System and method for generating reproducible session keys

• US 7,929,702 B2
• Filed: 02/16/2005
• Issued: 04/19/2011
• Est. Priority Date: 05/03/2004
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Research In Motion Limited (Blackberry Limited)
• Inventors: Brown, Michael S., Brown, Michael K., Little, Herbert A.
• Primary Examiner(s): Pich; Ponnoreay
• Application Number:
  US11/058,259
• Publication Number:
  US 20050254658A1
• Time in Patent Office: 2,253 Days
• Field of Search: 709/230, 709/236
• US Class Current: 380/277
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords

Abstract

A system and method for generating reproducible session keys in a wireless messaging system. The session key is generated based on a hash of a message itself, optionally concatenated with additional information. Since the local server stores the message, it can easily regenerate the same session key in response to each MORE request. The method of the invention can be implemented with the stored original message, a public key, and an algorithm for generating the session key based on a hash of the message.

Claims

1. A method of generating a reproducible encryption key for encrypting data associated with a data item for transmission to a remote communication device, comprising:

applying a deterministic algorithm to at least a portion of the data item to generate a first hash, the data item exceeding a selected batch size,

using the first hash as an encryption key to encrypt a first batch of the data associated with the data item,

transmitting the encrypted first batch of the data associated with the data item to the remote communication device,

applying the deterministic algorithm to at least a portion of the data item to generate a further hash whereby the further hash is identical to the first hash,

using the further hash as an encryption key to encrypt a further batch of the data associated with the data item, and

transmitting the encrypted further batch of the data associated with the data item to the remote communication device.

2. The method of claim 1 wherein the deterministic algorithm comprises a hash algorithm.

3. The method of claim 1 wherein the deterministic algorithm comprises a key derivation function.

4. The method of claim 1 further comprising concatenating the portion of the data item with additional data prior to applying the deterministic algorithm.

5. The method of claim 4 wherein the additional data is from a source external to the data item.

6. The method of claim 1 further comprising, after using the first hash as an encryption key to encrypt the first batch of the data associated with the data item,

encrypting the encryption key using a public key to generate an encrypted encryption key and transmitting the encrypted encryption key to the remote communication device.

7. The method of claim 1 further comprising repeating the applying of the deterministic algorithm to generate the further hash, using the further hash as an encryption key to encrypt a further batch of the data and transmitting the encrypted further batch of the data, for all further batches of the data associated with the data item.

8. The method of claim 1 further comprising, after transmitting the encrypted first batch of the data, receiving a request for additional data associated with the data item from the remote communication device.

9. The method of claim 1 where the encryption key is a session key.

10. A system for generating a reproducible encryption key for encrypting data in a data item for transmission to a remote communication device, comprising a data processing device in communication with at least one memory storing the data item and comprising a processor configured to apply a deterministic algorithm to at least a portion of the data item to generate a first hash for use as an encryption key associated with the data item for transmission of a first batch of data to the communication device, the data item exceeding a selected batch size, the processor further configured to encrypt a plurality of batches of data with a further encryption key generated by re-applying the deterministic algorithm to at least a portion of the data item to thereby reproduce the further encryption key and to encrypt each of the plurality of batches of data with the further encryption key, and to transmit each of the encrypted plurality of batches of data to a remote communication device whereby the encryption key is identical to the further encryption key.

11. The system of claim 10 wherein the deterministic algorithm comprises a hash algorithm.

12. The system of claim 10 wherein the deterministic algorithm comprises a key derivation function.

13. The system of claim 10 wherein the processor further concatenates the portion of the data item with additional data prior to applying the deterministic algorithm.

14. The system of claim 13 wherein the additional data is from a source external to the data item.

15. The system of claim 10 wherein the processor further encrypts the encryption key using a public key to generate an encrypted encryption key.

16. A computer program product for use with a computer, the computer program product comprising a non-transitory computer usable medium having computer readable program code means embodied in said medium for generating a reproducible encryption key for encrypting message data, said computer program product having:

computer readable program code means for applying a deterministic algorithm to at least a portion of the data item to generate a first hash for use as a encryption key to encrypt a first batch of the data associated with the data item; and

computer readable program code means for transmitting the encrypted first batch of the data associated with the data item to the communication device,

and if the data item exceeds a selected batch size, a plurality of batches of data are encrypted with a further encryption key generated by re-applying the deterministic algorithm to at least a portion of the data item to thereby reproduce the further encryption key and encrypting each of the plurality of batches of data with the further encryption key, and transmitted to the remote communication device whereby the encryption key is identical to the further encryption key.

17. The computer program product of claim 16 wherein the deterministic algorithm comprises a hash algorithm.

18. The computer program product of claim 16 wherein the deterministic algorithm comprises a key derivation function.

19. The computer program product of claim 16, further comprising computer readable program code means for concatenating the portion of the data item with additional data prior to applying the deterministic algorithm.

20. The computer program product of claim 19 wherein the additional data is from a source external to the data item.

21. The computer program product of claim 16, further comprising computer readable program code means for encrypting the encryption key using a public key to generate an encrypted encryption key.