Motorola Solutions, Inc.

Motorola Corporation

Chris A Kruegel

Thomas J Senese

Timothy Woodward

Andrzej Grzesik

Steven K Turner

Michael W Bright

Grzegorz Gustof

Hans Christopher Sowa

Stefan Lukasz Koprowski

Stuart James Boutell

Anthony R Metke

Michael F Korus

Dipendra M Chowdhary

Scott James Pappas

Shanthi E Thomas

Katrin Reitsma

David J Chater-Lea

Mark Shahaf

Wojciech Jan Kucharski

Harish Natarahjan

Leslie G Gustafson

Dennis R Newkirk

Kenneth C Fuchs

Brian W Pruss

Michael C Petrie

Ryan P Ziolko

Gary P Hunsberger

Obaid Shahab

Pawel Fafara

Richard J Bitter

Kristian Gronkjaer Pedersen

Larry Murrill

Marcin Tomasik

Jakub Trojanek

Elizeusz Musial

Chi Fai Sze

Konrad Papierz

Timothy G Woodward

Morten Kaehler

A process of redacting records based on a contextual correlation with a previously redacted record. In operation, an electronic computing device obtains redaction metadata associated with a previously redacted record and uses the redaction metadata to identify a segment within an unredacted record that was redacted to generate the previously redacted record. The device then processes the segment to detect characteristics of a person or the object captured in the unredacted record and further redacted in the redacted record. The device also determines a context in which the redacted person or object was captured within the segment of the unredacted record. The device then redacts a person or object captured in other unredacted records when such person or object is contextually related to the redacted person or object captured in the unredacted record corresponding to the previously redacted record.

Device and method for redacting records based on a contextual correlation with a previously redacted record

Systems and methods for authenticating public key infrastructure certificate enrollment using certificate entitlement licenses. One example system includes a device manager including an electronic processor. The electronic processor is configured to receive a request for software for an electronic device including a unique electronic device identifier. The electronic processor is configured to determine, based on the request, whether the electronic device is entitled to participate in a certificate management service. The electronic processor is configured to, responsive to determining that the electronic device is entitled to participate in a certificate management service, transmit a certificate entitlement license request including the unique device identifier to a certificate entitlement license manager. The electronic processor is configured to receive, from the certificate entitlement license manager, a certificate entitlement license for the unique device identifier. The electronic processor is configured to deliver the certificate entitlement license based on the unique device identifier.

Certificate entitlement licenses for authenticating public key infrastructure certificate enrollment

A process of extending retention periods of records. In operation, an electronic computing device identifies a retention period associated with the record. The device obtains information related to a future event. The information includes a time period during which the future event is predicted or scheduled to occur and a location at which the future event is predicted or scheduled to occur. When the device determines that the record is contextually related to the future event based at least in part on the time period or the location of the future event, the retention period associated with the record is extended. The device may also automatically extend retention periods of records based on a number of other retention-related factors associated with the record including recording content, record trustworthiness, recording time, recording location, recording data type, recording source, recording officers' profile and their association, crime statistics, incident severity, and the like.

Device and method for extending retention periods of records

A system and process for performing a touchless key provisioning operation for a communication device. In operation, a key management facility (KMF) imports a public key and a public key identifier uniquely identifying the public key of the communication device. The public key is associated with an asymmetric key pair generated at the communication device during its factory provisioning and configuration. The KMF registers the communication device and assigns a key encryption key (KEK) for the communication device. The KMF then provisions the communication device by deriving a symmetric touchless key provisioning (TKP) key based at least in part on the public key of the communication device, encrypting the KEK with the symmetric TKP key to generate a key wrapped KEK, and transmitting the key wrapped KEK to the communication device for decryption by the communication device.

Touchless key provisioning operation for communication devices

A mobile device and method are provided that allow for registering the mobile device using a machine readable optical label. The mobile device receives a machine readable optical label, such as a QR code or a bar code. The machine readable optical label includes authentication data and security information. The mobile device scans machine readable optical label to read the authentication data and the security information. The mobile device validates the machine readable optical label and generates certificate request, the certificate request digitally signed using the authentication data and the security information. The mobile device transmits the certificate signing request to a registration authority.

Method of utilizing a trusted secret package for certificate enrollment

A method and apparatus is provided for updating certificates in a trust chain and managing versions of the trust chain. A first electronic processor determines that a first certificate in a first level of the trust chain is to be updated, updating the first certificate and each certificate in a lower level in the trust chain that is lower than the first level, creates a second version of the trust chain including an updated first certificate and an updated certificate at each lower level in the trust chain, and transmits the second version of the trust chain to one or more entities.

Lifecycle management method and apparatus for trusted certificates and trust chains

A method and Key Management Facility (KMF) for managing keys of a single user having a plurality of devices is provided. The KMF receives an Over-The-Air Rekeying (OTAR) message relating to a first device and including an interworking bit. If the interworking bit is set, the KMF retrieves a main source RSI and a Sub-RSI field from the OTAR message. If the main source RSI matches other main source RSIs from other devices, the KMF manages keys for all devices that have the same main source RSI in an identical manner.

