Method and apparatus for signaling privacy in personal communications systems

• US 6,081,600 A
• Filed: 10/03/1997
• Issued: 06/27/2000
• Est. Priority Date: 10/03/1997
• Status: Expired due to Term

• Current Assignee: Google Technology Holdings LLC (Alphabet Inc.)
• Original Assignee: Motorola, Inc. (Motorola Solutions, Inc.)
• Inventors: Lester, Joseph Olk, Blanchard, Scott David, Vanden Heuvel, Dean Paul
• Primary Examiner(s): Swann, Tod R
• Assistant Examiner(s): Callahan, Paul E.
• Application Number:
  US08/939,720
• Time in Patent Office: 998 Days
• Field of Search: 455/410, 455/411, 455/415, 455/422, 455/451, 455/458, 455/461, 455/551, 380/44, 380/48, 380/247, 380/248, 380/249, 380/271, 380/273, 380/202, 380/239, 380/264
• US Class Current: 380/255
• CPC Class Codes: H04B 7/18565 Arrangements for preventing unauthorised access or for providing user protection arrangements for secret or secure communication H04L9/00
• CPC Class Codes: H04K 1/00 Secret communication
• CPC Class Codes: H04W 12/037 of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication

Abstract

A system and method provides signaling privacy for communications between nodes of a communications network (30). Multiple logical links exist between distinct network nodes (38-40, 42, 50-53) of the communication network (30). Signaling privacy is achieved by a subscriber unit (80) providing encryption/decryption of signaling data messages at the messaging level. The subscriber unit (80) employs a signaling encryptor/decryptor (86) along the signaling path, which enables the signaling data messages to be separately encrypted from data on the traffic channel. The encrypted signaling data can then be sent along a different logical link from the traffic, while maintaining cipher key synchronization between the signaling encryptor/decryptor (86) and a network encryptor/decryptor (78) at a remote end of the logical link which transports the encrypted signaling data.

Claims

1. A communication unit for use in a wireless communication system, the communication unit comprising:

a traffic data key generator for generating a traffic cipher key stream;

a traffic data encryptor coupled to the traffic key generator for encrypting traffic data with the traffic key stream;

a signaling processor which produces signaling data, the signaling data being destined for a signal destination node of the wireless communication system;

a signaling key generator which generates a signaling cipher key stream from a number stored on a subscriber information module (SIM);

a signaling encryptor, coupled to the signaling processor and to the signaling key generator, which encrypts the signaling data using the signaling cipher key stream resulting in encrypted signaling data;

a traffic data source which produces said traffic data, said traffic data being destined for a traffic destination node of the wireless communication system;

a multiplexor coupled to the traffic data encryptor and the signaling encryptor for multiplexing the encrypted traffic data and encrypted signaling data;

a transceiver, for transmitting the multiplexed encrypted signaling data and encrypted traffic data over a first RF link to a node of the wireless communication system.

2. The communication unit as claimed in claim 1

wherein the encrypted signaling data and encrypted traffic data are provided to the multiplexor in the form of, respectfully, signaling data packets and traffic data packets, wherein each data packet comprises a header portion and a payload portion, and wherein the payload portion of the signaling data packets comprises the signaling data, and the payload portion of the traffic data packets comprises the traffic data,

and wherein the signaling data packets are routed to the signaling destination node of the wireless communication system over a first logical link, and wherein traffic data packets are routed to the traffic destination node of the wireless communication system over a second logical link.

3. The communication unit as claimed in claim 1 wherein the wireless communication system comprises a plurality of satellites moving with respect to earth'"'"'s surface, and wherein the transceiver sends the encrypted signaling data and encrypted traffic data to one of the satellites of the communication system over said single RF link,

and wherein the traffic destination node is either a called or calling party,

and when the signaling destination node is said one satellite, said signaling data comprises link control data.

4. The communication unit as claimed in claim 1, wherein the signaling encryptor comprises a signaling decryptor portion coupled to the signaling processor and to the signaling key generator, which decrypts received encrypted signaling data using the signaling cipher key stream, resulting in decrypted signaling data, the signaling decryptor portion providing the decrypted signaling data to the signaling processor.

5. The communication unit as claimed in claim 3, further comprising:

a second signaling encryptor which encrypts second signaling data using second signaling cipher key stream for secure transmission over a third logical link, said second signaling data comprising channel control information being routed over the third logical link to second signaling destination node of the wireless communication system, the second signaling destination node being a gateway.

6. The communication unit as claimed in claim 5, further comprising:

a second signaling key generator, coupled to the second signaling encryptor, which generates the second signaling cipher key stream.

