ABSTRACT
Abstract
A key agreement protocol between a first party and a second party comprises the following steps from the first party perspective. An encrypted first random key component is sent to the second party, the first random key component being encrypted using a public key of the second party in accordance with an identity based encryption operation. An encrypted random key component pair is received from the second party, the random key component pair being formed from the first random key component and a second random key component computed at the second party, and encrypted at the second party using a public key of the first party in accordance with the identity based encryption operation. The second random key component, in encrypted form, is sent to the second party, the second random key component being encrypted using the public key of the second party. A key for use in subsequent communications between the first party and the second party is computable at the first party based on the second random key component. The key may be computed at the second party based on the first random key component.
Description
FIELD OF THE INVENTION
The present invention relates generally to cryptography and, more particularly, to an improved identity based authenticated key agreement protocol.
BACKGROUND OF THE INVENTION
Cryptography is a well-known technique for providing secure communication between two or more parties. Authenticated Key Agreement is a cryptographic protocol where two or more participants, authenticate each other and agree on a key for future communication. These protocols could be symmetric key or asymmetric public key protocols. Recall that symmetric key protocols require an out-of-band security mechanism to bootstrap a secret key, while public key protocols require certificates and large scale public key infrastructure (PKI). Clearly, public key methods are a bit more flexible, however, the requirement of certificates and a large scale public key infrastructure has proved to be challenging.
Recently, Identity Based Encryption (IBE) protocols have been proposed as a viable alternative to public key methods by simplifying the PKI requirements and replacing them with a simple Key Generation Function (KGF) to generate private keys. However, one significant limitation of existing IBE methods is that the KGF can end up being a de-facto key escrow server with undesirable consequences. That is, since the KGF in the existing IBE protocol generates each private key used in the protocol, KGF can therefore decrypt all exchanges. This is an undesirable consequence since if KGF was compromised by an intruder, then exchanges between the two parties operating under the protocol would be compromised as well.
Thus, a need exists for an improved identity based authenticated key agreement protocol.
SUMMARY OF THE INVENTION
Embodiments of the invention provide an improved identity based authenticated key agreement protocol.
For example, in one embodiment, a method for performing an identity based authenticated key agreement protocol between a computer system of a first party (the first party) and a computer system of a second party (the second party) comprises the following steps. An encrypted first random key component is sent from the first party to the second party, the first random key component having been computed at the first party and encrypted using a public key of the second party in accordance with an identity based encryption operation. An encrypted random key component pair is received at the first party from the second party, the random key component pair having been encrypted at the second party using a public key of the first party in accordance with the identity based encryption operation, and the random key component pair having been formed from the first random key component and a second random key component computed at the second party. The second random key component, in encrypted form, is sent from the first party to the second party, the second random key component having been encrypted using the public key of the second party in accordance with the identity based encryption operation. A key for use in subsequent communications between the first party and the second party is computable at the first party based on the second random key component. The key may be computed at the second party based on the first random key component.
Advantageously, embodiments of the invention provide an identity based authenticated key agreement protocol which does not suffer from the key escrow problem. Moreover, the protocol also provides perfect forward and backwards secrecy since computed key information is unrelated to any past or future authenticated key agreement sessions. Additionally, embodiments of the invention may be applied to various key agreement applications, by way of example only, end-to-end key agreement for applications over wired/wireless networks, and key agreement for networking protocols such as secure proxy based route optimization protocols.
These and other objects, features and advantages of the present invention will become apparent from the following detailed description of illustrative embodiments thereof, which is to be read in connection with the accompanying drawings.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 is a flow diagram illustrating an identity based authenticated key agreement protocol in accordance with an embodiment of the present invention; and
FIG. 2 is a block diagram illustrating a generalized hardware architecture of a data network and computer systems suitable for implementing one or more of the protocols according to embodiments of the present invention.
DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS
For ease of reference, the detailed description is divided as follows. An overview is provided of Identity Based Encryption (IBE) (section I). A review is provided of some examples of key agreement protocols including one involving IBE which has an inherent key escrow problem (section II). Embodiments of an improved identity based authenticated key agreement protocol according to the invention are then described in detail (section III) followed by a description of some illustrative applications (section IV). An illustrative computing system for implementing an improved identity based authenticated key agreement protocol according to the invention is then described (section V).
I. Identity Based Encryption
An Identity Based Encryption protocol was presented by Boneh and Franklin, see Dan Boneh, Matthew K. Franklin, âIdentity-Based Encryption from the Weil Pairingâ Advances in CryptologyâProceedings of CRYPTO 2001 (2001), the disclosure of which is incorporated by reference herein. This asymmetric cryptographic encryption protocol allows participants to use an âidentityâ (example: email-id, or domain name) as the public key and eliminates the need for large scale public key infrastructure which is often associated with public key encryption methods such as RSA (Rivest, Shamir and Adleman). Boneh and Franklin's approach to the problem uses bilinear maps on an elliptic curve over a finite field, and relies on the bilinear decisional Diffie-Hellman problem.
The protocol involves the following mathematical tools and parameters:
Let E be an elliptic curve over a finite field F, and let P be a point of large prime order.
Let e: EÃEââG be a bi-linear map on E. The typical example is the Weil pairing, and hence G will be the group of n-th roots of unity where n is a function of the number of points on E over F.
Let s be a non-zero positive integer and be a secret stored in a Key Generation Function (KGF). This is a system-wide secret and not revealed outside the KGF.
Let P pub =sP be the public key of the system that is known to all participants. Recall sP denotes a point in E, since E is a group.
Let H 1 be a known hash function that takes a string and assigns it to a point on the elliptic curve, i.e., H 1 (A)=Q A on E, where A is usually the identity, and is also the public key of A.
Let d A =sQ A be the private key computed by the KGF and delivered only to A.
Let H 2 be a known hash function that takes an element of G and assigns it to a string.
Let m be a message that has to be encrypted and sent to A. The encryption function described by Boneh and Franklin is as follows:
Let g A =e(Q A , P pub ), and let r be a random number.
Encryption A (m)=(rP, m xor H 2 (g A r )); in other words the encryption output of m has two coordinates u and v where u=rP and v=m xor H 2 (g A r ). Note that âxorâ refers to the exclusive OR logic function.
In order to decrypt (u,v), A recovers m using the following formula:
m=v xor H 2 ( e ( d A ,u )).
The proof of the formula is a straight forward exercise in bilinear maps, and the fact A has the secret d A (private key known only to A but not other participants). Also observe that the KGF, which computed d A in the first place, can also decrypt the message resulting in the KGF being a de-facto key escrow server.
II. Key Agreement Protocols
There are primarily two categories of key agreement protocolsâsymmetric and asymmetric. Symmetric key agreement protocols rely on a secret key being shared between participants, and asymmetric key agreement protocols do not require participants to have any form of prior communications. Until recently, public key based key agreement protocols were the only asymmetric key agreement protocols, but the situation has since changed with the popularity of IBE based protocols. Examples of key agreement protocols are now provided.
Symmetric key based key agreement protocols are extremely popular. A typical example is the Authenticated Key Agreement (AKA) protocol used in 3G wireless systems. This is an example of a mutual authentication and session key agreement protocol based on a symmetric root key between the mobile subscriber's SIM (subscriber identification module) card and the home subscriber server. As pointed out above, symmetric key based key exchange protocols require the provisioning of a secret key between the participating entities.
Public key based key agreement protocols are used in many network layer and transport layer protocols and are based on certificates of public keys issued by a certificate authority. Examples include the public key version of the Internet Key Exchange (IKE) protocol used to derive a session key for IP (Internet Protocol) layer security protocols commonly referred to as IPsec. Another example is the key agreement protocol used in Secure Shell. All public key protocols used in an open setting require the use of certificates and a PKI.
Identity based key exchange protocols are gaining in popularity, and a simple example of an existing identity based protocol proposed for end-to-end encryption is where the entity originating the communication chooses a random key and encrypts it using the public key of the receiver and then transmits it. This transmission over an open network is secure because only the receiver can decrypt the message which contains the key. This existing protocol, while simple enough, does not authenticate the users prior to key exchange and suffers from the key escrow problems already described.
