Conceptio › Archive › Google Patents

Google Patentsopen access

Method, device, and system for establishing secure connection — Huawei Device (Dongguan) Co., Ltd. (US10218501B2)

Huawei Device (Dongguan) Co., Ltd. · Google Patents

Google Patents · Patents · License: Open Access

Open Source ↗

ltd.

patent, google patents, intellectual property, US10218501B2, Huawei Device (Dongguan) Co., Ltd., Gaokun Pang, en, 2019

ABSTRACT

Abstract

A method includes: securely obtaining, by a first device, a first public key estimated value of a second device in an out-of-band manner; encrypting an asymmetric encryption public key by using the first public key estimated value; sending the encrypted asymmetric encryption public key to the second device; receiving an encrypted first key-exchange public key sent by the second device; decrypting the encrypted first key-exchange public key by using an asymmetric encryption private key; performing an operation based on the decrypted first key-exchange public key, to obtain a second public key estimated value; and when the first public key estimated value is consistent with the second public key estimated value, determining that the decrypted first key-exchange public key is correct, generating a shared key by using a key-exchange private key and the first key-exchange public key, and establishing a secure connection to the second device by using the shared key.

Description

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of International Application No. PCTPCT/CN2015/075896, filed on Apr. 3, 2015, which claims priority to Chinese Patent Application No. 201410133485.1, filed on Apr. 3, 2014. The disclosures of the aforementioned applications are hereby incorporated by reference in their entireties.

TECHNICAL FIELD

The present invention relates to the field of mobile communications technologies, and in particular, to a method, a device, and a system for establishing a secure connection.

BACKGROUND

WiFi Protected Setup (WPS, Wi-Fi Protected Setup) is a certification program implemented under organization of the Wireless Fidelity (WiFi, Wireless Fidelity) Alliance, and is mainly dedicated to simplifying setup of a wireless local area network (WLAN, Wireless Local Area Network) and configuration work of security performance. In a conventional manner, when setting up a wireless network, a user must set a security key at an access point manually, and then verify the key at a client to prevent an attacker from stealing WiFi resources. In the entire process, the user needs to have background knowledge about a WiFi device and have a capability of modifying a necessary configuration. The WPS can help the user to securely configure a network name (for example, a service set identifier (SSID, Service Set Identifier)), and configure powerful Wifi protected access (WPA, Wifi Protected Access) data encoding and authentication functions. To securely access the WLAN, the user needs to enter only a personal information number (PIN, Personal Identification Number). This greatly simplifies an operation of wireless security setup. However, in a WPS authentication process, only a PIN is required for network access, that is, if an attacker obtains the PIN, the attacker can steal WiFi resources of the wireless network.

In the prior art, a WPS configuration process may mainly include the following steps:

Step 1: A router and a terminal exchange their DH (Diffie-Hellman) public keys by using plaintexts.

Step 2: The router generates a shared key DH key by using a DH private key of the router and a DH public key of the terminal, and the terminal generates a shared key DH key by using a DH private key of the terminal and a DH public key of the router.

Step 3: The router generates a derivative key of the DH key according to the DH key generated by the router, and determines a hash value by using a hash algorithm and using the derivative key in combination with a first nonce generated by the router and a first half of a PIN.

Step 4: The router sends, to the terminal, the hash value determined in step 3 and the first nonce encrypted by using the derivative key generated in step 3.

Step 5: The terminal generates a derivative key of the DH key according to the DH key generated by the terminal, decrypts the first nonce, determines a hash value by using the hash algorithm and using the derivative key in combination with the first nonce and the first half of the PIN, and when the determined hash value is the same as the hash value that is determined by the router and received in step 4, continues to perform a subsequent step.

Step 6: The terminal determines a hash value by using the same hash algorithm used by the router and using the derivative key of the DH key of the terminal in combination with a second nonce and the first half of the PIN.

Step 7: The terminal sends, to the router, the hash value determined in step 5 and the second nonce encrypted by using the derivative key of the DH key of the terminal.

Step 8: The router decrypts the second nonce by using the derivative key of the DH key of the router, determines a hash value by using the hash algorithm and using the derivative key in combination with a second nonce generated by the router and the first half of the PIN, and when the determined hash value is the same as the hash value that is determined by the terminal and received in step 7, continues to perform a subsequent step.

Step 9: The router processes a second half of the PIN by using a method similar to that of step 3, obtains a hash value of the second half of the PIN, and sends it to the terminal.

Step 10: The terminal verifies the hash value of the second half of the PIN by using a method similar to that of step 5, and when the router passes the verification, determines that a secure connection is established with the router.

Step 11: The terminal processes the second half of the PIN by using a method similar to that of step 6, obtains a hash value of the second half of the PIN, and sends it to the router.

Step 12: The router verifies the hash value of the second half of the PIN by using a method similar to that of step 8, and when the terminal passes the verification, determines that a secure connection is established with the terminal.

In the foregoing WPS configuration process, an attacker may pretend to be a terminal knowing a PIN, exchange DH public keys with the router in step 1 by using a DH public key and a DH private key generated by the attacker, generate a shared key DH key between the attacker and the router in step 2, and receive a hash value that is generated based on a first half of the PIN and a first nonce and sent by the router in step 4 and the first nonce that is encrypted by using a derivative key of the DH key of the router.

Therefore, the attacker may decrypt the first nonce by using the shared key DHkey generated by the attacker and is the same as the DHkey of the router and using a derivative key of the DHkey. Because the attacker does not know the PIN, the attacker does not verify whether the received hash value sent by the router in step 4 is correct, but determines the first half of the PIN by using the decrypted first nonce and an offline exhaustive attack method. Because the first half of the PIN includes four digits, the attacker may perform the following operations on each four-digit number in sequence: determining a hash value by using the hash algorithm and the derivative key generated by the attacker in combination with the first nonce and the four-digit number, and when the determined hash value is the same as the received hash value sent by the router, determining that the four-digit number is the first half of the PIN. Because the PIN is relatively short, the attacker can calculate the first half of the PIN in an offline manner after 10 4 attempts.

Further, in the first WPS configuration process performed between the router and the attacker, the attacker does not know the first half of the PIN (the first half of the PIN is obtained subsequently by using the offline exhaustive attack method), and therefore, in step 6, the attacker cannot obtain the hash value that is determined based on the first half of the PIN. Therefore, in step 8, the router can verify that there is a potential security risk, and therefore the router does not perform subsequent data communication.

To acquire a second half of the PIN, a second WPS configuration is required. Because the attacker has obtained the first half of the PIN through the first WPS configuration, the attacker may acquire the second half of the PIN in a similar manner. That is, in the second WPS configuration process, the attacker receives a hash value that is generated based on the second half of the PIN and the first nonce and sent by the router in step 9, and may obtain the second half of the PIN by using a manner similar to the manner of obtaining the first half of the PIN, that is, the offline exhaustive attack method. Therefore, the attacker can obtain the entire PIN through the first WPS configuration and the second WPS configuration. The attacker can steal WiFi resources by using the PIN. Apparently, the WPS configuration mechanism in the prior art has a security vulnerability, and is not secure.

SUMMARY

Embodiments of the present invention provide a method, a device, and a system for establishing a secure connection, to solve a problem of poor security of a network connection between devices in the prior art.

