Motorola Corporation

Motorola Solutions, Inc.

Dennis R Newkirk

Daniel J McDonald

Scott James Pappas

Hans Christopher Sowa

David J Chater-Lea

Walter F Anderson

Jason J Johur

Randy Kremske

Glen B Walton

Leslie G Gustafson

Richard J Bitter

Chris A Kruegel

James E Eastwood

Ryan P Ziolko

Obaid Shahab

Jamillah G Davis

Glenn Brian Walton

A plurality of encryption keys is generated, and each encryption key is associated with one geographical area of a plurality of geographical areas. Each encryption key is forwarded to one or more base stations in the geographical area associated with the encryption key. At least one of the plurality of geographical areas that is adjacent to a first geographical area is determined, yielding one or more adjacent geographical areas, and an encryption key for at least one of the one or more adjacent geographical areas is forwarded to at least one base station covering the first geographical area.

Method and apparatus for storing and distributing encryption keys

Application service is provided for a subscriber unit (SU), employing a first protocol, in a communication network employing a second protocol. The method includes receiving a CAI OTAR message from the SU. The CAI OTAR message includes at least a key management message (KMM) and a CAI header of the SU. The method then includes determining that the first protocol employed by the SU is different from the second protocol associated with the communication network based on the received CAI OTAR message. The method further includes creating a key management message (KMM) preamble, associated with the second protocol, based on at least one of the CAI header and configuration information of the SU, and creating a data link independent (DLI) OTAR message associated with the second protocol. The DLI OTAR message includes the received KMM. The method finally includes encapsulating the DLI OTAR message with the created KMM preamble, and sending the encapsulated DLI OTAR message to a key management facility (KMF) unit operating at a second protocol.

Method and apparatus for providing application service between a first protocol and a second protocol

A home location register stores key material related to mobile stations associated with the home location register. A first visited location register associated with a first site in a first zone stores key material related to a first mobile station of the mobile stations associated with the home location register. When the first mobile station roams to a second site in a second zone associated with a second visited location register, the key material related to the first mobile station is encrypted with an interkey, yielding encrypted key material, wherein the interkey is used only by infrastructure system devices other than a mobile station for encrypting at least the key material for transport between at least the first and second zones. The encrypted key material is forwarded to the second visited location register.

The application discloses a method and apparatus for providing interoperability for a mobile subscriber unit (MSU), employing a first protocol e.g., SCEP, with a packet-data subsystem operating at a second protocol e.g., SNDCP. The method includes determining that the first protocol employed by the MSU is different from the second protocol operated by the packet data subsystem. The method then includes creating a context information for the MSU when the determined first protocol is different from the second protocol. Further, the method includes determining a header associated with the second protocol based on the created context information and then receiving at least one data packet associated with the first protocol from the MSU. The method then encapsulates the at least one data packet with the determined header associated with the second protocol. The method then transmits the at least one encapsulated data packet to the communication network through a context manager.

Method and apparatus for providing interoperability between a first protocol and a second protocol

A first infrastructure system device other than a mobile station generates key material and forwards the key material to a second infrastructure system device other than a mobile station. A determination is made as to whether a mobile station for which the key material is directed is active on the system, and if so the key material is forwarded to a base station where the mobile station is active. The base station forwards the key material to the mobile station.

A first infrastructure system device other than a mobile station generates an encryption key and encrypts the encryption key with a first intrakey associated with a first zone that includes a second infrastructure system device other than a mobile station, yielding a first encrypted encryption key. The first intrakey is used only by infrastructure system devices other than a mobile station for encrypting at least the encryption key prior to transport within the first zone. The first infrastructure system device forwards the first encrypted encryption key to the second infrastructure system device.

A method includes receiving an authentication request from a mobile station () and determining whether to forward the request to an authentication agent. When it is determined to forward the request, the request is forwarded to the authentication agent (). A random number and a random seed are received from the authentication agent (). The random number and the random seed are forwarded to the mobile station (). A response to the random number and the random seed from the mobile station () is received and forwarded to the authentication agent (). The authentication agent () compares the response with an expected response. When the authentication agent () authenticates the mobile station (), a derived cipher key is received from the authentication agent ().

Method and apparatus for providing authentication in a communication system

A method of key distribution includes generating, by a first system device (), key material and forwarding the key material from the first system device () to a second system device (). It is determined whether a mobile station (), for which the key material is directed, is active on the system. When the mobile station is active, the key material is forwarded to a base station () where the mobile station () is active, and the base station () forwards the key material to the mobile station ().

When a roaming communication unit () requires an updated encryption key to ensure continued secure communications with other communication units of its home system, it transmits a rekey request to a base site () for the system () in which it has a presence. The latter provides the rekey request to a key management facility () for that system. This key management facility, in turn, provides the rekey request to the key management facility () for the roaming communication unit's home system (). The latter then forwards a rekeying message that includes a rekeying encryption key to the roaming communication unit () with the second system's key management facility () acting as an intermediary. In a preferred embodiment, the rekey message is encrypted using an encryption key that is presently available to the roaming communication unit but not to the second system's key management facility. Therefore, although the latter acts as an intermediary to facilitate the rekeying process, the latter is not able to decrypt the rekeying message and thereby gain access to the encryption key or keys of the roaming communication unit's home system.

Growing community of inventors

Lake Barrington, IL, United States of America

Dennis R Newkirk