Method and apparatus for verifying data packet integrity in a streaming data channel

Disclosed is a method for verifying data packet integrity in a streaming-data channel. In the method, data packets are received from the streaming-data channel. Each data packet includes a data payload and a corresponding message integrity code. The received data packets are processed in a first processing mode, wherein the received data packets are forwarded to an application module before checking the integrity of the data packets using the respective message integrity codes. An integrity-check-failure measurement is generated for monitoring an integrity-check-failure rate in the first processing mode. If the integrity-check-failure measurement exceeds an integrity-check threshold, then the method transitions to a second processing mode. A received data packet is forwarded to the application module in the second processing mode only after passing the integrity check.

BACKGROUND

The present invention relates generally to wireless communications, and more specifically to data security in a streaming data channel.

The field of communications has many applications including, e.g., paging, wireless local loops, Internet telephony, and satellite communication systems. An exemplary application is a cellular telephone system for mobile subscribers. (As used herein, the term “cellular” system encompasses both cellular and personal communications services (PCS) system frequencies.) Modern communication systems, such as a wireless communication system, designed to allow multiple users to access a common communications medium have been developed for such cellular systems. These modern communication systems may be based on multiple access techniques such as code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), space division multiple access (SDMA), polarization division multiple access (PDMA), or other modulation techniques known in the art. These modulation techniques demodulate signals received from multiple users of a communication system, thereby enabling an increase in the capacity of the communication system. In connection therewith, various wireless communication systems have been established including, e.g., Advanced Mobile Phone Service (AMPS), Global System for Mobile communication (GSM), and other wireless systems.

In FDMA systems, the total frequency spectrum is divided into a number of smaller sub-bands and each user is given its own sub-band to access the communication medium. Alternatively, in TDMA systems, the total frequency spectrum is divided into a number of smaller sub-bands, each sub-band is shared among a number of users, and each user is allowed to transmit in predetermined time slots using that sub-band. A CDMA system provides potential advantages over other types of systems, including increased system capacity. In CDMA systems, each user is given the entire frequency spectrum for all of the time, but distinguishes its transmission through the use of a unique code.

In lower power wireless standards, such as Bluetooth or other technologies that may permit an extremely low-power personal network, packet-level data integrity protection is either unavailable or only optional. When packet-level integrity information is available, existing approaches fail to provide a combination of timely security and real-time performance.

There is therefore a need in the art for adequate real-time performance in combination with effective packet-level data integrity protection in a relatively low-power and/or bandwidth-limited streaming data channel.

SUMMARY

An aspect of the present invention may reside in a method for verifying data packet integrity in a streaming data channel. In the method, data packets are received from the streaming-data channel. Each data packet includes a data payload and a corresponding message integrity code. The received data packets are processed in a first processing mode, wherein the received data packets are forwarded to an application module before checking the integrity of the data packets using the respective message integrity codes. An integrity-check-failure measurement is generated for monitoring an integrity-check-failure rate in the first processing mode. If the integrity-check-failure measurement exceeds an integrity-check threshold, then the method transitions to a second processing mode. A received data packet is forwarded to the application module in the second processing mode only after passing the integrity check.

In more detailed aspects of the invention, a reception time for receiving a data packet over a bandwidth-limited streaming data channel may exceed a noticeable delay time, or may exceed about 50 milliseconds. The power consumed in the first processing mode may less than the power consumed in the second processing mode. The first processing mode may be performed using an application specific integrated circuit (ASIC), and second processing mode may be performed using a programmable processor.

In other more detailed aspects of the invention, the integrity check failure measurement may be a count of each data packet failing the integrity check in the first processing mode. The integrity-check threshold may comprise one data packet failing the integrity check, or it may comprise at least two consecutive data packets failing the integrity check. In the second processing mode, a data packet having failed an integrity check may be discarded, or may be analyzed for a security assessment. The application module may include an audio processing circuit.

Further, the method may include generating an integrity-check-success measurement for monitoring an integrity-check-success rate in the second processing mode. If the integrity-check-success measurement exceeds an integrity-check-success threshold, then the method may transition to the first processing mode.

Another aspect of the invention may reside in an apparatus for verifying data packet integrity in a streaming-data channel, comprising: means for receiving data packets from the streaming-data channel, wherein each data packet comprises a data payload and a corresponding message integrity code; means for processing the received data packets in a first processing mode, wherein the received data packets are forwarded to an application module before checking the integrity of the data packets using the respective message integrity codes; means for generating an integrity-check-failure measurement for monitoring an integrity check-failure-rate in the first processing mode; and means for transitioning to a second processing mode if the integrity-check-failure measurement exceeds an integrity-check threshold, wherein, in the second processing mode, a received data packet is forwarded to the application module only after passing the integrity check. The apparatus may comprise a watch, a headset, or a sensing device, for wireless communication.