According to a first aspect, a method for establishing a secure connection is provided and includes:

securely obtaining, by a first device, a first public key estimated value of a second device in an out-of-band manner, where the first public key estimated value is a value obtained after an operation is performed based on a first key-exchange public key of the second device by using a preset algorithm;

encrypting, by the first device, an asymmetric encryption public key of the first device by using the obtained first public key estimated value;

sending, by the first device, the encrypted asymmetric encryption public key and second key-exchange public key information of the first device to the second device, where the second key-exchange public key information includes a second key-exchange public key of the first device, and the second key-exchange public key is used by the second device to generate a shared key by using the second key-exchange public key and a key-exchange private key of the second device and establish a secure connection to the first device by using the generated shared key;

receiving, by the first device, the encrypted first key-exchange public key of the second device that is sent by the second device, where the encrypted first key-exchange public key is obtained by the second device after the second device decrypts the received encrypted asymmetric encryption public key of the first device by using the first public key estimated value of the second device and encrypts the first key-exchange public key by using the decrypted asymmetric encryption public key of the first device;

decrypting, by the first device, the encrypted first key-exchange public key by using an asymmetric encryption private key corresponding to the asymmetric encryption public key;

performing, by the first device by using the preset algorithm, an operation based on the decrypted first key-exchange public key, to obtain a second public key estimated value; and

when the first public key estimated value is consistent with the second public key estimated value, determining, by the first device, that the decrypted first key-exchange public key is correct, generating a shared key by using a key-exchange private key of the first device and the decrypted first key-exchange public key, and establishing a secure connection to the second device by using the shared key.

With reference to the first aspect, in a first possible implementation manner, the method further includes: after generating the shared key, generating, by the first device, first verification information, where the first verification information is a first encryption value obtained after the first device encrypts first designated information by using the generated shared key, or is a first hash value obtained after a hash operation is performed by using the generated shared key in combination with first designated information, or is a signature generated after first designated information is encrypted by using the asymmetric encryption private key, where the first designated information is information that is pre-agreed upon by the first device and the second device; and sending the first verification information to the second device, where the first verification information is used by the second device to verify, according to the received first verification information, whether the first device is trusted.

With reference to the first aspect or with reference to the first possible implementation manner of the first aspect, in a second possible implementation manner, the method further includes: receiving, by the first device, second verification information sent by the second device, where the second verification information is a second encryption value obtained after second designated information is encrypted by using the generated shared key after the shared key is generated by the second device, or is a second hash value obtained after a hash operation is performed by using the generated shared key in combination with second designated information, where the second designated information is information that is pre-agreed upon by the first device and the second device; and after the first device generates the shared key, the method further includes: when the second verification information is the second encryption value, decrypting the second encryption value by using the shared key generated by the first device; and determining, according to whether the second designated information obtained through decryption is correct, whether the generated shared key is available; or when the second verification information is the second hash value, performing a hash operation by using the shared key generated by the first device in combination with the second designated information; and determining, according to whether a hash value obtained by the first device matches the second hash value, whether the generated shared key is available.

With reference to the first aspect, or with reference to the first possible implementation manner of the first aspect, or with reference to the second possible implementation manner of the first aspect, in a fourth possible implementation manner, after the first device establishes the secure connection to the second device by using the shared key, the method further includes: securely obtaining, by the first device, a third public key estimated value of a fourth device in an out-of-band manner; encrypting the asymmetric encryption public key of the first device by using the obtained third public key estimated value; sending, by the first device, the encrypted asymmetric encryption public key to the fourth device; receiving an encrypted third key-exchange public key of the fourth device that is sent by the fourth device, where the encrypted third key-exchange public key is obtained by the fourth device after the fourth device decrypts the received encrypted asymmetric encryption public key by using the third public key estimated value of the fourth device and encrypts the third key-exchange public key by using the decrypted asymmetric encryption public key; decrypting, by the first device, the encrypted third key-exchange public key by using a private key corresponding to the asymmetric encryption public key; performing, by using the preset algorithm, an operation based on the third key-exchange public key obtained through decryption, to obtain a fourth public key estimated value; and when the third public key estimated value is consistent with the fourth public key estimated value, determining, by the first device, that the decrypted third key-exchange public key is correct, generating a shared key by using the key-exchange private key of the first device and the decrypted third key-exchange public key, and establishing a secure connection to the fourth device by using the shared key; and after the first device establishes the secure connection to the second device and the first device establishes the secure connection to the fourth device, the method further includes: determining, by the first device based on the shared key generated with the second device and the shared key generated with the fourth device, connec

CROSS-REFERENCE TO RELATED APPLICATIONS

TECHNICAL FIELD

The present invention relates to the field of mobile communications technologies, and in particular, to a method, a device, and a system for establishing a secure connection.

BACKGROUND

In the prior art, a WPS configuration process may mainly include the following steps:

Step 1: A router and a terminal exchange their DH (Diffie-Hellman) public keys by using plaintexts.

Step 4: The router sends, to the terminal, the hash value determined in step 3 and the first nonce encrypted by using the derivative key generated in step 3.

Step 7: The terminal sends, to the router, the hash value determined in step 5 and the second nonce encrypted by using the derivative key of the DH key of the terminal.

Step 9: The router processes a second half of the PIN by using a method similar to that of step 3, obtains a hash value of the second half of the PIN, and sends it to the terminal.

Step 11: The terminal processes the second half of the PIN by using a method similar to that of step 6, obtains a hash value of the second half of the PIN, and sends it to the router.

SUMMARY

According to a first aspect, a method for establishing a secure connection is provided and includes:

encrypting, by the first device, an asymmetric encryption public key of the first device by using the obtained first public key estimated value;

decrypting, by the first device, the encrypted first key-exchange public key by using an asymmetric encryption private key corresponding to the asymmetric encryption public key;

performing, by the first device by using the preset algorithm, an operation based on the decrypted first key-exchange public key, to obtain a second public key estimated value; and

According to a second aspect, a method for establishing a secure connection is provided and includes:

receiving, by a first device, an encrypted asymmetric encryption public key of a second device that is sent by the second device, where the encrypted asymmetric encryption public key of the second device is encrypted by the second device by using a first public key estimated value of the first device that is securely obtained in an out-of-band manner, and the first public key estimated value is a value obtained after an operation is performed based on a first key-exchange public key of the first device by using a preset algorithm;

decrypting, by the first device, the received encrypted asymmetric encryption public key by using the first public key estimated value of the first device, and encrypting the first key-exchange public key of the first device by using the decrypted asymmetric encryption public key;

sending, by the first device, the encrypted first key-exchange public key to the second device, so that the second device decrypts the encrypted first key-exchange public key by using an asymmetric encryption private key corresponding to the asymmetric encryption public key and generates, by using the decrypted first key-exchange public key and a key-exchange private key of the second device, a shared key for establishing a secure connection to the first device;

obtaining, by the first device, a second key-exchange public key of the second device; and

generating, by the first device, a shared key by using a key-exchange private key of the first device and the obtained second key-exchange public key, and establishing a secure connection to the second device by using the shared key.

With reference to the second aspect, in a first possible implementation manner, the method further includes: receiving, by the first device, third verification information sent by the second device, where the third verification information is a third encryption value obtained by the second device after third designated information is encrypted by using the generated shared key, or is a third hash value obtained by the second device after a hash operation is performed on third designated information by using the generated shared key, or is a signature generated after third designated information is encrypted by the second device by using the asymmetric encryption private key, where the third designated information is information that is pre-agreed upon by the first device and the second device; and after the first device generates the shared key, the method further includes: when the third verification information is the third encryption value, decrypting, by the first device, the third encryption value by using the shared key generated by the first device; and determining, according to whether the third designated information obtained through decryption is correct, whether the generated shared key is available; or when the third verification information is the third hash value, performing, by the first device, a hash operation on the third designated information by using the shared key generated by the first device; and determining, according to whether a hash value obtained by the first device matches the third hash value, whether the generated shared key is available; or when the third verification information is the encrypted signature, decrypting, by the first device, the encrypted signature by using the asymmetric encryption public key; and determining, according to whether the third designated information obtained through decryption is correct, whether the second device is trusted.

With reference to the second aspect or with reference to the first possible implementation manner of the second aspect, in a second possible implementation manner, the method further includes: after generating the shared key, generating, by the first device, fourth verification information by using the generated shared key, where the fourth verification information is a fourth encryption value obtained by the first device after fourth designated information is encrypted by using the generated shared key, or is a fourth hash value obtained after a hash operation is performed on fourth designated information by using the generated shared key, where the fourth designated information is information that is pre-agreed upon by the first device and the second device; and sending the fourth verification information to the second device, where the fourth verification information is used by the second device to verify, according to the received fourth verification information, whether the first device is trusted.

