments can have the advantage that, by using the message recipient's public key, only the recipient, who possesses the associated private key, is able to decrypt the corresponding message. This ensures that the message can only be read by the intended recipient, regardless of the intermediate stations in its transmission to the recipient. This is particularly advantageous because the encrypted transmission from the network node onwards is thus independent of the intermediate stations along the transmission path.

[0042] According to embodiments, the network node comprises a memory in which the public key of the message recipient is stored. Embodiments may have the advantage that the network node can directly access the public key of the message recipient. This can be particularly advantageous when a large number of messages are sent to the same message recipient. For example, after its initial use, the public key is stored in the memory for future use.

[0043] According to embodiments, the network node queries a directory server for the public key using the message recipient specified in the message. Embodiments can have the advantage that the network node can encrypt encrypted messages to a plurality of different recipients, each with individual public keys, by using the directory server. In particular, the network node thus requires no storage capacity to store a plurality of public keys for a plurality of potential recipients. Furthermore, the directory server reliably enables public keys to be provided to recipients for whom the network node does not have a public key. This applies in particular to new recipients to whom a message is to be sent for the first time.

[0044] The public key is provided, for example, as part of a corresponding certificate of the message recipient. The directory server that provides the public key can be, for example, the messaging server assigned to the messaging client, a messaging server of the messaging service provider, or a directory server of a trusted service provider, i.e., a certification authority, which provides corresponding certificates upon request. The certificate request can be made, for example, via LDAP.

[0045] According to embodiments, protecting the message comprises generating a link by the network node, via which the content of the message can be retrieved by the message recipient, wherein a further message containing the link is generated by the network node and sent via the message server to the recipient of the protected message, wherein the sending of the protected message takes place in the form of the message recipient retrieving the content of the message via the link.

[0046] A link is an identifier of a storage address under which the message is made available for retrieval, for example a hyperlink.

[0047] Embodiments can have the advantage that a protected transmission of the message can be ensured even if the network node does not have a cryptographic key for encrypting the message, in particular if the network node does not have the recipient's public key and cannot obtain it by retrieving it from, for example, a directory server. Rather, the corresponding message is made available for retrieval by the intended message recipient under a corresponding link, i.e., a corresponding network address. The intended recipient is informed of this provision by means of a corresponding message, which the network node generates and sends to the recipient. If the intended recipient retrieves the provided message under the specified link, it is sent to the recipient.For example, to retrieve the message, the recipient must provide a certificate with a public key assigned to them so that the retrieved message can be encrypted with the public key during retrieval. According to further embodiments, retrieval of the message by the intended recipient requires successful authentication of the message. Such authentication can be performed, for example, by specifying a registered username and / or password assigned to the intended recipient.

[0048] According to some embodiments, the successful retrieval of the message content requires successful authentication of the retrieving message recipient by a server that provides the message content under the retrieval link. Some embodiments can have the advantage of ensuring that the intended recipient actually retrieves the message. This can effectively prevent, for example, a man-in-the-middle attack, through which an unauthorized user receives the message informing about the availability of the original message under the corresponding link.

[0049] According to embodiments, the message content is retrieved via an end-to-end encrypted transmission channel between the server, which provides the message content for retrieval via the link, and a computer system of the message recipient. Embodiments can have the advantage of ensuring secure transmission of the message provided via the link to the intended recipient, who retrieves the message via the corresponding link.

[0050] According to embodiments, the server that provides the content of the message under the link for retrieval is the network node.

[0051] According to embodiments, the server that provides the content of the message under the link for retrieval is a download server of a service provider to which the network node sends the content of the message for retrieval.

[0052] According to embodiments, the content of the message is sent to the service provider's server via an encrypted communication connection. Embodiments may have the advantage that the network node has a cryptographic key for encrypting and communicating with the service provider's server. For example, the network node may include a preconfigured program for encrypted communication with the service provider's server.

[0053] Embodiments further include a network node for securely transmitting a message from a message client of a mobile device, the network node comprising a processor, a memory with program instructions and a network interface, wherein execution of the program instructions by the processor causes the network node to emulate a message server to the message client and to emulate the message client to the message server, wherein the message client is associated with the message server, which implements a protocol for receiving the message from the message client and for sending the message to another message server, to which the message recipient specified in the message is associated, wherein execution of the program instructions by the processor further causes the network node to: a) receive the message from the message client, b) check whether the content of the message to be transmitted is encrypted, and, c) if this is the case, send the message via the message server to the message recipient specified in the message, and, d) if this is not the case,Protecting the message by the network node and sending the protected message to the message recipient, , where the network node is a node of a mobile network.

