Method for establishing a secure private interconnection over a multipath network

A method for establishing a fully private, information secure interconnection between a source and a destination over a managed data network having at least a portion of a public infrastructure, comprising:

• a) at said source, creating n shares of the source data according to a predetermined secret sharing scheme and sending said shares to said data network, while encrypting the sent data using (n,k) secret sharing;
• b) using a centralized network controller or network management tools at the sender for dynamically managing a plurality of partially independent paths, over which said shares are routed from said source to said destination, such that the number of shares that pass the router at each node along each path does not exceed a threshold of k−1 shares, wherein optimal paths are dynamically determined by said network controller/sender, according to said threshold and to the load/current-eavesdropping-coalition-risks on each router in said data network,
• wherein the secret sharing scheme is implemented to perform double side identification between a client and a server, without the need to use a key that is certified by a third party using one/two/three handshake protocols, by:
• a) allowing the client to send its ID and a nonce, while each channel gets a share of the data, so that, only by having all or a threshold of the shares, the data can be reconstructed;
• b) the server creates shares from the nonce, receives the client address data from the public directory and sends the shares over different channels;
• c) the server sends its own information with the nonce it got from the client through multiple channels to the client, such that each channel gets only a share of the data;
• d) the client verifies the nonce and gets the server information;
• e) the client verifies the nonce and sends an acknowledgement through the different channels to multiple addresses of the server along with the nonce to the server;
• f) the server finalizes the authentication by reconstructing the acknowledgement, and starts a session using one or more of the channels.

A method for establishing a fully private, information secure interconnection between a source and a destination over a managed data network having at least a portion of a public infrastructure, comprising:

• a) at said source, creating n shares of the source data according to a predetermined secret sharing scheme and sending said shares to said data network, while encrypting the sent data using n−k secret sharing;
• b) using a centralized network controller for dynamically managing a plurality of partially independent paths, over which said shares are routed from said source to said destination, such that the number of shares that pass the router at each node along each path does not exceed a threshold of k−1 shares, wherein optimal paths are dynamically determined by said network controller, according to said threshold and to the load on each router in said data network,
• wherein the secret sharing scheme is implemented to perform double side identification between a client and a server, without the need to use a key that is certified by a third party using one/two/three handshake protocols, by:
• a) allowing the client to send its ID and a nonce, while each channel gets a share of the data, so that, only by having all or a threshold of the shares, the data can be reconstructed;
• b) the server creates shares from the nonce, receives the client address data from the public directory and sends the shares over different channels;
• c) the server sends its own information with the nonce it got from the client through multiple channels to the client, such that each channel gets only a share of the data;
• d) the client verifies the nonce and gets the server information;
• e) the client verifies the nonce and sends an acknowledgement through the different channels to multiple addresses of the server along with the nonce to the server;
• f) the server finalizes the authentication by reconstructing the acknowledgement, and starts a session using one or more of the channels.