III. Identity Based Authenticated Key Agreement
In the illustrative embodiment described here, the basic set up for this protocol involves the mathematical constructs and parameters discussed in section I. Recall that this protocol is asymmetric but does not require any PKI support; instead the protocol employs an offline server which serves as a Key Generation Function. The details of the protocol are outlined below:
Suppose A, B are the two entities (or parties, where A represents a computer system of a first party and B represents a computer system of a second party) that are attempting to authenticate and agree on a key.
We will use A and B to represent their corresponding identities, which by definition also represent their public keys.
Let H 1 (A)=Q A and H 1 (B)=Q B be the respective points on the elliptic curve corresponding to the public keys. In effect, one could refer to Q A and Q B as the public keys as well, since there is a one-to-one correspondence between the identities and the points on the curve obtained by applying H 1 .
Let x be a random number chosen by A, and let y be a random number chosen by B.
FIG. 1 illustrates the protocol exchanges between A and B. The protocol exchange 100 comprises of the following steps:
A computes xP (i.e., P added to itself x times as a point on E, using the addition law on E) encrypts it using B's public key, and transmits it to B in step 102 . In this step, encryption refers to identity based encryption described in section I above.
Upon receipt of the encrypted message, B decrypts the message and obtains xP. Subsequently B computes yP, and encrypts the pair {xP, yP} using A's public key and then transmits it to A in step 104 .
Upon receipt of this message, A decrypts the message and obtains yP. Subsequently, A encrypts yP using B's public key and sends it back to B in step 106 .
Following this, both A and B compute xyP as the session key.
Observe that A chose x randomly, and received yP in the second step of the protocol exchange. This allows A to compute xyP by adding yP to itself x times. Conversely, B chose y randomly, and received xP in the first step of the protocol exchange. This allows B to compute xyP by adding xP to itself y times. Note that any application of the protocol may utilize header data with the identities to ensure proper functioning of the protocol. This is relatively standard and applicable to almost any protocol exchange for key agreement.
Note also that x is random but xP provides no information about x. Therefore, xP is a component of a key based on a random secret chosen by A. Likewise, y is random but yP provides no information about y. Hence, yP is a component of a key based on a random secret known only to B.
Note further that xyP can serve as a session key. Also, the session key could be any known function of xyP. That is, the session key could equal f(xyP), where f is known to both parties and is not required to be secret (i.e., known to the world). One practical requirement on f should be that f is hard to compute without knowledge of x or y, and the output is of a satisfactory length from a cryptographic perspective, e.g., around 128 bits or more.
Some of the properties of the protocol include:
Immunity from key escrow: Observe that all the steps in the protocol exchange are encrypted using IBE. So clearly the KGF can decrypt all the exchanges. However, the KGF can not compute the session key. This is because of the hardness of the elliptic curve Diffie-Hellman problem. In other words, given xP and yP, it is computationally hard to compute xyP.
Mutually Authenticated Key Agreement: Observe that all the steps in the protocol exchange are encrypted using IBE. In particular, only B can decrypt the contents of the message sent by A in steps
102 and 106 , and similarly only A can decrypt the contents of the message sent by B in step 104 . Moreover, at the end of step</
FIELD OF THE INVENTION
The present invention relates generally to cryptography and, more particularly, to an improved identity based authenticated key agreement protocol.
BACKGROUND OF THE INVENTION
Cryptography is a well-known technique for providing secure communication between two or more parties. Authenticated Key Agreement is a cryptographic protocol where two or more participants, authenticate each other and agree on a key for future communication. These protocols could be symmetric key or asymmetric public key protocols. Recall that symmetric key protocols require an out-of-band security mechanism to bootstrap a secret key, while public key protocols require certificates and large scale public key infrastructure (PKI). Clearly, public key methods are a bit more flexible, however, the requirement of certificates and a large scale public key infrastructure has proved to be challenging.
Recently, Identity Based Encryption (IBE) protocols have been proposed as a viable alternative to public key methods by simplifying the PKI requirements and replacing them with a simple Key Generation Function (KGF) to generate private keys. However, one significant limitation of existing IBE methods is that the KGF can end up being a de-facto key escrow server with undesirable consequences. That is, since the KGF in the existing IBE protocol generates each private key used in the protocol, KGF can therefore decrypt all exchanges. This is an undesirable consequence since if KGF was compromised by an intruder, then exchanges between the two parties operating under the protocol would be compromised as well.
Thus, a need exists for an improved identity based authenticated key agreement protocol.
SUMMARY OF THE INVENTION
Embodiments of the invention provide an improved identity based authenticated key agreement protocol.
For example, in one embodiment, a method for performing an identity based authenticated key agreement protocol between a computer system of a first party (the first party) and a computer system of a second party (the second party) comprises the following steps. An encrypted first random key component is sent from the first party to the second party, the first random key component having been computed at the first party and encrypted using a public key of the second party in accordance with an identity based encryption operation. An encrypted random key component pair is received at the first party from the second party, the random key component pair having been encrypted at the second party using a public key of the first party in accordance with the identity based encryption operation, and the random key component pair having been formed from the first random key component and a second random key component computed at the second party. The second random key component, in encrypted form, is sent from the first party to the second party, the second random key component having been encrypted using the public key of the second party in accordance with the identity based encryption operation. A key for use in subsequent communications between the first party and the second party is computable at the first party based on the second random key component. The key may be computed at the second party based on the first random key component.
Advantageously, embodiments of the invention provide an identity based authenticated key agreement protocol which does not suffer from the key escrow problem. Moreover, the protocol also provides perfect forward and backwards secrecy since computed key information is unrelated to any past or future authenticated key agreement sessions. Additionally, embodiments of the invention may be applied to various key agreement applications, by way of example only, end-to-end key agreement for applications over wired/wireless networks, and key agreement for networking protocols such as secure proxy based route optimization protocols.
These and other objects, features and advantages of the present invention will become apparent from the following detailed description of illustrative embodiments thereof, which is to be read in connection with the accompanying drawings.
BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 is a flow diagram illustrating an identity based authenticated key agreement protocol in accordance with an embodiment of the present invention; and
FIG. 2 is a block diagram illustrating a generalized hardware architecture of a data network and computer systems suitable for implementing one or more of the protocols according to embodiments of the present invention.
DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS
For ease of reference, the detailed description is divided as follows. An overview is provided of Identity Based Encryption (IBE) (section I). A review is provided of some examples of key agreement protocols including one involving IBE which has an inherent key escrow problem (section II). Embodiments of an improved identity based authenticated key agreement protocol according to the invention are then described in detail (section III) followed by a description of some illustrative applications (section IV). An illustrative computing system for implementing an improved identity based authenticated key agreement protocol according to the invention is then described (section V).
I. Identity Based Encryption
An Identity Based Encryption protocol was presented by Boneh and Franklin, see Dan Boneh, Matthew K. Franklin, âIdentity-Based Encryption from the Weil Pairingâ Advances in CryptologyâProceedings of CRYPTO 2001 (2001), the disclosure of which is incorporated by reference herein. This asymmetric cryptographic encryption protocol allows participants to use an âidentityâ (example: email-id, or domain name) as the public key and eliminates the need for large scale public key infrastructure which is often associated with public key encryption methods such as RSA (Rivest, Shamir and Adleman). Boneh and Franklin's approach to the problem uses bilinear maps on an elliptic curve over a finite field, and relies on the bilinear decisional Diffie-Hellman problem.
The protocol involves the following mathematical tools and parameters:
Let E be an elliptic curve over a finite field F, and let P be a point of large prime order.
Let e: EÃEââG be a bi-linear map on E. The typical example is the Weil pairing, and hence G will be the group of n-th roots of unity where n is a function of the number of points on E over F.
Let s be a non-zero positive integer and be a secret stored in a Key Generation Function (KGF). This is a system-wide secret and not revealed outside the KGF.
Let P pub =sP be the public key of the system that is known to all participants. Recall sP denotes a point in E, since E is a group.
Let H 1 be a known hash function that takes a string and assigns it to a point on the elliptic curve, i.e., H 1 (A)=Q A on E, where A is usually the identity, and is also the public key of A.
Let d A =sQ A be the private key computed by the KGF and delivered only to A.
Let H 2 be a known hash function that takes an element of G and assigns it to a string.