[0054] According to embodiments, the network node is configured to execute one or more of the aforementioned embodiments of the method for securely transmitting a message from a message client of a mobile device.

[0055] According to embodiments, the network node is one of the following nodes: base station, BTS node, BSC node, Node-B, STP node, MSC node, SMSC node, PCU node, SGS node, GGS node, RNC node, CBC node, cellular router, SGW node, PGW node, MME node.

[0056] A computer system is defined here as a device that processes data using programmable computing rules and electronic circuits. A program, a program application, or program instructions is defined here, without limitation, as any type of computer program that contains machine-readable instructions for controlling a computer's functionality.

[0057] A computer system may comprise a communications interface for connecting to the network, wherein the network may be a communications network, in particular a mobile radio network. A computer system may, for example, be a mobile telecommunications device, in particular a smartphone, a portable computer such as a laptop or palmtop computer, a personal digital assistant, or the like. Furthermore, it may, for example, be a smartwatch or smartglasses. Furthermore, it may be a stationary computer system, such as a personal computer or a client or server integrated in a client-server environment.

[0058] The term “memory” or “data storage” refers here to both volatile and non-volatile electronic memories or digital storage media.

[0059] Non-volatile memory is defined here as electronic memory for the permanent storage of data. Non-volatile memory can be configured as non-modifiable memory, also known as read-only memory (ROM), or as modifiable memory, also known as non-volatile memory (NVM). In particular, this can be an EEPROM, such as a Flash EEPROM, also known as Flash. Non-volatile memory is characterized by the fact that the data stored on it is retained even after the power supply is turned off.

[0060] A volatile electronic memory is defined here as a memory for temporarily storing data, characterized by the fact that all data is lost after the power supply is turned off. In particular, this can be a volatile random-access memory (RAM) or a volatile processor memory.

[0061] A processor is a logic circuit used to execute program instructions. The logic circuit can be implemented on one or more discrete components, particularly on a chip. In particular, a processor is understood to be a microprocessor or a microprocessor system comprising multiple processor cores and / or multiple microprocessors.

[0062] A communication interface is defined here as an interface through which data can be sent and received. The communication interface can be configured as contact-based or contactless. The communication interface can be an internal or external interface, which is connected to an associated device, for example, via a cable or wirelessly. A communication interface for wireless communication is defined as a communication interface configured for contactless sending and receiving of data.

[0063] Embodiments of the invention will be explained in more detail below with reference to the drawings. They show: Figure 1 shows a schematic block diagram of a first exemplary embodiment of a network for secure message transmission. Figure 2 shows a schematic block diagram of a second exemplary embodiment of a network for secure message transmission. Figure 3 shows a schematic block diagram of a third exemplary embodiment of a network for secure message transmission. Figure 4 shows a schematic block diagram of a fourth exemplary embodiment of a network for secure message transmission. Figure 5 shows a schematic flow diagram of a first exemplary embodiment of a method for secure message transmission. Figure 6 shows a further schematic flow diagram of the first exemplary embodiment of a method for secure message transmission.Figure 7 shows a schematic flow diagram of a second exemplary embodiment of a method for secure message transmission, and Figure 8 shows a further schematic flow diagram of the second exemplary embodiment of a method for secure message transmission.

[0064] Elements of the following embodiments that correspond to one another are identified by the same reference numerals.

[0065] Figure 1shows an embodiment of an exemplary network 100 for secure mobile message transmission. This network 100, or at least part of this network, is a digital cellular radio network, e.g., a mobile radio network. The network 100 can comprise one or more mobile terminals 102, 104 of a user 101, which are mobile, portable communication devices, i.e., mobile radio devices. For example, they are a tablet 102 and a smartphone 104, each of which comprises a mobile radio interface to a digital cellular mobile radio network. Furthermore, possible mobile terminals, provided they comprise a mobile radio interface to a digital cellular mobile radio network, can be designed, for example, as: smart devices, such as smart glasses or smartwatches, laptops, phablets, personal digital assistants (PDAs), mobile digital assistants (MDAs).The mobile terminals 102, 104 can each include a messaging client program, i.e., can be configured as messaging clients. For example, the mobile terminals 102, 104 are each configured as email clients. Furthermore, or alternatively, they can be configured as instant messaging clients. The mobile terminals 102, 104 are each communicatively connected to a network node 120 of a mobile radio network via a wired or wireless encrypted communication connection 112, for example. The mobile radio network can be, for example, a mobile radio network according to the GSM, UMTS, or LTE standard. The network node 120 may be, for example: a base station, a BTS node, a BSC node, a Node-B, an STP node, an MSC node, an SMSC node, a PCU node, an SGS node, a GGS node, an RNC node, a CBC node, a cellular router, an SGW node, a PGW node, an MME node.The encryption can be implemented as a symmetric, asymmetric and / or hybrid cryptographic encryption.

