WO2013183940A1

WO2013183940A1 - Method for performing secured communication between terminals and an apparatus therefor

Info

Publication number: WO2013183940A1
Application number: PCT/KR2013/004967
Authority: WO
Inventors: 정윤찬
Original assignee: 가톨릭대학교 산학협력단
Priority date: 2012-06-08
Filing date: 2013-06-05
Publication date: 2013-12-12
Also published as: KR101297936B1

Abstract

The present invention provides a method for performing secured communication between a first and a second terminal, which includes the steps of: exchanging a prime number q of a Diffie-Hellman key exchange parameter and primitive root α with the second terminal to convert a communication session from the general mode to the security mode; selecting a first session secret value for the communication session of the first terminal; generating a first session blind key transmitted to the second terminal by using the first session secret value, prime number q and primitive root α; receiving from the second terminal a second session blind key for the communication session of the second terminal; generating a symmetrical packet key for a transmission packet of the first terminal by using the second session blind key; generating a packet key stream by using the symmetrical packet key; and encrypting the transmission packet transmitted to the second terminal by using the packet key stream.

Description

Secure communication method between terminals and device

The present invention relates to a method and apparatus for secure communication between terminals, and more particularly, to a method and apparatus for secure communication between terminals that can provide secure voice and video communication services in a smart device in real time.

Currently, SIP (Session Initiation Protocol) is used for application protocol to support voice or video service through IP (Internet Protocol) network (ex, Internet). This establishes a procedure for opening a session for a caller to find the callee and perform voice or video communication on the Internet if the caller knows only the name or e-mail address of the callee.

In addition, Real Time Protocol (RTP) is used as a protocol for transmitting real-time voice and video traffic in packets. RTP is located between User Datagram Protocol (UDP) and Application Protocol, and is responsible for meeting the requirements for real-time communication. Background art of a terminal and a method for providing video communication using the RTP has been disclosed in Korean Patent Publication No. 2010-0083388.

Recent network security technologies include confidentiality processing techniques that prevent transmission information from being leaked by third parties (ex, enemies or hackers), and man-in-middle attack (MIMA). There is an authentication processing technology that only confirms that it is communicating with the other party. Most of these technologies are being developed in the form of character-based information encryption technology. All of these confidentiality and authentication processing techniques are based on the generation, management, and exchange of secret keys. That is, it operates in a way that generates a secret key when a communication session is opened, so there is almost no time limit for generating, managing and exchanging a secret key.

However, real-time voice and video information (multimedia service) are transmitted in the form of RTP packets. A technology that generates, manages, and exchanges different secret keys for each RTP packet in order to prevent real-time multimedia information from being intercepted by third parties, intervene in the middle of transmission, to prevent the change of multimedia transmission information, and to prevent MIMA. Is required.

According to the present invention, it is possible to request a switch from a normal communication session to a secure mode for secure communication between terminals, and to encrypt a voice or video packet stream to be transmitted using a packet key that only the other terminal can know. Accordingly, an object of the present invention is to provide a method and apparatus for secure communication between terminals, which can safely transmit a packet stream.

The present invention relates to a method for secure communication between a second terminal and a second terminal, wherein the communication session is established by exchanging a primitive root α with a prime number q, which is a Diffie-Hellman key exchange variable. Switching from a normal mode to a secure mode, selecting a first session secret value for a communication session of the first terminal, and using a first session secret value, the prime number q and the primitive root α Generating and transmitting a session blind key to the second terminal, receiving a second session blind key for the communication session of the second terminal from the second terminal, and using the second session blind key Generating a symmetric packet key for the transport packet of the first terminal, generating a packet key stream using the symmetric packet key, and using the packet key stream And encrypting a transport packet and transmitting the encrypted packet to the second terminal.

In the generating of the packet key stream, different packet key streams may be generated for each transport packet of the first terminal.

In addition, the first session blind key (Y _A ) and the second session blind key (Y _B ) may be defined by the following equation.

Here, X _A represents the first session secret value selected by the first terminal, and X _B represents the second session secret value selected by the second terminal.

The generating of the symmetric packet key may include selecting a packet secret value X _{A, i} for the transport packet P _{A, i} (i th transport packet belonging to a communication session of the first terminal). And a packet blind key for the transport packet using the packet secret value.

