Securing method for lawful interception

Patent metadata

Field	Value
Publication number	US-9467283-B2
Application number	US-201313925299-A
Country	US
Kind code	B2
Filing date	Jun 24, 2013
Priority date	Jun 24, 2013
Publication date	Oct 11, 2016
Grant date	Oct 11, 2016

Abstract

A method is presented for secure communication, the method including generating a signature using a private key, a nonce, and at least one of an identifier and a key component; and transmitting the signature, the nonce, a security parameter, and the at least one of the identifier and the key component, wherein the security parameter associates a user identity with a public key, the public key being associated with the private key.

First claim

The invention claimed is:

1. A method, by an electronic device, for secure communication with at least one other electronic device, the method comprising:
generating, by a processor of the electronic device, a signature using a private key, a nonce, and at least one of an identifier and a key component;
transmitting, by the processor, the signature, the nonce, a security parameter, and the at least one of the identifier and the key component, wherein the security parameter associates a user identity with a public key, the public key being associated with the private key;
receiving, by the processor, based on the transmitting, session security data generated by the at least one other electronic device; and
establishing, by the processor, a secure communication session with the at least one other electronic device based on at least the session security data.

2. The method of claim 1 , wherein the identifier is one of an International Mobile Station Equipment Identity (IMEI), a Globally Routable User Agent URI (GRUU), an International Mobile Subscriber Identity (IMSI), and a Temporary International Mobile Subscriber Identity (TIMSI).

3. The method of claim 1 , wherein the nonce is one of a timestamp, a random number, and a sequence number.

4. The method of claim 1 , wherein the security parameter is a certificate.

5. The method of claim 1 , further comprising:
generating the key component using a master key, the nonce, and a known elliptic curve point.

6. The method of claim 1 , wherein the transmitting step further comprises:
transmitting the signature and the public key.

7. The method of claim 1 , wherein the session security data comprises a second nonce, at least one of a second identifier and a second key component, a second security parameter, and a second signature that was generated using a second private key, the second nonce, and the at least one of the second identifier and the second key component, and
wherein establishing the secure communication session comprises
verifying the second nonce and the at least one of the second identifier and the second key component using the received second signature and the second security parameter, wherein the second security parameter associates a second user identity with a second public key, the second public key being associated with the second private key; and
generating a session key using the at least one of the second identifier and the second key component, when verification is successful in the verifying step.

8. A method, by an electronic device, for secure communication with at least one other electronic device, the method comprising:
receiving, by a processor of the electronic device, a nonce, at least one of an identifier and a key component, a security parameter, and a signature that was generated using a private key, the nonce, and the at least one of the identifier and the key component;
verifying, by the processor, the nonce and the at least one of the identifier and the key component using the received signature and the security parameter, wherein the security parameter associates a user identity with a public key, the public key being associated with the private key; and
establishing, by the processor, a secure communication session with the at least one other electronic device based on at the at least one of the identifier and the key component that has been verified.

9. The method of claim 8 , further comprising, when verification is successful in the verifying step:
generating a session key using the at least one of the identifier and the key component.

10. The method of claim 8 , further comprising, when verification is successful in the verifying step:
generating a second signature using a second private key, a second nonce, and at least one of a second identifier and a second key component; and
transmitting the second signature, the second nonce, a second security parameter, and the at least one of the second identifier and the second key component, wherein the second security parameter associates a second user identity with a second public key, the second public key being associated with the second private key.

11. A method, by an electronic device, for secure communication with at least one other electronic device, the method comprising:
generating, by a processor of the electronic device, a MAC tag using a MAC key, a nonce, and a key component generated by the electronic device based on private key information associated with the electronic device and a publicly known elliptic curve point; and
transmitting, by the processor, the MAC tag, the nonce, and the key component;
receiving, by the processor, based on to the transmitting, session security data generated by the at least one other electronic device; and
establishing, by the processor, a secure communication session with the at least one other electronic device based on at least the session security data.

12. The method of claim 11 , wherein the MAC tag is further generated using an identifier, wherein the identifier is one of an International Mobile Station Equipment Identity (IMEI), a Globally Routable User Agent URI (GRUU), an International Mobile Subscriber Identity (IMSI), and a Temporary International Mobile Subscriber Identity (TIMSI).

13. The method of claim 11 , wherein the nonce is one of a timestamp, a random number, and a sequence number.

14. A method, by an electronic device, for secure communication with at least one other electronic device, the method comprising:
receiving, by a processor of the electronic device, a nonce, a key component, and a MAC tag that was generated by the at least one other electronic device using the nonce, the key component, and a MAC key, wherein the key component was generated by the at least one other electronic device based on private key information associated with the at least one other electronic device and a publicly known elliptic curve point;
verifying, by the processor, the nonce and the key component using the received MAC tag; and
establishing, by the processor, a secure communication session with the at least one other electronic device based on at least the key component that has been verified.

15. An apparatus for secure communication with at least one other apparatus, comprising:
a processing circuit configured to generate a signature using a private key, a nonce, and at least one of an identifier and a key component;
a transmitter configured to transmit the signature, the nonce, a security parameter, and the at least one of the identifier and the key component, wherein the security parameter associates a user identity with a public key, the public key being associated with the private key; and
a receiver configured to receive, based on the transmitting, session security data generated by the at least one other apparatus,
wherein the processing circuit is further configured to establish, a secure communication session with the at least one other apparatus based on at least the session security data.

16. An apparatus for secure communication with at least one other apparatus, comprising:
a receiver configured to receive a nonce, at least one of an identifier and a key component, a security parameter, and a signature that was generated using a private key, the nonce, and the at least one of the identifier and the key component; and
a processing circuit configured to
verify the nonce and the at least one of the identifier and the key component using the received signature and the security parameter, wherein the security parameter associates a user identity with a public key, the pub

Assignees

• Research In Motion Ltd
• Certicom Corp
• Blackberry Ltd

Inventors

• Buckley Michael Eoin
• Hollatz Michael Charles
• Lambert Robert John
• Ebeid Nevine Maurice Nassif

Classifications

• H04W12/02

  Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] · CPC title

• H04L63/0435

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L63/306 Primary

  intercepting packet switched data communications, e.g. Web, Internet or IMS communications · CPC title

• H04L9/3297

  involving time stamps, e.g. generation of time stamps · CPC title