Lucent Technologies Inc.

Alcatel Lucent

Alcatel-lucent USA Inc.

Alcatl-lucent USA Inc.

Robert J Rance

Semyon B Mizikovsky

Daniel Nelson Heer

Mark Howard Etzel

Robert Joseph McNelis

R Dale Shipp

Robert John Frank

David P Maher

Adam L Berenzweig

David Faucher

Donald J Youtkus

Steven Anthony Falco

Winston Edward Pekrul

Cecil A Dean

Joshua L Cohen

Vance Eugene Poteat

Simon B Mizikovsky

Thomas L Du Breuil

The present invention provides a method of operating a mobile unit in a wireless communication system. Embodiments of the method may include providing access request message(s) including information indicative of a first counter and a message authentication code formed using a first key. The first key is derived from a second key and the first counter. The second key is derived from a third key established for a security session between the mobile unit and an authenticator. The first counter is incremented in response to each access request provided by the mobile unit.

Method of providing fresh keys for message authentication

The present invention provides a method of cryptographic synchronization. The method may include providing information indicative of a first counter to a first one of a plurality of base stations. The first counter is incremented prior to each message transmitted to each of the plurality of base stations. The method may also include authenticating at least one first message received from the first one of the plurality of base stations in response to providing the information indicative of first counter.

Method of cryptographic synchronization

The present invention provides a method of wireless communication involving at least one first base station associated with a first access serving network and at least one second base station associated with a second access serving network is provided. The method may include generating a first key associated with the first access serving network and the second base station, receiving information indicating that the first key is temporary, and establishing a communication link with the second base station using the first key.

Method for distributing security keys during hand-off in a wireless communication system

The present invention provides a method for communication involving a supplicant, an authenticator, and an authentication server having an established security association based on a first key. The supplicant and the authenticator also have an established security association based on a second key. The method may include modifying the second key using the first key in response to determining that a challenge response from the supplicant is valid.

Method for refreshing a pairwise master key

Methods and apparatus for enhanced CMEA, or ECMEA, processing. A forward ECMEA and a reverse ECMEA process are provided. The forward ECMEA process decrypts text encrypted by the reverse ECMEA process and the reverse ECMEA process decrypts text encrypted by the forward ECMEA process. The forward ECMEA process employs a first transformation, an iteration of the CMEA process, and a second transformation. The reverse ECMEA process employs a first inverse transformation, an iteration of the CMEA process, and a second inverse transformation. The transformations and inverse transformations, and the iterations of the CMEA process, employ secret offsets to improve security. The transformations and the iteration of the CMEA process also employ an enhanced tbox function using an involutary lookup table.

Methods and apparatus for enhanced CMEA including a CMEA iteration preceded and followed by transformations and employing an involuntary lookup

The secure management of encryption keys is obtained by preventing external access thereto and ensuring that the keys do not leave an encryption unit in their original form. This result is obtained via a facility which (a) generates a unique device encryption key and at least one program encryption key, (b) encrypts the program encryption key using the device encryption key, and (c) stores the result in local memory. Thereafter, responsive to receipt of an indication to encrypt data, the program encryption key is retrieved from memory and is decrypted using the unique device encryption key. The data is then encrypted using the decrypted program encryption key and the encrypted data is stored in a server for distribution to a user who enters a request for the data. When there is a need to transport the latter key to another element, then the program key is encrypted using a symmetrical encryption key that the facility shares with the other element and the result is supplied to that element. The element then decrypts the encrypted program key using its own version of the symmetrical key.

Data encryption key management system

A self-inverting enhanced CMEA encryption system suitable for use in wireless telephony. An unprocessed text message is introduced into the system and subjected to a first iteration of a CMEA process, using a first CMEA key to produce a first intermediate message, a first intermediate processed text message, a first intermediate ciphertext message or the like. The first intermediate processed text message is subjected to a further iteration of the CMEA process, using a second CMEA key, to produce a second intermediate processed text message. The second intermediate processed text message is subjected to a final iteration of the CMEA process, using the first CMEA key, to produce the final processed text message. Security may be additionally enhanced by subjecting each message to an input/output transformation before and after each iteration of the CMEA process. In a three-iteration process, a total of four input/output transformations are used with the first and fourth input/output transformations being identical, and with the second and third input/output transformations being identical.