7. The communication unit as claimed in claim 6, further comprising:

a second signaling processor, coupled to the second signaling encryptor, which produces the second signaling data to be encrypted by the second signaling encryptor.

8. The communication unit as claimed in claim 3 wherein the signaling data comprises channel control information.

9. The communication unit as claimed in claim 8 wherein the traffic data encryptor comprises a traffic decryptor portion, coupled to the traffic key generator, the traffic data encryptor portion decrypting incoming encrypted traffic data using the traffic key stream.

10. A wireless communication system comprising:

an authentication center (AUC) which produces a signaling cipher key and a random number, and stores the random number on a SIM card;

a wireless communication device comprising a signaling key generator for retrieving the random number from the SIM card and generating the signaling cipher key from the random number, and using the signaling cipher key to generate a signaling cipher key stream used to encrypt signaling data resulting in encrypted signaling data; and

a gateway which receives the cipher key from the AUC, and uses the cipher key to decrypt the encrypted signaling data received from the wireless communication device through a first logical channel; and

a satellite coupled to the wireless communication device by an RF link,

said wireless communication device further comprising a traffic key generator for generating a traffic key stream, a traffic encryptor for encrypting traffic data with the traffic key stream, a multiplexor for multiplexing the encrypted signaling data with the encrypted traffic data, and a transceiver for transmitting the multiplexed data over the RF link to the satellite, the encrypted traffic data being routed to a called or calling party through a second logical channel.

11. The communication system as claimed in claim 10, wherein the wireless communication device further comprises a second signaling key generator for generating a second signaling cipher key stream for encrypting second signaling data, the second signaling data destined for use the satellite, the second signaling data comprising information for managing said RF link.

12. A method for securely communicating signaling data from a wireless communication device to a first destination device of a satellite communication system, and communicating traffic data to a second destination device, the method comprising the steps of:

generating a signaling cipher key by a signaling key generator using a random number stored on a SIM of the wireless communication device;

encrypting the signaling data, by a signaling encryptor, using the cipher key resulting in encrypted signaling data;

encrypting traffic data with a traffic data encryptor using a traffic cipher key stream;

multiplexing the encrypted signaling data and the encrypted traffic data for transmission to a satellite of the satellite communication system;

transmitting the encrypted signaling data over a first logical link to the first destination device, the first logical link comprising a first set of physical links;

transmitting the encrypted traffic data over a second logical link to a second destination device, the second logical link comprising a second set of physical links,

wherein the first and second sets of physical links comprise a common RF link between the wireless communication device and the satellite.

13. The method as claimed in claim 12, further comprising the steps of:

receiving second encrypted signaling data from the second destination device; and

decrypting the second encrypted signaling data by a signaling decryptor, using the signaling cipher key.

14. A method of operating a communication device for securely communicating signaling and traffic data in a wireless communication system, the method comprising the steps of:

generating a signaling cipher key stream with a signaling key generator;

encrypting signaling data using the signaling cipher key stream, the signaling data comprising channel control information;

multiplexing the encrypted signaling data and traffic data for transmission to a satellite of the wireless communication system, wherein the encrypted signaling data is routed over a first logical link to a first destination device, and the traffic data is routed over a second logical link to a second destination device, wherein the first and second logical links share a common RF link between the communication device and the satellite.

15. The method as claimed in claim 14 wherein the first destination device is a gateway of the communication system, and the method further comprises the steps of:

encrypting second signaling data with a second signaling cipher key stream, said second signaling data being destined for said satellite and comprising information for controlling the RF link between the satellite and the communication unit;

multiplexing the encrypted second signaling data with the encrypted signaling data and traffic data for transmission to the satellite.

16. A wireless communication system comprising:

an authentication center for producing a signaling cipher key and a random number and stores the random number of a SIM card;

a gateway which uses the signaling cipher key to decrypt encrypted signaling data, the encrypted signaling data being produced by a wireless communication device using the random number from the SIM card;

a satellite communication node coupling the wireless communication device to the wireless communication system by an RF link,

wherein multiplexed data comprising encrypted traffic data and the encrypted signaling data is received by the satellite from the wireless communication device, the encrypted traffic data being produced by the wireless communication device using a traffic cipher key that is different from the signaling cipher key, the encrypted traffic data being routed over a first logical link through the wireless communication system to a traffic destination node, the encrypted signaling data being routed over a second logical link through the wireless communication system to the gateway.

17. The wireless communication system as claimed in claim 16 wherein the signaling data is first signaling data, and the communication unit produces encrypted second signaling data, and wherein the satellite receives multiplexed data comprised of the encrypted traffic data, the encrypted first signaling data and the encrypted second signaling data, and wherein the second signaling data comprises link control data and is destined for receipt by the satellite communication node.