Let m be a message that has to be encrypted and sent to A. The encryption function described by Boneh and Franklin is as follows:
Let g A =e(Q A , P pub ), and let r be a random number.
Encryption A (m)=(rP, m xor H 2 (g A r )); in other words the encryption output of m has two coordinates u and v where u=rP and v=m xor H 2 (g A r ). Note that âxorâ refers to the exclusive OR logic function.
In order to decrypt (u,v), A recovers m using the following formula:
m=v xor H 2 ( e ( d A ,u )).
The proof of the formula is a straight forward exercise in bilinear maps, and the fact A has the secret d A (private key known only to A but not other participants). Also observe that the KGF, which computed d A in the first place, can also decrypt the message resulting in the KGF being a de-facto key escrow server.
II. Key Agreement Protocols
There are primarily two categories of key agreement protocolsâsymmetric and asymmetric. Symmetric key agreement protocols rely on a secret key being shared between participants, and asymmetric key agreement protocols do not require participants to have any form of prior communications. Until recently, public key based key agreement protocols were the only asymmetric key agreement protocols, but the situation has since changed with the popularity of IBE based protocols. Examples of key agreement protocols are now provided.
Symmetric key based key agreement protocols are extremely popular. A typical example is the Authenticated Key Agreement (AKA) protocol used in 3G wireless systems. This is an example of a mutual authentication and session key agreement protocol based on a symmetric root key between the mobile subscriber's SIM (subscriber identification module) card and the home subscriber server. As pointed out above, symmetric key based key exchange protocols require the provisioning of a secret key between the participating entities.
Public key based key agreement protocols are used in many network layer and transport layer protocols and are based on certificates of public keys issued by a certificate authority. Examples include the public key version of the Internet Key Exchange (IKE) protocol used to derive a session key for IP (Internet Protocol) layer security protocols commonly referred to as IPsec. Another example is the key agreement protocol used in Secure Shell. All public key protocols used in an open setting require the use of certificates and a PKI.
Identity based key exchange protocols are gaining in popularity, and a simple example of an existing identity based protocol proposed for end-to-end encryption is where the entity originating the communication chooses a random key and encrypts it using the public key of the receiver and then transmits it. This transmission over an open network is secure because only the receiver can decrypt the message which contains the key. This existing protocol, while simple enough, does not authenticate the users prior to key exchange and suffers from the key escrow problems already described.
III. Identity Based Authenticated Key Agreement
In the illustrative embodiment described here, the basic set up for this protocol involves the mathematical constructs and parameters discussed in section I. Recall that this protocol is asymmetric but does not require any PKI support; instead the protocol employs an offline server which serves as a Key Generation Function. The details of the protocol are outlined below:
Suppose A, B are the two entities (or parties, where A represents a computer system of a first party and B represents a computer system of a second party) that are attempting to authenticate and agree on a key.
We will use A and B to represent their corresponding identities, which by definition also represent their public keys.
Let H 1 (A)=Q A and H 1 (B)=Q B be the respective points on the elliptic curve corresponding to the public keys. In effect, one could refer to Q A and Q B as the public keys as well, since there is a one-to-one correspondence between the identities and the points on the curve obtained by applying H 1 .
Let x be a random number chosen by A, and let y be a random number chosen by B.
FIG. 1 illustrates the protocol exchanges between A and B. The protocol exchange 100 comprises of the following steps:
A computes xP (i.e., P added to itself x times as a point on E, using the addition law on E) encrypts it using B's public key, and transmits it to B in step 102 . In this step, encryption refers to identity based encryption described in section I above.
Upon receipt of the encrypted message, B decrypts the message and obtains xP. Subsequently B computes yP, and encrypts the pair {xP, yP} using A's public key and then transmits it to A in step 104 .
Upon receipt of this message, A decrypts the message and obtains yP. Subsequently, A encrypts yP using B's public key and sends it back to B in step 106 .
Following this, both A and B compute xyP as the session key.
Observe that A chose x randomly, and received yP in the second step of the protocol exchange. This allows A to compute xyP by adding yP to itself x times. Conversely, B chose y randomly, and received xP in the first step of the protocol exchange. This allows B to compute xyP by adding xP to itself y times. Note that any application of the protocol may utilize header data with the identities to ensure proper functioning of the protocol. This is relatively standard and applicable to almost any protocol exchange for key agreement.
Note also that x is random but xP provides no information about x. Therefore, xP is a component of a key based on a random secret chosen by A. Likewise, y is random but yP provides no information about y. Hence, yP is a component of a key based on a random secret known only to B.
Note further that xyP can serve as a session key. Also, the session key could be any known function of xyP. That is, the session key could equal f(xyP), where f is known to both parties and is not required to be secret (i.e., known to the world). One practical requirement on f should be that f is hard to compute without knowledge of x or y, and the output is of a satisfactory length from a cryptographic perspective, e.g., around 128 bits or more.
Some of the properties of the protocol include:
Immunity from key escrow: Observe that all the steps in the protocol exchange are encrypted using IBE. So clearly the KGF can decrypt all the exchanges. However, the KGF can not compute the session key. This is because of the hardness of the elliptic curve Diffie-Hellman problem. In other words, given xP and yP, it is computationally hard to compute xyP.
Mutually Authenticated Key Agreement: Observe that all the steps in the protocol exchange are encrypted using IBE. In particular, only B can decrypt the contents of the message sent by A in steps
102 and 106 , and similarly only A can decrypt the contents of the message sent by B in step 104 . Moreover, at the end of step 104 , A can verify B's authenticity since xP could have been sent in step 104 only after decryption of the contents in step 102 by B. Similarly, at the end of step 106 , B can verify A's authenticity since yP could have been sent back in step 106 only after correctly decrypting the contents of step 104 and this is possible only by A. Finally, both A and B can agree on the same session key. In other words, the protocol is a mutually authenticated key agreement protocol based on IBE. While the above description provides the motivation for the security of the protocol, a cryptographic proof of security can be easily provided. The hardness of the protocol relies on the hardness of the Elliptic curve Diffie-Hellman problem, which is influenced by the choice of elliptic curve.
Perfect forward and backwards secrecy: Since x and y are random, xyP is always fresh and unrelated to any past or future sessions between A and B.
No passwords: Clearly, the inventive protocol does not require any offline exchange of passwords or secret keys between A and B. In fact, the method is clearly applicable to any two parties communicating for the first time through any communication network. The only requirement is to ensure that both A and B are aware of each other's public keys, for example, through a directory service.
IV. Example Applications
Two example scenarios where the inventive protocol of FIG. 1 can be used are now described.
A. End-To-end Key Agreement
Existing and emerging Internet and wireless applications are increasingly supported over âopenâ networks. In addition, due to the explosion of security attacks, users are waking up to the desire for end-to-end privacy. This applies to client-to-client applications (such as Voice-over-IP, Instant Messaging, etc.) as well as server to client applications (such as e-commerce over the web). In all these applications, it is often not possible to have the participants agree on a secret key to use symmetric key based key agreement protocols, or register with a PKI to obtain a certificate for use in public key based key agreement protocols. In fact, end-users involved in client-to-client communication (for example, voice calls) may not even know each other in advance. Moreover, end-users who desire privacy and security will be very averse to key escrow since there are significant opportunities for miscreants to abuse the system. In these situations, Identity Based Authenticated Key Agreement protocols are an extremely attractive option. All that is required is individuals register with a Key Generation Service with their identity and obtain a private key. In fact, it is not required for the Key Generation Service to be unique and applicable to all participants.
Observe that in protocol exchanges outlined in the previous section (illustratively describing the inventive protocol), the encryption steps 102 and 106 could be based on one curve (applicable to B) and the encryption in step 104 could be based on a completely different curve (applicable to A). This allows for Key Generation Services to act independent of each other. However, it is important to ensure that all the parameters needed for encryption are publicly and easily available through a directory service. More importantly xP and yP should correspond to the same elliptic curve, but could be independent of the elliptic curves used for encryption.