) And the symmetric packet key for the transport packet using the second session blind key Y _B

May comprise a).

The generating of the packet key stream using the symmetric packet key may include encrypting the symmetric packet key K _{A, i} by using an RC4 encryption algorithm.

) Can be created.

The encrypting of the transport packet using the packet key stream and transmitting the encrypted packet to the second terminal may include: a Real Time Protocol (RTP) header, the packet blind key (Y _{A, i} ), and the packet key stream (KS). _{a, i)} the transport packet (transport packet encrypted by encrypting the P _{a, i)} by (

RTP packet including a) may be transmitted to the second terminal.

Further, the second terminal uses the received packet blind key (Y _{A, i} ) and the second session secret value (X _B ) to provide the symmetric packet key (

) And using the obtained symmetric packet key (K _{A, i} ), the packet key stream (

) And then the encrypted transport packet (

) Is decrypted by using the obtained packet key stream (KS _{A, i} ) and a plain text transmission packet (

) Can be obtained.

In addition, the present invention provides a secure communication device installed in the first terminal for secure communication with the second terminal, the prime number q which is a Diffie-Hellman key exchange variable with the second terminal. A mode switching unit for switching the primitive root α to switch the communication session from the normal mode to the secure mode, a session secret value selecting unit for selecting a first session secret value for the communication session of the first terminal, and the first session A session blind key generator for generating a first session blind key using the secret value, the prime number q, and the primitive root α and transmitting the first session blind key to the second terminal, and a second session blind key for the communication session of the second terminal. A symmetric packet for generating a symmetric packet key for the transport packet of the first terminal using the session blind key receiving unit received from the second terminal and the second session blind key. A key generation unit, a packet key stream generation unit for generating a packet key stream using the symmetric packet key, and a packet encryption unit for encrypting the transmission packet using the packet key stream and transmitting the encrypted packet to the second terminal; Provides a secure communication device.

Here, the packet key stream generator may generate different packet key streams for each transport packet of the first terminal.

The symmetric packet key generation unit may select a packet secret value X _{A, i} for the transport packet P _{A, i} (i-th transport packet belonging to the communication session of the first terminal), and select the packet secret value. Packet blind key for the transport packet using the

), And then using the second session blind key Y _B , a symmetric packet key for the transport packet (

) Can be created.

Here, the packet key stream generation unit encrypts the symmetric packet key K _{A, i} by using an RC4 encryption algorithm to perform the packet key stream (

) Can be created.

In addition, the packet encryptor uses the Real Time Protocol (RTP) header, the packet blind key (Y _{A, i} ), and the packet key stream (KS _{A, i} ) to detect the transport packet (P _{A, i} ). Encrypted encrypted transport packet (

RTP packet including a) may be transmitted to the second terminal.

According to the method and apparatus for secure communication between terminals according to the present invention, a request for switching from a normal mode communication session to a secure mode is possible for secure communication between terminals, and a voice or video packet stream to be transmitted is transmitted to a counterpart terminal. Encrypting via a packet key that only the user knows has the advantage of transmitting the packet stream securely.

1 is a block diagram of a secure communication device installed in a terminal according to an embodiment of the present invention.

2 is a conceptual diagram illustrating a packet transmission form in a normal mode operation according to the present invention.

3 is a conceptual diagram illustrating a packet transmission form in a secure mode operation according to the present invention.

4 is a flowchart illustrating a secure communication method between terminals using FIG. 1.

5 to 6 are flowcharts corresponding to FIG. 4.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention.

The present invention provides a secure communication method capable of ensuring the security and confidentiality of transport packets during multimedia communication (ex, voice and video communication) in a terminal such as a smartphone.

In the case of the present invention, the transmitting side encrypts and transmits each packet transmitted using a different packet key during a session in a secure mode, and the receiving side decrypts using the same packet key to ensure confidentiality. For such a secure communication method, each terminal is provided with a secure communication device according to an embodiment of the present invention.

1 is a block diagram of a secure communication device installed in a terminal according to an embodiment of the present invention. The secure communication device 100 may include a mode switch 110, a session secret value selector 120, a session blind key generator 130, a session blind key receiver 140, a symmetric packet key generator 150, The packet key stream generation unit 160, the packet encryption unit 170, and the packet decryption unit 180 are included.

