# US 10,320,850 B2 · Securing method for lawful interception

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,320,850 B2
- Document ID: US10320850B2
- Status: Granted
- Kind: B2
- Application number: 15/272,927
- Filed: 2016-09-22
- Published: 2017-01-12
- Granted: 2019-06-11
- Earliest claimed: 2013-06-24
- Assignees: BlackBerry Limited; Certicom Corp.
- Applicants: BlackBerry Limited; Certicom Corp.
- Inventors: Michael Eoin Buckley; Michael Charles Hollatz; Robert John Lambert; Nevine Maurice Nassif Ebeid
- Web page: https://patentgrep.com/patent/US10320850B2

## CPC

- H04L 63/306: {intercepting packet switched data communications, e.g. Web, Internet or IMS communications}
- H04L 9/0847: {involving identity based encryption [IBE] schemes}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/3073: {involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing}
- H04L 9/3252: {using DSA or related signature schemes, e.g. elliptic based signatures, ElGamal or Schnorr schemes}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 9/3297: {involving time stamps, e.g. generation of time stamps}
- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04M 3/2281: {Call monitoring, e.g. for law enforcement purposes; Call tracing; Detection or prevention of malicious calls}
- H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
- H04W 12/041: Key generation or derivation
- H04W 12/062: Pre-authentication
- H04W 12/80: Arrangements enabling lawful interception [LI]
- H04L 2101/654: International mobile subscriber identity [IMSI] numbers
- H04L 2209/80: Wireless
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A method is presented for secure communication, the method including generating a signature using a private key, a nonce, and at least one of an identifier and a key component; and transmitting the signature, the nonce, a security parameter, and the at least one of the identifier and the key component, wherein the security parameter associates a user identity with a public key, the public key being associated with the private key.

## Claims

### Claim 1

A method, by an electronic device, for secure communication, comprising:
generating, by a processor of the electronic device, a signature using a private key, a nonce, and at least one of an identifier and a key component, at least the signature being destined for reception by at least one other electronic device;
establishing, by the processor, a secure communication session with at least one other electronic device based on generating the signature and at least session security data associated with the at least one other electronic device and obtained by the electronic device, wherein the session security data is generated, at least in part, by the at least one other electronic device.

### Claim 2 (depends on 1)

The method of claim 1, wherein the identifier is one of an International Mobile Station Equipment Identity (IMEI), a Globally Routable User Agent URI (GRUU), an International Mobile Subscriber Identity (IMSI), and a Temporary International Mobile Subscriber Identity (TIMSI).

### Claim 3 (depends on 1)

The method of claim 1, wherein the nonce is one of a timestamp, a random number, and a sequence number.

### Claim 4 (depends on 1)

The method of claim 1, wherein the secure communication session is further established with the at least one electronic device based on a security parameter, wherein the security parameter is a certificate that associates a user identity with a public key, the public key being associated with the private key.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
generating the key component using a master key, the nonce, and a known elliptic curve point.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
transmitting the signature and a public key associated with the private key.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
receiving the session security data, wherein the session security data comprises a second nonce, at least one of a second identifier and a second key component, a second security parameter, and a second signature that was generated using a second private key, the second nonce, and the at least one of the second identifier and the second key component, and
wherein establishing the secure communication session comprises
verifying the second nonce and the at least one of the second identifier and the second key component using the received second signature and the second security parameter, wherein the second security parameter associates a second user identity with a second public key, the second public key being associated with the second private key; and
generating a session key using the at least one of the second identifier and the second key component, when verification is successful in the verifying step.

### Claim 8

A method, by an electronic device, for secure communication, comprising:
establishing, by a processor of the electronic device, a secure communication session with at least one other electronic device based on session security data associated with the at least one other electronic device and obtained by the electronic device, wherein the session security data is generated, at least in part, by the at least one other electronic device, the session security data comprising
a nonce, at least one of an identifier and a key component, a security parameter, and a signature that was generated by the at least one other electronic device using a private key, the nonce, and the at least one of the identifier and the key component.

### Claim 9 (depends on 8)

The method of claim 8, wherein prior to establishing the secure communication session, the method further comprising:
verifying the nonce and the at least one of the identifier and the key component using the received signature and the security parameter; and
generating a session key using the at least one of the identifier and the key component.

### Claim 10 (depends on 8)

The method of claim 8, further comprising, wherein establishing the secure communication session comprises:
generating a second signature using a second private key, a second nonce, and at least one of a second identifier and a second key component; and
transmitting the second signature, the second nonce, a second security parameter, and the at least one of the second identifier and the second key component, wherein the second security parameter associates a second user identity with a second public key, the second public key being associated with the second private key.

### Claim 11

An apparatus for secure communication, comprising:
a processing circuit configured to generate a signature using a private key, a nonce, and at least one of an identifier and a key component; and
a transmitter configured to transmit session security data comprising the signature, the nonce, a security parameter, and the at least one of the identifier and the key component, where the session security data is destined for reception by at least one electronic device for establishing a secure communication session therewith, and wherein the security parameter associates a user identity with a public key, the public key being associated with the private key.

### Claim 12

An apparatus for secure communication, comprising:
a processing circuit configured to establish a secure communication session with at least one other electronic device based on session security data associated with the at least one other electronic device and obtained by the electronic device, the session security data comprising a nonce, at least one of an identifier and a key component, a security parameter, and a signature that was generated by the at least one other electronic device using a private key, the nonce, and the at least one of the identifier and the key component.