System and method of reducing encryption overhead by concatenating multiple connection packets associated with a security association

• US 9,906,627 B2
• Filed: 06/03/2009
• Issued: 02/27/2018
• Est. Priority Date: 06/03/2008
• Status: Active Grant

• Current Assignee: Samsung Electronics Co. Ltd.
• Original Assignee: Samsung Electronics Co. Ltd.
• Inventors: Anil, Agiwal
• Primary Examiner(s): Nguyen, Thuong
• Application Number:
  US12/995,607
• Publication Number:
  US 20110145561A1
• Time in Patent Office: 3,191 Days
• Field of Search: 709206, 709246, 709231, 713186, 713150, 726 28
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 69/04 Protocols for data compression, e.g. ROHC

Abstract

A method and system for encryption is provided. The method includes detecting one or more security associations corresponding to data payloads in response to receipt of the data payloads from multiple source connections. Each data payload includes one or more data packets from each source connection. The method also includes concatenating the data payloads corresponding to each security association. Further, the method includes encrypting the concatenated data payloads for each security association. The system includes a determination module that detects one or more security associations corresponding to data payloads in response to receipt of the data payloads from multiple source connections and concatenates the data payloads corresponding to each security association. The system also includes an encryption module that encrypts the concatenated data payloads for each security association.

Claims

1. A method for transmitting data in a wireless communication system, the method comprising:

determining a plurality of payloads on multiple connections associated with a same security association;

concatenating the plurality of payloads associated with the same security association; and

encrypting the concatenated payload associated with the security association together in a Medium Access Control (MAC) Protocol Data Unit (PDU); and

transmitting a signal corresponding to the MAC PDU,

wherein the MAC PDU includes an integrity check value (ICV), and

wherein the plurality of payloads on multiple connections includes a first payload of a first connection and a second payload of a second connection.

2. The method of claim 1, further comprising:

generating security information for the concatenated payload; and

appending the security information to the concatenated payload.

3. The method of claim 1, further comprising at least one of:

generating a first PDU for the encrypted payload for each security association; and

generating a second PDU for the encrypted payloads for at least two security associations.

4. The method of claim 3, wherein the generating of the first PDU for the encrypted payload for each security association comprises generating a header for first PDU associated with each security association, and

wherein the generating of the second PDU for the encrypted payloads for at least two security associations comprises generating a header for the second PDU associated with at least two security associations.

5. The method of claim 4, wherein the generating of the header for the first PDU corresponding to each security association comprises:

determining connection identifiers associated with each connection corresponding to the security association;

determining lengths of the payloads associated with each connection corresponding to the security association; and

determining security information.

6. The method of claim 4, wherein the generating of the header for the second PDU corresponding to at least two security associations comprises:

determining connection identifiers associated with each connection corresponding to each security association;

determining lengths of the payloads associated with each connection corresponding to each security association; and

determining security information.

7. The method of claim 3, further comprising:

generating the header in combination with a generic media access control header (GMH) generated for one of the first and second PDUs; and

appending the header to the GMH.

8. The method of claim 3, further comprising:

generating an extended security header, wherein the extended security header comprises security information associated with the concatenated payload; and

appending the extended security header to one of the first and second PDUs.

9. The method of claim 1, wherein the encrypting of the concatenated payload is performed using Advanced Encryption Standard (AES) Counter with a Cipher block Chaining Message authentication code (CCM).

10. The method of claim 1, wherein the MAC PDU further includes a header indicating a length of the MAC PDU and each length of the plurality of payloads.

11. The method of claim 1, wherein the MAC PDU includes at least one MAC header that is applied to the plurality of payloads in common.

12. A method for receiving a signal in the wireless communication system, the method comprising:

receiving a signal corresponding to a Medium Access Control (MAC) Protocol Data Unit (PDU) including a concatenated payload, the concatenated payload including a plurality of payloads on multiple connections associated with a same security association;

determining if the concatenated payload is encrypted; and

decrypting the concatenated payload into the plurality of payloads on multiple connections in the MAC PDU using encryption information,

wherein the MAC PDU includes an integrity check value (ICV), and

wherein the plurality of payloads on multiple connections includes a first payload of a first connection and a second payload of a second connection.

13. The method of claim 12, further comprising:

delivering the decrypted payloads to the plurality of connections.

14. The method of claim 13, further comprising:

determining security information for the decrypted payloads; and

eliminating the security information to the decrypted payloads.