B. Secure Proxy Based Route Optimization
Mobile wireless networks have undergone a tremendous evolution and the next generation of systems are attempting to enlarge into a fully packet and IP based routed public land mobile wireless data network. This would require conventional services such as voice, to be supported over IP (i.e., mobile Voice-over-IP). In this regard, it has been recognized that while the radio network has undergone tremendous improvements, routing in the core network needs to be optimized.
An authenticated key agreement protocol between visited gateways may be used to set up a security association in order to securely forward packets between each other. In particular, these visited gateways could be on two different operator networks with no prior knowledge of each other and the operators who own these network elements may not even have any service level agreement. In such scenarios, Identity Based Authenticated Key Agreement protocols are a very attractive alternative. As in the previous example, it is not required for the Key Generation Service to be unique and applicable to all network elements. In fact, each network operator could own and operate a simple offline Key Generation Server.
Observe that in protocol exchanges outlined in the previous section (illustratively describing the inventive protocol), the encryption steps 102 and 106 could be based on one curve (applicable to B) and the encryption in step 104 could be based on a completely different curve (applicable to A). This allows for Key Generation Services to act independent of each other. However, it is important to ensure that all the parameters needed for encryption are publicly and easily available through a directory service. More importantly, xP and yP should correspond to the same elliptic curve, but could be independent of the elliptic curves used for encryption.
V. Illustrative Computing System
FIG. 2 illustrates a generalized hardware architecture of a data network and computer systems suitable for implementing an improved identity based authentication key agreement protocol between two entities A and B according to the present invention. As shown, entity A comprises a computer system 202 , while entity B comprises a computer system 204 . The two computer systems
202 and 204 are coupled via a data network 206 . The data network may be any data network across which A and B desire to communicate, e.g., the Internet. However, the invention is not limited to a particular type of network. Typically, A could be a client machine and B could be a server machine. Also, A and B could both be clients or both be servers. Thus, it is to be understood that the communication protocol of the present invention is not limited to the case where A and B are client and server, but instead is applicable to any computing devices comprising A and B.
Also shown in computer system 214 coupled to computer systems
202 and 204 via network 206 . Computer system 214 is preferably a server that performs a Key Generation Function or Service, as described above.
As would be readily apparent to one of ordinary skill in the art, the servers and clients may be implemented as programmed computers operating under control of computer program code. The computer program code would be stored in a computer readable storage medium (e.g., a memory) and the code would be executed by a processor of the computer. Given this disclosure of the invention, one skilled in the art could readily produce appropriate computer program code in order to implement the protocols described herein.
Nonetheless, FIG. 2 generally illustrates an exemplary architecture for each computer system communicating over the network. As shown, computer system A comprises I/O devices 208 -A, processor 210 -A, and memory 212 -A. Computer system B comprises I/O devices 208 -B, processor 210 -B, and memory 212 -B. Computer system 214 (key generator(s)) comprises I/O devices 208 -K, processor 210 -K, and memory 212 -K. It should be understood that the term âprocessorâ as used herein is intended to include one or more processing devices, including a central processing unit (CPU) or other processing circuitry. Also, the term âmemoryâ as used herein is intended to include memory associated with a processor or CPU, such as RAM, ROM, a fixed memory device (e.g., hard drive), or a removable memory device (e.g., diskette or CDROM). In addition, the term âI/O devicesâ as used herein is intended to include one or more input devices (e.g., keyboard, mouse) for inputting data to the processing unit, as well as one or more output devices (e.g., CRT display) for providing results associated with the processing unit. Accordingly, software instructions or code for performing the methodologies of the invention, described herein, may be stored in one or more of the associated memory devices, e.g., ROM, fixed or removable memory, and, when ready to be utilized, loaded into RAM and executed by the CPU.
Although illustrative embodiments of the present invention have been described herein with reference to the accompanying drawings, it is to be understood that the invention is not limited to those precise embodiments, and that various other changes and modifications may be made by one skilled in the art without departing from the scope or spirit of the invention.
Claims ( 24 )
What is claimed is:
1. A method for performing an identity based authenticated key agreement protocol between a computer system of a first party (the first party) and a computer system of a second party (the second party), the method at the first party comprising the steps of:
sending an encrypted first random key component from the first party to the second party, the first random key component having been computed at the first party and encrypted using a public key of the second party in accordance with an identity based encryption operation;
receiving an encrypted random key component pair at the first party from the second party, the random key component pair having been encrypted at the second party using a public key of the first party in accordance with the identity based encryption operation, and the random key component pair having been formed from the first random key component and a second random key component computed at the second party; and
sending the second random key component, in encrypted form, from the first party to the second party, the second random key component having been encrypted using the public key of the second party in accordance with the identity based encryption operation;
wherein a key for use in subsequent communications between the first party and the second party is computable at the first party based on the second random key component.
2. The method of claim 1 , wherein the respective public keys used by the first party and the second party to perform the identity based encryption operation comprise a result of a hash function applied to information indicative of an identity of the respective party to which the public key is assigned.
3. The method of claim 1 , wherein the first random key component, xP, is computed from a random number x chosen by the first party and a point P of large prime order on an elliptic curve over a finite field.
4. The method of claim 3 , wherein the first random key component, xP, is computed by P being added to itself x times as a point on the elliptic curve.
5. The method of claim 1 , wherein the second random key component, yP, is computed from a random number y chosen by the second party and the point P of large prime order on the elliptic curve over the finite field.
6. The method of claim 5 , wherein the second random key component, yP, is computed by P being added to itself y times as a point on the elliptic curve.
7. The method of claim 1 , wherein the key, xyP, for use in subsequent communications between the first party and the second party is computed at the first party from a random number x chosen by the first party and the second key component yP, yP having been computed at the second party from a random number y chosen by the second party and a point P of large prime order on an elliptic curve over a finite field.
8. The method of claim 7 , wherein the key, xyP, for use in subsequent communications between the first party and the second party is computed by adding yP to itself x times.
9. The method of claim 1 , wherein the key, xyP, for use in subsequent communications between the first party and the second party is computed at the second party from a random number y chosen by the second party and the first key component xP, xP having been computed at the first party from a random number x chosen by the first party and a point P of large prime order on an elliptic curve over a finite field.
10. The method of claim 9 , wherein the key, xyP, for use in subsequent communications between the first party and the second party is computed by adding xP to itself y times.
11. The method of claim 1 , wherein an elliptic curve used to compute the first random key component and the second random key component is independent of an elliptic curve used for the identity based encryption operation.
12. The method of claim 1 , wherein an elliptic curve used for the identity based encryption operation performed by the first party is different than an elliptic curve used for the identity based encryption operation performed by the second party.
13. The method of claim 1 , wherein respective private keys used by the first party and the second party to decrypt encrypted messages are assigned by a key generation function located on a computer system separate from the computer systems of the first party and the second party.
14. The method of claim 1 , wherein the key for use in subsequent communications between the first party and the second party is used to form a session key.
15. The method of claim 14 , wherein the session key is computed as a function of the key for use in subsequent communications between the first party and the second party.
16. The method of claim 1 , wherein the authenticated key agreement protocol is performed as part of an end-to-end key agreement for an application over a network.
17. The method of claim 1 , wherein the authenticated key agreement protocol is performed as part of a secure proxy based route optimization protocol.
18. The method of claim 1 , wherein the key for use in subsequent communications between the first party and the second party is computable at the second party based on the first random key component.
19. A method for obtaining authenticated key agreement between a computer system of a first party (the first party) and a computer system of a second party (the second party), the method at the first party comprising the steps of:
computing a first random key component at the first party;
encrypting at the first party the first random key component, wherein the first random key component is encrypted using a public key of the second party in accordance with an identity based encryption operation;
sending the encrypted first random key component to the second party, wherein, at the second party: (i) the encrypted first random key component is decrypted to obtain the first random key component; (ii) a second random key component is computed; (iii) a random key component pair comprising the first random key component and the second random key component is formed and encrypted using a public key of the first party in accordance with the identity based encryption operation; and (iv) the encrypted random key component pair is sent to the first party;
decrypting at the first party the encrypted random key component pair to obtain the second random key component;
encrypting at the first party the second random key component, wherein the second random key component is encrypted using the public key of the second party in accordance with the identity based encryption operation;
sending the encrypted second random key component to the second party; and
computing at the first party a key for use in subsequent communications between the first party and the second party, wherein the key is computed at the first party based on the second random key component, and wherein the key is computable at the second party based on the first random key component.