With reference to the second aspect, or with reference to the first possible implementation manner of the second aspect, or with reference to the second possible implementation manner of the second aspect, in a third possible implementation manner, the obtaining, by the first device, a second key-exchange public key of the second device, specifically includes: receiving second key-exchange public key information sent by the second device, where the second key-exchange public key information is the plaintext second key-exchange public key or the second key-exchange public key encrypted by using the public key estimated value of the first device; and when the received second key-exchange public key information is the encrypted second key-exchange public key, decrypting the encrypted second key-exchange public key by using the public key estimated value of the first device, to obtain the decrypted second key-exchange public key.

With reference to the second aspect, or with reference to the first possible implementation manner of the second aspect, or with reference to the second possible implementation manner of the second aspect, in a fourth possible implementation manner, after the secure connection is established with the second device by using the shared key, the method further includes: receiving, by the first device, an encrypted third public key estimated value of a third device that is sent by the second device; decrypting the received encrypted third public key estimated value, and encrypting an asymmetric encryption public key of the first device by using the decrypted third public key estimated value; sending, by the first device, the encrypted asymmetric encryption public key to the third device; receiving an encrypted third key-exchange public key sent by the third device, where the encrypted third key-exchange public key is obtained by the third device after the third device decrypts the received encrypted asymmetric encryption public key by using the third public key estimated value of the third device and encrypts the third key-exchange public key by using the decrypted asymmetric encryption public key; decrypting, by the first device, the encrypted third key-exchange public key by using an asymmetric encryption private key corresponding to the asymmetric encryption public key; performing, by using the preset algorithm, an operation based on the third key-exchange public key obtained through decryption, to obtain a fourth public key estimated value; and when the third public key estimated value is consistent with the fourth public key estimated value, determining, by the first device, that the decrypted third key-exchange public key is correct, generating a shared key by using the key-exchange private key of the first device and the decrypted third key-exchange public key, and establishing a secure connection to the third device by using the shared key.

According to a third aspect, a device for establishing a secure connection is provided and includes:

an obtaining module, configured to securely obtain a first public key estimated value of a second device in an out-of-band manner, where the first public key estimated value is a value obtained after an operation is performed based on a first key-exchange public key of the second device by using a preset algorithm;

an encryption module, configured to encrypt an asymmetric encryption public key of the device by using the first public key estimated value obtained by the obtaining module;

a sending module, configured to send the asymmetric encryption public key encrypted by the encryption module and second key-exchange public key information of the first device to the second device, where the second key-exchange public key information includes a second key-exchange public key of the first device, and the second key-exchange public key is used by the second device to generate a shared key by using the second key-exchange public key and a key-exchange private key of the second device and establish a secure connection to the first device by using the generated shared key;

a receiving module, configured to receive the encrypted first key-exchange public key of the second device that is sent by the second device, where the encrypted first key-exchange public key is obtained by the second device after the second device decrypts the received encrypted asymmetric encryption public key of the device by using the first public key estimated value of the second device and encrypts the first key-exchange public key by using the decrypted asymmetric encryption public key of the device;

a decryption module, configured to decrypt, by using an asymmetric encryption private key corresponding to the asymmetric encryption public key, the encrypted first key-exchange public key received by the receiving module;

an operation module, configured to perform, by using the preset algorithm, an operation based on the first key-exchange public key obtained by the decryption module through decryption, to obtain a second public key estimated value; and

a generation module, configured to: when the first public key estimated value is consistent with the second public key estimated value obtained by the operation module, determine that the decrypted first key-exchange public key is correct, generate a shared key by using a key-exchange private key of the device and the decrypted first key-exchange public key, and establish a secure connection to the second device by using the shared key.

With reference to the third aspect, in a first possible implementation manner, the generation module is further configured to generate first verification information after generating the shared key, where the first verification information is a first encryption value obtained by the generation module after first designated information is encrypted by using the generated shared key, or is a first hash value obtained by the generation module after a hash operation is performed by using the generated shared key in combination with first designated information, or is a signature generated by the generation module after first designated information is encrypted by using the asymmetric encryption private key, where the first designated information is information that is pre-agreed upon by the device and the second device; and the sending module is further configured to send the first verification information generated by the generation module to the second device, where the first verification information is used by the second device to verify, according to the received first verification information, whether the device is trusted.

With reference to the third aspect or with reference to the first possible implementation manner of the third aspect, in a second possible implementation manner, the receiving module is further configured to receive second verification information sent by the second device, where the second verification information is a second encryption value obtained after second designated information is encrypted by using the generated shared key after the shared key is generated by the second device, or is a second hash value obtained after a hash operation is performed by using the generated shared key in combination with second designated information, where the second designated information is information that is pre-agreed upon by the device and the second device; the decryption module is further configured to: after the shared key is generated, when the second verification information received by the receiving module is the second encryption value, decrypt the second encryption value by using the shared key generated by the generation module, and when the second verification information is the second hash value, perform a hash operation by using the shared key generated by the generation module in combination with the second designated information; and the generation module is further configured to determine, according to whether the second designated information obtained by the decryption module after the second encryption value is decrypted is correct, whether the generated shared key is available, and determine, according to whether a hash value obtained by the decryption module after the hash operation is performed on the second designated information matches the second hash value, whether the generated shared key is available.

With reference to the third aspect, or with reference to the first possible implementation manner of the third aspect, or with reference to the second possible implementation manner of the third aspect, in a fourth possible implementation manner, the obtaining module is further configured to securely obtain a third public key estimated value of a fourth device in an out-of-band manner after the device establishes the secure connection to the second device by using the shared key; the encryption module is further configured to encrypt the asymmetric encryption public key of the device by using the third public key estimated value obtained by the obtaining module; the sending module is further configured to send the asymmetric encryption public key encrypted by the encryption module to the fourth device; the receiving module is further configured to receive an encrypted third key-exchange public key of the fourth device that is sent by the fourth device, where the encrypted third key-exchange public key is obtained by the fourth device after the fourth device decrypts the received encrypted asymmetric encryption public key by using the third public key estimated value of the fourth device and encrypts the third key-exchange public key by using the decrypted asymmetric encryption public key; the decryption module is further configured to decrypt, by using a private key corresponding to the asymmetric encryption public key, the encrypted third key-exchange public key received by the receiving module; the operation module is further configured to perform, by using the preset algorithm, an operation based on the third key-exchange public key obtained through decryption, to obtain a fourth public key estimated value; the generation module is further configured to: when the third public key estimated value is consistent with the fourth public key estimated value obtained by the operation module, determine that the decrypted third key-exchange public key is correct, generate a shared key by using the key-exchange private key of the device and the decrypted third key-exchange public key, and establish a secure connection to the fourth device by using the shared key; and after the device establishes the secure connection to the second device and the device establishes the secure connection to the fourth device, determine, based on the shared key generated with the second device and the shared key generated with the fourth device, connection information for establishing a secure connection between the second device and the fourth device; and the sending module is further configured to send the connection information determined by the generation module to the second device and the fourth device separately.

With reference to the third aspect, or with reference to the first possible implementation manner of the third aspect, or with reference to the second possible implementation manner of the third aspect, in a fifth possible implementation manner, the second key-exchange public key information of the first device that is sent by the sending module is the plaintext second key-exchange public key of the first device, or is the second key-exchange public key encrypted by using the first public key estimated value of the second device.

According to a fourth aspect, a device for establishing a secure connection is provided and includes:

a receiving module, configured to receive an encrypted asymmetric encryption public key of a second device that is sent by the second device, where the encrypted asymmetric encryption public key of the second device is encrypted by the second device by using a first public key estimated value of the device that is securely obtained in an out-of-band manner, and the first public key estimated value is a value obtained after an operation is performed based on a first key-exchange public key of the device by using a preset algorithm;

a decryption module, configured to decrypt, by using the first public key estimated value of the device, the encrypted asymmetric encryption public key received by the receiving module;

an encryption module, configured to encrypt the first key-exchange public key of the device by using the asymmetric encryption public key decrypted by the decryption module;

a sending module, configured to send the first key-exchange public key encrypted by the encryption module to the second device, so that the second device decrypts the encrypted first key-exchange public key by using an asymmetric encryption private key corresponding to the asymmetric encryption public key and generates, by using the decrypted first key-exchange public key and a key-exchange private key of the second device, a shared key for establishing a secure connection to the device;

an obtaining module, configured to obtain a second key-exchange public key of the second device; and

a generation module, configured to generate a shared key by using a key-exchange private key of the device and the second key-exchange public key obtained by the obtaining module, and establish a secure connection to the second device by using the shared key.