[0066] According to embodiments, the network 100 may comprise a network node located in a security domain of the message clients 102, 104, for example, the network node 120. According to embodiments, the security domain is characterized in that the communication connections 112 between the message clients 102, 104 and the network node 120 are encrypted, for example by means of end-to-end encryption, and are thus secured against a man-in-the-middle attack.

[0067] The further (sub)network comprises one or more servers 150-158, which can be configured as message servers. These are, for example, one or more web servers, i.e. servers that transmit documents to clients such as web browsers. Web servers are referred to here as computer systems that include web server software and make documents available via the network 100. Furthermore, the servers 150-158 can, for example, comprise one or more FTP servers, WebDAV servers and / or X servers. FTP servers provide files for transmission using the FTP protocol (File Transfer Protocol). WebDAV servers provide files for transmission over the Internet based on the WebDAV standard (Web-based Distributed Authoring and Versioning). X servers provide (graphical) services using the network protocol of the X Window System.

[0068] The network 100 further comprises one or more exchanges 121, 122, 144 for certificates and / or public keys. The exchanges 122, 144 each comprise, for example, a directory server that provides a directory of certificates and / or public keys from which corresponding certificates and / or public keys can be retrieved. The directory servers are, for example, LDAP servers (Lightweight Directory Access Protocol servers), which provide an LDAP network protocol for querying and modifying information from distributed directory services. Object-related data, such as certificates and / or public keys of message recipients, can be retrieved from the directory provided by the LDAP servers.

[0069] In addition, the network 100 comprises at least one first message server 130, which is assigned to the message clients provided by the mobile terminals 102, 104. Furthermore, the network comprises at least one second message server 140, which is assigned to the recipient of a message sent by one of the message clients 102, 104. The two message servers 130, 140 each comprise, for example, a message gateway 132, 142, via which a connection is established between a (sub)network assigned to the sender of the message and a (sub)network assigned to the recipient of the message. The message servers 130, 140 are provided, for example, in the form of computers, each of which executes a message server program. For example, they are configured as email servers and / or instant messaging servers.

[0070] According to further embodiments, the message servers 130, 140 may also be web servers, FTP servers, WebDAV servers and / or X servers that transmit or forward a message or file.

[0071] A message generated by one of the mobile devices 102, 104 and sent to a recipient assigned to the message server 140, for example, an email, instant message, or other file, is transmitted from the network node 120 via the switching center 122, the message server 130, the message gateway 132, and the message gateway 142 to the message server 140. The message is thus within the recipient's sphere of influence and can be further processed by the recipient.

[0072] The transmission of messages from the message clients 102, 104 to the message server 130 takes place via one or more network nodes 120, 122, wherein at least one of the network nodes 120, 122 emulates the message server 130 to the message clients 102, 104 and the message clients 102, 104 to the message server 130.

[0073] One or more of the network nodes 120, 122 are configured to ensure that only secure messages are sent to the intended recipient. For example, the messages are automatically encrypted by the network node 120, 122 if they contain unencrypted content. For this purpose, for example, a public key of the intended recipient(s) of the corresponding message is used. Such a public key and / or a certificate with such a public key is stored, for example, in the network node 120, 122. According to embodiments, the public key and / or a certificate with a public key of a recipient is additionally or alternatively provided to the 120 for retrieval by the exchange 122 and / or an associated directory server.The exchange 122 receives this public key and / or a certificate with this public key, for example, from the message server 130, which is assigned to the message clients of the mobile terminals 102, 104, or from another exchange 144 with an assigned directory server. The message server 130 requests the public key and / or the certificate with the public key, for example, from the message server 140, which is assigned to the message recipient, or from the exchange 144. The exchange 144 requests the public key and / or the certificate with the public key, for example, from the message server 140.

[0074] Various components and / or subsystems of the network 100 can independently perform automatic encryption and decryption of the transmitted messages. For example, the network node 120 can be configured with appropriate extensions to automatically encrypt and decrypt messages forwarded by it. To do this, the network node 120 checks, for example, whether one or more ports intended for encrypted message transmission, e.g., using TLS, are being used to send the message. If this is the case, the network node 120 provides a local certificate for encrypted communication with the mobile devices 102, 104, the trustworthiness of which is confirmed by the user 101. For example, the network node 120 uses a certificate that is provided in a trust store, i.e., a protected storage area, of the mobile devices 102, 104.Using this certificate, the network node 120 can act as a TLS endpoint for the mobile devices 102, 104 and further process messages received from them.

