Key distribution in public communication networks taking account of security gradations

• US 5,216,715 A
• Filed: 12/12/1991
• Issued: 06/01/1993
• Est. Priority Date: 06/16/1989
• Status: Expired due to Fees

• Current Assignee: Siemens AG
• Original Assignee: Siemens AG
• Inventors: Markwitz, Wernhard
• Primary Examiner(s): SWANN, TOD R
• Application Number:
  US07/793,426
• Time in Patent Office: 537 Days
• Field of Search: 380/21, 380/23, 380/25, 380/30, 380/43, 380/45, 380/48
• US Class Current: 713/171
• CPC Class Codes: H04L 2209/04 Masking or blinding
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04Q 11/0435 Details
• CPC Class Codes: H04Q 2213/13095 PIN / Access code, authentication
• CPC Class Codes: H04Q 2213/13096 Digital apparatus individually associated with a subscriber line, digital line circuits
• CPC Class Codes: H04Q 2213/13098 Mobile subscriber
• CPC Class Codes: H04Q 2213/13106 Microprocessor, CPU
• CPC Class Codes: H04Q 2213/13202 Network termination [NT]
• CPC Class Codes: H04Q 2213/13209 ISDN
• CPC Class Codes: H04Q 2213/13339 Ciphering, encryption, security

Abstract

A public communication system for a plurality of communication services (ISDN) has an arrangement for the authentification of the subscriber stations (TLN A, TLN B) for the key transmission. For a first security level this authentification arrangement has an arrangement for monitoring the time frame (24) of the key transmission and/or an arrangement (A) for the indication of the agreed key in reduced form at the subscriber end, and for a second security level a key management station (SMZ) for authenticated traffic handling

Claims

1. An arrangement for key transmission in a public communication system having a plurality of subscriber stations, in which a key ia agreed to between transmitting station of the plurality of subscriber stations and a receiving station of the plurality of subscriber stations for encrypted transmission of messages, and in which a cryptographic device is provided in each of the transmitting station and the receiving station, to which device a station key is assigned, comprising:

a) means for authentification of the subscriber stations for the key transmission,

b) depending on at least one of a security level of the key transmission and an operating mode of the subscriber stations, the means for authentification has,

c) on a first level, a means for monitoring a time frame of the key transmission and a means for indication of the agreed key in reduced form at a respective subscriber station of the plurality of subscriber stations,

d) on a second level for automatic traffic handling, a key management station with integrated cryptographic device which, before key transmission, receives an identification message block encrypted with a first key from the transmitting station and forwards it encrypted with a second key to the receiving station, in which the identification message block has code words addressing the transmitting station and receiving station and authentification code words, derived from the agreed key of a checking sequence.

2. The arrangement or key transmission in a public communication system according to claim 1, wherein a public key assigned to the key management station is used as a first key.

3. The arrangement for key transmission in a public communication system according to claim 2, wherein a private key assigned to the key management station is used as a second key.

4. The arrangement for key transmission in a public communication system according to claim 2, wherein a public key assigned to the receiving station is used as a second key.

5. The arrangement for key transmission in a public communication system according to claim 1, wherein the public communication system is a communication system for a plurality of communication services, in which at least one subscriber station of the plurality of subscriber stations has a multiplicity of terminals with different functions.

6. The arrangement for key transmission in a public communication system according to claim 1, wherein the public communication system is a mobile radio network.

7. The arrangement for key transmission in a public communication system according to claim 1, wherein the first level is for voice communication between subscriber stations of the plurality of subscriber stations.

8. A method for key transmission in a public communication system having a plurality of subscriber stations in which a key is agreed between a transmitting station of the plurality of subscriber stations and a receiving station of the plurality of subscriber stations of encrypted transmission of messages, and in which a cryptographic device is provided in each of the transmitting stations and the receiving stations, and having a key management station, comprising the steps of:

a) in the transmitting station specifying a key to be agreed to, calculating an authentification code of the key and forming an identification message block with an identification code of the subscribers contained therein,

b) encrypting the identification message block in the transmitting station with a first key and transmitting the identification message block to the key management station,

c) in the key management station, decrypting the identification message block, checking the authenticity of eh transmitting station and transmitting the identification message block encrypted with a second key to the receiving station, and

d) in the receiving station notifying the transmitting station, in which the key was specified, for the key transmission of the agreed key.