# US 2019/0173671 A1 · System and method for obtaining a common session key between devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0173671 A1
- Document ID: US20190173671A1
- Status: Published application
- Kind: A1
- Application number: 16/258,109
- Filed: 2019-01-25
- Published: 2019-06-06
- Earliest claimed: 2016-07-26
- Assignees: Huawei International Pte. Ltd.
- Applicants: Huawei International Pte. Ltd.
- Inventors: Yanjiang YANG; Jie SHI; Guilin WANG
- Web page: https://patentgrep.com/patent/US20190173671A1

## CPC

- H04L 9/0841: {involving Diffie-Hellman or related key agreement protocols}
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/0869: {involving random numbers or seeds}
- H04L 9/3247: {involving digital signatures}
- H04L 63/123: {received data contents, e.g. message integrity}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

This document describes a system and method for generating a common session key for encoding digital communications between devices. In particular, the system allows two devices to verify the veracity of each device before these authenticated devices proceed to generate a common session key that is then utilized to encode digital communications between these two devices.

## Claims

### Claim 1

A method of generating a common session key SKij for encoding digital communications between a first entity and a second entity, comprising:
generating, by a secure server, a private key ski for the first entity wherein the private key ski comprises a Discrete-Logarithm type digital signature, [Ri, si], of an identity of the first entity, idi, and generating, by the secure server, a private key skj for the second entity wherein the private key skj comprises a Discrete-Logarithm type digital signature, [Rj, sj], of an identity of the second entity, idj, wherein Ri and Rj are group elements, and si and sj comprise integers modulo q, whereby q is a prime number, wherein the private key ski is communicated to the first entity and the private key skj is communicated to the second entity;
sharing, by the first entity, a cryptographic nonce Ni, the identity of the first entity idi, and Ri with the second entity;
calculating, by the second entity, an implicitly shared secret kji using the shared Ri, where g is a generator of a cyclic group G, and providing the implicitly shared secret kji, the cryptographic nonce Ni, and a cryptographic nonce Nj to an Authentication Data Deriving Function to generate an authentication data Adj;
sharing, by the second entity, the cryptographic nonce Nj, the identity of the second entity idj, Rj, and the authentication data Adj with the first entity; and
calculating, by the first entity, an implicitly shared secret kij using the shared Rj and verifying the authentication data Adj using the implicitly shared secret kij, the cryptographic nonce Ni, and the cryptographic nonce Nj, wherein if the authentication data Adj is verified, generating the common session key SKij by providing the implicitly shared secret kij, the cryptographic nonce Ni, the cryptographic nonce Nj, the identity of the first entity idi and the identity of the second entity idj to a Key Deriving Function.

### Claim 2 (depends on 1)

The method according to claim 1 further comprising:
providing, by the first entity, the implicitly shared secret kij, the cryptographic nonce Ni, and the cryptographic nonce Nj to the Authentication Data Deriving Function to generate an authentication data Adi, and communicating the authentication data Adi to the second entity; and
verifying, by the second entity, the authentication data Adi using the implicitly shared secret kji, wherein if the authentication data Adi is verified, providing the implicitly shared secret kji, the cryptographic nonce Ni, the cryptographic nonce Nj, the identity of the first entity idi and the identity of the second entity idj to the Key Deriving Function to generate the common session key SKij.

### Claim 3 (depends on 1)

The method according to claim 1 wherein the generation of the authentication data Adj further comprises providing the identity of the first entity idi and the identity of the second entity idj to the Authentication Data Deriving Function.

### Claim 4 (depends on 2)

The method according to claim 2 wherein the generation of the authentication data Adi further comprises providing the identity of the first entity idi and the identity of the second entity idj to the Authentication Data Deriving Function.

### Claim 5 (depends on 1)

The method according to claim 1 wherein the verifying the authentication data Adj comprises:
providing the implicitly shared secret kij, the cryptographic nonce Ni, and the cryptographic nonce Nj to the Authentication Data Deriving Function to obtain a result, and determining if the result matches with authentication data Adj, whereby if a match is found, verifying the authentication data Adj.

### Claim 6 (depends on 2)

The method according to claim 2 wherein the verifying the authentication data Adi comprises:
providing the implicitly shared secret kji, the cryptographic nonce Ni, and the cryptographic nonce Nj to the Authentication Data Deriving Function to obtain a result, and determining if the result matches with authentication data Adi, whereby if a match is found, verifying the authentication data Adi.

