# US 10,771,966 B2 · Encryption method, decryption method, and related apparatus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,966 B2 - Document ID: US10771966B2 - Status: Granted - Kind: B2 - Application number: 15/965,854 - Filed: 2018-04-28 - Published: 2018-08-30 - Granted: 2020-09-08 - Earliest claimed: 2011-10-27 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: Lijia Zhang; Jing Chen - Web page: https://patentgrep.com/patent/US10771966B2 ## CPC - H04L 9/0656: {Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher} - H04L 9/12: Transmitting and receiving encryption devices synchronised or initially set up in a particular manner - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/104: {Grouping of entities} - H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] - H04W 12/033: of the user plane, e.g. user's traffic - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04L 2209/80: Wireless - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract In order to provide confidentiality protection, an encryption method, a decryption method, and related apparatuses are provided. An encryption device generates a first initial layer-3 message. The first initial layer-3 message includes a first part and a second part. The device generates a keystream for encrypting the first initial layer-3 message. The device performs an exclusive OR operation on the keystream and the first initial layer-3 message to generate a second initial layer-3 message. The second initial layer-3 message includes an encrypted first part of the first initial layer-3 message, an unencrypted second part of the first initial layer-3 message, and an encryption indication indicating that the first part of the first initial layer-3 message is encrypted. The device transmits the second initial layer-3 message to a network device. Small data comprised in the second initial layer-3 message is protected by the encryption. ## Claims ### Claim 1 An apparatus, comprising a processor and a transmitter; wherein the processor is configured to: generate a first initial layer-3 message, wherein the first initial layer-3 message comprises a first part and a second part; generate a keystream for encrypting the first initial layer-3 message; and perform an exclusive OR operation on the keystream and the first initial layer-3 message, to generate a second initial layer-3 message, wherein the second initial layer-3 message comprises an encrypted first part of the first initial layer-3 message, an unencrypted second part of the first initial layer-3 message, and an encryption indication indicating that the first part of the first initial layer-3 message is encrypted; wherein the transmitter is configured to: transmit the second initial layer-3 message to a network device. ### Claim 2 (depends on 1) The apparatus according to claim 1, wherein the first part of the first initial layer-3 message comprises small data. ### Claim 3 (depends on 2) The apparatus according to claim 2, wherein the first part of the first initial layer-3 message comprises one or more internet protocol (IP) packets, in which at least one IP packet is occupied by the small data. ### Claim 4 (depends on 2) The apparatus according to claim 2, wherein the first part of the first initial layer-3 message comprises one or more short message service (SMS) messages, in which at least one SMS message is occupied by the small data. ### Claim 5 (depends on 1) The apparatus according to claim 1, wherein a length of the keystream is equal to a length of the first part of the first initial layer-3 message. ### Claim 6 (depends on 5) The apparatus according to claim 5, wherein in generating the keystream, the processor is configured to: set a value of a length parameter to be equal to the length of the first part of the first initial layer-3 message; and generate the keystream by using an evolved packet system encryption algorithm, wherein the length parameter is used as an input parameter of the algorithm. ### Claim 7 (depends on 1) The apparatus according to claim 1, wherein a length of the keystream is equal to a length of the first initial layer-3 message. ### Claim 8 (depends on 7) The apparatus according to claim 7, wherein in generating the keystream, the processor is configured to: set a value of a length parameter to be equal to the length of the first initial layer-3 message; generate an initial keystream by using an evolved packet system encryption algorithm, wherein the length parameter is used as an input parameter of the algorithm; acquire, according to a format of the first initial layer-3 message and a length of the first part of the first initial layer-3 message, a start bit and a stop bit of the first part of the first initial layer-3 message; and reserve bits in the initial keystream that correspond to bits from the start bit to the stop bit and replace other bits except the reserved bits with 0 to generate the keystream. ### Claim 9 A method, comprising: generating a first initial layer-3 message, wherein the first initial layer-3 message comprises a first part and a second part; generating a keystream for encrypting the first initial layer-3 message; performing an exclusive OR operation on the keystream and the first initial layer-3 message, to generate a second initial layer-3 message, wherein the second initial layer-3 message comprises an encrypted first part of the first initial layer-3 message, an unencrypted second part of the first initial