US 2024/0430244 A1 · SYSTEM AND METHODS FOR AUTHENTICATED SECURE SESSION KEY ESTABLISHMENT FOR PROTECTING A COMMUNICATION BETWEEN NODES IN A COMMUNICATION NETWORK

Abstract

Method and system for to establishing session keys for protecting communication between nodes in a communication network. A mutual authentication is performed between a responding device and a trusted authentication service. Parameters used in the authentication are shared with one or more initiating nodes, clients, that are allowed to communicate with the responding device if authentication was successful. A secure session key is created independently by the device and clients using authentication parameters and pre-shared keys. Session keys created can be used to protect subsequent actual data communication. The described solution is not tied to any specific underlying transport protocol.

Claims18

Dependent claims

A method of establishing a cryptographic session key for protecting a communication between nodes in a communication network (NW), the method being performed by a device acting as a first node, D, of the network (NW) and comprising:

performing a mutual authentication with a trusted authentication service, AS, the authentication involving sending to AS authentication information for authenticating D, and receiving from AS authentication information for authenticating AS;
and
creating a secure cryptographic session key using authentication parameters (AP;
AP′) resulting from the authentication and a cryptographic key (KCDU;
KGDU) associated with D and known to AS;
and
using the session key (KSU;
KGSU) to protect subsequent actual data communication between D and one or more second nodes, C, of the network (NW).

5 more elements

A method of establishing a cryptographic session key for protecting a communication between nodes in a communication network, the method being performed by a device acting as a second node, C, of the network and comprising:

registering C with a trusted authentication service, AS, for a specific use case, the registration involving receiving a cryptographic client key, KCDU, from AS, the client key being specifically associated with C and with the use case;
receiving authentication parameters, AP, related to a mutual authentication of a first node D of the network to AS;
creating a secure cryptographic session key, KSU, independently of D, using AP and KCDU;
and
using KSU to protect subsequent actual data communication between C and D.

2 more elements

A method of operating a trusted authentication service, AS, for providing device authentication to support establishment of a cryptographic session key for protecting a communication between devices acting as nodes in a communication network, the method comprising:

performing a mutual authentication with a device, D, the authentication involving receiving from D authentication information for authenticating D to AS, and sending authentication information for authenticating AS to D;
registering one or more second nodes, C, of the network and communicating to each of them a respective use-case-specific and client-specific client key (KCDU);
sharing one or more authentication parameters AP used in the authentication with each one of those second nodes, C, which are, as a result of a successful registration with AS, allowed to communicate with D.

Dependencies are inferred from the claim text.

System and methods for authenticated secure session key establishment for protecting a communication between nodes in a communication network

Life of this patent

System and methods for authenticated secure session key establishment for protecting a communication between nodes in a communication network

Life of this patent

Abstract

Claims18