Method of automatically populating a list of managed secure communications group members

• US 8,401,195 B2
• Filed: 09/22/2008
• Issued: 03/19/2013
• Est. Priority Date: 09/22/2008
• Status: Active Grant

• Current Assignee: Motorola Solutions, Inc.
• Original Assignee: Motorola Solutions, Inc.
• Inventors: Fuchs, Kenneth C., Murrill, Larry
• Primary Examiner(s): LaForgia, Christian
• Assistant Examiner(s): SCHMIDT, KARI L
• Application Number:
  US12/234,828
• Publication Number:
  US 20100074446A1
• Time in Patent Office: 1,639 Days
• Field of Search: 380/270, 380/277, 380/278, 380/279, 713/151, 713/152, 713/158, 713/163, 713/170, 713/171, 713/182, 726 2- 4, 726/6, 726/14, 726/26, 726/29, 726/30
• US Class Current: 380/278
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/30 Security of mobile devices; Security of mobile applications
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent

Abstract

Methods of automatically populating a secure group list in a key variable loader and of providing keys to a secure group are presented. After a user selects a secure group and encryption algorithm using inputs of the loader, the loader provides a group identifier and corresponding key for the group. The group identifier, encryption algorithm, and key are transmitted to a portable communication device over a physical connection between the two while a device identifier of the communication device is transmitted concurrently to the loader. The key variable loader automatically populates a stored list of subscribers of the group with the device identifier. When it is desired to transmit a new key to all of or fewer than all of the subscribers, one of the subscribers is connected with the loader and used to wirelessly transmit a new key to the remaining subscribers.

Claims

1. A method to automatically associate a mobile communication device having a device identifier with a newly created first secure group established to provide security information between subscribers of the first secure group, the method comprising:

maintaining lists of a plurality of secure groups, their currently authorized subscribers, and each group'"'"'s associated security information at a key variable loader;

receiving an identity of a newly created first secure group at the key variable loader via an external input interface of the key variable loader;

providing, via the key variable loader, a first group identifier for the first secure group at the key variable loader and associating the first group identifier with the received identity of the newly created first secure group;

setting a first key for the first secure group at the key variable loader, the first key associated with a corresponding encryption algorithm;

automatically downloading the device identifier of the mobile communication device to the key variable loader from the communication device over a short range connection connecting the communication device and the key variable loader; and

after downloading the device identifier, uploading, via the key variable loader, the first group identifier and the first key for the first secure group to the communication device via the short range connection for use in securing communications between currently authorized subscribers in the first group, and automatically updating a particular list associated with the first secure group out of the plurality of lists of secure groups maintained at the key variable loader to include the device identifier retrieved over the short range connection.

2. The method of claim 1, wherein the short range connection is a wired connection.

3. The method of claim 1, wherein the short range connection is a secure wireless connection with a range that is sufficiently short to guarantee simultaneous visibility of the key variable loader and the communication device.

4. The method of claim 1, further comprising generating the particular list associated with the first secure group at the key variable loader.

5. The method of claim 1, further comprising, after downloading the device identifier, providing the encryption algorithm, along with the first key, to the communication device from the key variable loader.

6. The method of claim 1, wherein the particular list is stored in the key variable loader and is maintained to comprise only currently authorized subscribers of the first secure group.

7. The method of claim 6, further comprising:

disconnecting the key variable loader from the communication device after having downloaded the device identifier and uploaded the first group identifier and first key;

reconnecting the key variable loader to the communication device after having disconnected the key variable loader from the communication device;

transmitting the particular list of currently authorized subscribers of the first secure group and a second key for the first secure group different from the first key from the key variable loader to the communication device; and

transmitting the second key from the communication device to other subscribers in the particular list of currently authorized subscribers of the first secure group over a wireless connection for use in securing subsequent wireless communications between currently authorized subscribers in the first group.

8. The method of claim 7, further comprising, prior to transmitting the particular list of currently authorized subscribers of the first secure group to the communication device, modifying the particular list of currently authorized subscribes for the first secure group at the key variable loader to remove one or more of the subscribers from the particular list who are no longer authorized subscribers for the first secure group.

9. The method of claim 7, further comprising the communication device transmitting the second key to other subscribers in the particular list of currently authorized subscribers of the first secure group over a radio interface.

10. The method of claim 9, wherein the particular list of currently authorized subscribers and the second key are both transmitted from the key variable loader to the communication device over a physical link between the key variable loader and the communication device.

