Authentication system and method

An anonymous authentication system including a group of data processing systems, a service provider, wherein:

• each data processing system in the group includes a group key common to the group;
• the service provider is arranged to provide an encrypted authenticator that is decryptable using the group key to one of the data processing systems to be authenticated;
• each data processing system of the group of data processing system is responsive upon receipt of an encrypted authenticator from a service provider to decrypt the encrypted authenticator using the group key and transmit the decrypted authenticator to the service provider;
• the service provider is arranged to positively authenticate the data processing system upon receipt of data associated with the decrypted authenticator;
• the authentication system is responsive upon revocation of authentication rights of one of the data processing systems of the group to distribute a new group key to the other data processing systems of the group using broadcast encryption.

An authentication system for anonymous authentication of a data processing system from a group of data processing systems by a service provider, the system comprising:

• a group key assigned to each data processing system of the group of data processing systems;
• a plurality of predefined disjoint subsets, each data processing system being associated with a plurality of subsets and each subset being assigned a key for decrypting received messages;
• a service provider arranged to provide an encrypted authenticator that is decryptable using the group key to one of the data processing systems to be authenticated and positively authenticate the data processing system upon receipt of data associated with the decrypted authenticator,
• wherein the authentication system is arranged, in dependence on revocation of a data processing system from the group, to disregard subsets associated with the revoked data processing system and to distribute a new group key to data processing systems associated with non-disregarded subsets, the group key distributed to a subset being encrypted in dependence on the key of the respective subset.

A method of anonymously authenticating a data processing system from a group of data processing systems comprising:

• assigning a group key to each data processing system of the group of data processing systems;
• generating an encrypted authenticator that is decryptable using the group key;
• transmitting the encrypted authenticator to a data processing systems of the group to be authenticated;
• positively authenticating the data processing system upon receipt of data associated with the decrypted authenticator,
• wherein upon revocation of authentication rights of one of the data processing systems of the group, the method comprising:
• distributing a new group key to the other data processing systems of the group using broadcast encryption.

A computer readable medium having computer readable code means embodied therein for anonymously authenticating a data processing system from a group of data processing systems and comprising:

• computer readable code means for assigning a group key to each data processing system of the group of data processing systems;
• computer readable code means for generating an encrypted authenticator that is decryptable using the group key;
• computer readable code means for transmitting the encrypted authenticator to a data processing systems of the group to be authenticated;
• computer readable code means for positively authenticating the data processing system upon receipt of data associated with the decrypted authenticator,
• computer readable code means for distributing a new group key to the other data processing systems of the group using broadcast encryption upon revocation of authentication rights of one of the data processing systems of the group.