20. A method for performing an identity based authenticated key agreement protocol between a computer system of a first party (the first party) and a computer system of a second party (the second party), the method at the second party comprising the steps of:
receiving an encrypted first random key component from the first party at the second party, the first random key component having been computed at the first party and encrypted using a public key of the second party in accordance with an identity based encryption operation;
sending an encrypted random key component pair to the first party from the second party, the random key component pair having been encrypted at the second party using a public key of the first party in accordance with the identity based encryption operation, and the random key component pair having been formed from the first random key component and a second random key component computed at the second party; and
receiving the second random key component, in encrypted form, from the first party at the second party, the second random key component having been encrypted using the public key of the second party in accordance with the identity based encryption operation;
wherein a key for use in subsequent communications between the first party and the second party is computable at the second party based on the first random key component.
21. The method of claim 20 , wherein the key for use in subsequent communications between the first party and the second party is computable at the first party based on the second random key component.
22. A method for obtaining authenticated key agreement between a computer system of a first party (the first party) and a computer system of a second party (the second party), the method at the second party comprising the steps of:
receiving an encrypted first random key component at the second party from the first party, wherein, at the first party: (i) the first random key component is computed; (ii) the first random key component is encrypted using a public key of the second party in accordance with an identity based encryption operation; and (iii) the encrypted first random key component is sent to the second party;
decrypting the encrypted first random key component to obtain the first random, key component;
computing a second random key component;
forming a random key component pair comprising the first random key component and the second random key component;
encrypting the random key component pair using a public key of the first party in accordance with the identity based encryption operation;
sending the encrypted random key component pair to the first party, wherein, at the first party: (i) the encrypted random key component pair is decrypted to obtain the second random key component; (ii) the second random key component is encrypted using the public key of the second party in accordance with the identity based encryption operation, and (iii) the encrypted second random key component is sent to the second party; and
computing at the second party a key for use in subsequent communications between the first party and the second party, wherein the key is computed at the second party based on the first random key component, and wherein the key is computable at the first party based on the second random key component.
23. Apparatus for performing an identity based authenticated key agreement protocol between a first party and a second party, the apparatus at the first party comprising:
a memory; and
a processor coupled to the memory and configured to: (i) send an encrypted first random key component from the first party to the second party, the first random key component having been computed at the first party and encrypted using a public key of the second party in accordance with an identity based encryption operation; (ii) receive an encrypted random key component pair at the first party from the second party, the random key component pair having been encrypted at the second party using a public key of the first party in accordance with the identity based encryption operation, and the random key component pair having been formed from the first random key component and a second random key component computed at the second party; and (iii) send the second random key component, in encrypted form, from the first party to the second party, the second random key component having been encrypted using the public key of the second party in accordance with the identity based encryption operation; wherein a key for use in subsequent communications between the first party and the second party is computable at the first party based on the second random key component.
24. Apparatus for performing an identity based authenticated key agreement protocol between a first party and a second party, the apparatus at the second party comprising:
a memory; and
a processor coupled to the memory and configured to: (i) receive an encrypted first random key component from the first party at the second party, the first random key component having been computed at the first party and encrypted using a public key of the second party in accordance with an identity based encryption operation; (ii) send an encrypted random key component pair to the first party from the second party, the random key component pair having been encrypted at the second party using a public key of the first party in accordance with the identity based encryption operation, and the random key component pair having been formed from the first random key component and a second random key component computed at the second party; and (iii) receive the second random key component, in encrypted form, from the first party at the second party, the second random key component having been encrypted using the public key of the second party in accordance with the identity based encryption operation; wherein a key for use in subsequent communications between the first party and the second party is computable at the second party based on the first random key component.
US12/372,242
2009-02-17
2009-02-17
Identity based authenticated key agreement protocol
Active
2032-03-04
US8510558B2
( en )
Priority Applications (7)
Application Number
Priority Date
Filing Date
Title
US12/372,242
US8510558B2
( en )
2009-02-17
2009-02-17
Identity based authenticated key agreement protocol
KR1020117019146A
KR101394730B1
( en )
2009-02-17
2010-02-10
Identity based authenticated key agreement protocol
PCT/US2010/023736
WO2010126638A2
( en )
2009-02-17
2010-02-10
Identity based authenticated key agreement protocol
JP2011550198A
JP5349619B2
( en )
2009-02-17
2010-02-10
Identity-based authentication key agreement protocol
EP10747091.6A
EP2399361B1
( en )
2009-02-17
2010-02-10
Identity based authenticated key agreement protocol
CN201080008115.5A
CN102318258B
( en )
2009-02-17
2010-02-10
Identity-Based Authenticated Key Agreement Protocol
US13/932,573
US9106410B2
( en )
2009-02-17
2013-07-01
Identity based authenticated key agreement protocol
Applications Claiming Priority (1)
Application Number
Priority Date
Filing Date
Title
US12/372,242
US8510558B2
( en )
2009-02-17
2009-02-17
Identity based authenticated key agreement protocol
Related Child Applications (1)
Application Number
Title
Priority Date
Filing Date
US13/932,573
Continuation
US9106410B2
( en )
2009-02-17
2013-07-01
Identity based authenticated key agreement protocol
Publications (2)
Publication Number
Publication Date
US20100211779A1
US20100211779A1 ( en )
2010-08-19
US8510558B2
true
US8510558B2 ( en )
2013-08-13
Family
ID=42560899
Family Applications (2)
Application Number
Title
Priority Date
Filing Date
US12/372,242
Active
2032-03-04
US8510558B2
( en )
2009-02-17
2009-02-17
Identity based authenticated key agreement protocol
US13/932,573
Active
2029-04-25
US9106410B2
( en )
2009-02-17
2013-07-01
Identity based authenticated key agreement protocol
Family Applications After (1)
Application Number
Title
Priority Date
Filing Date
US13/932,573
Active
2029-04-25
US9106410B2
( en )
2009-02-17
2013-07-01
Identity based authenticated key agreement protocol
Country Status (6)
Country
Link
US
( 2 )
<
CLAIMS
Claims ( 24 )
What is claimed is:
1. A method for performing an identity based authenticated key agreement protocol between a computer system of a first party (the first party) and a computer system of a second party (the second party), the method at the first party comprising the steps of:
sending an encrypted first random key component from the first party to the second party, the first random key component having been computed at the first party and encrypted using a public key of the second party in accordance with an identity based encryption operation;
receiving an encrypted random key component pair at the first party from the second party, the random key component pair having been encrypted at the second party using a public key of the first party in accordance with the identity based encryption operation, and the random key component pair having been formed from the first random key component and a second random key component computed at the second party; and
sending the second random key component, in encrypted form, from the first party to the second party, the second random key component having been encrypted using the public key of the second party in accordance with the identity based encryption operation;
wherein a key for use in subsequent communications between the first party and the second party is computable at the first party based on the second random key component.
2. The method of claim 1 , wherein the respective public keys used by the first party and the second party to perform the identity based encryption operation comprise a result of a hash function applied to information indicative of an identity of the respective party to which the public key is assigned.
3. The method of claim 1 , wherein the first random key component, xP, is computed from a random number x chosen by the first party and a point P of large prime order on an elliptic curve over a finite field.
4. The method of claim 3 , wherein the first random key component, xP, is computed by P being added to itself x times as a point on the elliptic curve.
5. The method of claim 1 , wherein the second random key component, yP, is computed from a random number y chosen by the second party and the point P of large prime order on the elliptic curve over the finite field.
6. The method of claim 5 , wherein the second random key component, yP, is computed by P being added to itself y times as a point on the elliptic curve.
7. The method of claim 1 , wherein the key, xyP, for use in subsequent communications between the first party and the second party is computed at the first party from a random number x chosen by the first party and the second key component yP, yP having been computed at the second party from a random number y chosen by the second party and a point P of large prime order on an elliptic curve over a finite field.
8. The method of claim 7 , wherein the key, xyP, for use in subsequent communications between the first party and the second party is computed by adding yP to itself x times.
