Back to results
US 12,750,233 B2Granted
Encrypted handshake for trust validation between two applications
AssigneeSap SE
InventorsRajib Saha, Sateesh Babu Chilamakuri, Laurent Pelecq
Life of this patent
Estimating the term…
Abstract
In an example embodiment, a framework is provided that provides a secure mechanism to limit misuse of licensed applications. Specifically, a mutual handshake is established, using existing properties of a requesting application, and wraps objects with dynamic parameters, such as a current timestamp, to perform masking, hashing, and encryption for the handshake.
Claims17
A system comprising:
- at least one hardware processor;
- and
- a computer-readable medium storing instructions that, when executed by the at least one hardware processor, cause the at least one hardware processor to perform operations on a framework, the operations comprising:
- receiving, by the framework, from a client, a client identification, a first challenge string, a unique index, and a first fixed secret key;
- masking, by the framework, the first fixed secret key with a fixed masker, producing a first masked key;
- encrypting, by the framework, a hash that includes a first concatenation of the client identification, the first challenge string, and a timestamp, using the first masked key;
- sending, by the framework, a first string to the client, with a second non-hashed concatenation of the client identification, the timestamp, the unique index, and the encrypted hash that includes the first concatenation of the client identification, the first challenge string, and the timestamp;
- receiving, by the framework, a second string, a second challenge string, and a second fixed secret key, wherein the first fixed secret key is identical to the second fixed secret key;
- masking, by the framework, the second fixed secret key with the fixed masker, producing a second masked key;
- extracting, by the framework, the client identification, the timestamp, and the encrypted hash that were included in the second string;
- decrypting, by the framework, the encrypted hash using the second masked key, producing a decrypted hash;
- determining, by the framework, that the client is genuine in response to a determination that the decrypted hash is equal to a hash of a third concatenation of the client identification, the second challenge string, and the timestamp;
- and
- granting special privileges to the client based on the determination that the client is genuine.
11 more elements
A method comprising:
- receiving, by the framework, from a client, a client identification, a first challenge string, a unique index, and a first fixed secret key;
- masking, by the framework, the first fixed secret key with a fixed masker, producing a first masked key;
- encrypting, by the framework, a hash that includes a first concatenation of the client identification, the first challenge string, and a timestamp, using the first masked key;
- sending, by the framework, a first string to the client, with a second non-hashed concatenation of the client identification, the timestamp, the unique index, and the encrypted hash that includes the first concatenation of the client identification, the first challenge string, and the timestamp;
- receiving, by the framework, a second string, a second challenge string, and a second fixed secret key, wherein the first fixed secret key is identical to the second fixed secret key;
- masking, by the framework, the second fixed secret key with the fixed masker, producing a second masked key;
- extracting, by the framework, the client identification, the timestamp, and the encrypted hash that were included in the second string;
- decrypting, by the framework, the encrypted hash using the second masked key, producing a decrypted hash;
- determining, by the framework, that the client is genuine in response to a determination that the decrypted hash is equal to a hash of a third concatenation of the client identification, the second challenge string, and the timestamp;
- and
- granting special privileges to the client based on the determination that the client is genuine.
8 more elements
A non-transitory machine-readable medium storing instructions which, when executed by one or more processors, cause the one or more processors to perform operations on a framework, the operations comprising:
- receiving, by the framework, from a client, a client identification, a first challenge string, a unique index, and a first fixed secret key;
- masking, by the framework, the first fixed secret key with a fixed masker, producing a first masked key;
- encrypting, by the framework, a hash that includes a first concatenation of the client identification, the first challenge string, and a timestamp, using the first masked key;
- sending, by the framework, a first string to the client, with a second non-hashed concatenation of the client identification, the timestamp, the unique index, and the encrypted hash that includes the first concatenation of the client identification, the first challenge string, and the timestamp;
- receiving, by the framework, a second string, a second challenge string, and a second fixed secret key, wherein the first fixed secret key is identical to the second fixed secret key;
- masking, by the framework, the second fixed secret key with the fixed masker, producing a second masked key;
- extracting, by the framework, the client identification, the timestamp, and the encrypted hash that were included in the second string;
- decrypting, by the framework, the encrypted hash using the second masked key, producing a decrypted hash;
- determining, by the framework, that the client is genuine in response to a determination that the decrypted hash is equal to a hash of a third concatenation of the client identification, the second challenge string, and the timestamp;
- and
- granting special privileges to the client based on the determination that the client is genuine.
8 more elements
Dependencies are inferred from the claim text.