US 2018/0295132 A1Published application

Multi-ttp-based method and device for verifying validity of identity of entity

AssigneeChina Iwncomm Co., Ltd.

InventorsZhiqiang Du, Bianling Zhang, Qin Li, Zhenhai Huang, Qiang Zhang

Life of this patent

Estimating the term…

Abstract

Provided are an entity identity validity verification method and device with multiple trusted third parties being involved. In the application, validity of identities of entities performing mutual identity validity verification can only be verified by different trusted third parties. During the verification process, the trusted third parties that are respectively trusted by the two entities interact with each other, and provide services for mutual identity validity verification between the entities, to complete the identity validity verification between the entities.

Claims20

Dependent claims

An entity identity validity verification method with a plurality of TTPs being involved, wherein the method involves an entity A, an entity B, a trusted third party TTPA and a trusted third party TTPB, the TTPA is capable of verifying validity of an identity of the entity A, the TTPB is capable of verifying validity of an identity of the entity B, the entity A trusts the TTPA, and the entity B trusts the TTPA and the TTPB, and wherein the method comprises:

step 1) transmitting, by the entity B, a message 1 to the entity A, wherein the message 1 comprises identity information IB of the entity B and a random number RB generated by the entity B;
step 2) transmitting, by the entity A, a message 2 to the trusted third party TTPA after the entity A receives the message 1, wherein the message 2 comprises identity information IA of the entity A, a random number RA generated by the entity A, the identity information IB of the entity B, and the random number RB;
step 3) after the trusted third party TTPA receives the message 2 transmitted by the entity A, verifying, by the trusted third party TTPA, the identity of the entity A based on IA, and transmitting, by the trusted third party TTPA, a message 3 to the trusted third party TTPB, wherein the message 3 comprises IB and a random number RTPA generated by the TTPA;
step 4) after the TTPB receives the message 3 transmitted by the TTPA, verifying, by the TTPB, the identity of the entity B based on IB, and transmitting, by the TTPB, a message 4 to the TTPA, wherein the message 4 comprises a token TokenTPBA, wherein TokenTPBA comprises ResB, and a first signature of the TTPB, wherein ResB is a verification result of verifying the entity B by the TTPB, and signature objects of the first signature of the TTPB comprise RTPA and ResB;
step 5) after the TTPA receives the message 4 transmitted by the TTPB, verifying, by the TTPA, the first signature of the TTPB in TokenTPBA;
after the first signature of the TTPB passes the verification performed by the TTPA, checking, by the TTPA, whether RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the TTPA to the TTPB;
if RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the TTPA to the TTPB, constructing a message 5 and transmitting the message 5 to the entity A by the TTPA, wherein the message 5 comprises a token TokenTA, wherein TokenTA comprises ResA, ResB, a first signature of the TTPA, and a second signature of the TTPA, wherein ResA is a verification result of verifying the entity A by the TTPA, signature objects of the first signature of the TTPA comprise ResB and RA, and signature objects of the second signature of the TTPA comprise ResA and RB;
step 6) after the entity A receives the message 5 from the TTPA, verifying, by the entity A, the first signature of the TTPA in TokenTA;
after the first signature of the TTPA passes the verification performed by the entity A, checking, by the entity A, whether RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the entity A to the TTPA;
if RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the entity A to the TTPA, determining, by the entity A, the validity of the identity of the entity B based on the verification result ResB, and constructing a message 6 and transmitting the message 6 to the entity B by the entity A, wherein the message 6 comprises ResA, and the second signature of the TTPA;
and
step 7) after the entity B receives the message 6, verifying, by the entity B, the second signature of the TTPA;
after the second signature of the TTPA passes the verification performed by the entity B, checking, by the entity B, whether RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the entity B to the entity A;
if RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the entity B to the entity A, determining, by the entity B, the validity of the identity of the entity A based on the verification result ResA.

