# US 12,010,507 B2 · Secure beacons > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,507 B2 - Document ID: US12010507B2 - Status: Granted - Kind: B2 - Application number: 17/296,580 - Filed: 2019-11-29 - Published: 2021-12-23 - Granted: 2024-06-11 - Earliest claimed: 2018-11-29 - Assignees: Nagravision Sarl - Applicants: Nagravision Sarl - Inventors: Jean-Philippe Aumasson - Web page: https://patentgrep.com/patent/US12010507B2 ## CPC - H04W 12/03: Protecting confidentiality, e.g. by encryption - H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms} - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04W 4/80: Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication - H04W 12/06: Authentication - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for securing a beacon signal in a network comprising a transmitter for broadcasting the beacon signal and one or more receivers for receiving the beacon signal, wherein the beacon signal comprises a data packet (103) including a payload (106) that comprises a first field containing broadcast information from the transmitter and a second field (204) for storing authentication information, the method comprising: computing, using a secret key, a message authentication code over the payload; extracting bytes from the message authentication code to obtain the authentication information; and encrypting the first field using a symmetric cipher which takes as parameter the secret key and a nonce, wherein the nonce comprises the authentication information, the encrypting resulting in an encrypted first field, the resulting secure beacon signal (200) comprising the encrypted first field (203) and the second field (204) with the authentication information. ## Claims ### Claim 1 A computer-implemented method for securing a beacon signal in a network comprising a transmitter for broadcasting the beacon signal and one or more receivers for receiving the beacon signal, wherein the beacon signal comprises a data packet, the data packet including a payload, wherein the payload comprises a first field containing broadcast information from the transmitter, a second field for storing authentication information, and a sequence number field for storing a sequence number, wherein the sequence number is incremented for each new beacon signal transmitted by the transmitter, the method comprising: computing, using a secret key, a message authentication code over at least a part of the payload; extracting a predefined number of bytes from the message authentication code to obtain the authentication information, the predefined number of bytes being equal to or less than the length of the second field; and encrypting at least part of the first field using a symmetric cipher which takes as parameter the secret key and a nonce, wherein the nonce is based on the authentication information and the sequence number, the encrypting resulting in an encrypted first field, wherein the resulting secure beacon signal comprises the data packet, wherein the payload comprises the encrypted first field and the second field contains the authentication information. ### Claim 2 (depends on 1) The method according to claim 1, wherein the symmetric cipher is a length-preserving symmetric cipher which takes as parameter the secret key and the nonce. ### Claim 3 (depends on 1) The method according to claim 1, wherein the nonce comprises a concatenation of the authentication information and the sequence number and is padded with zeros such that the nonce has a predetermined length. ### Claim 4 (depends on 1) The method according to claim 1, wherein the data packet further comprises an identification field containing an identifier of the transmitter, and wherein the secret key is associated with the identifier of the transmitter. ### Claim 5 (depends on 1) The method according to claim 1, wherein the data packet is a Bluetooth Low-Energy advertising packet data unit. ### Claim 6 A computer-implemented method for processing a received secure beacon signal in a network comprising a transmitter for broadcasting the secure beacon signal and one or more receivers for receiving the secure beacon signal, wherein the secure beacon signal comprises a data packet, the data packet including a payload, wherein the payload comprises a first field comprising encrypted broadcast information, a second field containing authentication information, and a sequence number field for storing a sequence number, wherein the sequence number is incremented for each new beacon signal transmitted by the transmitter, the method comprising: receiving the secure beacon signal in a receiver; and decrypting the encrypted first field using a symmetric cipher which takes as parameter a secret key and a nonce, wherein the nonce is based on the authentication information and the sequence number, the decrypting resulting in a decrypted first field. ### Claim 7 (depends on 6) The method according to claim 6, wherein the symmetric cipher is a length-preserving symmetric cipher which takes as parameter the secret key and the nonce. ### Claim 8 (depends on 6) The method according to claim 6, wherein the nonce comprises a concatenation of the authentication information and the sequence number and is padded with zeros such that the nonce has a predetermined length. ### Claim 9 (depends on 6) The method according to claim 6, wherein the data packet further comprises an identification field containing an identifier of the transmitter, wherein the secret key is associated to the identifier of the transmitter, and wherein the method further comprises obtaining the secret key based on the identifier. ### Claim 10 A computer-implemented method for processing a received secure beacon signal in a network comprising a transmitter for broadcasting the secure beacon signal and one or more receivers for receiving the secure beacon signal, wherein the secure beacon signal comprises a data packet, the data packet including a payload, wherein the payload comprises a first field comprising encrypted broadcast information and a second field containing authentication information, the method comprising: receiving the secure beacon signal in a receiver; decrypting the encrypted first field using a symmetric cipher which takes as parameter a secret key and a nonce, wherein the nonce comprises the authentication information, the decrypting resulting in a decrypted first field; computing a message authentication code over at least a part of the payload after decrypting, and using the secret key; extracting a predefined number of bytes from the message authentication code to obtain further authentication information, the predefined number of bytes being equal to or less than the length of the second field; and comparing the further authentication information with the authentication information to verify an authenticity of the data packet. ### Claim 11 (depends on 10) The method according to claim 10, wherein the second field is set to a predetermined value other than the authentication information before computing the message authentication code, the predetermined value preferably being zero. ### Claim 12 (depends on 6) The method according to claim 6, wherein the data packet is a Bluetooth Low-Energy advertising packet data unit. ### Claim 13 (depends on 1) A transmitter configured for securing a beacon signal, wherein the transmitter comprises: a processor configured to perform the method of claim 1; and an antenna for broadcasting the secure beacon signal to one or more receivers. ### Claim 14 (depends on 6) A receiver configured for processing a received secure beacon signal, wherein the receiver comprises: an antenna for receiving the secure beacon signal broadcast from a transmitter; and a processor configured to perform the method of claim 6.