Since the secure communication apparatus is applied equally to the two terminals, the security operation in each terminal is performed in the same manner. Hereinafter, for convenience of description, a case in which the first terminal performs secure communication with the second terminal will be described. That is, the description will be made based on the secure communication device 100 installed in the first terminal.

First, the mode switching unit 110 secures a communication session in a normal mode by exchanging a prime number q and a primitive root α, which is a Diffie-Hellman key exchange variable. Switch to mode.

The session secret value selector 120 selects a first session secret value for a communication session of the first terminal. The session blind key generation unit 130 generates a first session blind key using the first session secret value, the prime number q, and the primitive root α and transmits the generated first session blind key to the second terminal.

The session blind key receiver 140 receives a second session blind key for the communication session of the second terminal from the second terminal. In the case of a transmission packet stream to be transmitted by the first terminal, the symmetric packet key generation unit 150 uses the second session blind key and a first packet secret value generated differently for each transmission packet to transmit the packet to the transmission packet of the first terminal. Generate a symmetric packet key for.

In addition, in the case of a received packet stream to be received by the first terminal, the symmetric packet key generation unit 150 uses the second session blind key and the first session secret value generated at the start of the security mode. 2 Generate a symmetric packet key for the received packet arriving from the terminal.

The packet key stream generation unit 160 generates a packet key stream based on the symmetric packet key. Here, a different packet key stream is generated for each transport packet of the first terminal so as to be used for packet encryption. Similarly, different packet key streams can be used for decoding for each packet for each received packet.

In addition, the packet encryptor 170 encrypts the transport packet using the packet key stream and transmits the encrypted packet to the second terminal. In addition, the packet decryption unit 180 decrypts the encrypted packet transmitted by the second terminal using a packet key stream to safely receive the encrypted packet.

2 is a conceptual diagram illustrating a packet transmission form in a normal mode operation according to the present invention. Device A and device B communicate in real time with voice or video information and correspond to the first and second terminals, respectively. The apparatuses A and

B

101 and 102 transmit bidirectional multimedia packet streams 103 and 104 to each other. The packet types 105 and 106 forming the multimedia packet stream include an RTP header portion and a payload portion carrying multimedia contents.

3 is a conceptual diagram illustrating a packet transmission form in a secure mode operation according to the present invention. The apparatuses A and

B

201 and 202 transmit the bidirectional multimedia packet streams 203 and 204 to each other. In this case, it can be seen that the

packet types

205 and 206 constituting the packet stream in FIG. 3 are different from those of the normal

mode packet types

105 and 106 described with reference to FIG. 2.

In the case of the

packet types

105 and 106 according to the normal mode operation of FIG. 2, the RTP header and the payload portion are transmitted in a form that is easy to be exposed to an enemy. However, in the case of the

packet types

205 and 206 according to the security mode operation of FIG. 3, in addition to the RTP header, Y _{A, i} (i = 1,2,3, ...) or Y _{B, j} (j = 1,2, Packet blind key represented by 3, ...), and the payload portion is encrypted in the form of E _{KSA, i} (P _{A, i} ) or E _{KSB, j} (P _{B, i} ), Ensure confidentiality of packets.

Here, Y _{A, i} and Y _{B, j} have different values for each packet. Y _{A, i} represents a packet blind key for the i th transmission packet (P _{A, i} ) transmitted by the device A, and Y _{B, j} indicates the j th transmission packet (P _{B, j} ) transmitted by the device B. Represents a packet blind key. That is, P _{A, i} denotes the payload portion of the i th packet transmitted by the device A, which is encrypted by the packet key stream K S _{A, i} E _{KSA, i} (P _{A, i} ). to be.

In an embodiment of the present invention, the RC4 algorithm is used as the encryption algorithm corresponding to E. Of course, the encryption algorithm is not necessarily limited thereto.

In FIG. 3, the packet blind keys Y _{A, i} and Y _{B, j} are exposed to the enemy, but the encrypted packet content portions, that is, E _{KSA, i} (P _{A, i} ) and E _{KSB, j} (P _{B, i} ) Is never exposed to the enemy, keeping the secure communication secure.