Methods and apparatus for self-inverting multiple-iteration CMEA crypto-processing for improved security for wireless telephone messages

Methods and apparatus for enhanced CMEA, or ECMEA, processing. A forward ECMEA and a reverse ECMEA process are provided. The forward ECMEA process decrypts text encrypted by the reverse ECMEA process and the reverse ECMEA process decrypts text encrypted by the forward ECMEA process. The forward ECMEA process employs a transformation, an iteration of the CMEA process, and an inverse transformation. The reverse ECMEA process employs a reverse transformation, an iteration of the CMEA process, and a reverse inverse transformation. The transformations and inverse transformations, and the iteration of the CMEA process, employ secret offsets to improve security. The transformations and the iteration of the CMEA process also employ an enhanced tbox function using an involutary lookup table.

Methods and apparatus for enhanced CMEA employing enhanced transformations

Disclosed is an encrypting speech processor architecture that provides enhanced security without the use of external cryptosync and with minimal speech degradation. This is accomplished by incorporating a block encryptor and a keystream generator (instead of a fixed secret mask encryption scheme, such as those implemented in voice ciphers) for encrypting blocks of encoded speech bits at a transmitter side. The block encryptor employs an invertible cryptographic algorithm and internal cryptosync to convert a first block of encoded speech bits into a first ciphertext block. The first ciphertext block is used to generate a keystream, which is then used to encrypt a second ciphertext block.

Encrypting speech coder

An enhancement to the use of a tbox function for CMEA encryption. Offsets are generated for application of the tbox function to a message, using secret values and previously encrypted message octets. The offsets are used to permute the message for application of the tbox function. For the first message of a call, the previously encrypted message octets are replaced by an initialization value. In a system employing a single iteration of CMEA encryption, first and second offsets are generated. In a system employing two iterations of CMEA encryption, first, second, third and fourth offsets are generated, with the first and second offsets being used in the first iteration of CMEA encryption and the third and fourth offsets being used in the second iteration of CMEA encryption.

Methods and apparatus for enhanced security expansion of a secret key into a lookup table for improved security for wireless telephone messages

The specification relates to the encryption of data transmitted over a broadband multiple access bi-directional hybrid fiber/coax (HFC) network. The method supports downstream broadcast encryption from headend to cable modem, and also provides for encryption of transmissions from cable modems back to the headend. Although the present invention is described in relation to an HFC network, it is also equally applicable to a cellular wireless communications environment or any other digital broadcast medium. The invention is implemented in two subdivisions, a slow but secure software encrypting algorithm, and a fast but less secure hardware encrypting algorithm. The combination produces the security of the software subdivision, with the encrypting speed of the hardware subdivision. The encryption method and apparatus supports the various access and transmission modes, such as STM, ATM, and VL. The present invention utilizes a virtual random number generator at the individual cable modems to reduce cable modem hardware. The authentication and key generation process between headend and cable modem produces a mutually authenticated and mutually generated permanent key. The present invention features a cryptosync clock at the headend which is transmitted to individual cable modems as a broadcast clock, thus eliminating a need for a clock at each cable modem.

Encrypting method and apparatus enabling multiple access for multiple

The generation of electronic identifiers for network interface units connected to a data network for use in detecting unauthorized decryption of encrypted data transmitted over the data network. A random number is generated for use as a private key decryption code and is stored in memory in each network interface unit. A public key is calculated from the stored private key using a non-invertible mathematical formula. If the calculated public key is unique, then a portion of the public key (e.g. a subset of its bits) is stored in a data provider database as an electronic identifier for use in detecting unauthorized decryption of data by the interface unit.

Growing community of inventors

Andover, MA, United States of America

Robert J Rance