With reference to the fourth aspect, in a first possible implementation manner, the receiving module is further configured to receive third verification information sent by the second device, where the third verification information is a third encryption value obtained by the second device after third designated information is encrypted by using the generated shared key, or is a third hash value obtained by the second device after a hash operation is performed on third designated information by using the generated shared key, or is a signature generated after third designated information is encrypted by the second device by using the asymmetric encryption private key, where the third designated information is information that is pre-agreed upon by the device and the second device; the decryption module is further configured to: after the generation module generates the shared key, when the third verification information is the third encryption value, decrypt the third encryption value by using the shared key generated by the generation module, and when the third verification information is the third hash value, perform a hash operation on the third designated information by using the shared key generated by the generation module, and when the third verification information is the encrypted signature, decrypt the encrypted signature by using the asymmetric encryption public key; and the generation module is further configured to determine, according to whether the third designated information obtained by the decryption module after the third encryption value is decrypted is correct, whether the generated shared key is available, and determine, according to whether a hash value obtained by the decryption module after the hash operation is performed on the third designated information matches the third hash value, whether the generated shared key is available, and determine, according to whether the third designated information obtained by the decryption module after the encrypted signature is decrypted is correct, whether the second device is trusted.

With reference to the fourth aspect or with reference to the first possible implementation manner of the fourth aspect, in a second possible implementation manner, the generation module is further configured to generate fourth verification information by using the generated shared key after the shared key is generated, where the fourth verification information is a fourth encryption value obtained by the generation module after fourth designated information is encrypted by using the generated shared key, or is a fourth hash value obtained by the generation module after a hash operation is performed on fourth designated information by using the generated shared key, where the fourth designated information is information that is pre-agreed upon by the device and the second device; and the sending module is further configured to send the fourth verification information generated by the generation module to the second device, where the fourth verification information is used by the second device to verify, according to the received fourth verification information, whether the device is trusted.

With reference to the fourth aspect, or with reference to the first possible implementation manner of the fourth aspect, or with reference to the second possible implementation manner of the fourth aspect, in a fourth possible implementation manner, the device further includes an operation module, where: the receiving module is further configured to receive, after the generation module establishes the secure connection to the second device by using the shared key, an encrypted third public key estimated value of a third device that is sent by the second device; the decryption module is further configured to decrypt the encrypted third public key estimated value received by the receiving module; the encryption module is further configured to encrypt an asymmetric encryption public key of the device by using the third public key estimated value decrypted by the decryption module; the sending module is further configured to send the encrypted asymmetric encryption public key to the third device; the receiving module is further configured to receive, after the sending module sends the encrypted asymmetric encryption public key to the third device, an encrypted third key-exchange public key sent by the third device, where the encrypted third key-exchange public key is obtained by the third device after the third device decrypts the received encrypted asymmetric encryption public key by using the third public key estimated value of the third device and encrypts the third key-exchange public key by using the decrypted asymmetric encryption public key; the decryption module is further configured to decrypt, by using an asymmetric encryption private key corresponding to the asymmetric encryption public key, the encrypted third key-exchange public key received by the receiving module; the operation module is configured to perform, by using the preset algorithm, an operation based on the third key-exchange public key obtained by the decryption module through decryption, to obtain a fourth public key estimated value; and the generation module is further configured to: when the third public key estimated value is consistent with the fourth public key estimated value, determine that the decrypted third key-exchange public key is correct, generate a shared key by using the key-exchange private key of the device and the decrypted third key-exchange public key, and establish a secure connection to the third device by using the shared key.

According to a fifth aspect, a system for establishing a secure connection is provided and includes the device provided by the third aspect or any one of the possible implementation manners of the third aspect, and the device provided by the fourth aspect or any one of the possible implementation manners of the fourth aspect.

According to a sixth aspect, a device for establishing a secure connection is provided and includes:

a processor, configured to securely obtain a first public key estimated value of a second device in an out-of-band manner, where the first public key estimated value is a value obtained after an operation is performed based on a first key-exchange public key of the second device by using a preset algorithm, and encrypt an asymmetric encryption public key of the device by using the obtained first public key estimated value;

a transmitter, configured to send the asymmetric encryption public key encrypted by the processor and second key-exchange public key information of the first device to the second device, where the second key-exchange public key information includes a second key-exchange public key of the first device, and the second key-exchange public key is used by the second device to generate a shared key by using the second key-exchange public key and a key-exchange private key of the second device and establish a secure connection to the first device by using the generated shared key; and

a receiver, configured to receive the encrypted first key-exchange public key of the second device that is sent by the second device, where the encrypted first key-exchange public key is obtained by the second device after the second device decrypts the received encrypted asymmetric encryption public key of the device by using the first public key estimated value of the second device and encrypts the first key-exchange public key by using the decrypted asymmetric encryption public key of the device; where

the processor is further configured to decrypt, by using an asymmetric encryption private key corresponding to the asymmetric encryption public key, the encrypted first key-exchange public key received by the receiver; perform, by using the preset algorithm, an operation based on the first key-exchange public key obtained through decryption, to obtain a second public key estimated value; and when the first public key estimated value is consistent with the second public key estimated value, determine that the decrypted first key-exchange public key is correct, generate a shared key by using a key-exchange private key of the device and the decrypted first key-exchange public key, and establish a secure connection to the second device by using the shared key.

With reference to the sixth aspect, in a first possible implementation manner, the processor is further configured to generate first verification information after generating the shared key, where the first verification information is a first encryption value obtained by the processor after first designated information is encrypted by using the generated shared key, or is a first hash value obtained by the processor after a hash operation is performed by using the generated shared key in combination with first designated information, or is a signature generated after first designated information is encrypted by the processor by using the asymmetric encryption private key, where the first designated information is information that is pre-agreed upon by the device and the second device; and the transmitter is further configured to send the first verification information generated by the processor to the second device, where the first verification information is used by the second device to verify, according to the received first verification information, whether the device is trusted.

With reference to the sixth aspect or with reference to the first possible implementation manner of the sixth aspect, in a second possible implementation manner, the receiver is further configured to receive second verification information sent by the second device, where the second verification information is a second encryption value obtained after second designated information is encrypted by using the generated shared key after the shared key is generated by the second device, or is a second hash value obtained after a hash operation is performed by using the generated shared key in combination with second designated information, where the second designated information is information that is pre-agreed upon by the device and the second device; and the processor is further configured to: after the shared key is generated, when the second verification information received by the receiver is the second encryption value, decrypt the second encryption value by using the shared key generated by the processor; when the second verification information is the second hash value, perform a hash operation by using the shared key generated by the processor in combination with the second designated information; determine, according to whether the second designated information obtained after the second encryption value is decrypted is correct, whether the generated shared key is available; and determine, according to whether a hash value obtained by the processor after the hash operation is performed on the second designated information matches the second hash value, whether the generated shared key is available.

