# US 8,787,578 B2 · Method and apparatus for encrypting transmissions in a communication system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,787,578 B2 - Document ID: US8787578B2 - Status: Granted - Kind: B2 - Application number: 11/269,449 - Filed: 2005-11-07 - Published: 2006-03-16 - Granted: 2014-07-22 - Earliest claimed: 1999-09-30 - Assignees: QUALCOMM Incorporated - Applicants: Ramin Rezaiifar; Roy F. Quick, Jr.; Paul Williamson; Jun Wang; Edward G. Tiedemann, Jr. - Inventors: Ramin Rezaiifar; Roy F. Quick, Jr.; Paul Williamson; Jun Wang; Edward G. Tiedemann, Jr. - Web page: https://patentgrep.com/patent/US8787578B2 ## CPC - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - G06F 21/606: {by securing the transmission between two devices or processes} - H04L 1/0061: {Error detection codes} - H04L 1/0083: {Formatting with frames or packets; Protocol or part of protocol for error control} - H04L 9/12: Transmitting and receiving encryption devices synchronised or initially set up in a particular manner - H04L 9/3236: {using cryptographic hash functions} - H04L 9/3247: {involving digital signatures} - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/123: {received data contents, e.g. message integrity} - H04L 63/126: {the source of the received data} - H04L 63/162: {at the data link layer} - H04L 63/164: {at the network layer} - H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] - H04W 12/03: Protecting confidentiality, e.g. by encryption - H04W 12/069: using certificates or pre-shared keys - H04W 12/108: Source integrity - H04W 12/122: Counter-measures against attacks; Protection against rogue devices - G06F 2221/2113: Multi-level security, e.g. mandatory access control - H04L 1/18: Automatic repetition systems, e.g. Van Duuren systems - H04L 2209/34: Encoding or coding, e.g. Huffman coding or error correction - H04L 2209/80: Wireless - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Method and apparatus for encrypting transmission traffic at separate protocol layers L1, L2, and L3 so that separate encryption elements can be assigned to separate types of transmission traffic, which allows the implementation of different levels of encryption according to service requirements. Encryption elements use variable value inputs, called crypto-syncs, along with semi-permanent encryption keys to protect from replay attacks from rogue mobile stations. Since crypto-sync values vary, a method for synchronizing crypto-syncs at the mobile station and base station is also presented. ## Claims ### Claim 1 A method for encrypting transmission traffic at separate protocol layers, comprising: providing a plurality of encryption elements, each encryption element provided by inputting a variable value and an encryption key into an encryption algorithm to obtain an encryption mask that varies from data unit to data unit as the variable value changes; assigning different types of transmission traffic to the encryption elements to provide different levels of encryption based on service requirements of the different types of transmission traffic; and encrypting the different types of transmission traffic using the corresponding encryption mask for the assigned encryption elements. ### Claim 2 (depends on 1) The method of claim 1, wherein the variable value is constructed from four least significant bits of a sequence number. ### Claim 3 (depends on 1) The method of claim 1, wherein the variable value for each encryption element is different from other encryption elements. ### Claim 4 (depends on 1) The method of claim 1, wherein the variable value varies due to a dependence on a generated sequence number. ### Claim 5 (depends on 1) The method of claim 1, wherein the variable value varies due to a dependence on a system time. ### Claim 6 An apparatus for encrypting transmission traffic at separate protocol layers, comprising: means for providing a plurality of encryption elements, each encryption element provided by inputting a variable value and an encryption key into an encryption algorithm to obtain an encryption mask that varies from data unit to data unit as the variable value changes; means for assigning different types of transmission traffic to the encryption elements to provide different levels of encryption based on service requirements of the different types of transmission traffic; and means for encrypting the different types of transmission traffic using the corresponding encryption mask for the assigned encryption elements. ### Claim 7 (depends on 6) The apparatus of claim 6, wherein the variable value for each encryption element is different from other encryption elements. ### Claim 8 (depends on 6) The apparatus of claim 6, wherein the variable value is constructed from four least significant bits of a sequence number. ### Claim 9 An apparatus for encrypting transmission traffic at separate protocol layers, comprising: a processor; a storage element coupled to the processor comprising an instruction set executable by the processor, wherein the instruction set comprises instructions for: providing a plurality of encryption elements, each encryption element provided by inputting a variable value and an encryption key into an encryption algorithm to obtain an encryption mask that varies from data unit to data unit as the variable value changes; assigning different types of transmission traffic to the encryption elements to provide different levels of encryption based on service requirements of the different types of transmission traffic; and encrypting the different types of transmission traffic using the corresponding encryption mask for the assigned encryption elements. ### Claim 10 (depends on 9) The apparatus of claim 9, wherein the variable value is constructed from four least significant bits of a sequence number. ### Claim 11 (depends on 9) The apparatus of claim 9, wherein the variable value for each encryption element is different from other encryption elements. ### Claim 12 (depends on 9) The apparatus of claim 9, wherein the variable value varies due to a dependence on a generated sequence number. ### Claim 13 (depends on 9) The apparatus of claim 9, wherein the variable value varies due to a dependence on a system time. ### Claim 14 A non-transitory storage medium comprising an instruction set executable by a processor, wherein the instruction set comprises instructions for: providing a plurality of encryption elements, each encryption element provided by inputting a variable value and an encryption key into an encryption algorithm to obtain an encryption mask that varies from data unit to data unit as the variable value changes; assigning different types of transmission traffic to the encryption elements to provide different levels of encryption based on service requirements of the different types of transmission traffic; and encrypting the different types of transmission traffic using the corresponding encryption mask for the assigned encryption elements. ### Claim 15 (depends on 14) The non-transitory storage medium of claim 14, wherein the variable value is constructed from four least significant bits of a sequence number. ### Claim 16 (depends on 14) The non-transitory storage medium of claim 14, wherein the variable value for each encryption element is different from other encryption elements. ### Claim 17 (depends on 14) The non-transitory storage medium of claim 14, wherein the variable value varies due to a dependence on a generated sequence number. ### Claim 18 (depends on 14) The non-transitory storage medium of claim 14, wherein the variable value varies due to a dependence on a system time. ### Claim 19 (depends on 1) The method of claim 1, wherein the plurality of encryption elements include at least two encryption elements, wherein each of the at least two encryption elements encrypts the transmission traffic in different communication protocol layers. ### Claim 20 (depends on 1) The method of claim 1, wherein a data unit is defined by a transmission frame that includes a message field, a link access control field, and a message cyclic redundancy check field, where the message field and at least one of the link access control field and the message cyclic redundancy check field are encrypted using the encryption mask of an assigned encryption element. ### Claim 21 (depends on 20) The method of claim 20, wherein the transmission frame further includes an encryption sequence number used to generate the encryption mask for the corresponding encryption element used to encrypt the corresponding data unit. ### Claim 22 (depends on 20) The method of claim 20, wherein the transmission frame further includes an encryption identification field used to indicate whether portions of the transmission frame have been encrypted.