Mutual authentication of software layers
AssigneeVisa International Service Association
InventorsRasta Mansour, Soumendra Bhattacharya, Robert Youdale
Life of this patent
Estimating the term…
Abstract
Techniques for establishing mutual authentication of software layers of an application are described. During initialization of the application, the software layers execute a binding algorithm to exchange secrets to bind the software layers to one another. During subsequent runtime of the software application, the software layers execute a runtime key derivation algorithm to combine the secrets shared during initialization with dynamic time information to generate a data encryption key. The software layers can then securely transfer data with each other by encrypting and decrypting data exchanged between the software layers using the dynamically generated data encryption key.
Claims20
A computing device comprising:
- a processor;
- and
- a memory coupled to the processor and storing computer readable code for implementing a first software layer associated with a first nonce that interacts with a second software layer associated with a second nonce,
- wherein the computer readable code, when executed by the processor, causes the first software layer to perform operations including:
- retrieving binding information stored by the first software layer;
- decrypting the binding information to obtain the second nonce and initialization time information;
- receiving an encrypted first nonce from the second software layer;
- decrypting the encrypted first nonce to obtain the first nonce;
- determining dynamic time information based on the initialization time information;
- deriving a data encryption key based on the first nonce, the second nonce, and the dynamic time information determined based on the initialization time information;
- and
- encrypting data being sent from the first software layer to the second software layer using the data encryption key.
A computing device comprising:
- a processor;
- and
- a memory coupled to the processor and storing computer readable code for implementing a second software layer associated with a second nonce that interacts with a first software layer associated with a first nonce,
- wherein the computer readable code, when executed by the processor, causes the second software layer to perform operations including:
- retrieving binding information stored by the second software layer;
- decrypting the binding information to obtain the first nonce and initialization time information;
- receiving an encrypted second nonce from the first software layer;
- decrypting the encrypted second nonce to obtain the second nonce;
- determining dynamic time information based on the initialization time information;
- deriving a data encryption key based on the first nonce, the second nonce, and the dynamic time information determined based on the initialization time information;
- and
- encrypting data being sent from the second software layer to the first software layer using the data encryption key.
A method comprising:
- receiving, by a first software layer, an encrypted first nonce from a second software layer;
- decrypting, by the first software layer, the encrypted first nonce to obtain a first nonce;
- retrieving, by the first software layer, first binding information;
- decrypting, by the first software layer, the first binding information to obtain a second nonce and initialization time information;
- deriving, by the first software layer, a data encryption key based on the first nonce, the second nonce, and dynamic time information derived from the initialization time information;
- retrieving, by the second software layer, second binding information;
- decrypting, by the second software layer, the second binding information to obtain the first nonce and the initialization time information;
- receiving, by the second software layer, an encrypted second nonce from the first software layer;
- decrypting, by the second software layer, the encrypted second nonce to obtain the second nonce;
- and
- deriving, by the second software layer, the data encryption key based on the first nonce, the second nonce, and the dynamic time information derived from the initialization time information,
- wherein data being transferred between the first and second software layers are encrypted using the data encryption key.
Dependencies are inferred from the claim text.