Back to results
US 10,652,029 B2Granted
Multi-TTP-based method and device for verifying validity of identity of entity
AssigneeChina Iwncomm Co., Ltd.
InventorsZhiqiang Du, Bianling Zhang, Qin Li, Xiang Yan, Guoqiang Zhang
Life of this patent
Estimating the term…
Abstract
Provided are an entity identity validity verification method and device with multiple trusted third parties being involved. In the application, validity of identities of entities performing mutual identity validity verification can only be verified by different trusted third parties. During the verification process, the trusted third parties that are respectively trusted by the two entities interact with each other, and provide services for mutual identity validity verification between the entities, to complete the identity validity verification between the entities.
Claims20
An entity identity validity verification method with a plurality of trusted third parties (TTPs) being involved, wherein the method involves an entity A, an entity B, a trusted third party TTPA and a trusted third party TTPB, the TTPA is capable of verifying validity of an identity of the entity A, the TTPB is capable of verifying validity of an identity of the entity B, the entity A trusts the TTPA, the entity B trusts the TTPB, and wherein the method comprises:
- step 1) transmitting, by the entity B, a message 1 to the entity A, wherein the message 1 comprises identity information IB of the entity B, and a random number RB generated by the entity B;
- step 2) transmitting, by the entity A, a message 2 to the trusted third party TTPA after the entity A receives the message 1, wherein the message 2 comprises identity information IA of the entity A, a random number RA generated by the entity A, the identity information IB of the entity B, and the random number RB;
- step 3) after the trusted third party TTPA receives the message 2 transmitted by the entity A, verifying, by the trusted third party TTPA, the identity of the entity A based on IA, and transmitting, by the trusted third party TTPA, a message 3 to the trusted third party TTPB, wherein the message 3 comprises a random number RTPA generated by the TTPA and a token TokenTPAB, wherein TokenTPAB comprises ResA, IB, RB, and a first signature of the TTPA, wherein ResA is a verification result of verifying the entity A by the TTPA, and signature objects of the first signature of the TTPA comprise ResA, IB and RB;
- step 4) after the TTPB receives the message 3 transmitted by the TTPA, verifying, by the TTPB, the first signature of the TTPA in TokenTPAB;
- after the first signature of the TTPA passes the verification performed by the TTPB, verifying, by the TTPB, the identity of the entity B based on IB, and transmitting, by the TTPB, a message 4 to the TTPA, wherein the message 4 comprises a token TokenTPBA, wherein TokenTPBA comprises ResB, a first signature of the TTPB, and a second signature of the TTPB, wherein ResB is a verification result of verifying the entity B by the TTPB, signature objects of the first signature of the TTPB comprise ResA and RB, and signature objects of the second signature of the TTPB comprise RTPA and ResB;
- step 5) after the TTPA receives the message 4 transmitted by the TTPB, verifying, by the TTPA, the second signature of the TTPB in TokenTPBA;
- after the second signature of the TTPB passes the verification performed by the TTPA, checking, by the TTPA, whether RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the TTPA to the TTPB;
- if RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the TTPA to the TTPB, constructing a message 5 and transmitting the message 5 to the entity A by the TTPA, wherein the message 5 comprises a token TokenTA, wherein TokenTA comprises ResA, ResB, a second signature of the TTPA, and the first signature of the TTPB, wherein signature objects of the second signature of the TTPA comprise ResB and RA;
- step 6) after the entity A receives the message 5 from the TTPA, verifying, by the entity A, the second signature of the TTPA in TokenTA;
- after the second signature of the TTPA passes the verification performed by the entity A, checking, by the entity A, whether RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the entity A to the TTPA;
- if the RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the entity A to the TTPA, determining, by the entity A, the validity of the identity of the entity B based on the verification result ResB, and constructing a message 6 and transmitting the message 6 to the entity B by the entity A, wherein the message 6 comprises the first signature of the TTPB;
- and
- step 7) after the entity B receives the message 6, verifying, by the entity B, the first signature of the TTPB;
- after the first signature of the TTPB passes the verification performed by the entity B, checking, by the entity B, whether RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the entity B to the entity A;
- if the RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the entity B to the entity A, determining, by the entity B, the validity of the identity of the entity A based on the verification result ResA.
