Method and apparatus for security in a data processing system

• US 8,121,296 B2
• Filed: 08/20/2001
• Issued: 02/21/2012
• Est. Priority Date: 03/28/2001
• Status: Expired due to Term

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Hawkes, Philip, Rose, Gregory G., Hsu, Raymond T., Rezaiifar, Ramin
• Primary Examiner(s): SIMITOSKI, MICHAEL J
• Application Number:
  US09/933,972
• Publication Number:
  US 20020141591A1
• Time in Patent Office: 3,837 Days
• Field of Search: 713/171, 713/193, 713/194, 380/203, 380/210, 380/259, 380/273, 380/37, 380/281, 380/283, 380/278, 380/286, 379/120
• US Class Current: 380/283
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 12/1877 Measures taken prior to transmission
• CPC Class Codes: H04L 12/189 in combination with wireless systems selective distribution or broadcast in wireless communication networks H04W4/06
• CPC Class Codes: H04L 2209/601 Broadcast encryption
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/062 applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 2463/101 applying security measures for digital rights management data processing systems or methods, specially adapted for commerce, e.g. marketing, shopping, billing, auctions or e-commerce G06Q30/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/068 using time-dependent keys, e.g. periodically changing keys cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 65/1101 Session protocols
• CPC Class Codes: H04L 65/611 for multicast or broadcast systems for broadcast or conference H04L12/18; arrangements for broadcast or distribution combined with broadcast H04H20/00; arrangements for broadcast applications with a direct linkage to broadcast information or to broadcast space-time H04H60/00; selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS], H04W4/06
• CPC Class Codes: H04L 65/65 Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
• CPC Class Codes: H04L 65/70 Media network packetisation
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04L 69/04 Protocols for data compression, e.g. ROHC
• CPC Class Codes: H04L 69/16 : Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/161 : Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04L 69/164 : Adaptation or special uses of UDP protocol
• CPC Class Codes: H04L 69/22 : Parsing or analysis of headers
• CPC Class Codes: H04L 69/32 : Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
• CPC Class Codes: H04L 9/0891 : Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/30 : Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/40 : Network security protocols
• CPC Class Codes: H04W 12/03 : Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/041 : Key generation or derivation

Abstract

Method and apparatus for secure transmissions. Each user is provided a registration key. A long-time updated broadcast key is encrypted using the registration key and provided periodically to a user. A short-time updated key is encrypted using the broadcast key and provided periodically to a user. Broadcasts are then encrypted using the short-time key, wherein the user decrypts the broadcast message using the short-time key.

Claims

1. A method for secure transmissions, the method comprising:

determining a registration key specific to a mobile station participating in a transmission;

determining a first key;

encrypting the first key with the registration key;

sending the encrypted first key to the mobile station participating in the transmission;

determining a second key for decrypting content on a broadcast channel;

updating the first key after a first time period has elapsed; and

updating the second key after a second time period has elapsed, wherein the updated second key is determined based on two parts, a first part comprising the updated first key and a second part based on information sent on the broadcast channel, and wherein the first part and the second part are concatenated to determine the updated second key using a cryptographic function.

2. The method as in claim 1, wherein the second time period is less than the first time period.

3. The method as in claim 2, wherein updating the first key further comprises encrypting an updated first key with the registration key.

4. The method as in claim 3, further comprising:

calculating a registration key information message; and

transmitting the registration key information message.

5. The method as in claim 4, further comprising:

calculating a first key information message corresponding to the updated first key; and

transmitting the first key information message.

6. The method as in claim 5, further comprising:

determining a second key information message corresponding to the updated second key; and

transmitting the second key information message.

7. The method as in claim 2, further comprising:

encrypting a broadcast stream of information using the second key; and

transmitting the encrypted broadcast stream of information.

8. The method as in claim 7, wherein the broadcast stream of information comprises video information.

9. The method as in claim 7, wherein the broadcast stream of information comprises Internet Protocol packets.

10. The method as in claim 1, further comprising:

transmitting the encrypted first key.

11. The method as in claim 1, wherein the second part is further based on a time value.

12. The method as in claim 11, wherein the time value is not sent on the broadcast channel.

13. The method as in claim 1, wherein the updated second key is determined by applying a cryptographic hash function to the concatenation of the first and second parts.

14. A method for secure reception of a transmission, the method comprising:

receiving a registration key specific to a mobile station participating in a transmission;

receiving, at the mobile station, a first key encrypted with the registration key;

decrypting the first key with the registration key;

determining a second key using a cryptographic function and the first key, for decrypting content on a broadcast channel;

receiving a broadcast stream of information;

decrypting the broadcast stream of information using the second key;

receiving an updated first key after a first time period has elapsed; and

determining an updated second key after a second time period has elapsed, wherein the updated second key is determined based on two parts, a first part comprising the updated first key and a second part based on information sent on the broadcast channel, and wherein the first part and the second part are concatenated to determine the updated second key using a cryptographic function.

15. The method as in claim 14, further comprising:

storing the first key in a secure memory storage unit; and

storing the second key in a memory storage unit.

