Network authentication system with dynamic key generation
AssigneeAnalog Devices, Inc.
InventorsJohn J. Walsh, John Ross Wallrabenstein, Charles J. Timko
Life of this patent
Estimating the term…
Abstract
A network authentication system with dynamic key generation that facilitates the establishment of both endpoint identity, as well as a secure communication channel using a dynamically-generated key between two end devices (potentially on separate local area networks). An interactive or non-interactive authentication protocol is used to establish the identity of the target end device, and dynamic key generation is used to establish a shared symmetric session key for creating an encrypted communication channel between the end devices.
Claims20
A secure communication device comprising:
- a hardware identity module comprising a hardware-intrinsic identity unique to the device, wherein the hardware identity module is configured to output a unique value based on physical properties of circuitry of the hardware identity module and a challenge value associated with generation of an authentication token;
- and
- a processor connected to the hardware identity module, wherein the processor is configured to:
- receive an output value from the hardware identity module corresponding to the challenge value;
- generate, using the output value, a first authentication token encoded with a public key associated with the hardware-intrinsic identity of the secure communication device;
- generate a first authentication packet including the first authentication token;
- and
- transmit, to a verifying device, the first authentication packet for non-interactive authentication in zero knowledge, wherein the first authentication packet enables the verifying device to authenticate the secure communication device in zero knowledge by indicating, to the verifying device, that the secure communication device possesses a secret without revealing the secret to the verifying device.
A computer-implemented method of non-interactively authenticating a secure communication device, the method comprising:
- receiving, by a processor, an output from a hardware identity module comprising a hardware-intrinsic identity unique to the secure communication device responsive to a challenge value associated with generation of an authentication token, wherein the output is based on physical properties of circuitry of the hardware identity module;
- generating, by the processor, using the output, a first authentication token encoded with a public key associated with the hardware-intrinsic identity of the secure communication device;
- generating, by the processor, a first authentication packet including the first authentication token;
- and
- transmitting, by the processor, the first authentication packet for non-interactive authentication in zero knowledge at a verification device, wherein the first authentication packet enables the verifying device to authenticate the secure communication device in zero knowledge by indicating, to the verification device, that the secure communication device possesses a secret without revealing the secret to the verification device.
At least one non-transitory computer-readable storage medium containing processor-executable instructions that, when executed, perform a method comprising:
- receiving an output from a hardware identity module of a secure communication device comprising a hardware-intrinsic identity unique to the secure communication device responsive to a challenge value associated with generation of an authentication token, wherein the output is based on physical properties of circuitry of the hardware identity module;
- generating, using the output, a first authentication token encoded with a public key associated with the hardware-intrinsic identity of the secure communication device;
- generating a first authentication packet including the first authentication token;
- and
- transmitting the first authentication packet for non-interactive authentication in zero knowledge at a verification device, wherein the first authentication packet enables the verifying device to authenticate the secure communication device in zero knowledge by indicating, to the verification device, that the secure communication device possesses a secret without revealing the secret to the verifying device.
Dependencies are inferred from the claim text.