Yet another aspect of the invention may reside is computer program product comprising computer readable medium comprising: code for causing a computer to receive data packets from a streaming data channel wherein each data packet comprises a data payload and a corresponding message integrity code, code for causing a computer to processing received data packets in a first processing mode wherein the received data packets are forwarded to an application module before checking the integrity of the data packets using the respective message integrity codes, code for causing a computer to generate an integrity-check-failure measurement for monitoring an integrity-check-failure rate in the first processing mode, and code for causing a computer to transition to a second processing mode if the integrity-check-failure measurement exceeds an integrity-check threshold, wherein, in the second processing mode, a received data packet is forwarded to the application module only after passing the integrity check.

Another aspect of the invention may reside in an apparatus, for verifying data packet integrity in a streaming-data channel, comprising a receiver, a first processor, and a second processor. The receiver is configured to receive data packets from the streaming-data channel, wherein each data packet includes a data payload and a corresponding message integrity code. The first processor is configured to process the received data packets in a first processing mode, wherein the received data packets are forwarded to an application module before checking the integrity of the data packets using the respective message integrity codes, generate an integrity-check-failure measurement for monitoring an integrity-check-failure rate in the first processing mode, and transition to a second processing mode performed by second processor if the integrity-check-failure measurement exceeds an integrity-check threshold. The second processor is configured to forward a received data packet to the application module, in the second processing mode, only after the received packet passes an integrity check.

DETAILED DESCRIPTION

A remote station, also known as a mobile station (MS), an access terminal (AT), user equipment or subscriber unit, may be mobile or stationary, and may communicate with one or more base stations, also known as base transceiver stations (BTSs) or node Bs. A remote station transmits and receives data packets through one or more base stations to a base station controller, also known as radio network controllers (RNCs). Base stations and base station controllers are parts of a network called an access network. An access network transports data packets between multiple remote stations. The access network may be further connected to additional networks outside the access network, such as a corporate intranet or the Internet, and may transport data packets between each remote station and such outside networks. A remote station that has established an active traffic channel connection with one or more base stations is called an active remote station, and is said to be in a traffic state. A remote station that is in the process of establishing an active traffic channel connection with one or more base stations is said to be in a connection setup state. A remote station may be any data device that communicates through a wireless channel. A remote station may further be any of a number of types of devices including but not limited to PC card, compact flash, external or internal modem, or wireless phone. The communication link through which the remote station sends signals to the base station is called an uplink, also known as a reverse link. The communication link through which a base station sends signals to a remote station is called a downlink, also known as a forward link.

With reference toFIG. 1, a wireless communication system100includes one or more wireless mobile stations (MS)102, one or more base stations (BS)104, one or more base station controllers (BSC)106, and a core network108. Core network may be connected to an Internet110and a Public Switched Telephone Network (PSTN)112via suitable backhauls. A typical wireless mobile station may include a handheld phone, or a laptop computer. Wireless communication system100may employ any one of a number of multiple access techniques such as code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), space division multiple access (SDMA), polarization division multiple access (PDMA), or other modulation techniques known in the art.

With reference toFIG. 2, a mobile station240, such as a mobile phone, may transmit data packets to a low-power receiving RX device250over a streaming data channel210. The RX device may further include a data store260, such as a memory device, and an application module270. In other configurations, the receiving RX device may be a mobile phone, audio headset, video player, or similar audio/video device. Further, the transmitting TX device240may be a radio, music player, personal digital assistant (PDA), mobile phone, or the like. Further, each device may be configured with both a TX device and an RX device to communicate in a duplex mode over separate streaming-data channels. Further, the wireless devices,240and250, may be peer devices in, for example, a low-power, low-latency peer-to-peer network.

With reference toFIGS. 3 and 4, an aspect of the present invention may reside in a method300for verifying data packet integrity in a streaming-data channel210. In the method, data packets400are received from the streaming-data channel (step310). Each data packet includes a data payload and a corresponding message integrity code MIC. The received data packets are processed in a first processing mode320, wherein the received data packets are forwarded to an application module270(step330) before checking the integrity of the data packets using the respective message integrity codes (step340). An integrity-check-failure measurement is generated for monitoring an integrity-check-failure rate in the first processing mode (step350). If the integrity-check-failure measurement exceeds an integrity-check threshold (step360), then the method transitions to a second processing mode370. A received data packet is forwarded to the application module (step390) in the second processing mode only after passing the integrity check (step380).

In more detailed aspects of the invention, a reception time for receiving a data packet400over the streaming-data channel210may exceed a noticeable delay time, or may exceed about 50 milliseconds. The power consumed in the first processing mode may be less than the power consumed in the second processing mode. As examples, the first processing mode may be performed using dedicated hardware220, such as an application specific integrated circuit (ASIC), and second processing mode is performed using a programmable processor230, such as an ARM processor. The MIC may be based on a hash of the data payload and a secret key.