### Claim 7 (depends on 1)

The method according to claim 1 wherein the cryptographic nonce Ni comprises ga where a is a random number.

### Claim 8 (depends on 1)

The method according to claim 1 wherein the cryptographic nonce Nj comprises gb where b is a random number.

### Claim 9 (depends on 1)

The method according to claim 1 wherein the private key ski is a Schnorr signature of the identity of the first entity, idi, where Ri=gri, and si=ri+xH(Ri, idi) (modulo q), and wherein the private key skj is a Schnorr signature of the identity of the second entity, idj, where Rj=grj and sj=rj+xH(Rj, idj) (modulo q), where ri and rj are random numbers, x is a master secret key, and H( ) is a collision-resistant hash function, and
wherein the implicitly shared secret kij=gsi·sj, and the implicitly shared secret kij=gsj·si, where g is a generator of a cyclic group G.

### Claim 10 (depends on 1)

The method according to claim 1 wherein the private key sk, is a first variant of an ElGamal signature of the identity of the first entity, idi, where Ri=gri, and si=x−1·(H(idi)−ri·Ri) (modulo q), and wherein the private key skj is a first variant of an ElGamal signature of the identity of the second entity, idj, where Rj=grj and sj=x−1·(H(idj)−rj·Rj) (modulo q), where ri and rj are random numbers, x is a master secret key, H( ) is a collision-resistant hash function and,
wherein the implicitly shared secret kji=ysi·sj, and the implicitly shared secret kij=ysj·si, where y=gx is master public key, and where g is a generator of a cyclic group G.

### Claim 11 (depends on 1)

The method according to claim 1 wherein the private key ski is a second variant of an ElGamal signature of the identity of the first entity, idi, where Ri=gri, and si=xRi+ri·H(idi) (modulo q), and wherein the private key skj is a second variant of an ElGamal signature of the identity of the second entity, idj, where Rj=grj and sj=xRj+rj·H(idj) (modulo q), where ri and rj are random numbers, x is a master secret key, and H( ) is a collision-resistant hash function and,
wherein the implicitly shared secret kji=gsi·sj, and the implicitly shared secret kij=gsj·si, where g is a generator of a cyclic group G.

### Claim 12 (depends on 1)

The method according to claim 1 wherein the private key ski is a third variant of an ElGamal signature of the identity of the first entity, idi, where Ri=gri, and si=x·H(idi)+ri·Ri (modulo q), and wherein the private key skj is a third variant of an ElGamal signature of the identity of the second entity, idj, where Rj=grj and sj=x·H(idj)+rj·Rj (modulo q), where ri and rj are random numbers, x is a master secret key, and H( ) is a collision-resistant hash function and,
wherein the implicitly shared secret kji=gsi·sj, and the implicitly shared secret kij=gsj·si, where g is a generator of a cyclic group G.

### Claim 13 (depends on 1)

The method according to claim 1 wherein the private key ski is a fourth variant of an ElGamal signature of the identity of the first entity, idi, where Ri=gri, and si=x−1=x−1·(Ri−ri·H(idi)) (modulo q), and wherein the private key skj is a fourth variant of an ElGamal signature of the identity of the second entity, idj, where Rj=grj and sj=x−1·(Rj·rj·H(idj)) (modulo q), where ri and rj are random numbers, x is a master secret key, and H( ) is a collision-resistant hash function and,
wherein the implicitly shared secret kji=ysi·sj, and the implicitly shared secret kij=ysj·si, where y=gx is master public key, and where g is a generator of a cyclic group G.

### Claim 14

A method of generating a common session key SKij for encoding digital communications between a first entity and a second entity, comprising:
generating, by a secure server, a private key ski for the first entity wherein the private key ski comprises a Discrete-Logarithm type digital signature, [Ri, si], of an identity of the first entity, idi, and generating, by the secure server, a private key skj for the second entity wherein the private key skj comprises a Discrete-Logarithm type digital signature, [Rj, sj], of an identity of the second entity, idj, wherein Ri and Rj are group elements, and si and sj comprise integers modulo q, whereby q is a prime number, wherein the private key ski is communicated to the first entity and the private key skj is communicated to the second entity;
sharing, by the first entity, a cryptographic nonce Ni, the identity of the first entity idi, and Ri with the second entity;
calculating, by the second entity, an implicitly shared secret kji=gsi·sj, using the shared Ri, where g is a generator of a cyclic group G, and calculating the common session key SKji by providing the implicitly shared secret kji, the cryptographic nonce Ni, the cryptographic nonce Nj, the identity of the first entity idi and the identity of the second entity idj to the Key Deriving Function, and providing the common session key SKji, the cryptographic nonce Ni, and a cryptographic nonce Nj to an Authentication Data Deriving Function to generate an authentication data Adj;
sharing, by the second entity, the cryptographic nonce Nj, the identity of the second entity idj, Rj, and the authentication data Adj with the first entity; and
calculating, by the first entity, an implicitly shared secret kij=gsj·si, using the shared Rj, and calculating a common session key SKij by providing the implicitly shared secret kij, the cryptographic nonce Ni, the cryptographic nonce Nj, the identity of the first entity idi and the identity of the second entity idj to the Key Deriving Function and verifying the authentication data Adj using the common session key SKij, the cryptographic nonce Ni, and the cryptographic nonce Nj, wherein if the authentication data Adj is verified, using the common session key SKij or SKji as the common session key for encoding digital communications between a first entity and a second entity.