4 is a flowchart illustrating a secure communication method between terminals using FIG. 1. 5 to 6 are flowcharts corresponding to FIG. 4. Hereinafter, a method of securely communicating with the second terminal (device B; 502) by the first terminal (device A; 501) will be described in detail with reference to FIGS. 4 to 6. For convenience of explanation, it is assumed that the two

terminals

501 and 502 conduct a two-way audio conversation with each other.

First, a session for a call is opened between two terminals 501 and 5020 according to the SIP protocol procedure assisted by the SIP server 503 as shown in Fig. 5 (S400). Known details are omitted here.

When the call session is opened, a two-way call is made with the two-way RTP packet streams 504 and 505 being transmitted. The RTP packet streams 504 and 505 correspond to a normal mode bidirectional audio transmission without security as shown in FIG.

When the first terminal 501 wants to operate the session in the secure mode while the session is operating in the normal mode, the first terminal 501 and the Diffie-Hellman key The communication session is switched from the normal mode to the secure mode by exchanging the prime variable q and the primitive root α (S410). This step S410 is performed through the mode switching unit 110.

The step S410 will be described in more detail with reference to FIG. 5 below and FIG. 6. The first terminal 501 requests to switch the communication session from the normal mode to the secure mode through the mode switching unit 110 (S410). This request may use a separate button (physical button or touch button) provided in the first terminal 501. The first terminal 501 transmits a security mode request message to the second terminal 502 to request the switch of the security mode. At this time, the first terminal 501 needs to agree with the second terminal 502 a value (α, q), which is a variable for Diffie-Hellman key exchange. Where q is the prime in number theory and α is the primitive root of this value. When the (α, q) values are agreed between the first terminal 501 and the second terminal 502, the two

terminals

501 and 502 operate in a secure mode session with each other.

Thereafter, the session secret value selecting unit 120 of the first terminal 501 selects a first session secret value X _A for the communication session of the first terminal 501 (S420). Then, the session blind key generation unit 130 of the first terminal 501 uses the first session secret value X _A and the prime number q and the primitive root α to respectively use the first session blind key Y _A. It generates and transmits to the second terminal 502 (S430). In this case, the first session blind key (Y _A ) is

Is defined as

Of course, the second terminal 502 likewise generates a second session blind key Y _B in the same way. Accordingly, the session blind key receiving unit 140 of the first terminal 501 receives a second session blind key Y _B for the communication session of the second terminal 502 from the second terminal (S440). ). Here, the second session blind key (Y _B ) is

Is defined as Wherein, X _B denotes a second session secret value selected from the second terminal 502 at step S440. So far, both

terminals

501 and 502 have received session blind keys of each other.

Thereafter, the symmetric packet key generation unit 150 of the first terminal 501 generates a symmetric packet key for the transport packet of the first terminal 501 by using the second session blind key Y _B ( S450). This step S450 will be described in detail as follows.

First, a packet secret value X _{A, i} for the transport packet P _{A, i} (i-th transport packet belonging to the communication session of the first terminal) is selected (S450a). Then, the packet blind key for the transport packet P _{A, i} using the packet secret value X _{A, i} (

) Is generated (S450b). Then, using the second session blind key (Y _B ), a symmetric packet key for the transport packet (

) Is generated (S450c).

Then, the packet key stream generation unit 160 of the first terminal 501 generates a packet key stream using the symmetric packet keys K _{A, i} (S460). For example, the symmetric packet key (K _{A, i} ) is encrypted using an RC4 encryption algorithm so that the packet key stream (

). Steps S450 to S460 as described above correspond to a procedure necessary for configuring the RTP packet 511.

Thereafter, the packet key stream generation unit 160 of the first terminal 501 uses the packet key stream (

Encrypted transmission packet (P _{A, i} ) encrypted using

) Is transmitted to the second terminal 502 (S470). Here, to increase security, different packet key streams are generated for each transport packet of the first terminal 501.

According to this step S470, the first terminal 501 is a Real Time Protocol (RTP) header, the packet blind key (Y _{A, i} ), and the encrypted transmission packet (

RTP packet 511 including a) is transmitted to the second terminal 502. That is, in step S470 _{, the} RTP packet 511 including [RTP header + Y _{A, i} + E _{KSA, i} (P _{A, i} )] is completed and transmitted to the second terminal 502.

The present invention transmits the packet blind key every time an encrypted packet is sent, so that the packet key used for the encryption at the receiving terminal can be easily derived later. Accordingly, it is possible to ensure that a very high level of confidentiality and authentication is never occurred when voice and video packets use the same packet key.

