Method for the encryption of data transfer

• US 5,987,137 A
• Filed: 06/04/1997
• Issued: 11/16/1999
• Est. Priority Date: 06/06/1996
• Status: Expired due to Term

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Mobile Phones UK Limited (Nokia Corporation)
• Inventors: Kari, Hannu, Karppanen, Arto, Hamalainen, Jari, Juopperi, Jari
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US08/868,914
• Time in Patent Office: 895 Days
• Field of Search: 380/9, 380/28, 380/29, 380/37, 380/43, 380/49, 380/23, 380/25, 380/48, 380/21
• US Class Current: 380/28
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/065 Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 92/00 Interfaces specially adapted for wireless communication networks

Abstract

The object of the invention is a method for the encryption of information transferred between data transfer devices (MS, SGSN) in a data communication system wherein one or more data frames are created from one or more data packets formed from the information by the application. The data frames comprise at least a header field and a data field. In the method, at least some part of the data packets is ciphered by using a ciphering key (Kc). To the data frames, synchronization data (COUNT) is attached, the value of which is changed at least at the transmission of each data frame.

Claims

1. A method for the encryption of information transferred between data transfer devices in a data communication system wherein plural data frames are created from one or more data packets formed from the information by a communication application, and individual ones of these data frames comprise at least a header field and a data field, wherein the method comprises steps of:

ciphering at least one part of the data packets by using a ciphering key;

attaching synchronization data to the data frames, wherein the synchronization data includes a sequence number of each of said data frames; and

changing the value of the ciphering key at least at the transmission of each of said data frames.

2. A method according to claim 1 wherein a data transfer connection is formed between two or more data transfer devices connected to the data communication system, wherein a separate ciphering key is allocated to each connection, in which case in a common data transfer channel, data frames of at least two separate connections are transferable in ciphered mode independent of each other.

3. A method according to claim 1 wherein a group of said data frames is divided into sub-blocks, wherein synchronization data comprises a block counter which is allocated separately to each connection and to which an initial value is set at a start of a connection and a value of which is changed at a transmission of each of said sub-blocks.

4. A method according to claim 1 wherein data frames are formed at an adapting layer.

5. A method according to claim 4, wherein data frames of the adapting layer are transferred to a tile link layer wherein data frames of the tile link layer are formed from data frames of the adapting layer for transmission to a transmission path.

6. A method according to claim 5, wherein synchronization data comprises at least one of the following:

data frame number of the tile link layer,

data frame number of the adapting layer,

identity of a routing area,

identity of an area of a packet switching controller, and

identity of a cell.

7. A method according to claim 6, wherein a data frame number is formed and maintained locally in data transfer devices linked to a data transfer connection in which case the sequence number is set to its initial value at a start of the data transfer connection and is updated in a previously defined manner during the connection.

8. A method according to claim 7, wherein the data transfer connection is a data transfer connection of a packet switching system.

9. A method according to claim 7, wherein the data transfer connection is a Point-to-Point connection.

10. A method according to claim 7, wherein the data transfer connection is a multipoint connection.

11. A method according to claim 10, wherein there are a plurality of data transfer connections including said data transfer connection, and information is transferred between a file data transfer device of a data service provider and data transfer devices of data service users, wherein a ciphering key (allocated separately to each of said data connections is set to respective ones of the data transfer devices by transferring the ciphering key in a ciphered mode in the data communication system, by using a keypad of a data transfer device.

12. A method according to claim 11, wherein

only data transmitted from the data transfer device of a data service provider to data transfer devices of data service users is ciphered at least partly,

only data transmitted from data transfer devices of data service users to the data transfer device of data service provider is ciphered at least partly, or

data transmitted in both directions is ciphered at least partly.

13. A method according to claim 12, wherein at a start of ciphering, data, concerning a direction in which data transfer is ciphered, is transmitted to data transfer devices.

14. A method according to claim 10 wherein there are a plurality of data transfer connections including said data transfer connection, and information is transferred between a file data transfer device of a data service provider and data transfer devices of data service users, wherein a ciphering key allocated separately to each of said data connections is set to respective ones of the data transfer devices by transferring the ciphering key in a ciphered mode in the data communication system, by using a smart card.

15. A method according to claim 6, wherein a data frame number of the link layer is maintained in one data transfer device of a data transfer connection and is delivered to other data transfer devices in a data frame of the link layer.

16. A method according to claim 1, wherein only some part of the data frames of an adapting layer is ciphered, in which case data of a ciphering of each of said data frames is transmitted in the header field of the respective data frame.

17. A data communication system which comprises means for encryption of information transferred between data transfer devices, means for forming one or more data packets of the information and means for forming data frames of the data packets, the means for encryption of information comprise at least:

means for ciphering data packets by a ciphering key,

means for changing a value of the ciphering key for each of a plurality of transmission blocks;

means for attaching synchronization data to data frames,

means for changing the value of the synchronization data (COUNT) at the transmission of each data frame, wherein the synchronization data includes sequence numbers of respective ones of the data frames, and

means for interpreting synchronization data in the data transfer device of the receiver.

18. A data communication system according to claim 17, characterized in that the data transfer devices comprise at least one mobile station.

19. A data communication system according to claim 18, characterized in that the mobile station is a GSM mobile station.

20. A data communication system according to claim 17, characterized in that the data transfer devices comprise at least one base station.

21. A data communication system according to claim 20, characterized in that the base station is a GSM base station.