US 2018/0295131 A1Published application

Method and device for verifying validity of identity of entity

AssigneeChina Iwncomm Co., Ltd.

InventorsBianling Zhang, Zhiqiang Du, Qin Li, Xiaolong Lai, Weigang Tong

Life of this patent

Estimating the term…

Abstract

Provided are an entity identity validity verification method and device with multiple trusted third parties being involved. In the application, validity of identities of entities performing mutual identity validity verification can only be verified by different trusted third parties. During the verification process, the trusted third parties that are respectively trusted by the two entities interact with each other, and provide identity validity verification services for mutual identity validity verification between the entities, to complete the identity validity verification between the entities.

Claims20

Dependent claims

An entity identity validity verification method, involving an entity A, an entity B, a first trusted third party TTPA and a second trusted third party TTPB, wherein the TTPA is capable of verifying validity of an identity of the entity A, the TTPB is capable of verifying validity of an identity of the entity B, the entity A trusts the TTPA and the TTPB, the entity B trusts the TTPB, and wherein the method comprises:

step 1) transmitting, by the entity B, a message 1 to the entity A, wherein the message 1 comprises identity information IB of the entity B and a random number RB generated by the entity B;
step 2) transmitting, by the entity A, a message 2 to the TTPA after the entity A receives the message 1, wherein the message 2 comprises identity information IA of the entity A, a random number RA generated by the entity A, IB and RB;
step 3) after the TTPA receives the message 2 transmitted by the entity A, verifying, by the TTPA, the identity of the entity A based on IA to acquire an identity verification result ResA of verifying the entity A, and transmitting, by the TTPA, a message 3 to the TTPB, wherein the message 3 comprises a random number RTPA generated by the TTPA and a token TokenTPAB, wherein the token TokenTPAB comprises ResA, RA, IB, RB and a signature of the TTPA, wherein signature objects of the signature of the TTPA comprise RA, IB, ResA and RB;
step 4) after the TTPB receives the message 3 transmitted by the TTPA, firstly verifying, by the TTPB, the signature of the TTPA in TokenTPAB;
after the signature of the TTPA passes the verification performed by the TTPB, verifying, by the TTPB, the identity of the entity B based on IB to acquire an identity verification result ResB of verifying the entity B, and transmitting, by the TTPB, a message 4 to the TTPA, wherein the message 4 comprises a token TokenTPBA, wherein the token TokenTPBA comprises ResA, ResB, a first signature of the TTPB, a second signature of the TTPB, and a third signature of the TTPB, wherein objects of the first signature of the TTPB comprise ResA and RB, objects of the second signature of the TTPB comprise ResB and RA, and an object of the third signature of the TTPB comprises RTPA;
step 5) after the TTPA receives the message 4 transmitted by the TTPB, verifying, by the TTPA, the third signature of the TTPB in TokenTPBA;
after the third signature of the TTPB passes the verification performed by the TTPA, checking, by the TTPA, whether RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the TTPA to the TTPB;
if RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the TTPA to the TTPB, constructing a message 5 and transmitting the message 5 to the entity A by the TTPA, wherein the message 5 comprises a token TokenTA, wherein the token TokenTA comprises ResA, ResB, the first signature of the TTPB, and the second signature of the TTPB;
step 6) after the entity A receives the message 5 from the TTPA, firstly verifying, by the entity A, the second signature of the TTPB in TokenTA;
after the second signature of the TTPB passes the verification performed by the entity A, checking, by the entity A, whether RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the entity A to the TTPA;
if RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the entity A to the TTPA, determining, by the entity A, the validity of the identity of the entity B based on the verification result ResB, and constructing a message 6 and transmitting the message 6 to the entity B by the entity A, wherein the message 6 comprises the first signature of the TTPB;
and
step 7) after the entity B receives the message 6, firstly verifying, by the entity B, the first signature of the TTPB;
after the first signature of the TTPB passes the verification performed by the entity B, checking, by the entity B, whether RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the entity B to the entity A;
if RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the entity B to the entity A, determining, by the entity B, the validity of the identity of the entity A based on the verification result ResA.