Further, the method300may include generating an integrity-check-success measurement for monitoring an integrity-check-success rate in the second processing mode370. If the integrity-check-success measurement exceeds an integrity-check-success threshold, then the method may transition to the first processing mode320.

The present invention allows real-time performance while maintaining data integrity and security. For a data packet400-N with a payload #N, T1is the start time for receiving the payload, T2is the start time for receiving the MIC #N, and T3is the start time for verifying the MIC. In the first processing mode320, the data in the payload #N is delivered to the application layer or module270during the time between T1and T2, rather than waiting for time T3. If the MIC verification fails, then the device may transition to the second processing mode370before time T4and the reception of the payload #N+1. The combination of the channel bandwidth and the packet size determines the delay between times T1and T3.

As an example of an application in which real-time response is very important is a wireless headset (RX device250) connected to a mobile phone or station240. The headset must get an audio signal from the phone and perform noise/echo cancellation in real time. A delay caused by headset processing should not be noticed during a phone conversation. Thus, it is desirable to reduce transmission and processing delay.

The headset receives the audio data from the mobile phone in the form of streaming data packets. Authentication of the data packets ensures that the packets come from the phone and not from a hacker or the like. A message integrity code (MIC) is generated by the mobile phone and attached to the end of a respective packet400. The MIC covers all of the authenticated data. The mobile phone (transmitter TX) and the headset (receiver RX) share a secret key for message authentication so that only the mobile phone can create a MIC and only the headset can verify the MIC after having received the data packet over the streaming-data channel210. Advantageously, the data rate of the channel210may be bandwidth limited to save power, reduce clock drift, etc.

A hacker may attempt to introduce counterfeit data packets by another wireless signal260. It is assumed that the hacker may modify the payload but cannot control its content. This assumption is valid when the payload is encrypted. For streaming data, it desirable to use a stream cipher or a block cipher in counter mode for encryption.

In one aspect of the invention, the receiving device250determines when to verify the MIC field based on the validity of a previous packet400. If a previous data packet contained a valid MIC, the MIC in the current packet is verified after the payload is delivered to an upper or application layer or module270. If the previous packet contains a fake MIC, the MIC in the current packet is verified before the payload is delivered to the application module or upper layer.

For example, inFIG. 4, the MIC field of packet #N is checked before the processing of packet #N+1. If the MIC for packet #N is valid, the payload of packet #N+1 is delivered at time T4since it is highly likely that packet #N+1 is also valid. As a result, the delay from T4to T6may be avoided for improved real-time performance. However, if packet N+1 is found to be invalid at time T6, the next packet may be invalid. Therefore, the payload of packet #N+2 may not be delivered until its MIC is validated at time T9. The delivery of the payload of packet #N+2 depends on the MIC verification result. If the packet #N+2 passes the MIC check at time T9, the application module may skip this particular packet to reduce latency and prepare for real-time processing of the next packet #N+3 (not shown). The corrupted or illicit packet #N+1 may affect performance (e.g., noise in the headset). However, the delay from T7to T9does not further affect performance since no sound is generally better than annoying noise.

Annoying noise events may come from burst errors or fabricated data, rather than from common transmission errors. Fabricated data may pass error detection based on, for example, a CRC check, but it cannot circumvent the MIC verification. However, the MIC verification catches both fabricated data and transmission errors. To lower system sensitivity to common transmission errors, such as a few single bit errors in a long packet, two methods may be undertaken. In one, an error correcting technique may be used before MIC verification. In another, the decision on when to verify the MIC filed may be based on the validity of several previous packets. For example, the MIC is verified first if a certain continuous number of previous packets fail MIC verification.

For example, the integrity-check-failure measurement may be a count of each data packet400failing the integrity check in the first processing mode320. The integrity-check threshold may comprise one data packet failing the integrity check, or it may comprise at least two consecutive data packets failing the integrity check.

With reference toFIG. 5, a flow chart500is shown of packet processing in the low-power receiving device250. The processor230configures the dedicated hardware220for automated processing (step510). The processor enters a dormant state thus lowering the power consumption of the low-power receiving device250(step520). The dedicated hardware decodes the source data packets400received over the streaming-data channel210(step530). In accordance with the first processing mode320, the data packets are forwarded to the application module or layer270for play in real time (step540). The dedicated hardware checks for the end of the packet and continues decoding and playing data in the packet until the end of the packet is reached (step550). After the complete data payload and MIC are received, the MIC is verified (step560). If the MIC matches (step570), the device is prepared to receive the next data packet400(step580). If the MIC does not match, the device wakes up the processor (step590) and the device enters the second processing mode370. The processor handles the MIC failure (step600) as described above with respect toFIG. 3. If the failure is not recoverable (step610), further error handling is performed to determine, for example, whether a security threat exists (step620). If the failure is recoverable, such as a one time MIC failure, then the processor determines whether the data channel needs to be reset (step630). If not, the process continues at step520where the processor enters the dormant state and the device transitions back to the first processing mode320. Otherwise, the processor reinitializes the device by returning to step510. The dedicated hardware (e.g. ASIC) has good power efficiency.

