# US 11,122,428 B2 · Transmission data protection system, method, and apparatus

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,122,428 B2
- Document ID: US11122428B2
- Status: Granted
- Kind: B2
- Application number: 16/237,902
- Filed: 2019-01-02
- Published: 2019-05-09
- Granted: 2021-09-14
- Earliest claimed: 2016-07-06
- Assignees: Huawei Technologies Co., Ltd.
- Applicants: Huawei Technologies Co., Ltd.
- Inventors: Haiguang Wang; Fei Liu; Xin Kang
- Web page: https://patentgrep.com/patent/US11122428B2

## CPC

- H04L 9/3073: {involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing}
- H04L 9/08: Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)}
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 9/3247: {involving digital signatures}
- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04W 8/04: Registration at HLR or HSS [Home Subscriber Server]
- H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
- H04W 12/041: Key generation or derivation
- H04W 12/0433: Key management protocols
- H04W 12/06: Authentication
- H04L 2209/601: Broadcast encryption
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A system for transmission data protection includes user equipment (UE) and an access point. The access point sends a broadcast message that carries a public key for encryption. The UE receives and stores the public key for encryption. The UE obtains a global public key or a private key corresponding to the UE, and protects transmission data using the public key for encryption and the global public key or the private key corresponding to the UE.

## Claims

### Claim 1

A transmission data protection system, comprising:
a user equipment (UE); and
an access point configured to:
obtain system parameters from at least one of a network or a key management system (KMS), wherein the system parameters comprise a public key for encryption and at least one group of data selected from a first global public key and a first private key, or a second global public key and a second private key, wherein the first global public key is a global public key (GPKenc) for data encryption in an identity based cryptography (IBC) technology, wherein the first private key is a private key (SKBS_ID_enc) for data encryption corresponding to the access point in the IBC technology, wherein the second global public key is a global public key (GPKSig) for data signature in the IBC technology, and wherein the second private key is a private key (SKBS_ID_Sig for data signature corresponding to the access point in the IBC technology, and wherein the public key for encryption is at least one of is base station (BS) identity (BS_ID), comprises a BS_ID, comprises a media access control (MAC) address of a Wi-Fi access point (AP), comprises a service set identifier (SSID) of a Wi-Fi AP, comprises a hotspot UE identity (UE_ID), or comprises an international mobile subscriber identity (IMSI) of hotspot UE;
store the system parameters as second prestored data of the access point; and
send a broadcast message after obtaining the system parameters, wherein the broadcast message carries the public key for encryption;
wherein the UE is configured to receive the broadcast message of the access point and store the public key for encryption;
wherein the UE is further configured to perform, in response to transmission data needing to be sent to the access point:
obtain at least one of a global public key in an identity based cryptography (IBC) technology or a private key corresponding to the UE from first prestored data of the UE, wherein the global public key comprises the first global public key and the second global public key; and
protect the transmission data using the public key for encryption and the at least one of the global public key or the private key corresponding to the UE, and obtain a protection message;
wherein the UE is further configured to send the protection message to the access point, wherein the protection message carries an indication message indicating a protection manner of the transmission data;
wherein the access point is further configured to perform, after receiving the protection message:
obtain the global public key and a private key corresponding to the access point from second prestored data of the access point according to the indication message indicating the protection manner, wherein the private key corresponding to the access point comprises the first private key and the second private key; and
parse the protection message using the global public key and the private key corresponding to the access point, and obtain the transmission data sent by the UE; and
wherein the access point is further configured to send, to a core network, the transmission data that is obtained through parsing and that is sent by the UE.

### Claim 2 (depends on 1)

The protection system according to claim 1, wherein the global public key comprises a first global public key and a second global public key, and wherein the private key corresponding to the UE comprises a third private key and a fourth private key;
wherein the UE is further configured to obtain, before receiving the broadcast message of the access point, from at least one of a network or a KMS, processing parameters used by the UE to process the transmission data, and store the processing parameters as the first prestored data of the UE;
wherein the processing parameters comprise a first operator identity of an operator to which the UE belongs, and at least one group of data selected from the first global public key, or the first global public key and the third private key, or the second global public key and the fourth private key;
wherein the first global public key is a global public key (GPKenc) for data encryption in the IBC technology, wherein the third private key is a private key (SKUE_ID_enc) for data encryption corresponding to the UE_ID in the IBC technology, wherein the second global public key is a global public key (GPKSig) for data signature in the IBC technology, and wherein the fourth private key is a private key (SKUE_ID_Sig) for data signature corresponding to the UE_ID in the IBC technology.