15. The method of claim 12, wherein the decrypted payloads are decrypted using Advanced Encryption Standard (AES) Counter with a Cipher block Chaining Message authentication code (CCM).

16. The method of claim 12, wherein the encryption information needed to decrypt the plurality of payload is present at a beginning of a first connection payload and at an end of a last connection payload.

17. The method of claim 12, wherein the MAC PDU further includes a header indicating a length of the MAC PDU and each length of the plurality of payloads.

18. The method of claim 12, wherein the MAC PDU includes at least one MAC header that is applied to the plurality of payloads in common.

19. An apparatus for transmitting a signal in the wireless communication system, the apparatus comprising:

a processor configured to execute one or more modules; and

a transmission module for transmitting a signal corresponding to a Medium Access Control (MAC) Protocol Data Unit (PDU),

wherein the one or more modules comprises;

a determination module for determining if a plurality of payloads on multiple connections are associated with a same security association; and

an encryption module for concatenating the plurality of payloads associated with the same security association and encrypting the concatenated payload associated with the security association together in the MAC PDU,

wherein the MAC PDU includes an integrity check value (ICV), and

wherein the plurality of payloads on multiple connections includes a first payload of a first connection and a second payload of a second connection.

20. The apparatus of claim 19, wherein the encryption module generates security information for the concatenated payload and appends the security information to the concatenated payload.

21. The apparatus of claim 19, wherein the encryption module performs at least one of:

generating a first PDU for the encrypted payload for each security association; and

generating a second PDU for the encrypted payloads for at least two security associations.

22. The apparatus of claim 21,

wherein the encryption module generates at least one of a header for the first PDU associated with each security association and generates a header for the second PDU associated with at least two security associations.

23. The apparatus of claim 22, wherein the encryption module performs at least one of:

generating the header in combination with a generic media access control header (GMH) generated for at least one of the first and second PDUs; and

appending the header to the GMH.

24. The apparatus of claim 21, wherein the encryption module generates an extended security header and appends the extended security header to at least one of the first and second PDUs, wherein the extended security header comprises security information associated with the concatenated payload.

25. The apparatus of claim 21, wherein the encryption module determines connection identifiers associated with each connection corresponding to the security association, determines lengths of the payloads associated with each connection corresponding to the security association, and determines security information.

26. The apparatus of claim 21, wherein the encryption module determines connection identifiers associated with each connection corresponding to each security association, determines lengths of the payloads associated with each connection corresponding to each security association, and determines security information.

27. The apparatus of claim 26, wherein the encryption information needed to decrypt the plurality of payload is present at a beginning of a first connection payload and at an end of a last connection payload.

28. The apparatus of claim 19, wherein the encryption module encrypts the concatenated payload using Advanced Encryption Standard (AES) Counter with a Cipher block Chaining Message authentication code (CCM).

29. The apparatus of claim 19, wherein the MAC PDU further includes a header indicating a length of the MAC PDU and each length of the plurality of payloads.

30. The apparatus of claim 19, wherein the MAC PDU includes at least one MAC header that is applied to the plurality of payloads in common.

31. An apparatus for receiving a signal in the wireless communication system, the apparatus comprising:

a processor configured to execute one or more modules,

wherein the one or more modules comprises;

a receiving module for receiving a signal corresponding to a Medium Access Control (MAC) Protocol Data Unit (PDU) including a concatenated payload, the concatenated payload including a plurality of payloads on multiple connections associated with a same security association; and

a decryption module for determining if the concatenated payload is encrypted and decrypting the concatenated payload into the plurality of payloads on multiple connections in the MAC PDU using encryption information, and

wherein the MAC PDU includes an integrity check value (ICV), and

wherein the plurality of payloads on multiple connections includes a first payload of a first connection and a second payload of a second connection.

32. The apparatus of claim 31, wherein the decryption module delivers the decrypted payloads to the plurality of connections.

33. The apparatus of claim 32, wherein the decryption module determines security information for the decrypted payloads and eliminates the security information to the decrypted payloads.

34. The apparatus of claim 32, wherein the decrypted payloads are decrypted using Advanced Encryption Standard (AES) Counter with a Cipher block Chaining Message authentication code (CCM).

35. The apparatus of claim 31, wherein the MAC PDU further includes a header indicating a length of the MAC PDU and each length of the plurality of payloads.

36. The apparatus of claim 31, wherein the MAC PDU includes at least one MAC header that is applied to the plurality of payloads in common.