Motorola Corporation

Louis D Finkelstein

Daniel P Brown

Larry C Puhl

Jeffrey C Smolinske

Frank C Pennypacker

Mary B Flanders

Eugene J Bruckert

Ezzat A Dabbish

Jose Gutman

Jay R Krebs

Christopher L Clanton

Jennifer Ann Pierce

James Joseph Kosmach

Jeffrey T Klayman

Jim Wright

A system (100) and method of improving activation security allows a remote device (104) to identify that there is a difference between a first signal transmitted by a central site (102) and a first signal received by the remote device. A derived number is used. The derived number can be displayed to the user for verbal verification by the user, or the derived number can be used internally of the remote device, or the central site, for verification that is transparent to the user. A significant amount of security is added without substantially altering the communication protocol.

Communication method and device

An encryption apparatus and method generate a unique keystream output value for every frame of bearer traffic to provide encryption protection in a communications system. The keystream output value is generated from the following equations:

Apparatus for providing improved encryption protection in a

A processing system that is accessible via a number of speech transmission media. Access to the processing system may be made via a mobile radiotelephone, land line telephone, acoustic link or datalink. Access to programs, files and data is based upon the security of the communication media and authentication of the user.

System and method for securing speech transactions

The apparatus (101, 110) and method for authentication is provided by generating R and encrypting it using a selected algorithm K as the key in a primary station, encrypting the verification key, V using R as the key and encrypting the result using K as the key, transmitting both pieces of information (VAR1 and VAR3) to the secondary station (110), using K to decrypt VAR1 and VAR3 to obtain R and eventually V which is encrypted using R in the secondary station (110)verifying authenticity of the primary station (101) if the decrypted V matches the secret key portion of V that is stored at the secondary station (110).

Apparatus and method for authentication and session key exchange in a

Radio frequency based cellular telecommunication systems often require both subscriber units and communication units of a fixed network communication system to maintain secret data which may be used to verify authenticity as well as provide encrypting variables for message encryption processes. An efficient real-time authentication method and apparatus are provided which use a single message to provide authentication and communication link setup information. Further, an authentication method and apparatus are provided which uses instant-specific information such as a time of day, radio frequency carrier frequency, a time slot number, a radio port number, access manager identifier, a radio port control unit identifier, or a base site controller identifier to enhance the reliability of the authentication process. Furthermore, a method and apparatus are provided for maintaining secure packet data communications through an encryption process by utilizing a packetized message encryption key and a unique packet number as encryption variables.

Method and apparatus for efficient real-time authentication and

A method and apparatus for authenticating a roaming subscriber. In a preferred embodiment, a subscriber receives a challenge that is in a format of a local authentication protocol, and determines whether the local authentication protocol is the subseriber's home system authentication protocol. If it is not, the subscriber converts the challenge into a format (e.g., bit length) compatible with its home system authentication protocol, and processes the converted challenge with the subscriber's secret key and authentication algorithm into an authentication response. The authentication response is converted to be compatible with the local authentication protocol, and transmitted to a local system communication unit. The challenge and response is then forwarded to the subscriber's home system for similar conversion and processing, and subscriber's response is compared against a home system generated response.

Method and apparatus for authentication in a communication system

A method and apparatus for authentication between a subscriber unit and a communication unit is provided. The authentication process includes: maintaining an historic non-arbitrary value in the subscriber unit, generating an authentication message in the subscriber unit as a function of at least part of the historic non-arbitrary value, and transmitting the authentication message to the communication unit. In addition, the authentication process includes: receiving an authentication message at a communication unit, maintaining an historic non-arbitrary value in the communication unit, and determining, in the communication unit, through the use of the received authentication message and the maintained historic non-arbitrary value, whether a received service request is authentic. In another embodiment, the authentication process includes: providing the subscriber unit with at least part of a plurality of dialed digits which uniquely identify a target communication unit, generating an authentication message in the subscriber unit as a function of the at least part of the plurality of dialed digits, and transmitting the authentication message and the at least part of the plurality of dialed digits from the subscriber unit to the communication unit. In addition the other embodiment authentication process includes: receiving an authentication message and at least part of a plurality of dialed digits which uniquely identifies a target communication unit, the authentication message being derived from the received dialed digits, and determining in the communication unit, through the use of the received authentication message and the received dialed digits, whether a received service request is authentic.

