# US 2018/0323976 A1 · Multi-ttp-based method and device for verifying validity of identity of entity > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0323976 A1 - Document ID: US20180323976A1 - Status: Published application - Kind: A1 - Application number: 15/765,223 - Filed: 2016-08-23 - Published: 2018-11-08 - Earliest claimed: 2015-10-10 - Assignees: China Iwncomm Co., Ltd. - Applicants: China Iwncomm Co., Ltd. - Inventors: Zhiqiang DU; Bianlingf ZHANG; Qin LI; Xiang YANG; Guoqiang ZHANG - Web page: https://patentgrep.com/patent/US20180323976A1 ## CPC - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3247: {involving digital signatures} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/123: {received data contents, e.g. message integrity} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Provided are an entity identity validity verification method and device with multiple trusted third parties being involved. In the application, validity of identities of entities performing mutual identity validity verification can only be verified by different trusted third parties. During the verification process, the trusted third parties that are respectively trusted by the two entities interact with each other, and provide services for mutual identity validity verification between the entities, to complete the identity validity verification between the entities. ## Claims ### Claim 1 An entity identity validity verification method with a plurality of TTPs being involved, wherein the method involves an entity A, an entity B, a trusted third party TTPA and a trusted third party TTPB, the TTPA is capable of verifying validity of an identity of the entity A, the TTPB is capable of verifying validity of an identity of the entity B, the entity A trusts the TTPA, the entity B trusts the TTPB, and wherein the method comprises: step 1) transmitting, by the entity B, a message 1 to the entity A, wherein the message 1 comprises identity information IB of the entity B, and a random number RB generated by the entity B; step 2) transmitting, by the entity A, a message 2 to the trusted third party TTPA after the entity A receives the message 1, wherein the message 2 comprises identity information IA of the entity A, a random number RA generated by the entity A, the identity information IB of the entity B, and the random number RB; step 3) after the trusted third party TTPA receives the message 2 transmitted by the entity A, verifying, by the trusted third party TTPA, the identity of the entity A based on IA, and transmitting, by the trusted third party TTPA, a message 3 to the trusted third party TTPB, wherein the message 3 comprises a random number RTPA generated by the TTPA and a token TokenTPAB, wherein TokenTPAB comprises ResA, IB, RB, and a first signature of the TTPA, wherein ResA is a verification result of verifying the entity A by the TTPA, and signature objects of the first signature of the TTPA comprise ResA, IB and RB; step 4) after the TTPB receives the message 3 transmitted by the TTPA, verifying, by the TTPB, the first signature of the TTPA in TokenTPAB; after the first signature of the TTPA passes the verification performed by the TTPB, verifying, by the TTPB, the identity of the entity B based on IB, and transmitting, by the TTPB, a message 4 to the TTPA, wherein the message 4 comprises a token TokenTPBA, wherein TokenTPBA comprises ResB, a first signature of the TTPB, and a second signature of the TTPB, wherein ResB is a verification result of verifying the entity B by the TTPB, signature objects of the first signature of the TTPB comprise ResA and RB, and signature objects of the second signature of the TTPB comprise RTPA and ResB; step 5) after the TTPA receives the message 4 transmitted by the TTPB, verifying, by the TTPA, the second signature of the TTPB in TokenTPBA; after the second signature of the TTPB passes the verification performed by the TTPA, checking, by the TTPA, whether RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the TTPA to the TTPB; if RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the TTPA to the TTPB, constructing a message 5 and transmitting the message 5 to the entity A by the TTPA, wherein the message 5 comprises a token TokenTA, wherein TokenTA comprises ResA, ResB, a second signature of the TTPA, and the first signature of the TTPB, wherein signature objects of the second signature of the TTPA comprise ResB and RA; step 6) after the entity A receives the message 5 from the TTPA, verifying, by the entity A, the second signature of the TTPA in TokenTA; after the second signature of the TTPA passes the verification performed by the entity A, checking, by the entity A, whether RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the entity A to the TTPA; if the RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the entity A to the TTPA, determining, by the entity A, the validity of the identity of the entity B based on the verification result ResB, and constructing a message 6 and transmitting the message 6 to the entity B by the entity A, wherein the message 6 comprises the first signature of the TTPB; and step 7) after the entity B receives the message 6, verifying, by the entity B, the first signature of the TTPB; after the first signature of the TTPB passes the verification performed by the entity B, checking, by the entity B, whether RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the entity B to the entity A; if the RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the entity B to the entity A, determining, by the entity B, the validity of the identity of the entity A based on the verification result ResA. ### Claim 2 (depends on 1) The entity identity validity verification method according to claim 1, wherein the trusted third party TTPA verifying the identity of the entity A based on IA after the trusted third party TTPA receives the message 2 transmitted by the entity A in step 3) comprises: in a case that IA is a distinguisher of the entity A, extracting, by the TTPA, a public key PA of the entity A, wherein ResA comprises PA; and in a case that IA is a certificate CertA of the entity A, checking, by the TTPA, validity