[0075] A protected memory area is understood, for example, to be an area of ​​an electronic memory to which access, i.e., read or write access, is only possible via a processor coupled to the memory. Such access is only granted, for example, if a necessary condition is met. This can be, for example, a cryptographic condition, in particular, successful authentication and / or successful authorization verification.

[0076] The network node 120 checks whether the content of a message to be sent is encrypted, for example using PGP or s / mime. If this is the case, the network node 120 does not perform any additional actions to secure or encrypt the message. Instead, the already encrypted message is transmitted to the message server 130 for further transmission. If this is not the case, the network node 120 determines, for example based on the recipient or destination address specified in the message, which external or remote subsystems will be involved in receiving the message. To encrypt the message, the network node 120 determines a certificate with a public cryptographic key that is assigned to the recipient or the destination address of the message. For example, the network node 120 requests a corresponding certificate of the recipient from the message server 130. This request can be, for example,This could be an LDAP request. Network node 120 receives a response to the LDAP request, for example, from message server 130 or message gateway 132 of message server 130. According to further embodiments, network node 120 queries a network provider, such as an Internet provider, for the recipient's certificate. According to further embodiments, network node 120 queries a certification authority or certificate service provider (CA), which issues digital certificates, for the certificate of the intended recipient of the message. The encrypted message is sent to the intended recipient or the message's destination address via message server 130, which is assigned to the user's message clients 102, 104.

[0077] If network node 120 has the certificate of the message recipient, network node 120 uses the public key provided by the corresponding certificate to encrypt the message to be sent. If network node 120 is unable to determine a certificate of the message recipient or an error occurs while encrypting the message, e.g., because the determined certificate has expired, network node 120 sends, for example, an alternative message to the intended recipient of the original message, informing them of the delivery attempt and / or including a link with a download option for the original message.

[0078] According to alternative embodiments, the encryption is performed by a network node of the network provider, for example the exchange 122. To encrypt the message, the payload node of the network provider executes an encryption method analogous to the encryption method previously described for the network node 120.

[0079] According to alternative embodiments, the encryption can also be performed by the message server 130 of the messaging service provider itself. According to some embodiments, the encryption is performed by a message gateway 132 of the message server 130. To encrypt the message, the message server 130 of the messaging service provider or the network provider's utility node 122 executes an encryption method analogous to the encryption method previously described for the network node 120.

[0080] If an invalid certificate and / or public key is provided, an error message may be issued. For example, an error message is sent to the sender and / or recipient of the original message whose encryption failed, containing the error message and / or calling or linking to an error page where a user warning is provided.

[0081] According to embodiments, an encrypted communication channel between the mobile terminals 102, 104 and the network node 120 can be implemented as follows: For example, program instructions are provided, the execution of which by a processor of the mobile terminals 102, 104 implements operating system-wide setting changes or, alternatively, setting changes of the messaging client, such as an email client. Additionally or alternatively, a SIM tool kit or program instructions for updating SIM card settings or the firmware of the mobile terminals 102, 104 are provided. A certificate received, for example, via an SMS, which the user 101 recognizes as trustworthy, and a certificate assigned to the mobile terminals 102, 104 orA private key assigned to user 101 is used to implement the encrypted communication connection, wherein the previously described program instructions can be used. According to embodiments, when dialing into a dial-in point of the mobile network with certificate authentication or using a key- or certificate-based, packet-switched communication connection, such as TCP / IP, a local certificate is transmitted, which the user must recognize as trustworthy. The received certificate, which the user 101 recognizes as trustworthy, and a private key assigned to the mobile terminals 102, 104 or user 101 are used to implement the encrypted communication connection, wherein the previously described program instructions can be used.

[0082] Figure 2shows a further embodiment of an exemplary network 200 for secure mobile message transmission. At least part of the network 200 is configured as a cellular network. The network 200 comprises a first mobile terminal 201 with a memory 202, a processor 204, and a communication interface 210. The communication interface 210 is a cellular interface configured to send and receive messages via the network 200. The first mobile terminal 201 is configured as a message client, for example, as an email client. For this purpose, the processor 204 executes client program instructions 208. By executing the client program instructions 208 by the processor 204, the mobile terminal 201 is prompted to create a message 340 and to send it to a designated recipient via the network 200 using a first server 250 assigned to the message client.The created message is sent to a network node 220 of the network 200.

