Method for key management of point-to-point communications

• US 5,410,602 A
• Filed: 09/27/1993
• Issued: 04/25/1995
• Est. Priority Date: 09/27/1993
• Status: Expired due to Term

• Current Assignee: Motorola Solutions, Inc.
• Original Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Inventors: Brown, Daniel P., Puhl, Larry C., Finkelstein, Louis D.
• Primary Examiner(s): Cain, David C.
• Application Number:
  US08/127,718
• Time in Patent Office: 575 Days
• Field of Search: 380/21, 380/28, 380/29, 380/30, 380/49, 380/48
• US Class Current: 380/281
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]

Abstract

A method of secure key distribution in a communication system having a plurality of subscriber units and an infrastructure communication center is provided. A first subscriber unit sends a request to the infrastructure communication center for a secure communication link with a second subscriber unit. This request includes an encrypted session encryption key which was encrypted with a first subscriber registration key. The infrastructure communication center decrypts the encrypted session encryption key with the first subscriber registration key. Subsequently, the infrastructure communication center re-encrypts the session encryption key with a second subscriber registration key. This re-encrypted session encryption key is sent to the second subscriber unit. In an alternative method, the first subscriber unit and the infrastructure communication center a priori know a session key. Therefore, the infrastructure communication center only needs to encrypt and send the session encryption key to the second subscriber unit, in response to a request by the first subscriber unit.

Claims

1. A method of secure key distribution in a communication system having a plurality of subscriber units and an infrastructure communication center, comprising:

(a) requesting, by a first subscriber unit to the infrastructure communication center, a secure communication link with a second subscriber unit, the request including an encrypted session encryption key, the session encryption key being encrypted with a first subscriber registration key;

(b) decrypting, by the infrastructure communication center, the encrypted session encryption key with the first subscriber registration key;

(c) re-encrypting, by the infrastructure communication center, the session encryption key with a second subscriber registration key; and

(d) sending the encrypted session encryption key to the second subscriber unit.

2. The method of claim 1 further comprising the step of communicating a message encrypted by the session encryption key from the first subscriber unit to the second subscriber unit transparently through the infrastructure communication center.

3. The method of claim 1 further comprising the step of decrypting, by the second subscriber unit, the encrypted session encryption key with the second subscriber registration key.

4. The method of claim 1 wherein the sending step comprises sending the encrypted session encryption key to a plurality of second subscriber units.

5. The method of claim 1 further comprising the step of deleting, by the infrastructure communication center, the decrypted session encryption key from a memory device.

6. The method of claim 1 further comprising the step of enabling an encrypted conference communication link, by the infrastructure communication center, through decrypting subsequent communications from subscriber units with the decrypted session encryption key.

7. The method of claim 1 further comprising the step of enabling an encrypted conference communication link, by participating subscriber units, through providing communication activity information to the infrastructure communication center.

8. A method of secure key distribution in a communication system having a plurality of subscriber units and an infrastructure communication center, comprising:

(a) requesting, by a first subscriber unit to the infrastructure communication center, a secure communication link with a second subscriber unit, the request including an encrypted session encryption key, the session encryption key being encrypted with a first subscriber registration key;

(b) decrypting, by the infrastructure communication center, the encrypted session encryption key with the first subscriber registration key;

(c) re-encrypting, by the infrastructure communication center, the session encryption key with a second subscriber registration key;

(d) deleting, by the infrastructure communication center, the decrypted session encryption key from a memory device;

(e) sending the encrypted session encryption key to the second subscriber unit;

(f) decrypting, by the second subscriber unit, the encrypted session encryption key with the second subscriber registration key; and

(g) communicating a message encrypted by the session encryption key from the first subscriber unit to the second subscriber unit transparently through the infrastructure communication center.

9. The method of claim 8 wherein the sending step comprises sending the encrypted session encryption key to a plurality of second subscriber units.

10. The method of claim 8 further comprising the step of enabling an encrypted conference communication link, by the infrastructure communication center, through decrypting subsequent communications from subscriber units with the decrypted session encryption key.

11. The method of claim 8 further comprising the step of enabling an encrypted conference communication link, by participating subscriber units, through providing communication activity information to the infrastructure communication center.

12. A method of secure key distribution in a communication system having a plurality of subscriber units and an infrastructure communication center, comprising:

(a) requesting, by a first subscriber unit to the infrastructure communication center, a secure communication link with a second subscriber unit, the first subscriber unit and the infrastructure communication center a priori knowing a session key;

(b) encrypting, by the infrastructure communication center, the session encryption key with a second subscriber registration key; and

(c) sending tire encrypted session encryption key to the second subscriber unit.

13. The method of claim 12 further comprising the step of communicating a message encrypted by the session encryption key from the first subscriber unit to the second subscriber unit transparently through the infrastructure communication center.

14. The method of claim 12 further comprising the step of decrypting, by the second subscriber unit, the encrypted session encryption key with the second subscriber registration key.

15. The method of claim 12 wherein the sending step comprises sending the encrypted session encryption key to a plurality of second subscriber units.

16. The method of claim 12 further comprising the step of deleting, by the infrastructure communication center, the decrypted session encryption key from a memory device.

17. The method of claim 12 further comprising the step of enabling an encrypted conference communication link, by the infrastructure communication center, through decrypting subsequent communications from subscriber units with the decrypted session encryption key.

18. The method of claim 12 further comprising the step of enabling an encrypted conference communication link, by participating subscriber units, through providing communication activity information to the infrastructure communication center.

19. A method of secure key distribution in a communication system having a plurality of subscriber units and an infrastructure communication center, comprising:

(a) requesting, by a first subscriber unit to the infrastructure communication center, a secure communication link with a second subscriber unit, the first subscriber unit and the infrastructure communication center a priori knowing a session key;

(b) encrypting, by the infrastructure communication center, the session encryption key with a second subscriber registration key;

(c) deleting, by the infrastructure communication center, the decrypted session encryption key from a memory device;

(d) sending the encrypted session encryption key to the second subscriber unit;

(e) decrypting, by the second subscriber unit, the encrypted session encryption key with the second subscriber registration key; and

(f) communicating a message encrypted by the session encryption key from the first subscriber unit to the second subscriber unit transparently through the infrastructure communication center.

20. The method of claim 19 wherein the sending step comprises sending the encrypted session encryption key to a plurality of second subscriber units.

21. The method of claim 19 further comprising the step of enabling an encrypted conference communication link, by the infrastructure communication center, through decrypting subsequent communications from subscriber units with the decrypted session encryption key.

22. The method of claim 19 further comprising the step of enabling an encrypted conference communication link, by participating subscriber units, through providing communication activity information to the infrastructure communication center.