Of course, the second terminal 502 also completes the RTP packet 512 in the same manner as described above S450 ~ S470 and transmits to the first terminal 501 (S480).

To this end, selecting the packet secret value (X _{B, j} ) for the transport packet (P _{B, j} ; j-th transport packet belonging to the communication session of the second terminal) of the second terminal 502, and Packet blind key for the transport packet P _{B, j} using the selected packet secret value (X _{B, j} ).

), And a symmetric packet key for the transport packet P _{B, j} using the first session blind key Y _A.

).

The symmetric packet key K _{B, j} is then encrypted using the RC4 encryption algorithm to

), And then the packet key stream (

Encrypted transmission packet (P _{B, j} ) encrypted using

) Is transmitted to the first terminal 501 (S480). Here, of course, different packet key streams are generated for each transport packet of the second terminal 502 to increase security. That is, in step S480, the second terminal 502 completes the RTP packet 512 including [RTP header + Y _{B, j} + E _{KSB, j} (P _{B, j} )] to the first terminal 501. send.

Meanwhile, a process (S490) for decrypting the RTP packet 511 encrypted and transmitted from the first terminal 501 by the second terminal 502 will be described below. First, the second terminal 502 first uses the received packet blind key (Y _{A, i} ) and the second session secret value (X _B ) for the symmetric packet key (

) And, using the obtained symmetric packet key (K _{A, i} ), the packet key stream (

) Thereafter, the encrypted transport packet (

) Here, the decoding algorithm also uses RC4 decoding.

As described above, the packet contents transmitted by the first terminal 501 can be easily decrypted by the second terminal 502. Since the present embodiment corresponds to bidirectional communication between two terminals, a process (S495) for decrypting the RTP packet 512 encrypted and transmitted from the second terminal 502 by the second terminal 502 may also be performed in the same principle as in S490. Have Therefore, detailed description thereof will be omitted.

According to the present invention as described above, in a communication service that transmits voice or video over a network in real time, it prevents enemy attacks such as man-in-middle-attack (MIMA; Authentication can be provided.

In other words, the present invention allows a party to switch from a normal mode communication to a secure session in which a confidentiality and authentication is guaranteed, if the multimedia communication session is open, so that the session operation in the normal mode without security functions is performed. In the meantime, you can switch the session to secure mode whenever you need according to the user's intention.

In addition, since all packets transmitted during the secure mode session are encrypted with different packet secret keys, voice and video packets never use the same secret key, thereby ensuring a very high level of confidentiality and authentication. That is, since the packet is encrypted and decrypted for each packet by using different packet keys for each packet unit for transmitting audio or video, there is an advantage of high security.

Furthermore, in the present invention, since both terminals are in real time generating and sharing a packet key in real time only in a secure mode session in which a different packet key is generated in real time for each voice and video packet, no server assistance is required for packet key generation. There is an advantage. In other words, the present invention does not require any server help to manage the packet key because both session parties share the packet key in real time. This need for server help means that even if a multimedia device such as a smart phone is connected anywhere in the world, multimedia can be easily transmitted through secure mode communication at any time while a normal mode communication session is held between the two devices. .

When such a secure communication device of the present invention is mounted on a smartphone, the smartphone will be dualized into a smartphone with security capability and a smartphone without security capability. If a smartphone with a security mode function attempts to make a call in a secure mode with a smartphone that does not have a security mode function, the setting of the security mode will fail. It can increase the needs and contribute to the expansion of the industry.

Although the present invention has been described with reference to the embodiments shown in the drawings, this is merely exemplary, and it will be understood by those skilled in the art that various modifications and equivalent other embodiments are possible. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

Claims

In the method of the first terminal secure communication between the second terminal and the terminal,

Exchanging a communication session from a normal mode to a secure mode by exchanging a primitive root α with a prime number q, a Diffie-Hellman key exchange variable, with the second terminal;

Selecting a first session secret value for the communication session of the first terminal;

Generating a first session blind key by using the first session secret value, the prime number q, and the primitive root α and transmitting the generated first blind key to the second terminal;

Receiving from the second terminal a second session blind key for a communication session of the second terminal;

Generating a symmetric packet key for a transport packet of the first terminal using the second session blind key;