11. The method of claim 1, the method further comprising:

receiving an identity of a second secure group at a key variable loader after disconnection of the communication device from the key variable loader via the external input interface of the key variable loader, the first and second secure groups having overlapping subscribers including the communication device;

providing, via the key variable loader, a second group identifier for the second group at the key variable loader and associating the second group identifier with the received identity of the second secure group;

setting a second key for the second secure group at the key variable loader, the second key associate with the corresponding encryption algorithm;

verifying the device identifier at the key variable loader after the communication device and the key variable loader have been reconnected via a second short range connection using the downloaded device identifier; and

after verifying the device identifier, uploading the second group identifier and the second key for the second secure group to the communication device via the second short range connection and automatically updating a second particular list associated with the second secure group out of the plurality of lists of secure groups maintained at the key variable loader to include the device identifier retrieved over the short range connection.

12. A method of providing security information between a mobile communication device and a first secure group established to provide security information between subscribers of the first secure group, the method comprising:

at a portable key variable loader;

maintaining lists of a plurality of secure groups, their group identifiers, their currently authorized subscribers, and each group'"'"'s associated security information, the security information including keys and encryption algorithms associated with each secure group;

downloading a device identifier of a communication device through a first short range connection connecting the communication device and the key variable loader;

associating the downloaded device identifier with a first secure group out of the plurality of secure groups maintained at the portable key variable loader;

transmitting a first key to the communication device through a second short range connection connecting the communication device and the key variable loader for use in securing communications between currently authorized subscribers in the first group; and

transmitting a particular list of currently authorized subscribers of the first secure group out of the plurality of lists of secure groups maintained at the key variable loader to the communication device; and

at the communication device, further transmitting the first key to at least some subscribers set forth in the particular list of currently authorized subscribers of the first secure group over a wireless connection for use in securing communications between currently authorized subscribers in the first group.

13. The method of claim 12, wherein the key is wirelessly transmitted to the at least some subscribers set forth in the particular list of currently authorized subscribers of the first secure group while the communication device is simultaneously connected with the key variable loader through the second short range connection.

14. The method of claim 12, wherein the first and second short range connections are achieved over a wired connection.

15. The method of claim 12, further comprising transmitting the encryption algorithm from the key variable loader to the communication device over the second short range connection.

16. The method of claim 12, further comprising, at the communication device, further transmitting the first key, directly or indirectly, to all of the subscribers set forth in the particular list of currently authorized subscribers of the first secure group via the wireless connection for use in securing communications between currently authorized subscribers in the first group.

17. The method of claim 12, further comprising, prior to transmitting the particular list of currently authorized subscribers of the first secure group to the communication device, modifying the particular list of currently authorized subscribers for the first secure group at the key variable loader to remove one or more of the subscribers from the particular list who are no longer authorized subscribers for the first secure group;

and

the communication device refraining from further transmitting the first key to the one or more subscribers who are no longer authorized subscribers for the first secure group.

18. The method of claim 12, further comprising disconnecting the communication device from the key variable loader prior to the communication device further transmitting the first key to the at least some subscribers set forth in the particular list of currently authorized subscribers of the first secure group.

19. The method of claim 12, further comprising the first time the communication device is coupled to the key variable loader via the first short range connection, receiving an identity of the first secure group at the key variable loader via an external input interface of the key variable loader;

providing, via the key variable loader, a first group identifier for the first secure group at the key variable loader and associating the first group identifier with the received identity of the first secure group;

setting the first key for the first secure group at the key variable loader, the first key associated with a corresponding encryption algorithm.

20. The method of claim 12, further comprising a subsequent time the communication device is coupled to the key variable loader, and responsive to determining that one or more subscribers in the first group are no longer authorized:

transmitting a second key, different from the first key, from the key variable loader to the communication device through the second short range connection connecting the communication device and the key variable loader for use in securing subsequent wireless communications between subscribers in the first group; and

transmitting the particular list of currently authorized subscribers of the first secure group out of the plurality of lists of secure groups maintained at the key variable loader to the communication device, modified so as to remove the one or more subscribers from the particular list; and

at the communication device, further transmitting the first key to at least some subscribers set forth in the particular list of currently authorized subscribers of the first secure group, as modified, over the wireless connection for use in securing subsequent wireless communications between currently authorized subscribers in the first group.