9. The method of claim 1 , wherein the key, xyP, for use in subsequent communications between the first party and the second party is computed at the second party from a random number y chosen by the second party and the first key component xP, xP having been computed at the first party from a random number x chosen by the first party and a point P of large prime order on an elliptic curve over a finite field.
10. The method of claim 9 , wherein the key, xyP, for use in subsequent communications between the first party and the second party is computed by adding xP to itself y times.
11. The method of claim 1 , wherein an elliptic curve used to compute the first random key component and the second random key component is independent of an elliptic curve used for the identity based encryption operation.
12. The method of claim 1 , wherein an elliptic curve used for the identity based encryption operation performed by the first party is different than an elliptic curve used for the identity based encryption operation performed by the second party.
13. The method of claim 1 , wherein respective private keys used by the first party and the second party to decrypt encrypted messages are assigned by a key generation function located on a computer system separate from the computer systems of the first party and the second party.
14. The method of claim 1 , wherein the key for use in subsequent communications between the first party and the second party is used to form a session key.
15. The method of claim 14 , wherein the session key is computed as a function of the key for use in subsequent communications between the first party and the second party.
16. The method of claim 1 , wherein the authenticated key agreement protocol is performed as part of an end-to-end key agreement for an application over a network.
17. The method of claim 1 , wherein the authenticated key agreement protocol is performed as part of a secure proxy based route optimization protocol.
18. The method of claim 1 , wherein the key for use in subsequent communications between the first party and the second party is computable at the second party based on the first random key component.
19. A method for obtaining authenticated key agreement between a computer system of a first party (the first party) and a computer system of a second party (the second party), the method at the first party comprising the steps of:
computing a first random key component at the first party;
encrypting at the first party the first random key component, wherein the first random key component is encrypted using a public key of the second party in accordance with an identity based encryption operation;
sending the encrypted first random key component to the second party, wherein, at the second party: (i) the encrypted first random key component is decrypted to obtain the first random key component; (ii) a second random key component is computed; (iii) a random key component pair comprising the first random key component and the second random key component is formed and encrypted using a public key of the first party in accordance with the identity based encryption operation; and (iv) the encrypted random key component pair is sent to the first party;
decrypting at the first party the encrypted random key component pair to obtain the second random key component;
encrypting at the first party the second random key component, wherein the second random key component is encrypted using the public key of the second party in accordance with the identity based encryption operation;
sending the encrypted second random key component to the second party; and
computing at the first party a key for use in subsequent communications between the first party and the second party, wherein the key is computed at the first party based on the second random key component, and wherein the key is computable at the second party based on the first random key component.
20. A method for performing an identity based authenticated key agreement protocol between a computer system of a first party (the first party) and a computer system of a second party (the second party), the method at the second party comprising the steps of:
receiving an encrypted first random key component from the first party at the second party, the first random key component having been computed at the first party and encrypted using a public key of the second party in accordance with an identity based encryption operation;
sending an encrypted random key component pair to the first party from the second party, the random key component pair having been encrypted at the second party using a public key of the first party in accordance with the identity based encryption operation, and the random key component pair having been formed from the first random key component and a second random key component computed at the second party; and
receiving the second random key component, in encrypted form, from the first party at the second party, the second random key component having been encrypted using the public key of the second party in accordance with the identity based encryption operation;
wherein a key for use in subsequent communications between the first party and the second party is computable at the second party based on the first random key component.
21. The method of claim 20 , wherein the key for use in subsequent communications between the first party and the second party is computable at the first party based on the second random key component.
22. A method for obtaining authenticated key agreement between a computer system of a first party (the first party) and a computer system of a second party (the second party), the method at the second party comprising the steps of:
receiving an encrypted first random key component at the second party from the first party, wherein, at the first party: (i) the first random key component is computed; (ii) the first random key component is encrypted using a public key of the second party in accordance with an identity based encryption operation; and (iii) the encrypted first random key component is sent to the second party;
decrypting the encrypted first random key component to obtain the first random, key component;
computing a second random key component;
forming a random key component pair comprising the first random key component and the second random key component;
encrypting the random key component pair using a public key of the first party in accordance with the identity based encryption operation;
sending the encrypted random key component pair to the first party, wherein, at the first party: (i) the encrypted random key component pair is decrypted to obtain the second random key component; (ii) the second random key component is encrypted using the public key of the second party in accordance with the identity based encryption operation, and (iii) the encrypted second random key component is sent to the second party; and
computing at the second party a key for use in subsequent communications between the first party and the second party, wherein the key is computed at the second party based on the first random key component, and wherein the key is computable at the first party based on the second random key component.
23. Apparatus for performing an identity based authenticated key agreement protocol between a first party and a second party, the apparatus at the first party comprising:
a memory; and
a processor coupled to the memory and configured to: (i) send an encrypted first random key component from the first party to the second party, the first random key component having been computed at the first party and encrypted using a public key of the second party in accordance with an identity based encryption operation; (ii) receive an encrypted random key component pair at the first party from the second party, the random key component pair having been encrypted at the second party using a public key of the first party in accordance with the identity based encryption operation, and the random key component pair having been formed from the first random key component and a second random key component computed at the second party; and (iii) send the second random key component, in encrypted form, from the first party to the second party, the second random key component having been encrypted using the public key of the second party in accordance with the identity based encryption operation; wherein a key for use in subsequent communications between the first party and the second party is computable at the first party based on the second random key component.
24. Apparatus for performing an identity based authenticated key agreement protocol between a first party and a second party, the apparatus at the second party comprising:
a memory; and
a processor coupled to the memory and configured to: (i) receive an encrypted first random key component from the first party at the second party, the first random key component having been computed at the first party and encrypted using a public key of the second party in accordance with an identity based encryption operation; (ii) send an encrypted random key component pair to the first party from the second party, the random key component pair having been encrypted at the second party using a public key of the first party in accordance with the identity based encryption operation, and the random key component pair having been formed from the first random key component and a second random key component computed at the second party; and (iii) receive the second random key component, in encrypted form, from the first party at the second party, the second random key component having been encrypted using the public key of the second party in accordance with the identity based encryption operation; wherein a key for use in subsequent communications between the first party and the second party is computable at the second party based on the first random key component.
US12/372,242
2009-02-17
2009-02-17
Identity based authenticated key agreement protocol
Active
2032-03-04
US8510558B2
( en )
Priority Applications (7)
Application Number
Priority Date
Filing Date
Title
US12/372,242
US8510558B2
( en )
2009-02-17
2009-02-17
Identity based authenticated key agreement protocol
KR1020117019146A
KR101394730B1
( en )
2009-02-17
2010-02-10
Identity based authenticated key agreement protocol
PCT/US2010/023736
WO2010126638A2
( en )
2009-02-17
2010-02-10
Identity based authenticated key agreement protocol
JP2011550198A
JP5349619B2
( en )
2009-02-17
2010-02-10
Identity-based authentication key agreement protocol
EP10747091.6A
EP2399361B1
( en )
2009-02-17
2010-02-10
Identity based authenticated key agreement protocol
CN201080008115.5A
CN102318258B
( en )
2009-02-17
2010-02-10
Identity-Based Authenticated Key Agreement Protocol
US13/932,573
US9106410B2
( en )
2009-02-17
2013-07-01
Identity based authenticated key agreement protocol
Applications Claiming Priority (1)
Application Number
Priority Date
Filing Date
Title
US12/372,242
US8510558B2
( en )
2009-02-17
2009-02-17
Identity based authenticated key agreement protocol
Related Child Applications (1)
Application Number
Title
Priority Date
Filing Date
US13/932,573
Continuation
US9106410B2
( en )
2009-02-17
2013-07-01
Identity based authenticated key agreement protocol
Publications (2)
Publication Number
Publication Date
US20100211779A1
US20100211779A1 ( en )
2010-08-19
US8510558B2
true
US8510558B2 ( en )
2013-08-13
Family
ID=42560899
Family Applications (2)
Application Number
Title
Priority Date
Filing Date
US12/372,242
Active
2032-03-04
US8510558B2
( en )
2009-02-17
2009-02-17
Identity based authenticated key agreement protocol
US13/932,573
Active
2029-04-25
US9106410B2
( en )
2009-02-17
2013-07-01
Identity based authenticated key agreement protocol
Family Applications After (1)
Application Number
Title
Priority Date
Filing Date
US13/932,573
Active
2029-04-25
US9106410B2
( en )
2009-02-17
2013-07-01
Identity based authenticated key agreement protocol
Country Status (6)
Country
Link
US
( 2 )
US8510558B2
( en )
EP
( 1 )
EP2399361B1
( en )
JP
( 1 )
JP5349619B2
( en )
KR
( 1 )
KR101394730B1
( en )
CN
( 1 )
CN102318258B
( en )
WO
( 1 )
WO2010126638A2
( en )
Families Citing this family (57)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
USRE48433E1
( en )
2005-01-27
2021-02-09
The Chamberlain Group, Inc.
