SYSTEM AND METHOD OF REDUCING ENCRYPTION OVERHEAD BY CONCATENATING MULTIPLE CONNECTION PACKETS ASSOCIATED WITH A SECURITY ASSOCIATION

• US 20110145561A1
• Filed: 06/03/2009
• Published: 06/16/2011
• Est. Priority Date: 06/03/2008
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Anil, Agiwal
• Granted Patent: US 9,906,627 B2
• Time in Patent Office: Days
• US Class Current: 713/150
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 69/04 Protocols for data compression, e.g. ROHC

Abstract

A method and system for encryption is provided. The method includes detecting one or more security associations corresponding to data payloads in response to receipt of the data payloads from multiple source connections. Each data payload includes one or more data packets from each source connection. The method also includes concatenating the data payloads corresponding to each security association. Further, the method includes encrypting the concatenated data payloads for each security association. The system includes a determination module that detects one or more security associations corresponding to data payloads in response to receipt of the data payloads from multiple source connections and concatenates the data payloads corresponding to each security association. The system also includes an encryption module that encrypts the concatenated data payloads for each security association.

Claims

1. A method for encryption, the method comprising:

detecting one or more security associations corresponding to data payloads in response to receipt of the data payloads from a plurality of source connections, wherein each data payload comprises one or more data packets from each source connection;

concatenating the data payloads corresponding to each security association; and

encrypting the concatenated data payloads for each security association.

2. The method of claim 1 further comprising:

generating security information for the concatenated data payloads; and

combining the security information with the concatenated data payloads.

3. The method of claim 1 further comprising one of:

generating a protocol data unit for an encrypted data payload for each security association; and

generating a protocol data unit for the encrypted data payloads for at least two security associations.

4. The method of claim 3, wherein

generating the protocol data unit for an encrypted data payload for each security association comprises:

generating a header for protocol data unit; and

generating the protocol data unit for the encrypted data payloads for at least two security associations comprises;

generating a header for the protocol data unit.

5. The method of claim 4 further comprising at least one of:

generating the header in combination with a generic media access control header (GMH) generated for the protocol data unit; and

appending the header to the GMH.

6. The method of claim 4 further comprising:

generating an extended security header, wherein the extended security header comprises security information associated with the concatenated data payloads and

appending the extended security header to the protocol data unit.

7. The method of claim 4, wherein generating the header for a protocol data unit corresponding to each security association comprises:

determining connection identifiers associated with each source connection corresponding to the security association;

determining lengths of the data payloads associated with each source connection corresponding to the security association; and

determining security information.

8. The method of claim 4, wherein generating the header for the protocol data unit corresponding to at least two security associations comprises:

determining connection identifiers associated with each source connection corresponding to each security association;

determining lengths of the data payloads associated with each source connection corresponding to each security association; and

determining security information.

9. The method of claim 4 further comprising:

transmitting the protocol data unit.

10. The method of claim 9 further comprising:

receiving the protocol data unit corresponding to one or more security associations;

identifying the one or more security associations in the protocol data unit;

identifying the encrypted data payloads associated with the one or more security associations;

identifying security information to decrypt the encrypted data payloads;

decrypting the encrypted data payloads using the security information; and

identifying destination connections associated with each decrypted data payload.

11. The method of claim 10 further comprising:

rendering each data payload to a destination connection based on the identification of the destination connections.

12. The method claim 1, wherein encrypting the concatenated data payloads attenuates resource utilization, processing overhead and time taken for encrypting the data payloads from each source connection.

13. A system for encryption, the system comprising:

a determination module that

detects one or more security associations corresponding to data payloads in response to receipt of the data payloads from a plurality of source connections, wherein each data payload comprises one or more data packets from each source connection; and

concatenates the data payloads corresponding to each security association; and

an encryption module that encrypts the concatenated data payloads for each security association.

14. The system of claim 13 further comprising:

a transmission module that generates a protocol data unit for the encrypted data payloads and transmits the protocol data unit.

15. The system of claim 14 further comprising:

an identifier module that

identifies the one or more security associations in the protocol data unit;

identifies the encrypted data payloads associated with the one or more security associations; and

identifies security information to decrypt the encrypted data payloads.

16. The system of claim 15 further comprising:

a decryption module that

decrypts the encrypted data payloads using the security information; and

identifies destination connections associated with each decrypted data payload.

17. The system of claim 13, wherein the system is a worldwide interoperability for microwave access (WiMax) modem.

18. An electronic device comprising:

a communication interface that sends and receives data packets, the data packets comprising protocol data units;

a memory for storing information; and

a processor responsive to the information to

detect one or more security associations corresponding to data payloads in response to receipt of the data payloads from a plurality of source connections, wherein each data payload comprises one or more data packets from each source connection;

concatenate the data payloads corresponding to each security association; and

encrypt the concatenated data payloads for each security association.

19. The electronic device of claim 18, wherein the processor is responsive to the information to further perform:

generating a protocol data unit for the encrypted data payloads; and

transmitting the protocol data unit.

20. The electronic device of claim 19, wherein the processor is responsive to the information to further perform:

identifying the one or more security associations in the protocol data unit;

identifying the encrypted data payloads associated with the one or more security associations;

identifying security information to decrypt the encrypted data payloads;

decrypting the encrypted data payloads using the security information; and

identifying destination connections associated with each decrypted data payload.