In the second processing mode370, a data packet having failed an integrity check may discarded, or may be analyzed for a security assessment. For example, one MIC failure may be a chance error. Two MIC failures may be a coincidence. However, three MIC failure may be indicate that an attack is under way.

The application module may include an audio processing circuit. The noticeable delay time may depend on the application. For example, an activity such as listening to music may be more tolerant of delays over an activity involving a telephone conversation.

Another aspect of the invention may reside in an apparatus250for verifying data packet integrity in a streaming-data channel210. The apparatus includes means for receiving data packets400from the streaming-data channel210wherein each data packet comprises a data payload and a corresponding message integrity code MIC, means for processing the received data packets in a first processing mode320wherein the received data packets are forwarded to an application module270before checking the integrity of the data packets using the respective message integrity codes, means for generating an integrity-check-failure measurement for monitoring an integrity-check-failure rate in the first processing mode, and means for transitioning to a second processing mode370if the integrity-check-failure measurement exceeds an integrity-check threshold, wherein, in the second processing mode, a received data packet is forwarded to the application module only after passing the integrity check.

Yet another aspect of the invention may reside is computer program product comprising computer readable medium (e.g., data store260) comprising code for causing a computer (e.g., processor230) to receive data packets400from a streaming-data channel210, wherein each data packet comprises a data payload and a corresponding message integrity code MIC, code for causing a computer to processing received data packets in a first processing mode320wherein the received data packets are forwarded to an application module270before checking the integrity of the data packets using the respective message integrity codes, code for causing a computer to generate an integrity-check-failure measurement for monitoring an integrity-check-failure rate in the first processing mode, and code for causing a computer to transition to a second processing mode370if the integrity-check-failure measurement exceeds an integrity-check threshold, wherein, in the second processing mode, a received data packet is forwarded to the application module only after passing the integrity check.

A wireless device may include various components that perform functions based on signals that are transmitted by or received at the wireless device. For example, a wireless headset may include a transducer adapted to provide an audio output based on a signal received via the receiver. A wireless watch may include a user interface adapted to provide an indication based on a signal received via the receiver. A wireless sensing device may include a sensor adapted to provide data to be transmitted to another device.

A wireless device may communicate via one or more wireless communication links that are based on or otherwise support any suitable wireless communication technology. For example, in some aspects a wireless device may associate with a network. In some aspects the network may comprise a body area network or a personal area network (e.g., an ultra-wideband network). In some aspects the network may comprise a local area network or a wide area network. A wireless device may support or otherwise use one or more of a variety of wireless communication technologies, protocols, or standards such as, for example, CDMA, TDMA, OFDM, OFDMA, WiMAX, and Wi-Fi. Similarly, a wireless device may support or otherwise use one or more of a variety of corresponding modulation or multiplexing schemes. A wireless device may thus include appropriate components (e.g., air interfaces) to establish and communicate via one or more wireless communication links using the above or other wireless communication technologies. For example, a device may comprise a wireless transceiver with associated transmitter and receiver components (e.g., a transmitter and a receiver) that may include various components (e.g., signal generators and signal processors) that facilitate communication over a wireless medium.

The teachings herein may be incorporated into (e.g., implemented within or performed by) a variety of apparatuses (e.g., devices). For example, one or more aspects taught herein may be incorporated into a phone (e.g., a cellular phone), a personal data assistant (“PDA”), an entertainment device (e.g., a music or video device), a headset (e.g., headphones, an earpiece, etc.), a microphone, a medical device (e.g., a biometric sensor, a heart rate monitor, a pedometer, an EKG device, etc.), a user I/O device (e.g., a watch, a remote control, a light switch, a keyboard, a mouse, etc.), a tire pressure monitor, a computer, a point-of-sale device, an entertainment device, a hearing aid, a set-top box, or any other suitable device.

In some aspects a wireless device may comprise an access device (e.g., a Wi-Fi access point) for a communication system. Such an access device may provide, for example, connectivity to another network (e.g., a wide area network such as the Internet or a cellular network) via a wired or wireless communication link. Accordingly, the access device may enable another device (e.g., a Wi-Fi station) to access the other network or some other functionality. In addition, it should be appreciated that one or both of the devices may be portable or, in some cases, relatively non-portable.