### Claim 3 (depends on 2)

The protection system according to claim 2, wherein the second prestored data comprises the GPKSig and the SKBS_ID_Sig; and
wherein the access point is further configured to sign the broadcast message using the GPKSig and the SKBS_ID_Sig, to obtain a first signature of the broadcast message, and add indication information indicating that the access point has a data signature function or the first signature of the broadcast message to the broadcast message.

### Claim 4 (depends on 3)

The protection system according to claim 3, wherein the first prestored data comprises the first operator identity and the GPKSig; and
wherein the UE is configured to:
determine, according to the indication information carried in the received broadcast message, that the access point has a data signature function, and to determine, according to identification information of the access point corresponding to the broadcast message, a second operator identity of an operator to which the access point belongs;
match the second operator identity with the first operator identity, and search the first prestored data for a third global public key GPKSig1 corresponding to the access point;
attempt, in response to the broadcast message carrying the first signature, to authenticate the broadcast message using the GPKSig1 and the identification information of the access point; and
determine to add, to the first prestored data, in response to the broadcast message being authenticated, the public key for encryption that is carried in the broadcast message.

### Claim 5 (depends on 4)

The protection system according to claim 4, wherein the first prestored data comprises the GPKenc and the SKUE_ID_enc; and
the UE is specifically configured to:
when the transmission data needs to be sent to the access point, obtain the public key for encryption, the GPKenc, and the SKUE_ID_enc from the first prestored data;
generate a first symmetric key according to the public key for encryption, the GPKenc, and the SKUE_ID_enc, and input the transmission data and the first symmetric key into a system function to obtain a first message authentication code; and
encrypt the transmission data, identification information of the UE, and the first message authentication code using the public key for encryption and the GPKenc, to obtain the protection message, wherein
the protection manner of the transmission data is encrypting the transmission data, the identification information of the UE, and the first message authentication code using the public key for encryption and the GPKenc.

### Claim 6 (depends on 5)

The protection system according to claim 5, wherein the second prestored data comprises the public key for encryption, the GPKenc, and the SKBS_ID_enc; and
wherein the access point is configured to:
determine the protection manner of the transmission data according to the indication message indicating the protection manner;
obtain the GPKenc and the SKBS_ID_enc from the second prestored data;
decrypt the protection message using the SKBS_ID_enc and the GPKenc, to obtain a decrypted message;
obtain the first message authentication code, the identification information of the UE, and the transmission data that are carried in the protection message from the decrypted message;
generate a second symmetric key using the identification information of the UE, the GPKenc, and the SKBS_ID_enc;
calculate a second message authentication code using the second symmetric key, the identification information of the UE, and the transmission data obtained through decryption; and
send, to the core network, in response to the second message authentication code matching the first message authentication code, the transmission data sent by the UE.

### Claim 7 (depends on 4)

The protection system according to claim 4, wherein the first prestored data comprises the GPKenc; and
wherein the UE is configured to:
obtain, in response to the transmission data needing to be sent to the access point, the public key for encryption and the GPKenc from the first prestored data; and
encrypt the transmission data using the public key for encryption and the GPKenc, to obtain the protection message;
wherein the protection manner of the transmission data is encrypting the transmission data using the public key for encryption and the GPKenc.

### Claim 8 (depends on 7)

The protection system according to claim 7, wherein the second prestored data comprises the GPKenc, the SKBS_ID_enc, the GPKSig, and the SKBS_ID_Sig; and
wherein the access point is configured to:
determine the protection manner of the transmission data according to the indication message indicating the protection manner;
obtain the SKBS_ID_enc and the GPKenc from the second prestored data;
decrypt the protection message using the SKBS_ID_enc and the GPKenc, to obtain a decrypted message; and
send, to the core network, the transmission data that is carried in the decrypted message and that is sent by the UE.