Method and key management facility for managing keys of a single user having a plurality of mobile devices

A method, mobile device, and PKI are provided for enrolling a mobile device into a PKI domain for certificate management is provided. A first asymmetric key pair and a unique identifier is established in a device. The first asymmetric key pair includes a public key and a private key. The public key and the unique identifier are transferred to the PKI domain. The public key and the unique identifier are imported into the PKI domain. The device generates a second asymmetric kay pair and sends a certificate signing request (CSR) that is protected with the digital signature of the first asymmetric key pair. The CSR is transferred to the PKI domain. The PKI domain authenticates the CSR using the first public key and the unique identifier. Upon validation, the PKI domain issues a certificate to the device.

Method of enrolling a device into a PKI domain for certificate management using factory key provisioning

Method and management server for revoking group server identifiers of compromised group servers. One method includes determining, with a management server, an identity-based cryptographic signing key based on a group server identifier. The method also includes distributing, via the management server, the identity-based cryptographic signing key to a group server. The method further includes receiving, at the management server, a security status indicating that the security of the group server is compromised. The method also includes, responsive to receiving the security status, distributing, via the management server, a revocation of the group server identifier to a plurality of communication devices.

Method and management server for revoking group server identifiers of compromised group servers

Disclosed is a radio system, method, and device for a mobile station to indicate to an authentication controller, in an authentication response message, which of a plurality of group key link layer encryption keys (GKEK)s it currently has in its possession, and to work with the authentication controller to more intelligently manage multiple GKEKs. The authentication controller can use the information obtained from the authentication response message to determine which of a plurality of GKEKs to advertise in a key announcement broadcast. Furthermore, individual requests for a future LLE key (LEK) to be used for link layer encryption (LLE) encrypting and decrypting inbound and outbound group communications between base station(s) and mobile station(s) are responded to with a broadcast GKEK-encrypted transmission including the future LEK. Only the requesting mobile station transmits an acknowledgment packet in response to the broadcast.

Method and device for managing encrypted group rekeying in a radio network link layer encryption system

A radio is authenticated at the site and unique authentication information for the radio is stored at the site. A subsequent non-authentication message from the radio is received at the site and authentication information in the non-authentication message is identified. The unique authentication information stored at the site is compared with authentication information identified in the non-authentication message. If there is a match, the non-authentication message is authenticated with an authentication code included in the non-authentication message, wherein a predefined portion of the authentication code is obtained from at least one of a header portion or a data portion of the non-authentication message. Upon successfully completing authentication, the site repeats the non-authentication message towards destination radios indicated in non-authentication message.

Method and apparatus for authenticating a digital certificate status and authorization credentials

A method for operating with KMFs includes a communication device having a memory device: receiving a designation of a primary KMF for the communication device, wherein only one primary KMF is designated for the communication device at any given time instance; receiving a designation of a secondary KMF for the communication device; storing, within the memory device, a first and a second set of crypto groups, wherein each crypto group within each set of crypto groups comprises at least one keyset, wherein each set of crypto groups is associated, within the memory device, to only one KMF identifier; associating, within the memory device, the first set of crypto groups to an identifier for the primary KMF; and associating, within the memory device, the second set of crypto groups to an identifier for the secondary KMF.

Method for a communication device to operate with multiple key management facilities

Application service is provided for a subscriber unit (SU), employing a first protocol, in a communication network employing a second protocol. The method includes receiving a CAI OTAR message from the SU. The CAI OTAR message includes at least a key management message (KMM) and a CAI header of the SU. The method then includes determining that the first protocol employed by the SU is different from the second protocol associated with the communication network based on the received CAI OTAR message. The method further includes creating a key management message (KMM) preamble, associated with the second protocol, based on at least one of the CAI header and configuration information of the SU, and creating a data link independent (DLI) OTAR message associated with the second protocol. The DLI OTAR message includes the received KMM. The method finally includes encapsulating the DLI OTAR message with the created KMM preamble, and sending the encapsulated DLI OTAR message to a key management facility (KMF) unit operating at a second protocol.

Method and apparatus for providing application service between a first protocol and a second protocol

Methods and systems for LLE encrypting and decrypting voice message streams (VMSs) already supporting eTe encryption are disclosed. In one example, LLE and eTe encryption initialization vectors (EIVs) are interleaved such that an LLE EIV retrieved from one of a header and a data unit is used to LLE decrypt both the header or data unit and a subsequent data unit. A recovered eTe EIV is used to eTe decrypt voice payloads in one or more subsequent data units. In another example, a base station dynamically LLE encrypts a VMS already supporting eTe encrypting by determining whether a received VMS is eTe encrypted, and ii it is not generating a new LLE EIV, and if it is, re-using the pre-existing eTe EIV for LLE encryption. The LLE encrypted (and perhaps eTe encrypted) VMS is then sent over the air to one or more mobile stations.

Growing community of inventors

Plainfield, IL, United States of America

Chris A Kruegel