US Patent 8,755,528 — Method and system for establishing secure connection between stations

Life of the patent

9 dated events

⤢ drag to zoom

ProsecutionTerm & feeshover for detail · click to open

Abstract

A method and system for establishing a secure connection between stations are disclosed. The method includes that: 1) a switch device receives an inter-station key request packet sent by a first user terminal; 2) the switch device generates an inter-station key, constructs an inter-station key announcement packet and sends it to a second user terminal; 3) the switch device receives an inter-station key announcement response packet sent by the second user terminal; 4) the switch device constructs an inter-station key announcement response packet and sends it to the first user terminal; 5) the switch device receives an inter-station key announcement response packet sent by the first user terminal. The switch device establishes an inter-station key for the two stations which are connected to the switch device directly, by which the embodiments of the present invention ensure the confidentiality and integrality of user data between the stations.

Claims

18 · 2 independent · depth 10

18 granted claims

›1.independentA method for establishing a security connection between stations, comprising:n1) receiving, by a switch device, an inter-station key request packet se…+11

›2.↳ 1The method for establishing a security connection between stations according to claim 1, further comprising:nchecking at first, by the first station, …d2

›3.↳ 1The method for establishing a security connection between stations according to claim 1, wherein the generating, by the switch device, an inter-statio…d2+8

›4.↳ 3The method for establishing a security connection between stations according to claim 3, wherein:nthe value of the key announcement identifier KN2 fie…d3+7

›5.↳ 4The method for establishing a security connection between stations according to claim 4, further comprising:nchecking, by the second station, the key …d4+6

›6.↳ 5The method for establishing a security connection between stations according to claim 5, wherein:nthe value of the key announcement identifier KN2 fie…d5+5

›7.↳ 6The method for establishing a security connection between stations according to claim 6, wherein the constructing, by the switch device, an inter-stat…d6+4

›8.↳ 7The method for establishing a security connection between stations according to claim 7, wherein:nthe value of the key announcement identifier KN1 fie…d7+3

›9.↳ 8The method for establishing a security connection between stations according to claim 8, further comprising:ncomparing, by the first station, to deter…d8+2

›10.↳ 9The method for establishing a security connection between stations according to claim 9, wherein:nthe value of the key announcement identifier KN1 fie…d9+1

›12.↳ 1The method for establishing a security connection between stations according to claim 1, further comprising:nconstructing an inter-station key request…d2

›13.independentA system for establishing a security connection between stations, wherein the system for establishing security connection between direct-connected sta…+5

›14.↳ 13The system for establishing a security connection between stations according to claim 13, wherein the switch device adapted for sending an inter-stati…d2+4

›15.↳ 14The system for establishing a security connection between stations according to claim 14, wherein the second station is further adapted for:nchecking …d3+3

›16.↳ 15The system for establishing a security connection between stations according to claim 15, wherein the switch device adapted for:nsending the inter-sta…d4+2

The system for establishing a security connection between stations according to claim 15, wherein the switch device adapted for:nsending the inter-station key announcement packet to the first station is further adapted to comparing, by the switch device, to determine whether the value of the key announcement identifier KN2 field of the second station in the inter-station key announcement response packet is consistent with the value of the key announcement identifier KN2 field of the second station in the inter-station key announcement packet sent to the second station previously, after receiving the inter-station key announcement response packet sent by the second station;verifying whether the message identification code MIC3 field is correct by using the protocol data key PDK2 in the unicast key shared with the second station, if the value of the key announcement identifier KN2 field of the second station in the inter-station key announcement response packet is consistent with the value of the key announcement identifier KN2 field of the second station in the inter-station key announcement packet sent to the second station previously;saving the value of the key announcement identifier KN2 field, in the case that the message identification code MIC3 field is correct; andconstructing an inter-station key announcement packet according to the inter-station key STAkey1-2 that is announced to the second station previously, and sending the inter-station key announcement packet to the first station,wherein the inter-station key announcement packet comprises a key announcement identifier KN1 field of the first station, a key-encrypted data E1 field and a message identification code MIC4 field,wherein the value of the key announcement identifier KN1 field of the first station in the inter-station key announcement packet is equal to that of the key announcement identifier KN1 field of the first station in the received inter-station key request packet sent by the first station previously,wherein the key-encrypted data E1 field is the data obtained by the switch device encrypting the inter-station key STAkey1-2 with the protocol data key PDK1 in the unicast key shared with the first station, andwherein the value of the message identification code MIC4 field is a hash value obtained by the switch device performing hash function calculation on the fields in the inter-station key announcement packet other than the message identification code MIC4 field by using the protocol data key PDK1 in the unicast key shared with the first station.

›17.↳ 16The system for establishing a security connection between stations according to claim 16, wherein the first station is adapted for:ncomparing to deter…d5+1

The system for establishing a security connection between stations according to claim 16, wherein the first station is adapted for:ncomparing to determine whether the value of the key announcement identifier KN1 field of the first station in the inter-station key announcement packet is consistent with that of the key announcement identifier KN1 field of the first station in the inter-station key request packet sent previously, after receiving the inter-station key announcement packet sent by the switch device;verifying whether the message identification code MIC4 field is correct by using the protocol data key PDK1 in the unicast key shared with the switch device, if the value of the key announcement identifier KN1 field of the first station in the inter-station key announcement packet is consistent with that of the key announcement identifier KN1 field of the first station in the inter-station key request packet sent previously;decrypting the key-encrypted data E1 field by using the protocol data key PDK1 in the unicast key shared with the switch device, to obtain the inter-station key STAkey1-2 between the second station and the first station, if the message identification code MIC4 field is correct; and saving the value of the key announcement identifier KN1 field of the first station, constructing the inter-station key announcement response packet and sending the inter-station key announcement response packet to the switch device,wherein the inter-station key announcement response packet comprises the key announcement identifier KN1 field of the first station and a message identification code MIC5 field,wherein the value of the key announcement identifier KN1 field of the first station in the inter-station key announcement response packet is equal to that of the key announcement identifier KN1 field of the first station in the inter-station key announcement packet received by the first station, andwherein the value of the message identification code MIC5 field is a hash value obtained by the first station performing hash function calculation on the fields in the inter-station key announcement response packet other than the message identification code MIC5 field by using the protocol data key PDK1 in the unicast key shared with the switch device.

Classifications

2 codes

IPC · International Patent Classification

Section G — Physics

G06F21/00

USPC · US Patent Classification

380/281

Claim changes

Soon

Coming soonHow the claims changed between publication and grant

See which claims were amended, added or cancelled during examination, with every added and removed word marked.

AmendedAddedCancelledUnchanged

The published claims of this patent are not paired with the granted ones in what we hold.

File wrapper

⤢ drag to zoom

USPTOApplicanthover for detail · click to open

Pendency

4.1 y

1,488 days filing → grant

Office actions

1

non-final + final

Responses

2

1 RCE

Examiner

Michael Guirguis

art unit —

Law firm

Law firm · Log in to unlock

Citations: 25 back · 0 forward

See the full prosecution history — every USPTO and applicant action on this file, in order.

Log in to unlock

Term & fees

See the term timeline — pendency span, in-force span, the maintenance fees paid and both computed expiry dates.

Log in to unlock

Priority chain

1 priority documents

›Priority documents — 1

Type	Document	Date
related publication	US 20120257755 A1	11 Oct 2012

Validity challenges

See the validity challenges on record — reexaminations, IPRs and PGRs, with their institution decisions and outcomes.

Log in to unlock

Citations

See every patent this one cites and every patent that cites it back — publication, assignee, and how each one was found.

Log in to unlock