12 more elements
A first entity identity validity verification device for performing identity validity verification together with a second entity identity validity verification device with a first trusted third party device and a second trusted third party device being involved, the first entity identity validity verification device comprising:
- a processing unit configured to generate a random number RA;
- a storage unit configured to store identity information IA of the first entity identity validity verification device;
- and
- a transceiving unit configured to:
- receive a message 1 transmitted by the second entity identity validity verification device and transmit a message 2 to the first trusted third party device, wherein the message 1 comprises identity information IB of the second entity identity validity verification device, and a random number RB generated by the second entity identity validity verification device, and the message 2 comprises IA, RA, IB and RB;
- receive a message 5 transmitted by the first trusted third party device and transmit a message 6 to the second entity identity validity verification device, wherein the message 5 comprises a token TokenTA, wherein TokenTA comprises ResA, ResB, a second signature of the first trusted third party device, and a first signature of the second trusted third party device, wherein ResA is a verification result of verifying the first entity identity validity verification device by the first trusted third party device, ResB is a verification result of verifying the second entity identity validity verification device by the second trusted third party device, signature objects of the second signature of the first trusted third party device comprise ResB and RA, signature objects of the first signature of the second trusted third party device comprise ResA and RB, and the message 6 comprises the first signature of the second trusted third party device, wherein
- the processing unit is further configured to:
- verify the second signature of the first trusted third party device in TokenTA;
- check whether RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the first entity identity validity verification device to the first trusted third party device;
- determine validity of an identity of the second entity identity validity verification device based on the verification result ResB;
- and construct the message 6,
- wherein the message 6 transmitted by the transceiving unit is constructed as follows,
- the message 1 transmitted by the second entity identity validity verification device to the transceiving unit is used by the first entity identity validity verification device to construct the message 2;
- the message 2 is transmitted by the transceiving unit to the first trusted third party device, and the first trusted third party device verifies the identity of the first entity identity validity verification device based on IA, and the first trusted third party device constructs a message 3 based on the message 2, wherein the message 3 comprises a random number RTPA generated by the first trusted third party device and a token TokenTPAB, wherein TokenTPAB comprises ResA, IB, RB, and a first signature of the first trusted third party device, wherein signature objects of the first signature of the first trusted third party device comprise ResA, IB and RB;
- the message 3 is transmitted by the first trusted third party device to the second trusted third party device, and the second trusted third party device verifies the first signature of the first trusted third party device in TokenTPAB;
- after the first signature of the first trusted third party device passes the verification performed by the second trusted third party device, the second trusted third party device verifies the identity of the second entity identity validity verification device based on IB, and the second trusted third party device constructs a message 4 based on the message 3, wherein the message 4 comprises a token TokenTPBA, wherein TokenTPBA comprises ResB, a first signature of the second trusted third party device, and a second signature of the second trusted third party device, wherein signature objects of the second signature of the second trusted third party device comprise RTPA and ResB;
- the message 4 is transmitted by the second trusted third party device to the first trusted third party device, and the first trusted third party device verifies the second signature of the second trusted third party device in TokenTPBA;
- after the second signature of the second trusted third party device passes the verification performed by the first trusted third party device, the first trusted third party device checks whether RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the first trusted third party device to the second trusted third party device;
- if RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the first trusted third party device to the second trusted third party device, the first trusted third party device constructs the message 5 based on the message 4;
- the message 5 is transmitted by the first trusted third party device to the transceiving unit, and the processing unit constructs the message 6 based on the message 5.