12 more elements

A first entity identity validity verification device for performing identity validity verification together with a second entity identity validity verification device with a first trusted third party device and a second trusted third party device being involved, the first entity identity validity verification device comprising:

a processing unit configured to generate a random number RA;
a storage unit configured to store identity information IA of the first entity identity validity verification device;
and
a transceiving unit configured to:
receive a message 1 transmitted by the second entity identity validity verification device and transmit a message 2 to the first trusted third party device, wherein the message 1 comprises identity information IB of the second entity identity validity verification device and a random number RB generated by the second entity identity validity verification device, wherein the message 2 comprises IA, RA, IB and RB;
receive a message 5 transmitted by the first trusted third party device and transmit a message 6 to the second entity identity validity verification device, wherein the message 5 comprises a token TokenTA, wherein the token TokenTA comprises an identity verification result ResA of verifying the first entity identity validity verification device, an identity verification result ResB of verifying the second entity identity validity verification device, a first signature of the second trusted third party device, and a second signature of the second trusted third party device, wherein signature objects of the first signature of the second trusted third party device comprise ResA and RB, signature objects of the second signature of the second trusted third party device comprise ResB and RA, and wherein the message 6 comprises the first signature of the second trusted third party device, wherein
the processing unit is further configured to:
verify the second signature of the second trusted third party device in TokenTA;
after the second signature of the second trusted third party device passes verification performed by the first entity identity validity verification device, check whether RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the first entity identity validity verification device to the first trusted third party device;
if RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the first entity identity validity verification device to the first trusted third party device, determine validity of an identity of the second entity identity validity verification device based on the verification result ResB, and construct the message 6.

7 more elements

A first trusted third party device for being involved in identity validity verification between a first entity identity validity verification device and a second entity identity validity verification device together with a second trusted third party device, the first trusted third party device comprising:

a transceiving unit configured to receive a message 2 transmitted by the first entity identity validity verification device, wherein the message 2 comprises identity information IA of the first entity identity validity verification device, a random number RA generated by the first entity identity validity verification device, identity information IB of the second entity identity validity verification device, and a random number RB generated by the second entity identity validity verification device;
and
a processing unit configured to verify an identity of the first entity identity validity verification device based on IA to acquire a verification result ResA, wherein
the transceiving unit is further configured to transmit a message 3 to the second trusted third party device, wherein the message 3 comprises a random number RTPA generated by the first trusted third party device and a token TokenTPAB, wherein the token TokenTPAB comprises the identity verification result ResA of verifying the first entity identity validity verification device, RA, IB, RB, and a signature of the first trusted third party device, wherein signature objects of the signature of the first trusted third party device comprise RA, IB, ResA and RB;
the transceiving unit is further configured to receive a message 4 transmitted by the second trusted third party device, wherein the message 4 comprises a token TokenTPBA, wherein the token TokenTPBA comprises ResA, an identity verification result ResB of verifying the second entity identity validity verification device, a first signature of the second trusted third party device, a second signature of the second trusted third party device and a third signature of the second trusted third party device, wherein signature objects of the first signature of the second trusted third party device comprise ResA and RB, signature objects of the second signature of the second trusted third party device comprise ResB and RA, and a signature object of the third signature of the second trusted third party device comprises RTPA;
the processing unit is further configured to:
verify the third signature of the second trusted third party device in TokenTPBA;
after the third signature of the second trusted third party device passes verification performed by the first trusted third party device, check whether RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the first trusted third party device to the TTPB;
if RTPA acquired from the message 4 is the same as the random number RTPA in the message 3, construct a message 5, wherein the message 5 comprises a token TokenTA, wherein the token TokenTA comprises ResA, ResB, the first signature of the second trusted third party device, and the second signature of the second trusted third party device;
and
the transceiving unit is further configured to transmit the message 5 to the first entity identity validity verification device.