[0083] The network node 220 is a mobile network node and includes a memory 222, a processor 226, and a communication interface 240. The communication interface 240 is configured to send and receive messages over the network 200. By executing first emulator program instructions 234 by the processor 226, the network node 220 emulates a first message server 250 to the first message client 201. Furthermore, by executing second emulator program instructions 234 by the processor 226, the network node 220 emulates the first message client 201 to the first message server 250.

[0084] The processor 204 of the first mobile terminal 201 and the processor 226 of the network node 220 each execute first cryptographic program instructions 206. By executing the first cryptographic program instructions 206, an encrypted communication channel 350 is implemented between the first mobile terminal 201 and the network node 220. This is, for example, end-to-end encryption between the first mobile terminal 201 and the network node 220. The encryption can be, for example, symmetric, asymmetric, and / or hybrid encryption.

[0085] The network node 220 receives a message 340 via the secure communication connection 350. If the message is end-to-end encrypted, the network node 220 decrypts the message for further processing and / or sending. During further processing, the network node 220 checks whether the content of the message to be sent is encrypted. If the content is encrypted, i.e., if the message received by the mobile terminal 201 has network-node-independent encryption in addition to securing the communication connection 350, the message is not further processed by the network node 220 but is forwarded in its encrypted form to the first server 250. If the content of the message to be sent is unencrypted, the network node 220 determines a public cryptographic key 224 of the intended recipient of the message.For example, memory 222 includes the intended recipient's public cryptographic key 224. By executing the second cryptographic program instructions 228 by processor 226, network node 220 is controlled to encrypt message 340 with the intended recipient's public cryptographic key 224 and send the encrypted message 342 to the first server associated with message client 201.

[0086] The first server 250 comprises a memory 252, a processor 254, and a communications interface 258. The communications interface 258 is configured to send and receive messages over the network 200. The processor 254 executes server program instructions 256, thereby implementing a server associated with the message client 201. The server 250 receives the encrypted message 342 from the network node 220 via the communications link 352, which is, for example, unsecured. The server 250 forwards the encrypted message 342 over the network 200 to a second message server 260, which is associated with a message client 270 of the intended recipient. The encrypted message 342 is sent, for example, over an unsecured communications link 354.In particular, during transmission from the first message server 250 to the message server 260, the message client 270 leaves the domain of a first service provider managing the first message server 250 and enters the domain of a second service provider managing the second message server 260.

[0087] The second message server 260 includes a memory 262, a processor 264, and a communication interface 268. The communication interface 268 is configured to send and receive messages via the network 200. The processor 264 executes server program instructions 266, thereby implementing a message server associated with the message client 270 of the message recipient. The second message server 260 receives the encrypted message 342 from the first message server 250 via the communication connection 354, which is, for example, unsecured. The server 260 forwards the encrypted message 342 via the network 200 to a second terminal 270, which is configured as a second message client. According to embodiments, the second terminal 270, like the first terminal 201, can be a mobile terminal with a radio interface, i.e.The communication interface 286 is configured as a radio interface and the communication connection 366 is a wireless radio connection, or a stationary terminal in which the communication connection 366 is a wired communication connection. The second message client 270 is assigned to the intended recipient of the encrypted message 342. According to embodiments, the encrypted message 342 is sent, for example, via an unsecured or a secure communication connection 356.

[0088] The terminal 270 comprises a memory 272, a processor 280, and a communication interface 286. The communication interface 286 is configured to send and receive messages via the network 200. The processor 280 executes client program instructions 284, thereby implementing a message client of the message recipient associated with the message server 260. Furthermore, the processor 280 executes second cryptographic program instructions 228, thereby decrypting the encrypted message 342 with a private cryptographic key 276 associated with the message recipient. The private cryptographic key 276 is stored, for example, in a protected memory area 274 of the memory 272 and, together with the associated public cryptographic key 224, forms an asymmetric cryptographic key pair.

[0089] Figure 3shows another embodiment of an exemplary network 200 for secure message transmission, which differs from the network 200 of the Figure 2 in that the network node 220 does not store a public cryptographic key of the intended message recipient. Rather, the network 200 of the Figure 3 an additional directory server 290, which provides the public cryptographic key 224. To encrypt the message 340, the network node 220 determines the public cryptographic key of the intended message recipient. To do this, the processor 226 executes program instructions 230, which direct the network node 220 to send a request for the public cryptographic key 224 to the directory server 290.

[0090] The directory server 290 includes a memory 292, a processor 298, and a communications interface 300. The communications interface 300 is configured to send and receive messages over the network 200. A directory 294 containing the public cryptographic key 224 is stored in the memory 292. The directory server 290 receives the request for the public cryptographic key 224 from the network node via the communications link 358. The processor 298 executes program instructions 231, causing the directory server 290, in response to the received request, to search the directory 294 for the public cryptographic key 224 and return it to the network node.