of the CertA, wherein ResA comprises a validity state of CertA; wherein if the TTPA is incapable of acquiring the public key or the validity of the certificate of the entity A, ResA comprises content indicating failed verification. ### Claim 3 (depends on 1) The entity identity validity verification method according to claim 1, wherein the trusted third party TTPB verifying the identity of the entity B based on IB after the trusted third party TTPB receives the message 3 transmitted by the TTPA in step 4) comprises: in a case that IB is a distinguisher of the entity B, extracting, by the TTPB, a public key PB of the entity B, wherein ResB comprises PB; and in a case that IB is a certificate CertB of the entity B, checking, by the TTPB, validity of the CertB, wherein ResB comprises a validity state of CertB; wherein if the TTPB is incapable of acquiring the public key or the validity of the certificate of the entity B, ResB comprises content indicating failed verification. ### Claim 4 (depends on 1) The entity identity validity verification method according to claim 1, wherein the TTPA acquiring RTPA from the message 4 in step 5) comprises: recovering, by the TTPA, RTPA directly from the second signature of the TTPB after the second signature of the TTPB passes verification performed by the TTPA, in a case that the TTPA is capable of recovering RTPA from the second signature of the TTPB when TTPA verifies the second signature of the TTPB; and acquiring, by the TTPA, RTPA directly from the message 4 comprising an RTPA field, in a case that the TTPA is incapable of recovering RTPA from the second signature of the TTPB when the TTPA verifies the second signature of the TTPB; the entity A acquiring RA from the message 5 in step 6) comprises: recovering, by the entity A, RA directly from the second signature of the TTPA after the second signature of the TTPA passes verification performed by the entity A, in a case that the entity A is capable of recovering RA from the second signature of the TTPA when the entity A verifies the second signature of the TTPA; and acquiring, by the entity A, RA directly from the message 5 comprising an RA field, in a case that the entity A is incapable of recovering RA from the second signature of the TTPA when the entity A verifies the second signature of the TTPA; and the entity B acquiring RB from the message 6 in step 7) comprises: recovering, by the entity B, RB directly from the first signature of the TTPB after the first signature of the TTPB passes verification performed by the entity B, in a case that the entity B is capable of recovering RB from the first signature of the TTPB when the entity B verifies the first signature of the TTPB; and acquiring, by the entity B, RB directly from the message 6 comprising an RB field, in a case that the entity B is incapable of recovering RB from the first signature of the TTPB when the entity B verifies the first signature of the TTPB. ### Claim 5 (depends on 1) The entity identity validity verification method according to claim 1, further comprising: verifying, by the entity A, a signature of the entity B, and verifying, by the entity B, a signature of the entity A, wherein the method further comprises step 0) before step 1), step 0) comprises: transmitting, by the entity A, a message 0 to the entity B, wherein the message 0 comprises the identity information IA of the entity A, and a random number RA′ generated by the entity A; and wherein a token TokenBA comprising a signature of the entity B is added to the message 1, and signature objects of the signature of the entity B comprise RA′, RB, an identifier of the entity A, and an identifier of the entity B; after the entity A determines the validity of the identity of the entity B based on ResB in step 6), step 6) further comprises: verifying, by the entity A, the signature of the entity B acquired from the message 1; after the signature of the entity B passes the verification performed by the entity A, checking, by the entity A, whether RA′ acquired from the message 1 is the same as the random number RA′ in the message 0 transmitted by the entity A to the entity B, to complete authentication with respect to the entity B; wherein a token TokenAB comprising a signature of the entity A is added to the message 6, and signature objects of the signature of the entity A comprise RA′, RB, the identifier of the entity A, and the identifier of the entity B; and after the entity B determines the validity of the identity of the entity A based on ResA in step 7), step 7) further comprises: verifying, by the entity B, the signature of the entity A acquired from the message 6; after the signature of the entity A passes the verification performed by the entity B, checking, by the entity B, whether RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the entity B to the entity A, to complete authentication with respect to the entity A. ### Claim 6 (depends on 1) The entity identity validity verification method according to claim 1, further comprising: verifying, by the entity A, a signature of the entity B, and verifying, by the entity B, a signature of the entity A, wherein a token TokenAB comprising a random number RA′ generated by the entity A and a signature of the entity A is added to the message 6, and signature objects of the signature of the entity A comprise RA′, RB, an identifier of the entity A, and an identifier of the entity B; after the entity B determines the validity of the identity of the entity A based on ResA in step 7), step 7) further comprises: verifying, by the entity B, the signature of the entity A acquired from the message 6; after the signature of the entity A passes the verification performed by the entity B, checking, by the entity B, whether RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the entity B to the entity A, to complete authentication with respect to the entity A; and the method further comprises step 8) and step 9) after step 7), wherein step 8) comprises: transmitting, by the entity B, a message 7 to the entity A, wherein the message 7 comprises a token TokenBA comprising a signature of the entity B, and signature objects of the