17 more elements
A second entity identity validity verification device for performing identity validity verification together with a first entity identity validity verification device with a first trusted third party device and a second trusted third party device being involved, the second entity identity validity verification device comprising:
- a processing unit configured to generate a random number RB;
- a storage unit configured to store identity information IB of the second entity identity validity verification device;
- and
- a transceiving unit configured to transmit a message 1 and receive a message 6 transmitted by the first entity identity validity verification device, wherein the message 1 comprises IB and RB, the message 6 comprises a first signature of the second trusted third party device, wherein signature objects of the first signature of the second trusted third party device comprise ResA and RB, wherein ResA is a verification result of verifying the first entity identity validity verification device by the first trusted third party device, wherein
- wherein the message 6 received by the transceiving unit is constructed as follows,
- the message 1 transmitted by the transceiving unit to the first entity identity validity verification device is used by the first entity identity validity verification device to construct a message 2, wherein the message 2 comprises identity information IA of the first entity identity validity verification device, a random number RA generated by the first entity identity validity verification device, the identity information IB of the second entity identity validity verification device, and the random number RB;
- the message 2 is transmitted by the first entity identity validity verification device to the first trusted third party device, and the first trusted third party device verifies the identity of the first entity identity validity verification device based on IA, and the first trusted third party device constructs a message 3 based on the message 2, wherein the message 3 comprises a random number RTPA generated by the first trusted third party device and a token TokenTPAB, wherein TokenTPAB comprises ResA, IB, RB, and a first signature of the first trusted third party device, wherein signature objects of the first signature of the first trusted third party device comprise ResA, IB and RB;
- the message 3 is transmitted by the first trusted third party device to the second trusted third party device, and the second trusted third party device verifies the first signature of the first trusted third party device in TokenTPAB;
- after the first signature of the first trusted third party device passes the verification performed by the second trusted third party device, the second trusted third party device verifies the identity of the second entity identity validity verification device based on IB, and the second trusted third party device constructs a message 4 based on the message 3, wherein the message 4 comprises a token TokenTPBA, wherein TokenTPBA comprises ResB, a first signature of the second trusted third party device, and a second signature of the second trusted third party device, wherein ResB is a verification result of verifying the second entity identity validity verification device by the second trusted third party device, and signature objects of the second signature of the second trusted third party device comprise RTPA and ResB;
- the message 4 is transmitted by the second trusted third party device to the first trusted third party device, and the first trusted third party device verifies the second signature of the second trusted third party device in TokenTPBA;
- after the second signature of the second trusted third party device passes the verification performed by the first trusted third party device, the first trusted third party device checks whether RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the first trusted third party device to the second trusted third party device;
- if RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the first trusted third party device to the second trusted third party device, the first trusted third party device constructs a message 5 based on the message 4, wherein the message 5 comprises a token TokenTA, wherein TokenTA comprises ResA, ResB, a second signature of the first trusted third party device, and the first signature of the second trusted third party device, wherein signature objects of the second signature of the first trusted third party device comprise ResB and RA;
- the message 5 is transmitted by the first trusted third party device to the first entity identity validity verification device, and the first entity identity validity verification device verifies the second signature of the first trusted third party device in TokenTA;
- after the second signature of the first trusted third party device passes the verification performed by the first entity identity validity verification device, the first entity identity validity verification device checks whether RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the first entity identity validity verification device to the first trusted third party device;
- if the RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the first entity identity validity verification device to the first trusted third party device, the first entity identity validity verification device determines the validity of the identity of the second entity identity validity verification device based on the verification result ResB, and the first entity identity validity verification device constructs the message 6 based on the message 5;
- the processing unit is further configured to:
- verify the first signature of the second trusted third party device;
- check whether RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the second entity identity validity verification device to the first entity identity validity verification device;
- and determine validity of an identity of the first entity identity validity verification device based on the verification result ResA.