11 more elements

A first entity identity validity verification device for performing identity validity verification together with a second entity identity validity verification device with a first trusted third party device and a second trusted third party device being involved, the first entity identity validity verification device comprising:

a processing unit configured to generate a random number RA;
a storage unit configured to store identity information IA of the first entity identity validity verification device;
and
a transceiving unit configured to:
receive a message 1 transmitted by the second entity identity validity verification device and transmit a message 2 to the first trusted third party device, wherein the message 1 comprises identity information IB of the second entity identity validity verification device and a random number RB generated by the second entity identity validity verification device, and the message 2 comprises IA, RA, IB and RB;
receive a message 5 transmitted by the first trusted third party device and transmit a message 6 to the second entity identity validity verification device, wherein the message 5 comprises a token TokenTA, wherein TokenTA comprises ResA, ResB, a first signature of the first trusted third party device, and a second signature of the first trusted third party device, wherein ResA is a verification result of verifying the first entity identity validity verification device by the first trusted third party device, ResB is a verification result of verifying the second entity identity validity verification device by the second trusted third party device, signature objects of the first signature of the first trusted third party device comprise ResB and RA, signature objects of the second signature of the first trusted third party device comprise ResA and RB, and the message 6 comprises ResA and the second signature of the first trusted third party device, wherein
the processing unit is further configured to:
verify the first signature of the first trusted third party device in TokenTA;
check whether RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the first entity identity validity verification device to the first trusted third party device;
determine validity of an identity of the second entity identity validity verification device based on the verification result ResB;
and construct the message 6.

8 more elements

A first trusted third party device for being involved in identity validity verification between a first entity identity validity verification device and a second entity identity validity verification device together with a second trusted third party device, the first trusted third party device comprising:

a transceiving unit configured to receive a message 2 transmitted by the first entity identity validity verification device, wherein the message 2 comprises identity information IA of the first entity identity validity verification device, a random number RA generated by the first entity identity validity verification device, identity information IB of the second entity identity validity verification device, and a random number RB generated by the second entity identity validity verification device;
and
a processing unit configured to verify an identity of the first entity identity validity verification device based on IA, wherein
the transceiving unit is further configured to transmit a message 3 to the second trusted third party device, wherein the message 3 comprises IB and a random number RTPA generated by the first trusted third party device;
the transceiving unit is further configured to receive a message 4 transmitted by the second trusted third party device, wherein the message 4 comprises a token TokenTPBA, wherein TokenTPBA comprises ResB, and a first signature of the second trusted third party device, wherein ResB is a verification result of verifying the second entity identity validity verification device by the second trusted third party device, and signature objects of the first signature of the second trusted third party device comprise RTPA and ResB;
the processing unit is further configured to:
verify the first signature of the second trusted third party device in TokenTPBA;
check whether RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the first trusted third party device to the second trusted third party device;
and construct a message 5, wherein the message 5 comprises a token TokenTA, wherein TokenTA comprises ResA, ResB, a first signature of the first trusted third party device, and a second signature of the first trusted third party device, wherein ResA is a verification result of verifying the first entity identity validity verification device by the first trusted third party device, signature objects of the first signature of the first trusted third party device comprise ResB and RA, and signature objects of the second signature of the first trusted third party device comprise ResA and RB;
and
the transceiving unit is further configured to transmit the message 5 to the first entity identity validity verification device.

8 more elements

A second trusted third party device for being involved in identity validity verification between a first entity identity validity verification device and a second entity identity validity verification device together with a first trusted third party device, the second trusted third party device comprising:

a transceiving unit configured to receive a message 3 transmitted by the first trusted third party device, wherein the message 3 comprises identity information IB of the second entity identity validity verification device, and a random number RTPA generated by the first trusted third party device;
and
a processing unit configured to verify an identity of the second entity identity validity verification device based on IB;
wherein
the transceiving unit is further configured to transmit a message 4 to the first trusted third party device, wherein the message 4 comprises a token TokenTPBA, wherein TokenTPBA comprises ResB and a first signature of the second trusted third party device, wherein ResB is a verification result of verifying the second entity identity validity verification device by the second trusted third party device, and signature objects of the first signature of the second trusted third party device comprise RTPA and ResB.