signature of the entity B comprise RA′, RB, an identifier of the entity A, and an identifier of the entity B; and step 9) comprises: after the entity A receives the message 7, verifying, by the entity A, the signature of the entity B; after the signature of the entity B passes the verification performed by the entity A, checking, by the entity A, whether RA′ acquired from the message 7 is the same as the random number RA′ in the message 6 transmitted by the entity A to the entity B, to complete authentication with respect to the entity B. ### Claim 7 (depends on 1) The entity identity validity verification method according to claim 1, wherein RTPA in steps 3), 4) and 5) is replaced with RA. ### Claim 8 A first entity identity validity verification device for performing identity validity verification together with a second entity identity validity verification device with a first trusted third party device and a second trusted third party device being involved, the first entity identity validity verification device comprising: a processing unit configured to generate a random number RA; a storage unit configured to store identity information IA of the first entity identity validity verification device; and a transceiving unit configured to: receive a message 1 transmitted by the second entity identity validity verification device and transmit a message 2 to the first trusted third party device, wherein the message 1 comprises identity information IB of the second entity identity validity verification device, and a random number RB generated by the second entity identity validity verification device, and the message 2 comprises IA, RA, IB and RB; receive a message 5 transmitted by the first trusted third party device and transmit a message 6 to the second entity identity validity verification device, wherein the message 5 comprises a token TokenTA, wherein TokenTA comprises ResA, ResB, a second signature of the first trusted third party device, and a first signature of the second trusted third party device, wherein ResA is a verification result of verifying the first entity identity validity verification device by the first trusted third party device, ResB is a verification result of verifying the second entity identity validity verification device by the second trusted third party device, signature objects of the second signature of the first trusted third party device comprise ResB and RA, signature objects of the first signature of the second trusted third party device comprise ResA and RB, and the message 6 comprises the first signature of the second trusted third party device, wherein the processing unit is further configured to: verify the second signature of the first trusted third party device in TokenTA; check whether RA acquired from the message 5 is the same as the random number RA in the message 2 transmitted by the first entity identity validity verification device to the first trusted third party device; determine validity of an identity of the second entity identity validity verification device based on the verification result ResB; and construct the message 6. ### Claim 9 A second entity identity validity verification device for performing identity validity verification together with a first entity identity validity verification device with a first trusted third party device and a second trusted third party device being involved, the second entity identity validity verification device comprising: a processing unit configured to generate a random number RB; a storage unit configured to store identity information IB of the second entity identity validity verification device; and a transceiving unit configured to transmit a message 1 and receive a message 6 transmitted by the first entity identity validity verification device, wherein the message 1 comprises IB and RB, the message 6 comprises a first signature of the second trusted third party device, wherein signature objects of the first signature of the second trusted third party device comprise ResA and RB, wherein ResA is a verification result of verifying the first entity identity validity verification device by the first trusted third party device, wherein the processing unit is further configured to: verify the first signature of the second trusted third party device; check whether RB acquired from the message 6 is the same as the random number RB in the message 1 transmitted by the second entity identity validity verification device to the first entity identity validity verification device; and determine validity of an identity of the first entity identity validity verification device based on the verification result ResA. ### Claim 10 A first trusted third party device for being involved in identity validity verification between a first entity identity validity verification device and a second entity identity validity verification device together with a second trusted third party device, the first trusted third party device comprising: a transceiving unit configured to receive a message 2 transmitted by the first entity identity validity verification device, wherein the message 2 comprises identity information IA of the first entity identity validity verification device, a random number RA generated by the first entity identity validity verification device, identity information IB of the second entity identity validity verification device, and a random number RB generated by the second entity identity validity verification device; and a processing unit configured to verify an identity of the first entity identity validity verification device based on IA, wherein the transceiving unit is further configured to transmit a message 3 to the second trusted third party device, wherein the message 3 comprises a random number RTPA generated by the first trusted third party device and a token TokenTPAB, wherein TokenTPAB comprises ResA, IB, RB, and a first signature of the first trusted third party device, wherein ResA is a verification result of verifying the first entity identity validity verification device by the first trusted third party device, and signature objects of the first signature of the first trusted third party device