With reference to the sixth aspect, or with reference to the first possible implementation manner of the sixth aspect, or with reference to the second possible implementation manner of the sixth aspect, in a fourth possible implementation manner, the processor is further configured to securely obtain a third public key estimated value of a fourth device in an out-of-band manner after the device establishes the secure connection to the second device by using the shared key, and encrypt the asymmetric encryption public key of the device by using the obtained third public key estimated value; the transmitter is further configured to send the asymmetric encryption public key encrypted by the processor to the fourth device; the receiver is further configured to receive an encrypted third key-exchange public key of the fourth device that is sent by the fourth device, where the encrypted third key-exchange public key is obtained by the fourth device after the fourth device decrypts the received encrypted asymmetric encryption public key by using the third public key estimated value of the fourth device and encrypts the third key-exchange public key by using the decrypted asymmetric encryption public key; the processor is further configured to decrypt, by using a private key corresponding to the asymmetric encryption public key, the encrypted third key-exchange public key received by the receiver; perform, by using the preset algorithm, an operation based on the third key-exchange public key obtained through decryption, to obtain a fourth public key estimated value; when the third public key estimated value is consistent with the fourth public key estimated value, determine that the decrypted third key-exchange public key is correct, generate a shared key by using the key-exchange private key of the device and the decrypted third key-exchange public key, and establish a secure connection to the fourth device by using the shared key; and after the device establishes the secure connection to the second device and the device establishes the secure connection to the fourth device, determine, based on the shared key generated with the second device and the shared key generated with the fourth device, connection information for establishing a secure connection between the second device and the fourth device; and the transmitter is further configured to send the connection information determined by the processor to the second device and the fourth device separately.

With reference to the sixth aspect, or with reference to the first possible implementation manner of the sixth aspect, or with reference to the second possible implementation manner of the sixth aspect, in a fifth possible implementation manner, the second key-exchange public key information of the first device that is sent by the transmitter is the plaintext second key-exchange public key of the first device, or is the second key-exchange public key encrypted by using the first public key estimated value of the second device.

According to a seventh aspect, a device for establishing a secure connection is provided and includes:

a receiver, configured to receive an encrypted asymmetric encryption public key of a second device that is sent by the second device, where the encrypted asymmetric encryption public key of the second device is encrypted by the second device by using a first public key estimated value of the device that is securely obtained in an out-of-band manner, and the first public key estimated value is a value obtained after an operation is performed based on a first key-exchange public key of the device by using a preset algorithm;

a processor, configured to decrypt, by using the first public key estimated value of the device, the encrypted asymmetric encryption public key received by the receiver, and encrypt the first key-exchange public key of the device by using the decrypted asymmetric encryption public key; and

a transmitter, configured to send the first key-exchange public key encrypted by the processor to the second device, so that the second device decrypts the encrypted first key-exchange public key by using an asymmetric encryption private key corresponding to the asymmetric encryption public key and generates, by using the decrypted first key-exchange public key and a key-exchange private key of the second device, a shared key for establishing a secure connection to the device; where

the processor is further configured to obtain a second key-exchange public key of the second device, generate a shared key by using a key-exchange private key of the device and the obtained second key-exchange public key, and establish a secure connection to the second device by using the shared key.

With reference to the seventh aspect, in a first possible implementation manner, the receiver is further configured to receive third verification information sent by the second device, where the third verification information is a third encryption value obtained by the second device after third designated information is encrypted by using the generated shared key, or is a third hash value obtained by the second device after a

CLAIMS

Claims ( 20 )

What is claimed is:

1. A method for establishing a secure connection, comprising:

securely obtaining, by a first device, a first public key estimated value of a second device in an out-of-band manner, wherein the first public key estimated value is a value obtained after an operation is performed based on a first key-exchange public key of the second device by using a preset algorithm;

encrypting, by the first device, an asymmetric encryption public key of the first device by using the obtained first public key estimated value;

sending, by the first device, the encrypted asymmetric encryption public key and second key-exchange public key information of the first device to the second device, wherein the second key-exchange public key information comprises a second key-exchange public key of the first device, and the second key-exchange public key is used by the second device to generate a shared key by using the second key-exchange public key and a key-exchange private key of the second device and establish a secure connection to the first device by using the generated shared key;

receiving, by the first device, the encrypted first key-exchange public key of the second device that is sent by the second device, wherein the encrypted first key-exchange public key is obtained by the second device after the second device decrypts the received encrypted asymmetric encryption public key of the first device by using the first public key estimated value of the second device and encrypts the first key-exchange public key by using the decrypted asymmetric encryption public key of the first device;

decrypting, by the first device, the encrypted first key-exchange public key by using an asymmetric encryption private key corresponding to the asymmetric encryption public key;

performing, by the first device by using the preset algorithm, an operation based on the decrypted first key-exchange public key, to obtain a second public key estimated value; and

2. The method according to claim 1 , further comprising:

after generating the shared key:

generating, by the first device, first verification information, wherein the first verification information is a first encryption value obtained after the first device encrypts first designated information by using the generated shared key, or is a first hash value obtained after a hash operation is performed by using the generated shared key in combination with first designated information, or is a signature generated after first designated information is encrypted by using the asymmetric encryption private key, wherein the first designated information is information that is pre-agreed upon by the first device and the second device; and

sending the first verification information to the second device, wherein the first verification information is used by the second device to verify, according to the received first verification information, whether the first device is trusted.

3. The method according to claim 1 , further comprising:

receiving, by the first device, second verification information sent by the second device, wherein the second verification information is a second encryption value obtained after second designated information is encrypted by using the shared key generated by the second device, or is a second hash value obtained after a hash operation is performed by using the generated shared key in combination with second designated information, wherein the second designated information is information that is pre-agreed upon by the first device and the second device; and

after the first device generates the shared key, further comprising:

when the second verification information is the second encryption value, decrypting the second encryption value by using the shared key generated by the first device, and

determining, according to whether the decrypted second designated information is correct, whether the generated shared key is available; or

when the second verification information is the second hash value, performing a hash operation by using the shared key generated by the first device in combination with the second designated information; and

determining, according to whether a hash value obtained by the first device matches the second hash value, whether the generated shared key is available.

4. The method according to claim 1 , wherein after the first device establishes the secure connection to the second device by using the shared key, the method further comprises:

securely obtaining, by the first device, a public key estimated value of a third device in an out-of-band manner; and

encrypting the obtained public key estimated value of the third device, and sending the encrypted public key estimated value of the third device to the second device, wherein the public key estimated value of the third device is used by the second device to establish a secure connection to the third device based on the public key estimated value of the third device.

5. The method according to claim 1 , wherein after the first device establishes the secure connection to the second device by using the shared key, the method further comprises:

securely obtaining, by the first device, a third public key estimated value of a fourth device in an out-of-band manner;

encrypting the asymmetric encryption public key of the first device by using the obtained third public key estimated value;

sending, by the first device, the encrypted asymmetric encryption public key to the fourth device;

receiving an encrypted third key-exchange public key of the fourth device that is sent by the fourth device, wherein the encrypted third key-exchange public key is obtained by the fourth device after the fourth device decrypts the received encrypted asymmetric encryption public key by using the third public key estimated value of the fourth device and encrypts the third key-exchange public key by using the decrypted asymmetric encryption public key;

decrypting, by the first device, the encrypted third key-exchange public key by using a private key corresponding to the asymmetric encryption public key;

performing, by using the preset algorithm, an operation based on the decrypted third key-exchange public key, to obtain a fourth public key estimated value; and

when the third public key estimated value is consistent with the fourth public key estimated value, determining, by the first device, that the decrypted third key-exchange public key is correct, generating a shared key by using the key-exchange private key of the first device and the decrypted third key-exchange public key, and establishing a secure connection to the fourth device by using the shared key; and

after the first device establishes the secure connection to the second device and the first device establishes the secure connection to the fourth device, the method further comprises:

determining, by the first device based on the shared key generated with the second device and the shared key generated with the fourth device, connection information for establishing a secure connection between the second device and the fourth device; and

sending the determined connection information to the second device and the fourth device separately.

6. The method according to claim 1 , wherein the second key-exchange public key information of the first device is a plaintext second key-exchange public key of the first device, or is the second key-exchange public key encrypted by using the first public key estimated value of the second device.

