Data security in wireless network system

• US 20060153375A1
• Filed: 01/09/2006
• Published: 07/13/2006
• Est. Priority Date: 01/11/2005
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Yi, Sang-Kug
• Granted Patent: US 7,876,897 B2
• Time in Patent Office: Days
• US Class Current: 380/44
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]

Abstract

For data protection in a wireless network system, a frame, including its Medium Address Control (MAC) header and payload, is encrypted with an initialization vector modified at each set state in a wireless network system, such that wirelessly transmitted data is prevented from being exposed to unauthorized users.

Claims

1. An apparatus for data security in a wireless network system, comprising:

a modifier adapted to modify encryption/decryption key information for encrypting a frame to be transmitted to a wireless network based on modification status information for the encryption/decryption key information;

an encryptor adapted to encrypt the frame with the modified encryption/decryption key information according to a predetermined encryption algorithm upon a subsequent receipt of a request to transmit the frame; and

a transmitter adapted to transmit the encrypted frame to the wireless network.

2. The apparatus according to claim 1, wherein the modification status information comprises either information as to a set time or information as to a number of times that frames to be transmitted to the wireless network have been generated.

3. The apparatus according to claim 1, wherein the encryption/decryption key information comprises one of information as to a group key set to be shared between one unit and at least another unit to protect the frame transmitted to the wireless network, information as to a pair-wise key set in each unit and the at least another unit, information as to a combination of information as to an initialization vector that the unit generates using a random number generation function and the group key information, and information as to a combination of the initialization vector information and the pair-wise key information set in each unit and the at least another unit.

4. The apparatus according to claim 3, wherein the modifier is adapted to modify the initialization vector information in response to the modification status information for the encryption/decryption key information indicating modification.

5. The apparatus according to claim 1, further comprising a storage unit adapted to store one of the encryption/decryption key information, initialization vector information, and the modification status information for the encryption/decryption key.

6. The apparatus according to claim 5, wherein the initialization vector information comprises one of initialization vector information generated upon a first frame being transmitted to the wireless network, and initialization vector information that is modified upon the modification status information for the encryption/decryption key indicating modification.

7. The apparatus according to claim 1, further comprising an initialization vector generator adapted to generate an initialization vector created by a random number generation function and to transfer it into a first frame upon the first frame being transmitted to the wireless network, and the encryptor adapted to encrypt the frame with the encryption/decryption key information according to the encryption algorithm, and

the initialization vector generator adapted to generate an initialization vector, modified upon the modification status information for the encryption/decryption key indicating modification, and to transfer it into the frame and the encryptor adapted to encrypt the frame with a non-modified initialization vector information and the encryption/decryption key information according to the encryption algorithm.

8. The apparatus according to claim 1, wherein the encryption algorithm comprises either a Wired Equivalent Privacy (WEP) algorithm or a Counter-mode CBC MAC Protocol (CCMP) algorithm.

9. The apparatus according to claim 5, further comprising a decryptor adapted to decrypt the received frame from the wireless network with the encryption/decryption key information, to determine whether or not the initialization vector information is contained in the decrypted frame, and to store the initialization vector information contained in the decrypted frame in the storage unit.

10. The apparatus according to claim 9, wherein after storing the initialization vector information in the storage unit, the decryptor is adapted to decrypt the received frame from the wireless network with the encryption/decryption key information and the stored initialization vector information in the storage unit, to determine whether or not initialization vector information different from the stored initialization vector information in the storage unit is contained in the decrypted frame, and to store the different initialization vector information contained in the decrypted frame in the storage unit.

11. The apparatus according to claim 10, wherein the decryptor is adapted to decrypt a received frame from the wireless network with the encryption/decryption key information and the different initialization vector information after storing the different initialization vector information in the storage unit.

12. An apparatus for data security in a wireless network system, comprising:

a modifier adapted to modify encryption/decryption key information for encrypting a frame to be transmitted to a wireless network based on modification status information for the encryption/decryption key information;

an encryptor adapted to selectively encrypt a Medium Access Control (MAC) header portion and a payload portion of the frame with the modified encryption/decryption key information according to a predetermined encryption algorithm upon a subsequent receipt of a request to transmit the frame; and

a transmitter adapted to transmit the encrypted frame to the wireless network.

13. The apparatus according to claim 12, wherein the modification status information comprises either information as to a set time or information as to a number of times that frames to be transmitted to the wireless network have been generated.

14. The apparatus according to claim 12, wherein the encryption/decryption key information comprises one of information as to a group key set to be shared between one unit and at least another unit to protect the frame transmitted to the wireless network, information as to a pair-wise key set in each unit and the at least another unit, information as to a combination of information as to an initialization vector that the unit generates using a random number generation function and the group key information, and information as to a combination of the initialization vector information and the pair-wise key information set in each unit and the at least another unit.

15. The apparatus according to claim 14, wherein the modifier is adapted to modify the initialization vector information in response to the modification status information for the encryption/decryption key information indicating modification.

16. The apparatus according to claim 12, further comprising an initialization vector generator adapted to generate an initialization vector created by a random number generation function and to transfer it into a first frame upon the first frame being transmitted to the wireless network, and the encryptor adapted to selectively encrypt a MAC header portion and a payload portion of the first frame with the encryption/decryption key information according to the encryption algorithm, and the initialization vector generator adapted to generate an initialization vector, modified upon the modification status information for the encryption/decryption key indicating modification, and to transfer it into the frame and the encryptor adapted to selectively encrypt a MAC header portion and a payload portion of the frame with a non-modified initialization vector information and the encryption/decryption key information according to the encryption algorithm.

17. The apparatus according to claim 12, further comprising a decryptor adapted to selectively decrypt a MAC header portion and a payload portion of the received frame from the wireless network with the encryption/decryption key information, to determine whether or not the initialization vector information is contained in the decrypted frame, and to store the initialization vector information contained in the decrypted frame in a storage unit.