Generating a packet key stream using the symmetric packet key; And

Encrypting the transport packet using the packet key stream and transmitting the encrypted packet to the second terminal.
The method according to claim 1,

Generating the packet key stream may include:

The method for secure communication between terminals generating different packet key streams for each transport packet of the first terminal.
The method according to claim 2,

The first session blind key (Y A ) and the second session blind key (Y B ) is a secure communication method between terminals defined by the following equation:

Here, X A represents the first session secret value selected by the first terminal, and X B represents the second session secret value selected by the second terminal.
The method according to claim 3,

Generating the symmetric packet key,

Selecting a packet secret value (X A, i ) for the transport packet (P A, i ; an i-th transport packet belonging to a communication session of the first terminal);

Packet blind key for the transport packet using the packet secret value (
Generating c); And

A symmetric packet key for the transport packet using the second session blind key Y B (
Generating a).
The method according to claim 4,

Generating a packet key stream using the symmetric packet key,

The symmetric packet key (K A, i ) is encrypted using an RC4 encryption algorithm so that the packet key stream (
Secure communication method between the terminals.
The method according to claim 4 or 5,

Encrypting the transmission packet using the packet key stream and transmitting the encrypted packet to the second terminal;

RTP (Real Time Protocol) header, the packet blind key (Y A, i), and the key stream packets encrypted transmission packet by encrypting the transport packet (P A, i) using the (KS A, i) (
Secure communication method between the terminals transmitting the RTP packet to the second terminal.
The method according to claim 6,

The second terminal,

Using the received packet blind key (Y A, i ) and the second session secret value (X B ) the symmetric packet key (
),

By using the obtained symmetric packet key (K A, i ), the packet key stream (
), Then

The encrypted transport packet (
) Is decrypted by using the obtained packet key stream (KS A, i ) and a plain text transmission packet (
Secure communication method between terminals.
In the secure communication device is installed in the first terminal for secure communication with the second terminal, the first terminal,

A mode switching unit for switching a communication session from a normal mode to a secure mode by exchanging a prime number q and a primitive root α which is a Diffie-Hellman key exchange variable with the second terminal;

A session secret value selecting unit selecting a first session secret value for the communication session of the first terminal;

A session blind key generation unit configured to generate a first session blind key using the first session secret value, the prime number q, and the primitive root α and transmit the generated first blind key to the second terminal;

A session blind key receiving unit receiving a second session blind key for a communication session of the second terminal from the second terminal;

A symmetric packet key generation unit for generating a symmetric packet key for a transport packet of the first terminal using the second session blind key;

A packet key stream generator for generating a packet key stream using the symmetric packet key; And

And a packet encryption unit to encrypt and transmit the transport packet to the second terminal using the packet key stream.
The method according to claim 8,

The packet key stream generation unit,

And a different packet key stream for each transport packet of the first terminal.
The method according to claim 9,

The first session blind key (Y A ) and the second session blind key (Y B ) are secure communication devices defined by the following equation:

Here, X A represents the first session secret value selected by the first terminal, and X B represents the second session secret value selected by the second terminal.
The method according to claim 10,

The symmetric packet key generation unit,

Select a packet secret value (X A, i ) for the transport packet (P A, i ; i-th transport packet belonging to the communication session of the first terminal),

Packet blind key for the transport packet using the packet secret value (
), Then

A symmetric packet key for the transport packet using the second session blind key Y B (
Secure communication device.
The method according to claim 11,

The packet key stream generation unit,

The symmetric packet key (K A, i ) is encrypted using an RC4 encryption algorithm so that the packet key stream (
Secure communication device.
The method according to claim 11 or 12,

The packet encryption unit,

RTP (Real Time Protocol) header, the packet blind key (Y A, i), and the key stream packets encrypted transmission packet by encrypting the transport packet (P A, i) using the (KS A, i) (
Secure communication device for transmitting the RTP packet to the second terminal.
The method according to claim 13,

The second terminal,

Using the received packet blind key (Y A, i ) and the second session secret value (X B ) the symmetric packet key (
),

By using the obtained symmetric packet key (K A, i ), the packet key stream (
), Then

The encrypted transport packet (
) Is decrypted by using the obtained packet key stream (KS A, i ) and a plain text transmission packet (
Secure communication devices.