16. The method as in claim 14, further comprising:

recovering the updated first key from a first key information message; and

determining the updated second key using a second key information message.

17. The method as in claim 14, wherein the second part is further based on a time value.

18. The method as in claim 17, wherein the time value is not sent on the broadcast channel.

19. The method as in claim 14, wherein the updated second key is determined by applying a cryptographic hash function to the concatenation of the first and second parts.

20. In a wireless communication system supporting a broadcast service option, an infrastructure element comprising:

a receive circuitry adapted to receive a registration key specific to a mobile station participating in a transmission, receive a first key encrypted with the registration key, receive an updated first key after a first time period has elapsed, and receive a second part for updating a short-time key after a second time period has elapsed;

a user identification unit, operative to determine an updated short-time key for decrypting a broadcast message, wherein the short-time key is determined based on two parts, a first part comprising the updated first key and the second part based on information sent on the broadcast channel, and wherein the first part and the second part are concatenated to determine the updated short-time key using a cryptographic function, comprising;

processing unit operative to decrypt and to determine key information;

memory storage unit for storing a registration key; and

a mobile equipment unit adapted to apply the short-time key for decrypting the broadcast message.

21. The infrastructure element as in claim 20, wherein the short-time key is processed by the user identification unit and passed to the mobile equipment unit.

22. The infrastructure element as in claim 20, wherein the memory storage unit is a secure memory storage unit.

23. The infrastructure element as in claim 20, wherein the memory storage unit stores a broadcast access key comprising the first key, and wherein the processing unit determines the short-time key using the broadcast access key.

24. The infrastructure element as in claim 23, wherein the short-time key is updated at a first frequency.

25. The infrastructure element as in claim 24, wherein the broadcast access key is updated at a second frequency less than the first frequency.

26. The infrastructure element as in claim 20, wherein the broadcast service option is a video service.

27. The infrastructure element as in claim 20, wherein the second part is further based on a time value.

28. The infrastructure element as in claim 27, wherein the time value is not sent on the broadcast channel.

29. The infrastructure element as in claim 20, wherein the updated short-time key is determined by applying a cryptographic hash function to the concatenation of the first and second parts.

30. A wireless communication system, comprising:

means for determining a registration key specific to a mobile station participating in a transmission;

means for determining a first key;

means for encrypting the first key with the registration key;

means for sending the encrypted first key to the mobile station participating in the transmission;

means for determining a second key for decrypting content on a broadcast channel;

means for updating the first key after a first time period has elapsed; and

means for updating the second key after a second time period has elapsed, wherein the updated second key is determined based on two parts, a first part comprising the updated first key and a second part based on information sent on the broadcast channel, and wherein the first part and the second part are concatenated to determine the updated second key using a cryptographic function.

31. The wireless communication system as in claim 30, wherein the second part is further based on a time value.

32. The wireless communication system as in claim 31, wherein the time value is not sent on the broadcast channel.

33. The wireless communication system as in claim 30, wherein the updated second key is determined by applying a cryptographic hash function to the concatenation of the first and second parts.

34. An infrastructure element, comprising:

means for receiving a registration key specific to a mobile station participating in a transmission;

means for receiving a first key encrypted with the registration key;

means for decrypting the first key with the registration key;

means for determining a second key using a cryptographic function and the first key, for decrypting content on a broadcast channel;

means for receiving a broadcast stream of information;

means for decrypting the broadcast stream of information using the second key;

means for updating the first key after a first time period has elapsed; and

means for updating the second key after a second time period has elapsed, wherein the updated second key is determined based on two parts, a first part comprising the updated first key and a second part based on information sent on the broadcast channel, and wherein the first part and the second part are concatenated to determine the updated second key using a cryptographic function.

35. The infrastructure element as in claim 34, wherein the second part is further based on a time value.

36. The infrastructure element as in claim 35, wherein the time value is not sent on the broadcast channel.

37. The infrastructure element as in claim 34, wherein the updated second key is determined by applying a cryptographic hash function to the concatenation of the first and second parts.

38. A digital storage device storing instructions, said instructions comprising:

first set of instructions for receiving a registration key specific to a mobile station participating in a transmission;

second set of instructions for receiving a first key encrypted with the registration key;

third set of instructions for decrypting the first key with the registration key;

fourth set of instructions for determining a second key using a cryptographic function and the first key, for decrypting content on a broadcast channel;

fifth set of instructions for receiving the broadcast stream of information;

sixth set of instructions for decrypting the broadcast stream of information using the second key; and

seventh set of instructions for updating the first key after a first time period has elapsed, updating the second key after a second time period has elapsed, wherein the updated second key is determined based on two parts, a first part comprising the updated first key and a second part based on information sent on a broadcast channel, and wherein the first part and the second part are concatenated to determine the updated second key using a cryptographic function.

39. The digital storage device as in claim 38, wherein the second part is further based on a time value.

40. The digital storage device as in claim 39, wherein the time value is not sent on the broadcast channel.

41. The digital storage device as in claim 38, wherein the updated second key is determined by applying a cryptographic hash function to the concatenation of the first and second parts.