7. A method for establishing a secure connection, comprising:

receiving, by a first device, an encrypted asymmetric encryption public key of a second device that is sent by the second device, wherein the encrypted asymmetric encryption public key of the second device is encrypted by the second device by using a first public key estimated value of the first device that is securely obtained in an out-of-band manner, and the first public key estimated value is a value obtained after an operation is performed based on a first key-exchange public key of the first device by using a preset algorithm;

obtaining, by the first device, a second key-exchange public key of the second device; and

8. The method according to claim 7 , further comprising:

receiving, by the first device, third verification information sent by the second device, wherein the third verification information is a third encryption value obtained by the second device after third designated information is encrypted by using the generated shared key, or is a third hash value obtained by the second device after a hash operation is performed on third designated information by using the generated shared key, or is a signature generated after third designated information is encrypted by the second device by using the asymmetric encryption private key, wherein the third designated information is information that is pre-agreed upon by the first device and the second device; and

after the first device generates the shared key, further comprising:

when the third verification information is the third encryption value, decrypting, by the first device, the third encryption value by using the shared key generated by the first device, and

determining, according to whether the decrypted third designated information is correct, whether the generated shared key is available; or

when the third verification information is the third hash value, performing, by the first device, a hash operation on the third designated information by using the shared key generated by the first device, and

determining, according to whether a hash value obtained by the first device matches the third hash value, whether the generated shared key is available; or

when the third verification information is the encrypted signature, decrypting, by the first device, the encrypted signature by using the asymmetric encryption public key, and

determining, according to whether the decrypted third designated information is correct, whether the second device is trusted.

9. The method according to claim 7 , further comprising:

after generating the shared key:

generating, by the first device, fourth verification information by using the generated shared key, wherein the fourth verification information is a fourth encryption value obtained by the first device after fourth designated information is encrypted by using the generated shared key, or is a fourth hash value obtained after a hash operation is performed on fourth designated information by using the generated shared key, wherein the fourth designated information is information that is pre-agreed upon by the first device and the second device; and

sending the fourth verification information to the second device, wherein the fourth verification information is used by the second device to verify, according to the received fourth verification information, whether the first device is trusted.

10. The method according to claim 7 , wherein obtaining, by the first device, the second key-exchange public key of the second device comprises:

receiving second key-exchange public key information sent by the second device, wherein the second key-exchange public key information is the plaintext second key-exchange public key or the second key-exchange public key encrypted by using the first public key estimated value of the first device; and

when the received second key-exchange public key information is the encrypted second key-exchange public key, decrypting the encrypted second key-exchange public key by using the first public key estimated value of the first device, to obtain the decrypted second key-exchange public key.

11. The method according to claim 7 , wherein after the secure connection is established with the second device by using the shared key, the method further comprises:

receiving, by the first device, an encrypted third public key estimated value of a third device that is sent by the second device;

decrypting the received encrypted third public key estimated value, and encrypting an asymmetric encryption public key of the first device by using the decrypted third public key estimated value;

sending, by the first device, the encrypted asymmetric encryption public key to the third device;

receiving an encrypted third key-exchange public key sent by the third device, wherein the encrypted third key-exchange public key is obtained by the third device after the third device decrypts the received encrypted asymmetric encryption public key by using the third public key estimated value of the third device and encrypts the third key-exchange public key by using the decrypted asymmetric encryption public key;

decrypting, by the first device, the encrypted third key-exchange public key by using an asymmetric encryption private key corresponding to the asymmetric encryption public key;

performing, by using the preset algorithm, an operation based on the decrypted third key-exchange public key, to obtain a fourth public key estimated value; and

12. A device for establishing a secure connection, comprising:

where the processor is further configured to:

decrypt, by using an asymmetric encryption private key corresponding to the asymmetric encryption public key, the encrypted first key-exchange public key received by the receiver,

perform, by using the preset algorithm, an operation based on the first key-exchange public key obtained through decryption, to obtain a second public key estimated value, and

when the first public key estimated value is consistent with the second public key estimated value:

determine that the decrypted first key-exchange public key is correct,

generate a shared key by using a key-exchange private key of the device and the decrypted first key-exchange public key, and

establish a secure connection to the second device by using the shared key.

13. The device according to claim 12 , wherein the processor is further configured to:

generate first verification information after generating the shared key, where the first verification information is a first encryption value obtained by the processor after first designated information is encrypted by using the generated shared key, or is a first hash value obtained by the processor after a hash operation is performed by using the generated shared key in combination with first designated information, or is a signature generated after first designated information is encrypted by the processor by using the asymmetric encryption private key, where the first designated information is information that is pre-agreed upon by the device and the second device; and

the transmitter is further configured to send the first verification information generated by the processor to the second device, where the first verification information is used by the second device to verify, according to the received first verification information, whether the device is trusted.

14. The device according to claim 12 , wherein the receiver is further configured to:

receive second verification information sent by the second device, where the second verification information is a second encryption value obtained after second designated information is encrypted by using the generated shared key after the shared key is generated by the second device, or is a second hash value obtained after a hash operation is performed by using the generated shared key in combination with second designated information, where the second designated information is information that is pre-agreed upon by the device and the second device; and

the processor is further configured to:

after the shared key is generated:

when the second verification information received by the receiver is the second encryption value, decrypt the second encryption value by using the shared key generated by the processor,

when the second verification information is the second hash value, perform a hash operation by using the shared key generated by the processor in combination with the second designated information,

determine, according to whether the second designated information obtained after the second encryption value is decrypted is correct, whether the generated shared key is available, and

determine, according to whether a hash value obtained by the processor after the hash operation is performed on the second designated information matches the second hash value, whether the generated shared key is available.

15. The device according to claim 12 , wherein the processor is further configured to:

securely obtain a public key estimated value of a third device in an out-of-band manner after the device establishes the secure connection to the second device by using the shared key; and

the transmitter is further configured to:

encrypt the public key estimated value of the third device that is obtained by the processor, and send the encrypted public key estimated value of the third device to the second device, where the public key estimated value of the third device is used by the second device to establish a secure connection to the third device based on the public key estimated value of the third device.

16. The device according to claim 12 , wherein the processor is further configured to:

securely obtain a third public key estimated value of a fourth device in an out-of-band manner after the device establishes the secure connection to the second device by using the shared key, and

encrypt the asymmetric encryption public key of the device by using the obtained third public key estimated value;

the transmitter is further configured to:

send the asymmetric encryption public key encrypted by the processor to the fourth device;

the receiver is further configured to:

receive an encrypted third key-exchange public key of the fourth device that is sent by the fourth device, where the encrypted third key-exchange public key is obtained by the fourth device after the fourth device decrypts the received encrypted asymmetric encryption public key by using the third public key estimated value of the fourth device and encrypts the third key-exchange public key by using the decrypted asymmetric encryption public key; the processor is further configured to:

decrypt, by using a private key corresponding to the asymmetric encryption public key, the encrypted third key-exchange public key received by the receiver;

perform, by using the preset algorithm, an operation based on the third key-exchange public key obtained through decryption, to obtain a fourth public key estimated value;

when the third public key estimated value is consistent with the fourth public key estimated value:

determine that the decrypted third key-exchange public key is correct,

generate a shared key by using the key-exchange private key of the device and the decrypted third key-exchange public key, and

establish a secure connection to the fourth device by using the shared key; and

after the device establishes the secure connection to the second device and the device establishes the secure connection to the fourth device, determine, based on the shared key generated with the second device and the shared key generated with the fourth device, connection information for establishing a secure connection between the second device and the fourth device; and

the transmitter is further configured to:

send the connection information determined by the processor to the second device and the fourth device separately.

17. A device for establishing a secure connection, comprising:

a processor, configured to:

decrypt, by using the first public key estimated value of the device, the encrypted asymmetric encryption public key received by the receiver, and

encrypt the first key-exchange public key of the device by using the decrypted asymmetric encryption public key; and

a transmitter, configured to:

send the first key-exchange public key encrypted by the processor to the second device, so that the second device decrypts the encrypted first key-exchange public key by using an asymmetric encryption private key corresponding to the asymmetric encryption public key and generates, by using the decrypted first key-exchange public key and a key-exchange private key of the second device, a shared key for establishing a secure connection to the device;

where the processor is further configured to:

obtain a second key-exchange public key of the second device,

generate a shared key by using a key-exchange private key of the device and the obtained second key-exchange public key, and

establish a secure connection to the second device by using the shared key.