### Claim 15

A system for generating a common session key SKij for encoding digital communications between a first entity and a second entity, comprising:
a secure server configured to share a private key ski for the first entity wherein the private key ski comprises a Discrete-Logarithm type digital signature, [Ri, si], of an identity of the first entity, idi, and generating, by the secure server, a private key skj for the second entity wherein the private key skj comprises a Discrete-Logarithm type digital signature, [Rj, sj], of an identity of the second entity, idj, wherein Ri and Rj are group elements, and si and sj comprise integers modulo q, whereby q is a prime number, wherein the private key ski is communicated to the first entity and the private key skj is communicated to the second entity;
the first entity configured to share a cryptographic nonce Ni, the identity of the first entity idi, and Ri with the second entity;
the second entity configured to calculate an implicitly shared secret kji using the shared Ri, and providing the implicitly shared secret kji, the cryptographic nonce Ni, and a cryptographic nonce Nj to an Authentication Data Deriving Function to generate an authentication data Adj;
the second entity configured to share the cryptographic nonce Nj, the identity of the second entity idj, Rj, and the authentication data Adj with the first entity; and
the first entity configured to calculate the implicitly shared secret kij=gsj·si, using the shared Rj and verifying the authentication data Adj using the implicitly shared secret kij, the cryptographic nonce Ni, and the cryptographic nonce Nj, wherein if the authentication data Adj is verified, generating the common session key SKij by providing the implicitly shared secret kij, the cryptographic nonce Ni, the cryptographic nonce Nj, the identity of the first entity idi and the identity of the second entity idj to a Key Deriving Function.

### Claim 16

A system for generating a common session key SKij for encoding digital communications between a first entity and a second entity, comprising:
a secure server configured to generate a private key ski for the first entity wherein the private key sk, comprises a Discrete-Logarithm type digital signature, [Ri, si], of an identity of the first entity, idi, and generating, by the secure server, a private key skj for the second entity wherein the private key skj comprises a Discrete-Logarithm type digital signature, [Rj, sj], of an identity of the second entity, idj, wherein Ri and Rj are group elements, and si and sj comprise integers modulo q, whereby q is a prime number, wherein the private key ski is communicated to the first entity and the private key skj is communicated to the second entity;
the first entity configured to share a cryptographic nonce Ni, the identity of the first entity idi, and Ri with the second entity;
the second entity configured to calculate an implicitly shared secret kji=gsi·sj, using the shared Ri, where g is a generator of a cyclic group G, and calculating the common session key SKji by providing the implicitly shared secret kji, the cryptographic nonce Ni, the cryptographic nonce Nj, the identity of the first entity idi and the identity of the second entity idj to the Key Deriving Function, and providing the common session key SKji, the cryptographic nonce Ni, and a cryptographic nonce Nj to an Authentication Data Deriving Function to generate an authentication data Adj;
the second entity configured to share the cryptographic nonce Nj, the identity of the second entity idj, Rj, and the authentication data Adj with the first entity; and
the first entity configured to calculate an implicitly shared secret kij=gsj·si, using the shared Rj, and calculating a common session key SKij by providing the implicitly shared secret kij, the cryptographic nonce Ni, the cryptographic nonce Nj, the identity of the first entity idi and the identity of the second entity idj to the Key Deriving Function and verifying the authentication data Adj using the common session key SKij, the cryptographic nonce Ni, and the cryptographic nonce Nj, wherein if the authentication data Adj is verified, using the common session key SKij or SKji as the common session key for encoding digital communications between a first entity and a second entity.