Method for authentication and protection of subscribers in

Blind access (100, 300, 400) to a desired encryption key of a predetermined first group member is provided to a second group. The first group encrypts a plurality of first group member encryption keys using a predetermined algorithm and transfers to the second group, the encrypted plurality of first group member encryption keys with corresponding unencrypted first group member identification fields, IDs, and a list of IDs corresponding to the first group members. The desired ID-free encryption key is selected and encrypted by the second group using a predetermined algorithm. The doubly encrypted key is transferred to the first group, decrypted by the first group and transferred to the second group for decryption. Thus, the encryption key is provided without knowledge to the first group of which member's encryption key is being examined and with knowledge to the second group of only the desired encryption key.

Method for providing blind access to an encryption key

A method and apparatus for authenticating a roaming subscriber. In a preferred embodiment, a subscriber receives a challenge that is in a format of a local authentication protocol, and determines whether the local authentication protocol is the subscriber's home system authentication protocol. If it is not, the subscriber converts the challenge into a format (e.g., bit length) compatible with its home system authentication protocol, and processes the converted challenge with the subscriber's secret key and authentication algorithm into an authentication response. The authentication response is converted to be compatible with the local authentication protocol, and transmitted to a local system communication unit. The challenge and response is then forwarded to the subscriber's home system for similar conversion and processing, and subscriber's response is compared against a home system generated response.

A communication system (100) employs a method of messaging between a subscriber unit (105) and an infrastructure communication center (101). A messaging key associated with a subscriber unit reference number is provided (203, 403) to the subscriber unit (105) and to the infrastructure communication center (101). An authentication key and/or an identifier for the subscriber unit (105) is then produced (300, 407) by either the subscriber unit (105) or the infrastructure communication center (101). The authentication key and/or the identifier is encrypted (207, 413) with the messaging key and is subsequently communicated (209, 415) between the subscriber unit (105) and the infrastructure communication center (101).

Method of messaging in a communication system

A method of secure key distribution in a communication system having a plurality of subscriber units and an infrastructure communication center is provided. A first subscriber unit sends a request to the infrastructure communication center for a secure communication link with a second subscriber unit. This request includes an encrypted session encryption key which was encrypted with a first subscriber registration key. The infrastructure communication center decrypts the encrypted session encryption key with the first subscriber registration key. Subsequently, the infrastructure communication center re-encrypts the session encryption key with a second subscriber registration key. This re-encrypted session encryption key is sent to the second subscriber unit. In an alternative method, the first subscriber unit and the infrastructure communication center a priori know a session key. Therefore, the infrastructure communication center only needs to encrypt and send the session encryption key to the second subscriber unit, in response to a request by the first subscriber unit.

Method for key management of point-to-point communications

A method and apparatus for generating a pseudo-random bit sequence is provided. A first input bit is determined as a function of bits stored in a shift register in accordance with a first feedback algorithm. In addition, a second input bit is determined as a function of bits stored in the shift register in accordance with a second feedback algorithm. Subsequently, a particular input bit to be provided to the shift register is deterministically selected from the group consisting of the first input bit and the second input bit such that a non-linear pseudo random sequence may be produced by the shift register. In addition, a communication unit which utilizes the pseudo-random bit sequence in encrypting a signal to be transmitted and decrypting a received signal is described.

Method and apparatus for encryption having a feedback register with

A method and apparatus for providing cryptographic protection of a data stream are described in accordance with the Open Systems Interconnection (OSI) model for a communication system. This cryptographic protection is accomplished on the transmitting side by assigning a packet sequence number to a packet derived from a data stream received from a network layer. Subsequently, a transmit overflow sequence number is updated as a function of the packet sequence number. Then, prior to communicating the packet and the packet sequence number on a physical layer, the packet is encrypted as a function of the packet sequence number and the transmit overflow sequence number. On the receiving side, the packet sequence number is extracted from the physical layer. In addition, a receive overflow sequence number is updated as a function of the packet sequence number. Finally, the encrypted packet is decrypted as a function of the packet sequence number and the receive overflow sequence number. In addition, a transmitting and a receiving communication unit for use in a communication system which includes cryptographic protection of a data stream is described.

Growing community of inventors

Wheeling, IL, United States of America

Louis D Finkelstein