[0091] Figure 4 shows another embodiment of an exemplary network 200 for secure message transmission, which differs from the network 200 of the Figure 2differs in that the network node 220 does not have a public cryptographic key of the intended message recipient available to encrypt the content of the message 340. The network 200 of the Figure 4 Rather, it includes an additional download server 310.

[0092] The download server 310 includes a memory 312, a processor 316, and a communication interface 318. The communication interface 318 is configured to send and receive messages over the network 200. The processors 226 and 316 each execute cryptographic program instructions 230, thereby implementing an encrypted communication channel 360 between the network node 220 and the download server 310. The encrypted communication channel 360 provides, for example, end-to-end encryption between the network node 220 and the download server 310, which may be based on a symmetric, asymmetric, and / or hybrid encryption method. The network node 220 sends the message 340 via the encrypted communication channel 360 to the download server 310, which stores the message 340 in the memory 312 and makes it available under a link for download or retrieval via the network 200.

[0093] Network node 220 sends an unencrypted message 344 via the two message servers 250, 260 to the message recipient's terminal 270. Message 344 includes the download link for message 340.

[0094] Terminal 270 sends a download request to download server 310 using the download link provided by message 344. The terminal further authenticates itself to download server 310. Download server 310 checks the authentication data received from terminal 270 by comparing it with verification data 314 stored in memory 312 and associated with the intended recipient of message 340. The authentication data is, for example, the user name and password of the intended recipient.

[0095] Upon successful authentication, processors 316 and 280 each execute cryptographic program instructions 282, thereby implementing an encrypted communication channel 362 between terminal device 270 and download server 310. Encrypted communication channel 362 provides, for example, end-to-end encryption between terminal device 270 and download server 310, which may be based on a symmetric, asymmetric, and / or hybrid encryption method. Message 340 is sent from download server 310 to terminal device 270 in response to the request via encrypted communication channel 362.

[0096] Figures 5 and 6show another embodiment of an exemplary method for secure message transmission. A mobile terminal 400 of a sender of a message 404 includes a message client 42. The message client 402 is assigned to a message server 410. The message client 402 creates the message 404, which is addressed to an intended recipient, and sends it to a network node 406 for forwarding to the intended recipient via the message server 410. An encrypted communication channel 420, for example, exists between the message client 402 and the network node 406.

[0097] The network node 406 performs the procedure according to Figure 6In step 500, network node 406 receives message 404 for sending to message server 410. In step 502, network node 406 checks whether the content of the received message 404 is encrypted. If the content is encrypted, the method continues in step 508, and message 408, protected by the existing encryption, is sent to message server 410 via the communication connection. If the content is not encrypted, the method continues in step 504, and a public cryptographic key of the intended recipient of the message is determined. For example, network node 406 comprises the corresponding public cryptographic key, or network node 406 queries the public cryptographic key from a directory server or the intended recipient of the message.To do this, network node 406 sends a corresponding request to the directory server or the intended recipient of the message. In step 506, the content of message 404 is encrypted with the recipient's public cryptographic key, and the thus protected message 408 is sent to message server 410 via communication link 422 in step 508.

[0098] The message server 410 sends the encrypted message 408 via a communication connection 424 to a message server 412, which is assigned to a message client 416 of the intended recipient of the message. The message server 412 of the recipient finally forwards the encrypted message to the message client 416 of the recipient via a communication connection. The message client 416 is provided, for example, by a terminal device 414 of the recipient. According to embodiments, the terminal device 414 can be a mobile terminal, in particular a mobile radio device, or a stationary terminal for wired communication. The terminal device 414 of the recipient comprises a private cryptographic key assigned to the public cryptographic key of the recipient, with which the encrypted message 408 is decrypted so that the content of the message becomes accessible to the recipient.

[0099] Figures 7 and 8 show another embodiment of an exemplary method for secure message transmission. The embodiment according to the Figures 7 and 8 differs from the design of the Figures 5 and 6 in that the network node 406 does not have a public cryptographic key available to encrypt the message 404.

[0100] The network node 406 and an additional download server 407 carry out the procedure according to Figure 7In step 600, network node 406 receives message 404 for sending to message server 410. In step 602, network node 406 checks whether the content of the received message 404 is encrypted. If the content is encrypted, the method continues in step 618, and message 408, protected by the existing encryption, is sent to message server 410 via the communication connection. If the content is not encrypted, the method continues in step 604.