comprise ResA, IB and RB; the transceiving unit is further configured to receive a message 4 transmitted by the second trusted third party device, wherein the message 4 comprises a token TokenTPBA, wherein TokenTPBA comprises ResB, a first signature of the second trusted third party device, and a second signature of the second trusted third party device, wherein ResB is a verification result of verifying the second entity identity validity verification device by the second trusted third party device, signature objects of the first signature of the second trusted third party device comprise ResA and RB, and signature objects of the second signature of the second trusted third party device comprise RTPA and ResB; the processing unit is further configured to: verify the second signature of the second trusted third party device in TokenTPBA; check whether RTPA acquired from the message 4 is the same as the random number RTPA in the message 3 transmitted by the first trusted third party device to the second trusted third party device; and construct a message 5, wherein the message 5 comprises a token TokenTA, wherein TokenTA comprises ResA, ResB, a second signature of the first trusted third party device, and the first signature of the second trusted third party device, wherein signature objects of the second signature of the first trusted third party device comprise ResB and RA; and the transceiving unit is further configured to transmit the message 5 to the first entity identity validity verification device. ### Claim 11 (depends on 10) The first trusted third party device according to claim 10, wherein in a process that the first trusted third party device TTPA verifies the identity of the first entity identity validity verification device based on IA after the message 2 transmitted by the first entity identity validity verification device is received by the first trusted third party device TTPA, the processing unit is further configured to: extract a public key PA of the first entity identity validity verification device in a case that IA is a distinguisher of the first entity identity validity verification device; and check validity of a certificate CertA of the first entity identity validity verification device in a case that IA is the certificate CertA of the first entity identity validity verification device. ### Claim 12 A second trusted third party device for being involved in identity validity verification between a first entity identity validity verification device and a second entity identity validity verification device together with a first trusted third party device, the second trusted third party device comprising: a transceiving unit configured to receive a message 3 transmitted by the first trusted third party device, wherein the message 3 comprises a random number RTPA generated by the first trusted third party device and a token TokenTPAB, wherein TokenTPAB comprises ResA, IB, RB, and a first signature of the first trusted third party device, wherein ResA is a verification result of verifying the first entity identity validity verification device by the first trusted third party device, IB is identity information of the second entity identity validity verification device, RB is a random number generated by the second entity identity validity verification device, and signature objects of the first signature of the first trusted third party device comprise ResA, IB and RB; and a processing unit configured to verify the first signature of the first trusted third party device in TokenTPAB and verify an identity of the second entity identity validity verification device based on IB; wherein the transceiving unit is further configured to transmit a message 4 to the first trusted third party device, wherein the message 4 comprises a token TokenTPBA, wherein TokenTPBA comprises ResB, a first signature of the second trusted third party device, and a second signature of the second trusted third party device, wherein ResB is a verification result of verifying the second entity identity validity verification device by the second trusted third party device, signature objects of the first signature of the second trusted third party device comprise ResA and RB, and signature objects of the second signature of the second trusted third party device comprise RTPA and ResB. ### Claim 13 (depends on 12) The second trusted third party device according to claim 12, wherein in a process that the second trusted third party device verifies the identity of the second entity identity validity verification device based on IB after the message 3 transmitted by the first trusted third party device is received by the second trusted third party device, the processing unit is further configured to: extract a public key PB of the second entity identity validity verification device in a case that IB is a distinguisher of the second entity identity validity verification device; and check validity of a certificate CertB of the second entity identity validity verification device in a case that IB is the certificate CertB of the second entity identity validity verification device. ### Claim 14 (canceled) ### Claim 15 (depends on 10) The first trusted third party device according to claim 10, wherein RTPA is replaced with RA. ### Claim 16 (depends on 2) The entity identity validity verification method according to claim 2, wherein RTPA in steps 3), 4) and 5) is replaced with RA. ### Claim 17 (depends on 3) The entity identity validity verification method according to claim 3, wherein RTPA in steps 3), 4) and 5) is replaced with RA. ### Claim 18 (depends on 4) The entity identity validity verification method according to claim 4, wherein RTPA in steps 3), 4) and 5) is replaced with RA. ### Claim 19 (depends on 5) The entity identity validity verification method according to claim 5, wherein RTPA in steps 3), 4) and 5) is replaced with RA. ### Claim 20 (depends on 6) The entity identity validity verification method according to claim 6, wherein RTPA in steps 3), 4) and 5) is replaced with RA. ### Claim 21 (depends on 12) The second trusted third party device according to claim 12, wherein RTPA is replaced with RA.