18. The device according to claim 17 , wherein the receiver is further configured to receive third verification information sent by the second device, where the third verification information is a third encryption value obtained by the second device after third designated information is encrypted by using the generated shared key, or is a third hash value obtained by the second device after a hash operation is performed on third designated information by using the generated shared key, or is a signature generated after third designated information is encrypted by the second device by using the asymmetric encryption private key, where the third designated information is information that is pre-agreed upon by the device and the second device; and

the processor is further configured to:

after the shared key is generated:

when the third verification information is the third encryption value, decrypt the third encryption value by using the generated shared key,

when the third verification information is the third hash value, perform a hash operation on the third designated information by using the generated shared key,

when the third verification information is the encrypted signature, decrypt the encrypted signature by using the asymmetric encryption public key,

determine, according to whether the third designated information obtained after the third encryption value is decrypted is correct, whether the generated shared key is available,

determine, according to whether a hash value obtained after the hash operation is performed on the third designated information matches the third hash value, whether the generated shared key is available, and

determine, according to whether the third designated information obtained after the encrypted signature is decrypted is correct, whether the second device is trusted.

19. The device according to claim 17 , wherein the processor is further configured to:

generate fourth verification information by using the generated shared key after the shared key is generated, where the fourth verification information is a fourth encryption value obtained after fourth designated information is encrypted by using the generated shared key, or is a fourth hash value obtained after a hash operation is performed on fourth designated information by using the generated shared key, where the fourth designated information is information that is pre-agreed upon by the device and the second device; and the transmitter is further configured to send the fourth verification information generated by the processor to the second device, where the fourth verification information is used by the second device to verify, according to the received fourth verification information, whether the device is trusted.

20. The device according to claim 17 , wherein the processor is configured to:

receive second key-exchange public key information sent by the second device, where the second key-exchange public key information is a plaintext second key-exchange public key or the second key-exchange public key encrypted by using the public key estimated value of the device; and

when the received second key-exchange public key info illation is the encrypted second key-exchange public key, decrypt the encrypted second key-exchange public key by using the public key estimated value of the device, to obtain the decrypted second key-exchange public key.

US15/282,598

2014-04-03

2016-09-30

Method, device, and system for establishing secure connection

Active

2035-09-02

US10218501B2

( en )

Applications Claiming Priority (4)

Application Number

Priority Date

Filing Date

Title

CN201410133485.1

2014-04-03

CN201410133485

2014-04-03

CN201410133485.1A

CN104980928B

( en )

2014-04-03

It is a kind of for establishing the method, equipment and system of secure connection

PCT/CN2015/075896

WO2015149723A1

( en )

2014-04-03

2015-04-03

Method, device and system for establishing secure connection

Related Parent Applications (1)

Application Number

Title

Priority Date

Filing Date

PCT/CN2015/075896

Continuation

WO2015149723A1

( en )

2014-04-03

2015-04-03

Method, device and system for establishing secure connection

Publications (2)

Publication Number

Publication Date

US20170026174A1

US20170026174A1 ( en )

2017-01-26

US10218501B2

true

US10218501B2 ( en )

2019-02-26

Family

ID=54239416

Family Applications (1)

Application Number

Title

Priority Date

Filing Date

US15/282,598

Active

2035-09-02

US10218501B2

( en )

2014-04-03

2016-09-30

Method, device, and system for establishing secure connection

Country Status (4)

Country

Link

( 1 )

US10218501B2

( en )

( 1 )

EP3119119B1

( en )

( 1 )

CN104980928B

( en )

( 1 )

WO2015149723A1

( en )

Cited By (1)

* Cited by examiner, â Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US12621143B2

( en )

2021-05-14

2026-05-05

Verizon Patent And Licensing Inc.

Systems and methods for blockchain-based secure key exchange with key escrow fallback

Families Citing this family (49)

* Cited by examiner, â Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

CN112287389B

( en )

2015-03-03

2024-08-02

æºå¾·æµ·å°æ¯æéè´£ä»»å¬å¸

Access control for encrypted data in machine-readable identifiers

US10051470B2

( en )

2015-03-23

2018-08-14

Qualcomm Incorporated

Schedule selection and connection setup between devices participating in a NAN data link

US11042488B2

( en )

2015-06-01

2021-06-22

Cryptography Research, Inc.

Diversifying a base symmetric key based on a public key

CN105407450A

( en )

2015-10-21

2016-03-16

ç æµ·å¥å¾çµåæéå¬å¸

Intelligent equipment, electronic device, and network connection method based on near-field communication

CN106817219B

( en )

2015-12-01

2020-11-03

é¿éå·´å·´éå¢æ§è¡æéå¬å¸

Method and device for negotiating session key

US9584493B1

( en )

2015-12-18

2017-02-28

Wickr Inc.

Decentralized authoritative messaging

EP3185509B1

( en )

2015-12-22

2022-11-02

Sennheiser Electronic GmbH & Co. KG

Authentication of base station and headset

US10382210B2

( en )

2016-01-10

2019-08-13

Apple Inc.

Secure device pairing

GB2547025A

( en )

2016-02-05

2017-08-09

Thales Holdings Uk Plc

A method of data transfer, a method of controlling use of data and a cryptographic device

EP3211554A1

( en )

2016-02-25

2017-08-30

Micro Systemation AB

System and method for forensic access control

US10979412B2

( en )

2016-03-08

2021-04-13

Nxp Usa, Inc.

Methods and apparatus for secure device authentication

CN105939167B

( en )

2016-03-15

2018-11-30

å¤©å°èç§æè¡ä»½æéå¬å¸

A kind of data transmission method, terminal, electronic signature equipment and system

CN105868980A

( en )

2016-03-29

2016-08-17

å¹¿ä¸éé¸¿æ°æ®æéå¬å¸

Payment equipment and payment method based on HCE technology of NFC in standard of ministry of construction

US10230700B2

( en )

2016-08-09

2019-03-12

Lenovo (Singapore) Pte. Ltd.

Transaction based message security

CN107968999B

( en )

2016-10-18

2021-04-20

åä¸ºææ¯æéå¬å¸

A kind of privacy protection method and related equipment

CN111585749B

( en )

2016-10-26

2023-04-07

åæ°åè¿ææ¯æéå¬å¸

Data transmission method, device, system and equipment

CN106533662A

( en )

2016-11-03

2017-03-22

åäº¬å¥èç§ææéå¬å¸

Methods and devices for transmitting network safety secret key

JP6797674B2

( en )

2016-12-26

2020-12-09

ãã¤ãã³æ ªå¼ä¼ç¤¾

Communication equipment, control methods, and programs

CN106789022B

( en )

2016-12-28

2021-03-09

ä¸æµ·æ¦æ æºè½ç§ææéå¬å¸

Method, device and system for generating shared key

CN108268781B

( en )

2016-12-30

2022-01-04

çæ±åå¯¼ä½è¡ä»½æéå¬å¸

Electronic element of electronic device, method for starting electronic device and encryption method

US10985915B2

( en )

2017-04-12

2021-04-20

Blackberry Limited

Encrypting data in a pre-associated state

JP6754325B2

( en )

2017-06-20

2020-09-09

å½ç«å¤§å¦æ³äººæ±æµ·å½ç«å¤§å¦æ©æ§

Authentication method for in-vehicle authentication system, in-vehicle authentication device, computer program and communication device

US11385099B1

( en )

2017-06-26

2022-07-12

SeeQC Inc.

Integrated superconducting nanowire digital photon detector

US11316666B2

( en )

2017-07-12

2022-04-26

Amazon Technologies, Inc.

Generating ephemeral key pools for sending and receiving secure communications

US11082412B2

( en )

2017-07-12

2021-08-03

Wickr Inc.