18. The apparatus according to claim 17, the decryptor is adapted to selectively decrypt a MAC header portion and a payload portion of the received frame from the wireless network with the encryption/decryption key information and the stored initialization vector information in the storage unit, to determine whether or not initialization vector information different from the stored initialization vector information in the storage unit is contained in the decrypted frame, and to store the different initialization vector information contained in the decrypted frame in the storage unit.

19. The apparatus according to claim 18, wherein the decryptor is adapted to selectively decrypt a MAC header portion and a payload portion of a received frame from the wireless network with the encryption/decryption key information and the different initialization vector information after storing the different initialization vector information in the storage unit.

20. A data security method in a unit of a wireless network system, the method comprising:

modifying encryption/decryption key information to encrypt a frame to be transmitted to a wireless network, based on modification status information for the encryption/decryption key information; and

encrypting the frame with the modified encryption/decryption key information according to a predetermined encryption algorithm upon subsequent receipt of a request to transmit the frame, and transmitting the encrypted frame to the wireless network.

21. The method according to claim 20, wherein the modification status information comprises either information as to a set time or information as to a number of times that frames to be transmitted to the wireless network have been generated.

22. The method according to claim 20, wherein the encryption/decryption key information comprises one of information as to a group key set to be shared between the unit and at least another unit to protect the frame transmitted to the wireless network, information as to a pair-wise key set in each unit and the at least another unit, information as to a combination of information as to an initialization vector that the unit generates using a random number generation function and the group key information, and information as to a combination of the initialization vector information and the pair-wise key information set in each unit and the at least another unit.

23. The method according to claim 22, wherein the initialization vector information is modified in response to the modification status information for the encryption/decryption key information indicating modification.

24. The method according to claim 20, wherein encrypting the frame comprises:

including an initialization vector created by a random number generation function in a first frame upon the first frame being transmitted to the wireless network, and encrypting the frame with the encryption/decryption key information according to the encryption algorithm; and

including an initialization vector, modified upon the modification status information for the encryption/decryption key indicating modification, in the frame and encrypting the frame with a non-modified initialization vector information and the encryption/decryption key information according to the encryption algorithm.

25. The method according to claim 20, wherein the encryption algorithm comprises either a Wired Equivalent Privacy (WEP) algorithm or a Counter-mode CBC MAC Protocol (CCMP) algorithm.

26. The method according to claim 20, further comprising:

decrypting the received frame from the wireless network with the encryption/decryption key information, determining whether or not the initialization vector information is contained in the decrypted frame, and storing the initialization vector information contained in the decrypted frame in a database.

27. The method according to claim 26, further comprising:

after storing the initialization vector information in the database, decrypting the received frame from the wireless network with the encryption/decryption key information and the stored initialization vector information in the database; and

determining whether or not initialization vector information different from the stored initialization vector information in the storage unit is contained in the decrypted frame, and storing the different initialization vector information contained in the decrypted frame in the database.

28. The method according to claim 27, further comprising:

decrypting a received frame from the wireless network with the encryption/decryption key information and the different initialization vector information after storing the different initialization vector information in the storage unit.

29. A data security method in a unit of a wireless network system, the method comprising:

modifying encryption/decryption key information for encrypting a frame to be transmitted to a wireless network, based on modification status information for the encryption/decryption key information;

selectively encrypting a Medium Access Control (MAC) header portion and a payload portion of the frame with the modified encryption/decryption key information according to a predetermined encryption algorithm upon subsequent receipt of a request to transmit the frame, and transmitting the encrypted frame to the wireless network.

30. The method according to claim 29, wherein the modification status information comprises either information as to a set time or information as to a number of times that frames to be transmitted to the wireless network have been generated.

31. The method according to claim 29, wherein the encryption/decryption key information comprises one of information as to a group key set to be shared between the unit and at least another unit to protect the frame transmitted over the wireless network, information as to a pair-wise key set in each unit and the at least another unit, information as to a combination of information as to an initialization vector that the unit generates using a random number generation function and the group key information, and information as to a combination of the initialization vector information and the pair-wise key information set in each unit and the at least another unit.

32. The method according to claim 31, wherein the initialization vector information is modified in response to the modification status information for the encryption/decryption key information indicating modification.

33. The method according to claim 29, wherein encrypting the frame comprises:

including an initialization vector created by a random number generation function in a first frame upon the first frame being transmitted to the wireless network, and selectively encrypting a Medium Access Control (MAC) header portion and a payload portion of the frame with the encryption/decryption key information according to the encryption algorithm; and

including an initialization vector, modified upon the modification status information for the encryption/decryption key indicating modification, in the frame and selectively encrypting an MAC header portion and a payload portion of the frame with a non-modified initialization vector information and the encryption/decryption key information according to the encryption algorithm.

34. The method according to claim 29, further comprising:

selectively decrypting a MAC header portion and a payload portion of the received frame from the wireless network with the encryption/decryption key information, determining whether or not the initialization vector information is contained in the decrypted frame, and storing the initialization vector information contained in the decrypted frame in the database.

35. The method according to claim 34, further comprising:

after storing the initialization vector information in the database, selectively decrypting a MAC header portion and a payload portion of the received frame from the wireless network with the encryption/decryption key information and the stored initialization vector information in the database; and

determining whether or not initialization vector information different from the stored initialization vector information in the database is contained in the decrypted frame, and storing the different initialization vector information contained in the decrypted frame in the database.

36. The method according to claim 35, further comprising:

selectively decrypting a MAC header portion and a payload portion of a received frame from the wireless network with the encryption/decryption key information and the different initialization vector information after storing the different initialization vector information in the database.