16 more elements
A first trusted third party device for being involved in identity validity verification between a first entity identity validity verification device and a second entity identity validity verification device together with a second trusted third party device, the first trusted third party device comprising:
- a transceiving unit configured to receive a message 2 transmitted by the first entity identity validity verification device, wherein the message 2 comprises identity information IA of the first entity identity validity verification device, a random number RA generated by the first entity identity validity verification device, identity information IB of the second entity identity validity verification device, and a random number RB generated by the second entity identity validity verification device;
- and
- a processing unit configured to verify an identity of the first entity identity validity verification device based on IA, wherein
- the transceiving unit is further configured to transmit a message 3 to the second trusted third party device, wherein the message 3 comprises a random number RTPA generated by the first trusted third party device and a token TokenTPAB, wherein TokenTPAB comprises ResA, IB, RB, and a first signature of the first trusted third party device, wherein ResA is a verification result of verifying the first entity identity validity verification device by the first trusted third party device, and signature objects of the first signature of the first trusted third party device comprise ResA, IB and RB;
- the transceiving unit is further configured to receive a message 4 transmitted by the second trusted third party device, wherein the message 4 comprises a token TokenTPBA, wherein TokenTPBA comprises ResB, a first signature of the second trusted third party device, and a second signature of the second trusted third party device, wherein ResB is a verification result of verifying the second entity identity validity verification device by the second trusted third party device, signature objects of the first signature of the second trusted third party device comprise ResA and RB, and signature objects of the second signature of the second trusted third party device comprise RTPA and ResB;
- the processing unit is further configured to:
- verify the second signature of the second trusted third party device in TokenTPBA;
- check whether RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the first trusted third party device to the second trusted third party device;
- and construct a message 5, wherein the message 5 comprises a token TokenTA, wherein TokenTA comprises ResA, ResB, a second signature of the first trusted third party device, and the first signature of the second trusted third party device, wherein signature objects of the second signature of the first trusted third party device comprise ResB and RA;
- and
- the transceiving unit is further configured to transmit the message 5 to the first entity identity validity verification device,
- wherein the message 5 transmitted by the transceiving unit is constructed as follows,
- a message 1 is transmitted by the second entity identity validity verification device to the first entity identity validity verification device, wherein the message 1 comprises identity information IB of the second entity identity validity verification device, and a random number R generated by the second entity identity validity verification device, and the first entity identity validity verification device constructs the message 2 based on the message 1;
- the message 2 is transmitted by the first entity identity validity verification device to the transceiving unit, and the first trusted third party device constructs the message 3 based on the message 2;
- the message 3 is transmitted by the transceiving unit to the second trusted third party device, and the second trusted third party device verifies the first signature of the first trusted third party device in TokenTPAB;
- after the first signature of the first trusted third party device passes the verification performed by the second trusted third party device, the second trusted third party device verifies the identity of the second entity identity validity verification device based on IB, and the second trusted third party device constructs the message 4 based on the message 3;
- the message 4 is transmitted by the second trusted third party device to the transceiving unit, and the first trusted third party device constructs the message 5 based on the message 4,
- wherein
- the message 5 is transmitted by the transceiving unit to the first entity identity validity verification device, the first entity identity validity verification device verifies the second signature of the first trusted third party device in TokenTA;
- after the second signature of the first trusted third party device passes the verification performed by the first entity identity validity verification device, the first entity identity validity verification device checks whether RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the first entity identity validity verification device to the first trusted third party device;
- if the RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the first entity identity validity verification device to the first trusted third party device, the first entity identity validity verification device determines the validity of the identity of the second entity identity validity verification device based on the verification result ResB, and constructs a message 6 based on the message 5, wherein the message 6 comprises the first signature of the second trusted third party device;
- and
- the message 6 is transmitted by the first entity identity validity verification device to the second entity identity validity verification device, and the second entity identity validity verification device verifies the first signature of the second trusted third party device;
- after the first signature of the second trusted third party device passes the verification performed by the second entity identity validity verification device, the second entity identity validity verification device checks whether RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the second entity identity validity verification device to the first entity identity validity verification device;
- if the RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the second entity identity validity verification device to the first entity identity validity verification device, the second entity identity validity verification device determines the validity of the identity of the first entity identity validity verification device based on the verification result ResA.