8 more elements

A second trusted third party device for being involved in identity validity verification between a first entity identity validity verification device and a second entity identity validity verification device together with a first trusted third party device, the second trusted third party device comprising:

a transceiving unit configured to receive a message 3 transmitted by the first trusted third party device, wherein the message 3 comprises a token TokenTPAB and a random number RTPA generated by the first trusted third party device, wherein the token TokenTPAB comprises an identity verification result ResA of verifying the first entity identity validity verification device, a random number RA generated by the first entity identity validity verification device, an identity identifier IB of the second entity identity validity verification device, a random number RB generated by the second entity identity validity verification device, and a signature of the first trusted third party device, wherein signature objects of the signature of the first trusted third party device comprise RA, IB, ResA and RB;
and
a processing unit configured to:
verify the first signature of the first trusted third party device in TokenTPAB, and then verify an identity of the entity B based on IB to acquire an identity verification result ResB of verifying the entity B, wherein
the transceiving unit is further configured to transmit a message 4 to the first trusted third party device, wherein the message 4 comprises a token TokenTPBA, wherein the token TokenTPBA comprises ResA, ResB, a first signature of the second trusted third party device, a second signature of the second trusted third party device, and a third signature of the second trusted third party device, wherein signature objects of the first signature of the second trusted third party device comprise ResA and RB, and signature objects of the second signature of the second trusted third party device comprise ResB and RA, and a signature object of the third signature of the second trusted third party device comprises RTPA.

2 more elements

Dependencies are inferred from the claim text.

patentgrep

Loading patent…

Abstract

step 1) transmitting, by the entity B, a message 1 to the entity A, wherein the message 1 comprises identity information IB of the entity B and a random number RB generated by the entity B;
step 2) transmitting, by the entity A, a message 2 to the TTPA after the entity A receives the message 1, wherein the message 2 comprises identity information IA of the entity A, a random number RA generated by the entity A, IB and RB;
step 3) after the TTPA receives the message 2 transmitted by the entity A, verifying, by the TTPA, the identity of the entity A based on IA to acquire an identity verification result ResA of verifying the entity A, and transmitting, by the TTPA, a message 3 to the TTPB, wherein the message 3 comprises a random number RTPA generated by the TTPA and a token TokenTPAB, wherein the token TokenTPAB comprises ResA, RA, IB, RB and a signature of the TTPA, wherein signature objects of the signature of the TTPA comprise RA, IB, ResA and RB;
step 4) after the TTPB receives the message 3 transmitted by the TTPA, firstly verifying, by the TTPB, the signature of the TTPA in TokenTPAB;
after the signature of the TTPA passes the verification performed by the TTPB, verifying, by the TTPB, the identity of the entity B based on IB to acquire an identity verification result ResB of verifying the entity B, and transmitting, by the TTPB, a message 4 to the TTPA, wherein the message 4 comprises a token TokenTPBA, wherein the token TokenTPBA comprises ResA, ResB, a first signature of the TTPB, a second signature of the TTPB, and a third signature of the TTPB, wherein objects of the first signature of the TTPB comprise ResA and RB, objects of the second signature of the TTPB comprise ResB and RA, and an object of the third signature of the TTPB comprises RTPA;
step 5) after the TTPA receives the message 4 transmitted by the TTPB, verifying, by the TTPA, the third signature of the TTPB in TokenTPBA;
after the third signature of the TTPB passes the verification performed by the TTPA, checking, by the TTPA, whether RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the TTPA to the TTPB;
if RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the TTPA to the TTPB, constructing a message 5 and transmitting the message 5 to the entity A by the TTPA, wherein the message 5 comprises a token TokenTA, wherein the token TokenTA comprises ResA, ResB, the first signature of the TTPB, and the second signature of the TTPB;
step 6) after the entity A receives the message 5 from the TTPA, firstly verifying, by the entity A, the second signature of the TTPB in TokenTA;
after the second signature of the TTPB passes the verification performed by the entity A, checking, by the entity A, whether RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the entity A to the TTPA;
if RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the entity A to the TTPA, determining, by the entity A, the validity of the identity of the entity B based on the verification result ResB, and constructing a message 6 and transmitting the message 6 to the entity B by the entity A, wherein the message 6 comprises the first signature of the TTPB;
and
step 7) after the entity B receives the message 6, firstly verifying, by the entity B, the first signature of the TTPB;
after the first signature of the TTPB passes the verification performed by the entity B, checking, by the entity B, whether RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the entity B to the entity A;
if RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the entity B to the entity A, determining, by the entity B, the validity of the identity of the entity A based on the verification result ResA.

12 more elements