Sending secure communications using a local ephemeral key pool

CN107370598B

( en )

2017-07-17

2021-01-19

å¹¿ä¸ççµååå¡è®¤è¯æéå¬å¸

Method for using intelligent mobile phone as personal computer electronic key

CN107846685A

( en )

2017-11-16

2018-03-27

åäº¬å°ç±³ç§»å¨è½¯ä»¶æéå¬å¸

The transmission method of configuration information, apparatus and system, storage medium

US10437745B2

( en )

2018-01-05

2019-10-08

Denso International America, Inc.

Mobile de-whitening

CN108550036B

( en )

2018-03-20

2022-09-23

ä¸å½é¶èè¡ä»½æéå¬å¸

A method, terminal and device for establishing security infrastructure

CN108540493B

( en )

2018-04-28

2021-05-04

æ·±å³ä½°æé¦ææ¯æéå¬å¸

Authentication method, user equipment, network entity and service side server

CN108777678B

( en )

2018-05-18

2020-12-11

åäº¬é®çµå¤§å¦

A network key exchange system, device and method

EP3793129B1

( en )

2018-05-30

2025-04-23

Huawei International Pte. Ltd.

Key exchange system, method, and apparatus

US11172477B2

( en )

2018-11-02

2021-11-09

Qualcomm Incorproated

Multi-transport block scheduling

CN109413076B

( en )

2018-11-06

2022-11-29

åäº¬å¥èç§ææéå¬å¸

Domain name resolution method and device

US20200366476A1

( en )

2019-05-17

2020-11-19

Panasonic Avionics Corporation

Transient key negotiation for passenger accessible peripherals

EP3758322A1

( en )

2019-06-25

2020-12-30

Gemalto Sa

Method and system for generating encryption keys for transaction or connection data

CN110602058B

( en )

2019-08-22

2020-10-30

åå°æºè(æ¦æ±)ç ç©¶é¢æéå¬å¸

Chip activation device, method and computer readable storage medium

US11405203B2

( en )

2020-02-17

2022-08-02

Eclypses, Inc.

System and method for securely transferring data using generated encryption keys

CN111314072B

( en )

2020-02-21

2021-06-22

åäº¬é®çµå¤§å¦

A scalable identity authentication method and system based on SM2 algorithm

CN114362950B

( en )

2020-09-29

2025-01-21

Information transmission method, device and terminal

CN114531225B

( en )

2020-11-02

2024-09-17

æ·±å³Tclæ°ææ¯æéå¬å¸

End-to-end communication encryption method, device, storage medium and terminal equipment

CN112383915B

( en )

2020-12-02

2023-11-21

ä¸å½èåç½ç»éä¿¡éå¢æéå¬å¸

Wireless network access method, wireless access device and terminal

CN112737774B

( en )

2020-12-28

2023-04-07

èå·ç§è¾¾ç§æè¡ä»½æéå¬å¸

Data transmission method, device and storage medium in network conference

US11522707B2

( en )

2021-03-05

2022-12-06

Eclypses, Inc.

System and method for detecting compromised devices

US11720693B2

( en )

2021-03-05

2023-08-08

Eclypses, Inc.

System and method for securely transferring data

US12353576B2

( en )

2021-03-05

2025-07-08

Eclypses, Inc.

System and method for securely transferring data using encryption keys

CN116192368B

( en )

2022-12-09

2026-02-06

æµ·åä¿¡æ¯ææ¯è¡ä»½æéå¬å¸

Data processing method and device and related equipment

CN115622821B

( en )

2022-12-20

2023-04-28

åäº¬ä½³è¯ä¿¡æ¯ç§ææéå¬å¸

Encryption communication method and encryption communication system

US12615241B2

( en )

2023-04-27

2026-04-28

International Business Machines Corporation

Securing access to a virtual machine via a service processor using a key

Citations (8)

* Cited by examiner, â Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

EP1104959A2

( en )

1991-10-02

2001-06-06

AT&T Corp.

A cryptographic protocol for secure communications

CN1868163A

( en )

2003-10-16

2006-11-22

æ¾ä¸çµå¨äº§ä¸æ ªå¼ä¼ç¤¾

Encrypted communication system and communication device

US7234063B1

( en )

2002-08-27

2007-06-19

Cisco Technology, Inc.

Method and apparatus for generating pairwise cryptographic transforms based on group keys

CN101277242A

( en )

2007-03-30

2008-10-01

åå¼å·¥ä¸æ ªå¼ä¼ç¤¾

Wireless network system and wireless devices included in the system

US20090327724A1

( en )

2008-06-30

2009-12-31

Shah Rahul C

Two-way authentication between two communication endpoints using a one-way out-of-band (oob) channel

WO2010023506A1

( en )

2008-08-26

2010-03-04

Nokia Corporation

Methods, apparatuses, computer program products, and systems for providing secure pairing and association for wireless devices

US20110107101A1

( en )

2005-10-14

2011-05-05

Juniper Networks, Inc.

Password-authenticated asymmetric key exchange

US20130332739A1

( en )

2011-04-26

2013-12-12

Soongsil University Research Consortium Techno- Park

Method of sharing a session key between wireless communication terminals using a variable-length authentication code

2014

2014-04-03

CN201410133485.1A

patent/CN104980928B/en

active

Active

2015

2015-04-03

EP15772566.4A

patent/EP3119119B1/en

active

Active

2015-04-03

PCT/CN2015/075896

patent/WO2015149723A1/en

not_active

Ceased

2016

2016-09-30

US15/282,598

patent/US10218501B2/en

active

Active

Patent Citations (11)

* Cited by examiner, â Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

EP1104959A2

( en )

1991-10-02

2001-06-06

AT&T Corp.

A cryptographic protocol for secure communications

US7234063B1

( en )

2002-08-27

2007-06-19

Cisco Technology, Inc.

Method and apparatus for generating pairwise cryptographic transforms based on group keys

CN1868163A

( en )

2003-10-16

2006-11-22

æ¾ä¸çµå¨äº§ä¸æ ªå¼ä¼ç¤¾

Encrypted communication system and communication device

US20070150735A1

( en )

2003-10-16

2007-06-28

Yuichi Futa

Encrypted communication system and communication device

US20110107101A1

( en )

2005-10-14

2011-05-05

Juniper Networks, Inc.

Password-authenticated asymmetric key exchange

CN101277242A

( en )

2007-03-30

2008-10-01

åå¼å·¥ä¸æ ªå¼ä¼ç¤¾

Wireless network system and wireless devices included in the system

US20080240068A1

( en )

2007-03-30

2008-10-02

Brother Kogyo Kabushiki Kaisha

Wireless Network System, And Wireless Device Included In The System

US20090327724A1

( en )

2008-06-30

2009-12-31

Shah Rahul C

Two-way authentication between two communication endpoints using a one-way out-of-band (oob) channel

CN101978652A

( en )

2008-06-30

2011-02-16

è±ç¹å°å¬å¸

Mutual authentication between two communicating endpoints using a one-way out-of-band (OOB) channel

WO2010023506A1

( en )

2008-08-26

2010-03-04

Nokia Corporation

Methods, apparatuses, computer program products, and systems for providing secure pairing and association for wireless devices

US20130332739A1

( en )

2011-04-26

2013-12-12

Soongsil University Research Consortium Techno- Park

Method of sharing a session key between wireless communication terminals using a variable-length authentication code

Cited By (1)

* Cited by examiner, â Cited by third party

Publication number

Priority date

Publication date

Assignee

Title

US12621143B2

( en )

2021-05-14

2026-05-05

Verizon Patent And Licensing Inc.

Systems and methods for blockchain-based secure key exchange with key escrow fallback

Also Published As

Publication number

Publication date

EP3119119A1

( en )

2017-01-18

EP3119119A4

( en )

2017-03-22

CN104980928A

( en )

2015-10-14

US20170026174A1

( en )

2017-01-26

EP3119119B1

( en )

2017-11-15

CN104980928B

( en )

2018-12-07

WO2015149723A1

( en )

2015-10-08

Method, device, and system for establishing secure connection — Huawei Device (Dongguan) Co., Ltd. (US10218501B2)

Related documents