22 more elements
A second trusted third party device for being involved in identity validity verification between a first entity identity validity verification device and a second entity identity validity verification device together with a first trusted third party device, the second trusted third party device comprising:
- a transceiving unit configured to receive a message 3 transmitted by the first trusted third party device, wherein the message 3 comprises a random number RTPA generated by the first trusted third party device and a token TokenTPAB, wherein TokenTPAB comprises ResA, IB, RB, and a first signature of the first trusted third party device, wherein ResA is a verification result of verifying the first entity identity validity verification device by the first trusted third party device, IB is identity information of the second entity identity validity verification device, RB is a random number generated by the second entity identity validity verification device, and signature objects of the first signature of the first trusted third party device comprise ResA, IB and RB;
- and
- a processing unit configured to verify the first signature of the first trusted third party device in TokenTPAB and verify an identity of the second entity identity validity verification device based on IB;
- wherein
- the transceiving unit is further configured to transmit a message 4 to the first trusted third party device, wherein the message 4 comprises a token TokenTPBA, wherein TokenTPBA comprises ResB, a first signature of the second trusted third party device, and a second signature of the second trusted third party device, wherein ResB is a verification result of verifying the second entity identity validity verification device by the second trusted third party device, signature objects of the first signature of the second trusted third party device comprise ResA and RB, and signature objects of the second signature of the second trusted third party device comprise RTPA and ResB,
- wherein the message 4 transmitted by the transceiving unit is constructed as follows,
- a message 1 is transmitted by the second entity identity validity verification device to the first entity identity validity verification device, wherein the message 1 comprises identity information IB of the second entity identity validity verification device, and a random number R generated by the second entity identity validity verification device, and the first entity identity validity verification device constructs a message 2 based on the message 1, the message 2 comprises identity information IA of the first entity identity validity verification device, a random number RA generated by the first entity identity validity verification device, the identity information IB of the second entity identity validity verification device, and the random number RB;
- the message 2 is transmitted by the first entity identity validity verification device to the first trusted third party device, and the first trusted third party device verifies the identity of the first entity identity validity verification device based on IA, and the first trusted third party device constructs the message 3 based on the message 2;
- the message 3 is transmitted by the first trusted third party device to the transceiving unit, and the second trusted third party device constructs the message 4 based on the message 3;
- wherein
- the message 4 is transmitted by the transceiving unit to the first trusted third party device, and the first trusted third party device verifies the second signature of the second trusted third party device in TokenTPBA;
- after the second signature of the second trusted third party device passes the verification performed by the first trusted third party device, the first trusted third party device checks whether RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the first trusted third party device to the second trusted third party device;
- if RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the first trusted third party device to the second trusted third party device, the first trusted third party device constructs a message 5 based on the message 4, wherein the message 5 comprises a token TokenTA, wherein TokenTA comprises ResA, ResB, a second signature of the first trusted third party device, and the first signature of the second trusted third party device, wherein signature objects of the second signature of the first trusted third party device comprise ResB and RA;
- the message 5 is transmitted by the first trusted third party device to the first entity identity validity verification device, and the first entity identity validity verification device verifies the second signature of the first trusted third party device in TokenTA;
- after the second signature of the first trusted third party device passes the verification performed by the first entity identity validity verification device, the first entity identity validity verification device checks whether RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the first entity identity validity verification device to the first trusted third party device;
- if the RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the first entity identity validity verification device to the first trusted third party device, the first entity identity validity verification device determines the validity of the identity of the second entity identity validity verification device based on the verification result ResB, and constructs a message 6 based on the message 5, wherein the message 6 comprises the first signature of the second trusted third party device;
- the message 6 is transmitted by the first entity identity validity verification device to the second entity identity validity verification device, and the second entity identity validity verification device verifies the first signature of the second trusted third party device;
- after the first signature of the second trusted third party device passes the verification performed by the second entity identity validity verification device, the second entity identity validity verification device checks whether RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the second entity identity validity verification device to the first entity identity validity verification device;
- if the RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the second entity identity validity verification device to the first entity identity validity verification device, the second entity identity validity verification device determines the validity of the identity of the first entity identity validity verification device based on the verification result ResA.
16 more elements
Dependencies are inferred from the claim text.