Method and apparatus to facilitate transmission of an encrypted rolling code
US9148409B2
( en )
2005-06-30
2015-09-29
The Chamberlain Group, Inc.
Method and apparatus to facilitate message transmission and reception using different transmission characteristics
US12149618B2
( en )
2005-01-27
2024-11-19
The Chamberlain Group Llc
Method and apparatus to facilitate transmission of an encrypted rolling code
US8422667B2
( en )
2005-01-27
2013-04-16
The Chamberlain Group, Inc.
Method and apparatus to facilitate transmission of an encrypted rolling code
WO2008030523A2
( en )
*
2006-09-06
2008-03-13
Bsecured Solutions, Llc
Real privacy management authentication system
US8510558B2
( en )
2009-02-17
2013-08-13
Alcatel Lucent
Identity based authenticated key agreement protocol
EP2334008A1
( en )
2009-12-10
2011-06-15
Tata Consultancy Services Limited
A system and method for designing secure client-server communication protocols based on certificateless public key infrastructure
US9025767B2
( en )
*
2010-03-24
2015-05-05
Nokia Corporation
Method and apparatus for querying content protected by identity-based encryption
EP2482243A1
( en )
*
2011-01-31
2012-08-01
Alcatel Lucent
A payment transaction method and corresponding applications
JP5225412B2
( en )
*
2011-03-03
2013-07-03
æ ªå¼ä¼ç¤¾æ±è
Communication apparatus and communication method
US8769288B2
( en )
2011-04-22
2014-07-01
Alcatel Lucent
Discovery of security associations
US8661240B2
( en )
*
2011-04-29
2014-02-25
International Business Machines Corporation
Joint encryption of data
US8644510B2
( en )
*
2011-05-11
2014-02-04
Alcatel Lucent
Discovery of security associations for key management relying on public keys
CN103765810B
( en )
2011-07-15
2018-03-13
é¿å°å¡ç¹æè®¯å ¬å¸
method and apparatus for secure group messaging
US20130034229A1
( en )
2011-08-05
2013-02-07
Apple Inc.
System and method for wireless data protection
US20130110920A1
( en )
*
2011-10-27
2013-05-02
Alcatel-Lucent Usa Inc.
Network-assisted peer-to-peer secure communication establishment
US9065642B2
( en )
*
2012-03-07
2015-06-23
Certicom Corp.
Intercepting key sessions
KR20130140948A
( en )
2012-05-17
2013-12-26
ì¼ì±ì ì주ìíì¬
Apparatus and method for contents encryption and decryption based on storage device id
KR101301609B1
( en )
2012-05-31
2013-08-29
ìì¸ëíêµì°ííë ¥ë¨
Apparatus and method for generating secret key, and recording medium storing program for executing method of the same in computer
CN103354498B
( en )
*
2013-05-31
2016-09-28
å京åä¸æ³°å ç§æè¡ä»½æéå ¬å¸
A kind of file encryption transmission method of identity-based
US9350550B2
( en )
*
2013-09-10
2016-05-24
M2M And Iot Technologies, Llc
Power management and security for wireless modules in âmachine-to-machineâ communications
US9100175B2
( en )
2013-11-19
2015-08-04
M2M And Iot Technologies, Llc
Embedded universal integrated circuit card supporting two-factor authentication
US10498530B2
( en )
2013-09-27
2019-12-03
Network-1 Technologies, Inc.
Secure PKI communications for âmachine-to-machineâ modules, including key derivation by modules and authenticating public keys
US10700856B2
( en )
2013-11-19
2020-06-30
Network-1 Technologies, Inc.
Key derivation for a module using an embedded universal integrated circuit card
US10726102B2
( en )
*
2014-01-08
2020-07-28
Ipra Technologies Oy Ltd.
Method of and system for providing access to access restricted content to a user
CN105721153B
( en )
*
2014-09-05
2020-03-27
ä¸æSdsæ ªå¼ä¼ç¤¾
Key exchange system and method based on authentication information
CN105635039B
( en )
2014-10-27
2019-01-04
é¿éå·´å·´éå¢æ§è¡æéå ¬å¸
A kind of secure communication of network method and communication device
US9918225B2
( en )
*
2014-11-03
2018-03-13
Qualcomm Incorporated
Apparatuses and methods for wireless communication
JP6320943B2
( en )
*
2015-01-19
2018-05-09
æ¥æ¬é»ä¿¡é»è©±æ ªå¼ä¼ç¤¾
Key sharing device, key sharing system, key sharing method, and program
US9853977B1
( en )
2015-01-26
2017-12-26
Winklevoss Ip, Llc
System, method, and program product for processing secure transactions within a cloud computing system
CN106130716B
( en )
*
2015-05-06
2020-01-21
ä¸æSdsæ ªå¼ä¼ç¤¾
Key exchange system and method based on authentication information
CN104902471B
( en )
*
2015-06-01
2018-12-14
ä¸å大å¦
The key of identity-based exchanges design method in wireless sensor network
CN105553951B
( en )
*
2015-12-08
2019-11-08
è ¾è®¯ç§æï¼æ·±å³ï¼æéå ¬å¸
Data transmission method and device
CN105743646B
( en )
*
2016-02-03
2019-05-10
åå·é¿è¹çµå¨è¡ä»½æéå ¬å¸
A kind of Identity based encryption method and system
WO2017167771A1
( en )
*
2016-03-29
2017-10-05
Koninklijke Philips N.V.
Handshake protocols for identity-based key material and certificates
WO2017167741A1
( en )
*
2016-03-29
2017-10-05
Koninklijke Philips N.V.
System and method for distribution of identity based key material and certificate
CN107547466A
( en )
*
2016-06-23
2018-01-05
å京ä¸å ´è½¯ä»¶æéè´£ä»»å ¬å¸
A kind of simple network protocol authentication method and device
CN114826673A
( en )
2016-07-06
2022-07-29
å为ææ¯æéå ¬å¸
Protection system, method and device for transmission data
CN111865603B
( en )
*
2016-09-05
2025-02-28
å为ææ¯æéå ¬å¸
Authentication method, authentication device and authentication system
CN106788997B
( en )
*
2016-12-08
2019-07-12
æ·±å³å¥¥èä¿¡æ¯å®å ¨ææ¯æéå ¬å¸
A kind of real-time multimedia encryption method based on id password
SG10201701044SA
( en )
*
2017-02-09
2018-09-27
Huawei Int Pte Ltd
System and method for computing private keys for self certified identity based signature schemes
US11128452B2
( en )
*
2017-03-25
2021-09-21
AVAST Software s.r.o.
Encrypted data sharing with a hierarchical key structure
US10541804B2
( en )
*
2017-08-18
2020-01-21
Intel Corporation
Techniques for key provisioning in a trusted execution environment
CN109728901B
( en )
*
2017-10-31
2022-04-08
ä¸å½çµä¿¡è¡ä»½æéå ¬å¸
Digital signature authentication method, device and system
JP6536999B2
( en )
*
2017-11-28
2019-07-03
å½ç«ç 究éçºæ³äººæ å ±éä¿¡ç 究æ©æ§
Host device
US10652743B2
( en )
2017-12-21
2020-05-12
The Chamberlain Group, Inc.
Security system for a moveable barrier operator
US11074773B1
( en )
2018-06-27
2021-07-27
The Chamberlain Group, Inc.
Network-based control of movable barrier operators for autonomous vehicles
WO2020010515A1
( en )
2018-07-10
2020-01-16
Apple Inc.