[0101] In step 604, a check is performed to determine whether a public cryptographic key of the intended recipient is available. If a public cryptographic key of the intended recipient is available, the method continues in step 616. In step 616, the content of message 404 is encrypted with the recipient's public cryptographic key, and the thus protected message 408 is sent to the message server 410 via the communication connection 422 in step 618.

[0102] If a public cryptographic key of the intended recipient is not available, the method continues in step 606. In step 606, a link for retrieving the message from the download server 407 is generated, and in step 608, the message 404 is made available for retrieval under the link. For this purpose, an encrypted communication channel is implemented between the network node 406 and the download server 407, via which the message 404 is sent to the download server 407. The download server 407 makes the message 404 available for retrieval, i.e., download, under the generated link. In step 610, an additional message 405 with the download link is created and sent via the message servers 410, 412 to the message client 416 of the terminal 414. The intended recipient of the message 404 is thereby enabled to retrieve the message 404 from the download server 407 using the provided download link.Here, the download server 407 receives authentication data from the recipient in step 612. If this authentication data is valid, a protected, in particular end-to-end encrypted, communication channel 430 is established between the download server 407 and the recipient terminal 414 in step 614. In response to receiving a request 409 from the recipient terminal 414, the protected message 404 is sent to the recipient terminal 414 in step 618, wherein the message 404 is protected by the end-to-end encryption of the communication channel 430. List of reference symbols

[0103] 100Network 102Mobile radio device 104Mobile radio device 112Encrypted communication connection 120Network node 121Exchange 122Exchange 130Message server 132Message gateway 140Message server 142Message gateway 144Exchange 150Network server 152Network server 154Network server 156Network server 158Network server 200Network 201Mobile radio device 202Memory 204Processor 206Cryptographic program instructions 208Client program instructions 210Communication interface 220Network node 222Memory 224Public cryptographic key 226Processor 228Cryptographic program instructions 230Program instructions 231Program instructions 234Emulator program instructions 236Emulator program instructions 240Communication interface 250Message server 252Memory 254Processor 256Server program instructions 258Communication interface 260Message server 262Memory 264Processor 266Server program instructions268 Communication interface 270 Terminal 272 Memory 274 Protected memory area 276 Private cryptographic key 280 Processor 282 Cryptographic program instructions 284 Client program instructions 286 Communication interface 290 Directory server 292 Memory 294 Directory 298 Processor 300 Communication interface 310 Download server 312 Memory 314 Verification data 316 Processor 318 Communication interface 340 Message 342 Encrypted message 344 Message 350 Encrypted communication link 352 Communication link 354 Communication link 356 Communication link 358 Communication link 360 Communication link 362 Encrypted communication link 400 Mobile device 402 Message client 404 Message 405Message 406Network node 407Download server 408Encrypted message 409Request 410Message server 412Message server 414End device 416Message client 420Encrypted communication connection422Communication connection 424Communication connection 426Communication connection 428Encrypted communication connection 430Encrypted communication connection

Claims

1. A telecommunication method for the protected transmission of a message (340, 404) from a message client (402) of a mobile radio device (102, 104, 201, 400), wherein a message server (130, 250, 410) is assigned to the message client (402) and implements a protocol (208) for receiving the message from the message client (402) and for sending the message (340, 404) to a further message server (140, 260, 412), to which the message recipient specified in the message (340, 404) is assigned, wherein the message (340, 404) is transmitted from the message client (402) to the message server (130, 250, 410) via a network node (120, 122, 132, 220, 406), wherein the network node (120, 122, 132, 220, 406) emulates the message server (130, 250, 410) with respect to the message client (402), and wherein the network node (120, 122, 132, 220, 406) emulates the message client (402) with respect to the message server (130, 250, 410), said method comprising the following steps: a) receiving the message (340, 404) from the message client (402) by the network node (120, 122, 132, 220, 406), b) checking by the network node (120, 122, 132, 220, 406) whether the content of the message (340, 404) to be transmitted is encrypted, and, c) if this is the case, sending the message (340, 404) from the network node (120, 122, 132, 220, 406) via the message server (130, 250, 410) to the message recipient specified in the message (340, 404), and, d) if this is not the case, protecting the message (340, 404) by the network node (120, 122, 132, 220, 406) and sending the protected message (342, 408) to the message recipient, wherein the network node (120, 122, 132, 220, 406) is a node of a mobile radio network.

2. The telecommunication method according to claim 1, wherein the message (340, 404) is an e-mail, the message client (402) is an e-mail client and the message server (130, 250, 410) is an e-mail server.

3. The telecommunication method according to claim 1, wherein the message (340, 404) is an instant message, the message client (402) is an instant messaging client and the message server (130, 250, 410) is an instant messaging server.