layer-3 message, and an encryption indication indicating that the first part of the first initial layer-3 message is encrypted; and transmitting the second initial layer-3 message to a network device. ### Claim 10 (depends on 9) The method according to claim 9, wherein the first part of the first initial layer-3 message comprises small data. ### Claim 11 (depends on 10) The method according to claim 10, wherein the first part of the first initial layer-3 message comprises one or more internet protocol (IP) packets, in which at least one IP packet is occupied by the small data. ### Claim 12 (depends on 10) The method according to claim 10, wherein the first part of the first initial layer-3 message comprises one or more short message service (SMS) messages, in which at least one SMS message is occupied by the small data. ### Claim 13 (depends on 9) The method according to claim 9, wherein a length of the keystream is equal to a length of the first part of the first initial layer-3 message. ### Claim 14 (depends on 13) The method according to claim 13, wherein generating the keystream comprises: setting a value of a length parameter to be equal to the length of the first part of the first initial layer-3 message; and generating the keystream by using an evolved packet system encryption algorithm, wherein the length parameter is used as an input parameter of the algorithm. ### Claim 15 (depends on 9) The method according to claim 9, wherein a length of the keystream is equal to a length of the first initial layer-3 message. ### Claim 16 (depends on 15) The method according to claim 15, wherein generating the keystream comprises: setting a value of a length parameter to be equal to the length of the first initial layer-3 message; generating an initial keystream by using an evolved packet system encryption algorithm, wherein the length parameter is used as an input parameter of the algorithm; acquiring, according to a format of the first initial layer-3 message and a length of the first part of the first initial layer-3 message, a start bit and a stop bit of the first part of the first initial layer-3 message; and reserving bits in the initial keystream that correspond to bits from the start bit to the stop bit and replacing other bits except the reserved bits with 0 to generate the keystream. ### Claim 17 An apparatus comprising a processor and a non-transitory medium storing program instructions; wherein the instructions, when executed by the processor, cause the apparatus to: generate a first initial layer-3 message, wherein the first initial layer-3 message comprises a first part and a second part; generate a keystream for encrypting the first initial layer-3 message; perform an exclusive OR operation on the keystream and the first initial layer-3 message, to generate a second initial layer-3 message, wherein the second initial layer-3 message comprises an encrypted first part of the first initial layer-3 message, an unencrypted second part of the first initial layer-3 message, and an encryption indication indicating that the first part of the first initial layer-3 message is encrypted; and output the second initial layer-3 message for transmitting to a network device. ### Claim 18 (depends on 17) The apparatus according to claim 17, wherein the first part of the first initial layer-3 message comprises small data. ### Claim 19 (depends on 18) The apparatus according to claim 18, wherein the first part of the first initial layer-3 message comprises one or more internet protocol (IP) packets, in which at least one IP packet is occupied by the small data. ### Claim 20 (depends on 18) The apparatus according to claim 18, wherein the first part of the first initial layer-3 message comprises one or more short message service (SMS) messages, in which at least one SMS message is occupied by the small data. ### Claim 21 (depends on 17) The apparatus according to claim 17, wherein a length of the keystream is equal to a length of the first part of the first initial layer-3 message. ### Claim 22 (depends on 21) The apparatus according to claim 21, wherein in generating the keystream, the instructions, when executed by the processor, cause the apparatus to: set a value of a length parameter to be equal to the length of the first part of the first initial layer-3 message; and generate the keystream by using an evolved packet system encryption algorithm, wherein the length parameter is used as an input parameter of the algorithm. ### Claim 23 (depends on 17) The apparatus according to claim 17, wherein a length of the keystream is equal to a length of the first initial layer-3 message. ### Claim 24 (depends on 23) The apparatus according to claim 23, wherein in generating the keystream, the instructions, when executed by the processor, cause the apparatus to: set a value of a length parameter to be equal to the length of the first initial layer-3 message; generate an initial keystream by using an evolved packet system encryption algorithm, wherein the length parameter is used as an input parameter of the algorithm; acquire, according to a format of the first initial layer-3 message and a length of the first part of the first initial layer-3 message, a start bit and a stop bit of the first part of the first initial layer-3 message; and reserve bits in the initial keystream that correspond to bits from the start bit to the stop bit and replace other bits except the reserved bits with 0 to generate the keystream.