Identity-based message integrity protection and verification for wireless communication
CA3107457A1
( en )
2018-08-01
2020-02-06
The Chamberlain Group, Inc.
Movable barrier operator and transmitter pairing over a network
US10997810B2
( en )
2019-05-16
2021-05-04
The Chamberlain Group, Inc.
In-vehicle transmitter training
CN112711745A
( en )
*
2021-01-06
2021-04-27
ç« ä¼
Method and device for strengthening network security based on encryption
WO2022185328A1
( en )
*
2021-03-02
2022-09-09
Fortytwo42 Labs Llp
System and method for identity-based key agreement for secure communication
KR102887214B1
( en )
*
2021-12-17
2025-11-17
주ìíì¬ í¬ë¦½í ë©
Electronic apparatus and method for encryption thereof
CN114244513B
( en )
*
2021-12-31
2024-02-09
æ¥æ·ç§æ(ä¸æµ·)æéå ¬å¸
Key negotiation method, device and storage medium
CN114785508B
( en )
*
2022-04-24
2023-08-29
ä¸å½æ°ç¨èªç©ºæ»å±ç¬¬äºç 究æ
A Heterogeneous Authentication Key Agreement Method and System
CN115001865B
( en )
*
2022-07-28
2022-12-02
æå·å®å¸æºç§ææéå ¬å¸
Communication processing method and system, client, communication server and supervision server
US12212663B1
( en )
*
2022-10-31
2025-01-28
Graphiant, Inc.
Bounded broadcast encryption key management
Citations (16)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
EP0535863A2
( en )
1991-10-02
1993-04-07
AT&T Corp.
A cryptographic protocol for secure communications
JPH0798563A
( en )
1993-06-18
1995-04-11
Matsushita Electric Ind Co Ltd
Elliptic curve signature, authentication and secret communication method
WO2003017559A2
( en )
2001-08-13
2003-02-27
Board Of Trustees Of The Leland Stanford Junior University
Systems and methods for identity-based encryption and related cryptographic techniques
WO2004047352A2
( en )
2002-11-14
2004-06-03
Voltage Security, Inc.
Identity-based encryption system
US20040123098A1
( en )
*
2002-07-05
2004-06-24
Ligun Chen
Method and apparatus for use in relation to verifying an association between two parties
US20040179684A1
( en )
2003-03-14
2004-09-16
Identicrypt, Inc.
Identity-based-encryption messaging system
JP2004282657A
( en )
2003-03-19
2004-10-07
Nippon Hoso Kyokai <Nhk>
Personal information protection method, product ordering terminal and product order receiving server, and personal information transmission program and personal information receiving program
WO2005001629A2
( en )
2003-06-25
2005-01-06
Voltage Security, Inc.
Encryption system with public parameter host servers
US20050084100A1
( en )
2003-10-17
2005-04-21
Terence Spies
Identity-based-encryption system with district policy information
JP2005141200A
( en )
2003-11-03
2005-06-02
Microsoft Corp
Use of isogeny for design of cryptosystem
US20050187877A1
( en )
*
2001-05-31
2005-08-25
Contentguard Holding, Inc.
Method and apparatus for hierarchical assignment of rights to documents and documents having such rights
JP2007208410A
( en )
2006-01-31
2007-08-16
Hitachi Ltd
ID-based cryptographic communication system
JP2007295366A
( en )
2006-04-26
2007-11-08
Nippon Telegr & Teleph Corp <Ntt>
Encrypted message transmission / reception method, sender apparatus, receiver apparatus, key server, and encrypted message transmission / reception system
JP2010004288A
( en )
2008-06-19
2010-01-07
Nippon Telegr & Teleph Corp <Ntt>
Secret information transmission system, secret information transmission method, secret information management server, encryption device, secret information transmission program
WO2010126638A2
( en )
2009-02-17
2010-11-04
Alcatel-Lucent Usa Inc.
Identity based authenticated key agreement protocol
JP2010537541A
( en )
2007-08-20
2010-12-02
ãµã ã¹ã³ ã¨ã¬ã¯ãããã¯ã¹ ã«ã³ããã¼ ãªãããã
Method and apparatus for sharing secret information between devices in home network
Family Cites Families (1)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
US7353395B2
( en )
*
2002-03-21
2008-04-01
Ntt Docomo Inc.
Authenticated ID-based cryptosystem with no key escrow
2009
2009-02-17
US
US12/372,242
patent/US8510558B2/en
active
Active
2010
2010-02-10
CN
CN201080008115.5A
patent/CN102318258B/en
active
Active
2010-02-10
WO
PCT/US2010/023736
patent/WO2010126638A2/en
not_active
Ceased
2010-02-10
JP
JP2011550198A
patent/JP5349619B2/en
active
Active
2010-02-10
EP
EP10747091.6A
patent/EP2399361B1/en
active
Active
2010-02-10
KR
KR1020117019146A
patent/KR101394730B1/en
active
Active
2013
2013-07-01
US
US13/932,573
patent/US9106410B2/en
active
Active
Patent Citations (22)
* Cited by examiner, â Cited by third party
Publication number
Priority date
Publication date
Assignee
Title
EP0535863A2
( en )
1991-10-02
1993-04-07
AT&T Corp.
A cryptographic protocol for secure communications
JPH0798563A
( en )
1993-06-18
1995-04-11
Matsushita Electric Ind Co Ltd
Elliptic curve signature, authentication and secret communication method
US20050187877A1
( en )
*
2001-05-31
2005-08-25
Contentguard Holding, Inc.
Method and apparatus for hierarchical assignment of rights to documents and documents having such rights
WO2003017559A2
( en )
2001-08-13
2003-02-27
Board Of Trustees Of The Leland Stanford Junior University
Systems and methods for identity-based encryption and related cryptographic techniques
US20070041583A1
( en )
*
2001-08-13
2007-02-22
Dan Boneh
Systems and methods for identity-based encryption and related cryptographic techniques
US7113594B2
( en )
2001-08-13
2006-09-26
The Board Of Trustees Of The Leland Stanford University
Systems and methods for identity-based encryption and related cryptographic techniques
US20040123098A1
( en )
*
2002-07-05
2004-06-24
Ligun Chen
Method and apparatus for use in relation to verifying an association between two parties
US6886096B2
( en )
2002-11-14
2005-04-26
Voltage Security, Inc.
Identity-based encryption system
WO2004047352A2
( en )
2002-11-14
2004-06-03
Voltage Security, Inc.
Identity-based encryption system
WO2005010732A2
( en )
2003-03-14
2005-02-03
Voltage Security, Inc.
Identity-based-encryption messaging system
US20040179684A1
( en )
2003-03-14
2004-09-16
Identicrypt, Inc.
Identity-based-encryption messaging system
JP2004282657A
( en )
2003-03-19
2004-10-07
Nippon Hoso Kyokai <Nhk>
Personal information protection method, product ordering terminal and product order receiving server, and personal information transmission program and personal information receiving program
US7017181B2
( en )
2003-06-25
2006-03-21
Voltage Security, Inc.
Identity-based-encryption messaging system with public parameter host servers
WO2005001629A2
( en )
2003-06-25
2005-01-06
Voltage Security, Inc.
Encryption system with public parameter host servers
WO2005040975A2
( en )
2003-10-17
2005-05-06
Voltage Security, Inc.
Identity-based-encryption system with district policy information
US20050084100A1
( en )
2003-10-17
2005-04-21
Terence Spies
Identity-based-encryption system with district policy information
JP2005141200A
( en )
2003-11-03
2005-06-02
Microsoft Corp
Use of isogeny for design of cryptosystem
JP2007208410A
( en )
2006-01-31
2007-08-16
Hitachi Ltd
ID-based cryptographic communication system
JP2007295366A
( en )
2006-04-26
2007-11-08
Nippon Telegr & Teleph Corp <Ntt>
Encrypted message transmission / reception method, sender apparatus, receiver apparatus, key server, and encrypted message transmission / reception system
JP2010537541A
( en )
2007-08-20
2010-12-02
ãµã ã¹ã³ ã¨ã¬ã¯ãããã¯ã¹ ã«ã³ããã¼ ãªãããã
Method and apparatus for sharing secret information between devices in home network
JP2010004288A
( en )
2008-06-19
2010-01-07