System and Method of Lawful Access to Secure Communications

• US 20130182843A1
• Filed: 01/11/2013
• Published: 07/18/2013
• Est. Priority Date: 01/12/2012
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited, Certicom Corporation (Blackberry Limited)
• Inventors: Buckley, Michael Eoin, Zaverucha, Gregory Marc, Campagna, Matthew John
• Granted Patent: US 9,083,509 B2
• Time in Patent Office: Days
• US Class Current: 380/255
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/306 intercepting packet switched data communications, e.g. Web, Internet or IMS communications
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner

Abstract

The present disclosure relates to systems and methods for secure communications. In some aspects, one or more values used to generate an encryption key used to encrypt a packet are stored in a header of the packet. The packet is transmitted with the encrypted data portion in a communication. In some aspects, one or more values used to generate an encryption key are received. The encryption key is regenerated using the one or more values.

Claims

1. A method for secure communication, the method comprising:

storing in a header of a packet one or more values used in generation of an encryption key used to encrypt the packet; and

transmitting the packet with the encrypted data portion in a communication.

2. The method of claim 1, further comprising encrypting at least a data portion of the packet using the encryption key.

3. The method of claim 1, wherein the encrypted packet is a secure real-time transport protocol (SRTP) packet.

4. The method of claim 1, wherein the header is an SRTP header.

5. The method of claim 1, wherein the one or more values are stored in a master key identifier (MKI) field of the SRTP header.

6. The method of claim 1, wherein the one or more values comprise a nonce value, a crypto session identity (CS ID) and a traffic encryption key generation key (TGK).

7. The method of claim 6, wherein the nonce value comprises a value associated with an initiator of the communication.

8. The method of claim 1, wherein the encryption key is a traffic encryption key generated following a MIKEY-TICKET protocol.

9. The method of claim 1, wherein the one or more values used in the generation of the encryption key can be combined with a secret value to regenerate the encryption key after the transmission of the packet.

10. The method of claim 1, wherein the one or more values are stored in the header to assist with lawful access to the secured communication.

11. The method of claim 1, wherein some of the one or more values are not required for the secured communication.

12. A method for secure communication, the method comprising:

storing a nonce value, a crypto session identity (CS ID), and a traffic encryption key generation key (TGK) in a master key identifier (MKI) field of a header of a secure realtime transport protocol (SRTP) packet used in a communication following the generation of a traffic encryption key (TEK), the nonce value associated with a MIKEY-TICKET protocol key exchange initiator, the CS ID associated with the communication, the TGK generated by a key management system (KMS), the TEK associated with the MIKEY-TICKET protocol;

encrypting at least a data portion of the SRTP packet using the TEK; and

transmitting the SRTP packet with the encrypted data portion in the communication.

13. A communication device comprising a processor and a memory including stored instructions for secure communication, the communication device configured to:

store a nonce value, a crypto session identity (CS ID), and a traffic encryption key generation key (TGK) master key identifier (MKI) field of a packet header of a secure real-time transport protocol (SRTP) packet used in a communication following the generation of a traffic encryption key (TEK), the nonce value associated with a MIKEY-TICKET protocol key exchange initiator, the CS ID associated with the communication, the SRTP TGK generated by a key management system (KMS), the TEK associated with the MIKEY-TICKET protocol;

encrypt at least a data portion of the SRTP packet using the TEK; and

transmit the SRTP packet with the encrypted data portion in the communication.

14. A method for regenerating an encryption key, the method comprising:

receiving one or more values used in generation of an encryption key;

regenerating the encryption key using the one or more values.

15. The method of claim 14, wherein the one or more values are stored in a header of a packet of the secure communication.

16. The method of claim 15, wherein the header is a secure real-time transport protocol (SRTP) header.

17. The method of claim 16, wherein the one or more values are stored in a master key identifier (MKI) field of the SRTP header.

18. The method of claim 14, wherein the one or more values comprise a nonce value, a crypto session identity (CS ID) and a traffic encryption key generation key (TGK).

19. The method of claim 18, wherein the nonce value comprises a value associated with an initiator of the communication.

20. The method of claim 19, wherein the nonce value can be combined with a secret value of the initiator to regenerate a random value generated by the initiator (RANDRi).

21. The method of claim 14, wherein the encryption key is a traffic encryption key (TEK) generated following a MICKEY-TICKET protocol.

22. The method of claim 14, wherein the one or more values are combined with a secret value to regenerate the encryption key following a key generating algorithm.

23. A method for regenerating a traffic encryption key (TEK) used for secure communication, the method comprising:

receiving a nonce value associated with a MIKEY-TICKET protocol key exchange initiator, a crypto session identity (CS ID) associated with a secure communication, and a traffic encryption key generation key (TGK), the TGK generated by a key management system (KMS), the TEK associated with a MIKEY-TICKET protocol;

regenerating the TEK using nonce value, CS ID and the TGK.

24. A key management service (KMS) equipment comprising a processor and a memory including stored instructions for secure communication, the KMS equipment configured to:

receive a nonce value associated with a MIKEY-TICKET protocol key exchange initiator, a crypto session identity (CS ID) associated with a secure communication, and a traffic encryption key generation key (TGK), the TGK generated by a key management system (KMS), the TEK associated with a MIKEY-TICKET protocol;

regenerate the TEK using nonce value, CS ID and the TGK.

25. A first user equipment comprising a processor and a memory including stored instructions for secure communication with a second user equipment, the first user equipment configured to:

generate at least a first value used in generation of an encryption key;

transmit the first value to a key management service (KMS) equipment;

receive from the KMS equipment at least a second value used in the generation of said encryption key;

store in the header of a packet at least the first value and the second value which are used in the generation of the encryption key;

encrypt a data portion of the packet using the encryption key; and

transmit the packet with the encrypted data portion in a communication to the second user equipment.