Encryption of data packets using a sequence of private keys generated from a public key exchange

• US 6,052,466 A
• Filed: 08/28/1997
• Issued: 04/18/2000
• Est. Priority Date: 08/28/1997
• Status: Expired due to Term

• Current Assignee: Optis Wireless Technology, LLC (Brevet Capital)
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Wright, Andrew S.
• Primary Examiner(s): Barron, Jr., Gilberto
• Application Number:
  US08/919,728
• Time in Patent Office: 964 Days
• Field of Search: 380/21, 380/48, 380/30, 380/44, 380/254, 380/260, 380/262, 380/265, 380/278, 380/282, 380/283, 380/285
• US Class Current: 380/262
• CPC Class Codes: H04L 9/065 Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords

Abstract

A first cipher stream generated from a private key negotiated as a result of a public key exchange is partitioned to form a sequence of secondary keys. The secondary keys are then indexed. In one instance, each plaintext data packet is encrypted with a second cipher streams generated from a different one of the secondary keys. In another instance, a second cipher stream generated from a single secondary key is used to encrypt a plurality of plaintext data packets. A new second cipher stream generated from another one of the secondary keys is then used for encryption following each instance of the loss of a ciphertext data packet. The index is communicated with the ciphertext to identify which secondary key is to be used in generating the second cipher stream needed for decryption. With knowledge of the secondary key to be used, re-synchronization (along with new private key negotiation) at each instance of a ciphertext data packet loss is obviated.

Claims

1. A private key generator, comprising:

a first generator for generating a private key;

a second generator initialized with the private key for generating a first cipher stream;

a partitioner that partitions the first cipher stream into a plurality of secondary keys for use in generating corresponding second cipher streams to encrypt plaintext information into ciphertext information; and

an indexer for indexing the plurality of secondary keys, an index included with the ciphertext information identifying which of the indexed plurality of secondary keys was used in encrypting the plaintext information.

2. The private key generator as in claim 1 further including:

means for exchanging public keys; and

wherein the first generator functions to generate the private key from processing at least one of the exchanged public keys.

3. The private key generator as in claim 1 wherein the plaintext information comprises a plurality of plaintext packets, each plaintext packet encrypted with a second cipher stream generated from a different one of the secondary keys.

4. The private key generator as in claim 1 wherein the plaintext information comprises a plurality of plaintext packets, each sequence of plaintext packets handled between instances of ciphertext information loss encrypted with a second cipher stream generated from a different one of the secondary keys.

5. The private key generator as in claim 1 wherein the first generator generates a new private key when each of the generated plurality of secondary keys from a prior private key has been used for encryption.

6. A method for generating a private key, comprising the steps of:

generating a private key;

generating a first cipher stream initialized from the generated private key;

partitioning the first cipher stream into a plurality of secondary keys for use in generating corresponding second cipher streams to encrypt plaintext information into ciphertext information; and

indexing the plurality of secondary keys, an index included with the ciphertext information identifying which of the indexed plurality of secondary keys was used in encrypting the plaintext information.

7. The method as in claim 6 further including the steps of:

exchanging public keys; and

generating the private key from processing at least one of the exchanged public keys.

8. The method as in claim 6 wherein the plaintext information comprises a plurality of plaintext packets, further including the steps of:

generating a plurality of second cipher streams, each second cipher stream initialized from a different one of the secondary keys; and

encrypting each plaintext packet with a different one of the plurality of second cipher streams.

9. The method as in claim 6 wherein the plaintext information comprises a plurality of plaintext packets, further including the steps of:

generating a plurality of second cipher streams, each second cipher stream initialized from a different one of the secondary keys; and

encrypting each sequence of plaintext packets handled between instances of ciphertext information loss with a different one of the plurality of second cipher streams.

10. The method as in claim 6 further including the step of repeating the steps of claim 6 when each of the generated plurality of secondary keys has been used for encryption.

11. An encryption device, comprising:

a first generator for generating a private key;

a second generator initialized with the private key for generating a first cipher stream;

a partitioner for partitioning the first cipher stream into a plurality of secondary keys;

an indexer for indexing the plurality of secondary keys;

means for encrypting plaintext information into ciphertext information using second cipher streams generated from the plurality of secondary keys; and

means for including an index with the ciphertext information identifying which of the indexed plurality of secondary keys was used in encrypting the plaintext information.

12. The encryption device as in claim 11 further including:

means for exchanging public keys; and

wherein the first generator functions to generate the private key from processing at least one of the exchanged public keys.

13. The encryption device as in claim 11 wherein the plaintext information comprises a plurality of plaintext packets, and wherein the means for encrypting comprises:

a third generator initialized with the secondary keys for generating corresponding second cipher streams; and

means for encrypting each plaintext packet with a different one of the second cipher streams.

14. The encryption device as in claim 11 wherein the plaintext information comprises a plurality of plaintext packets, and wherein the means for encrypting comprises:

a third generator initialized with the secondary keys for generating corresponding second cipher streams; and

means for encrypting each one of a plurality of sequences of plaintext packets that is handled between instances of ciphertext information loss with a different one of the second cipher streams.

15. The encryption device as in claim 11 wherein the first generator generates a new private key when each of the generated plurality of secondary keys from a prior private key has been used for encryption.

16. A method for encrypting, comprising the steps of:

generating a private key;

generating a first cipher stream initialized from the generated private key;

partitioning the first cipher stream into a plurality of secondary keys;

indexing the plurality of secondary keys;

encrypting plaintext information into ciphertext information using second cipher streams generated from the plurality of secondary keys; and

including with the ciphertext information an index identifying which of the indexed plurality of secondary keys was used in encrypting the plaintext information.

17. The method as in claim 16 further including the steps of:

exchanging public keys; and

generating the private key from processing at least one of the exchanged public keys.

18. The method as in claim 16 wherein the plaintext information comprises a plurality of plaintext packets, and the step of encrypting comprises the steps of:

generating second cipher streams each initialized from a different one of the plurality of secondary keys; and

encrypting each plaintext packet with a different one of the second cipher streams.

19. The method as in claim 16 wherein the plaintext information comprises a plurality of plaintext packets, and the step of encrypting comprises the steps of:

generating second cipher streams each initialized from a different one of the plurality of secondary keys; and

encrypting each sequence of plaintext packets handled between instances of ciphertext information loss with a different one of the second cipher streams.

20. The method as in claim 16 further including the step of repeating the steps of claim 16 when each of the generated plurality of secondary keys has been used for encryption.