4. The telecommunication method according to any one of the preceding claims, wherein the network node (120, 122, 132, 220, 406) is one of the following nodes: base station, BTS node, BSC node, node-B, STP node, MSC node, SMSC node, PCU node, SGS node, GGS node, RNC node, CBC node, mobile router, SGW node, PGW node, MME node.

5. The telecommunication method according to any one of the preceding claims, wherein the message (340, 404) is transmitted from the message client (402) to the network node (120, 122, 132, 220, 406) by means of a transport layer security protocol (206).

6. The telecommunication method according to any one of the preceding claims, wherein the unencrypted message content is encrypted for protection by the network node (120, 122, 132, 220, 406), wherein the protected message is the message (342, 408) encrypted by the network node (120, 122, 132, 220, 406) and the message (342, 408) encrypted by the network node (120, 122, 132, 220, 406) is sent to message recipients via the message server (130, 250, 410).

7. The telecommunication method according to claim 6, wherein the message (340, 404) is encrypted using a public key (224) of the message recipient indicated in the message (340, 404).

8. The telecommunication method according to claim 7, wherein the network node (120, 122, 132, 220, 406) comprises a memory (222) in which the public key (224) of the message recipient is stored, or wherein the network node (120, 122, 132, 220, 406) retrieves the public key (224) from a directory server (122, 290) using the message recipient specified in the message (340, 404).

9. The telecommunications method according to any one of claims 1 to 5, wherein protecting the message (340, 404) comprises generating a link by the network node (120, 122, 132, 220, 406) via which the content of the message (340, 404) can be retrieved by the message recipient, wherein a further message (344, 405) containing the link is generated by the network node (120, 122, 132, 220, 406) and sent via the message server (130, 250, 410) to the recipient of the protected message, wherein the protected message is sent in the form of a retrieval of the content of the message (340, 404) by the message recipient via the link.

10. The telecommunication method according to claim 9, wherein the successful retrieval of the contents of the message (340, 404) requires a successful authentication of the retrieving message recipient by a server (310, 407) providing the content of the message (340, 404) under the link for retrieval.

11. The telecommunication method according to any one of claims 9 or 10, wherein the content of the message (340, 404) is retrieved via an end-to-end encrypted transmission channel (362, 430) between the server (310, 407) providing the content of the message (340, 404) under the link for retrieval and a computer system (270, 414) of the message recipient.

12. The telecommunication method according to any one of claims 9 to 11, wherein the server (310, 407) providing the content of the message (340, 404) under the link for retrieval is the network node (120, 122, 132, 220, 406).

13. The telecommunication method according to any one of claims 9 to 11, wherein the server (310, 407) providing the content of the message (340, 404) under the link for retrieval is a download server (310, 407) of a service provider to which the network node (120, 122, 132, 220, 406) sends the content of the message (340, 404) in encrypted form for retrieval.

14. A network node (120, 122, 132, 220, 406) for the protected transmission of a message (340, 404) to a message client (402) of a mobile radio device, wherein the network node (120, 122, 132, 220, 406) comprises a processor (226), a memory (222) with program instructions (228, 234, 236) and a network interface (240), wherein execution of the program instructions (228, 234, 236) by the processor (226) causes the network node (120, 122, 132, 220, 406) to emulate a message server (130, 250, 410) with respect to the message client (402) and to emulate the message client (402) with respect to the message server (130, 250, 410), wherein the message client (402) is assigned to the message server (130, 250, 410) which implements a protocol (208) for receiving the message (340, 404) from the message client (402) and for sending the message (340, 404) to a further message server (140, 260, 412) to which the message recipient specified in the message (340, 404) is assigned, wherein execution of the program instructions (228, 234, 236) by the processor (226) further causes the network node (120, 122, 132, 220, 406) to: a) receive the message (340, 404) from the message client (402), b) check whether the content of the message (340, 404) to be transmitted is encrypted, and, c) if this is the case, send the message (340, 404) via the message server (130, 250, 410) to the message recipient specified in the message, and, d) if this is not the case, protect the message (340, 404) by the network node (120, 122, 132, 220, 406) and send the protected message (342, 408) to the message recipient, wherein the network node (120, 122, 132, 220, 406) is a node of a mobile radio network.

15. The network node (120, 122, 132, 220, 406) according to claim 14, wherein the network node (120, 122, 132, 220, 406) is one of the following nodes: base station, BTS node, BSC node, node-B, STP node, MSC node, SMSC node, PCU node, SGS node, GGS node, RNC node, CBC node, mobile router, SGW node, PGW node, MME node.