2 more elements

Dependencies are inferred from the claim text.

Facts

Application: 15/766,332Filed 26 Aug 2016
Priority: CN 201510654781.010 Oct 2015
Published: 11 Oct 2018
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/0869
For authentication of entities: for achieving mutual authentication
H04L 9/3213
Involving a third party or a trusted authority: using tickets or tokens, e.g. Kerberos
H04L 9/3247
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…:…
H04L 9/3268
Involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements: using…

Family

US 10,681,045 B2Related patent
US 2018/0295132 A1This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

patentgrep

Loading patent…

Abstract

step 1) transmitting, by the entity B, a message 1 to the entity A, wherein the message 1 comprises identity information IB of the entity B and a random number RB generated by the entity B;
step 2) transmitting, by the entity A, a message 2 to the trusted third party TTPA after the entity A receives the message 1, wherein the message 2 comprises identity information IA of the entity A, a random number RA generated by the entity A, the identity information IB of the entity B, and the random number RB;
step 3) after the trusted third party TTPA receives the message 2 transmitted by the entity A, verifying, by the trusted third party TTPA, the identity of the entity A based on IA, and transmitting, by the trusted third party TTPA, a message 3 to the trusted third party TTPB, wherein the message 3 comprises IB and a random number RTPA generated by the TTPA;
step 4) after the TTPB receives the message 3 transmitted by the TTPA, verifying, by the TTPB, the identity of the entity B based on IB, and transmitting, by the TTPB, a message 4 to the TTPA, wherein the message 4 comprises a token TokenTPBA, wherein TokenTPBA comprises ResB, and a first signature of the TTPB, wherein ResB is a verification result of verifying the entity B by the TTPB, and signature objects of the first signature of the TTPB comprise RTPA and ResB;
step 5) after the TTPA receives the message 4 transmitted by the TTPB, verifying, by the TTPA, the first signature of the TTPB in TokenTPBA;
after the first signature of the TTPB passes the verification performed by the TTPA, checking, by the TTPA, whether RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the TTPA to the TTPB;
if RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the TTPA to the TTPB, constructing a message 5 and transmitting the message 5 to the entity A by the TTPA, wherein the message 5 comprises a token TokenTA, wherein TokenTA comprises ResA, ResB, a first signature of the TTPA, and a second signature of the TTPA, wherein ResA is a verification result of verifying the entity A by the TTPA, signature objects of the first signature of the TTPA comprise ResB and RA, and signature objects of the second signature of the TTPA comprise ResA and RB;
step 6) after the entity A receives the message 5 from the TTPA, verifying, by the entity A, the first signature of the TTPA in TokenTA;
after the first signature of the TTPA passes the verification performed by the entity A, checking, by the entity A, whether RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the entity A to the TTPA;
if RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the entity A to the TTPA, determining, by the entity A, the validity of the identity of the entity B based on the verification result ResB, and constructing a message 6 and transmitting the message 6 to the entity B by the entity A, wherein the message 6 comprises ResA, and the second signature of the TTPA;
and
step 7) after the entity B receives the message 6, verifying, by the entity B, the second signature of the TTPA;
after the second signature of the TTPA passes the verification performed by the entity B, checking, by the entity B, whether RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the entity B to the entity A;
if RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the entity B to the entity A, determining, by the entity B, the validity of the identity of the entity A based on the verification result ResA.

11 more elements

Facts

Application

15/766,332Filed 26 Aug 2016

Priority

CN 201510654781.010 Oct 2015

Published

11 Oct 2018

Term ends

Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 63/0869
For authentication of entities: for achieving mutual authentication
H04L 9/3213
Involving a third party or a trusted authority: using tickets or tokens, e.g. Kerberos
H04L 9/3247
Including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity…:…
H04L 9/3268
Involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements: using…