Communication security

• US 6,373,946 B1
• Filed: 12/23/1997
• Issued: 04/16/2002
• Est. Priority Date: 05/31/1996
• Status: Expired due to Term

• Current Assignee: DBSD Services Ltd. (Dish Network Corporation)
• Original Assignee: ICO Services, Ltd. (Dish Network Corporation)
• Inventors: Johnston, Thomas Francis
• Primary Examiner(s): Barron, Jr., Gilberto
• Application Number:
  US08/997,695
• Time in Patent Office: 1,575 Days
• Field of Search: 380/21, 380/277, 380/278, 380/279-283, 380/247, 380/273
• US Class Current: 380/211
• CPC Class Codes: H04B 7/18565 Arrangements for preventing unauthorised access or for providing user protection arrangements for secret or secure communication H04L9/00
• CPC Class Codes: H04L 2209/16 Obfuscation or hiding, e.g. involving white box
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]

Abstract

A satellite mobile telecommunications system includes mobile terminals 2a, 2b which can communicate with one another using end-to end encryption and decryption techniques. When secure end-to-end communication is required, each terminal uses a common encryption code (RAND) to encode data and decode data transmitted between the terminals. The encryption code is transmitted in a secure manner from a remote database station (15) to the terminals. Each terminal stores a terminal key (K_a, K_b) on its SIM card and the keys are also held in the remote station (15). Partial keys (K_pa, K_b) comprising the pseudo random number (RAND) and the keys K_a, K_b stored at the station (15) are produced at the station (15) by an exclusive OR process in order to mask the keys and the random number. The partial key K_pa=K_a+(RAND) is sent to terminal 2a. At the terminal 2a, the partial key K_pa is exclusive OR-ed with the locally stored terminal key K_a on the SIM card, so as to recover (RAND). The common code (RAND) is determined by the same process at terminal 2b, from K_pb=K_b+(RAND) and the locally stored key K_b. The terminals then both run a GSM encryption algorithm (A5) to encrypt and decrypt transmitted data, on the basis of the common code (RAND).

Claims

1. A method of distributing though a communication network, enciphering key data to be used in encrypting and decrypting data at first and second terminals so as to provide secure data transmission between the terminals through the network, the terminals each storing corresponding first and second terminal keys, the method comprising:

storing the first and second keys remotely of the terminals;

generating at a location remote from both of the terminals, first and second separate partial keys each as a masked function of a common number and a corresponding one of said stored keys;

dispatching the first partial keV separately towards the first terminal; and

separately dispatching the second partial key towards the second terminal,

wherein the enciphering key data is to be used for encrypting and decrypting data at said first and second terminals and at least one further terminal so as to provide security for concurrent data transmissions between all of said terminals through the network, the method further including;

storing a further key remotely of the terminals corresponding to the terminal key of the further terminal;

generating a further partial key as a masked function of the common number and said remotely stored further key; and

dispatching the further partial key towards the further terminal.

2. A method according to claim 1 including causing the further terminal to join in data transmission between the terminals whilst said transmission is in progress, including transmitting to the further terminal, timing data concerning the data transmission between the terminals.

3. A method according to claim 1 wherein one or more of the partial keys is transmitted to the terminals over an air interface of a mobile communications system.

4. A method according to claim 3 including additionally encrypting data transmitted over the air interface.

5. A method according to claim 4 including performing the additional encryption at each said terminal with the terminal key of the respective terminal and a predetermined algorithm.

6. A terminal for communicating through a communication network with at least one further terminal, comprising:

means to receive a store that stores an individual terminal key;

a key generator to receive from the network a partial key comprising a masked function of the individual terminal key and a number transmitted in common to said at least one further terminal, and operative to compare the individual key stored in the store with said partial key so as to produce an encryption code as a function of said number;

enciphering means operative to encipher data transmitted through the network in accordance with the encryption code; and

user operable means for selectively initiating operation of the enciphering means,

the terminal being operative to transmit and receive data in different channels through the network, wherein the enciphering means is operative to encipher data transmitted through the network in accordance with a first said encryption code, and including deciphering means operative to decipher data received through the network in accordance with a second, different said encryption code.