System and method for authentication in a crypto-system utilizing symmetric and asymmetric crypto-keys

A system for authentication of network stations utilizing asymmetric crypto-keys, each asymmetric crypto-key having a public/private key pair with a public key and a private key, comprising:

• a user network station associated with a first asymmetric crypto-key, the private key of the first asymmetric crypto-key having multiple private key portions, configured to transmit a first request for authentication to one or more of a plurality of authentication network stations;
• and
• a plurality of authentication network stations, each associated with an asymmetric crypto-key and each having a different one of the multiple private key portions of the first asymmetric crypto-key stored thereat;
• wherein each authentication network station is configured to (i) generate a challenge, (ii) encrypt the generated challenge with the one private key portion of the first asymmetric crypto-key stored thereat, sign the encrypted challenge with the private key of its associated asymmetric crypto-key and transmit the signed and encrypted challenge to the user network station in response to the transmitted first request for authentication, (iii) respectively encrypt the generated challenge with the public key of the asymmetric crypto-key associated with each of the other of the plurality of authentication network stations, sign each respectively encrypted challenge with the private key of its associated asymmetric crypto-key, and transmit each signed and respectively encrypted challenge to the other authentication network station associated with the asymmetric crypto-key having the public key used to encrypt that challenge, and (iv) verify the signature on and decrypt each signed and respectively encrypted challenge transmitted to it by each of the other authentication network stations;
• wherein the user network station is further configured to (i) verify the signature on each signed and encrypted challenge transmitted to it by the authentication network stations, (ii) combine the verified challenges to form a single combined encrypted challenge, (iii) decrypt the single combined encrypted challenge with yet another different one of the multiple private key portions of the asymmetric crypto-key associated with the user network station, and (iv) encrypt a second authentication request with the decrypted challenge and transmit the encrypted second authentication request to at least one of the plurality of authentication network stations to authenticate the user network station.

A method for authenticating network users in a cryptosystem in which each network user is associated with an asymmetric crypto-key having a public/private key pair with a public key and a private key, comprising:

• receiving a first request for authentication of a first network user by a second network user, the first network user being associated with a first asymmetric crypto-key, the private key of the first asymmetric crypto-key having multiple private key portions, and the second network user being associated with a second asymmetric crypto-key;
• generating a shared symmetric crypto-key;
• encrypting the shared symmetric crypto-key with a first of the multiple private key portions of the first asymmetric crypto-key to form a first message;
• signing the first message with the private key of the second asymmetric crypto-key;
• transmitting the signed first message to the first network user responsive to the received request for authentication;
• encrypting the shared symmetric crypto-key with the public key of a third asymmetric crypto-key associated with a third network user to form a second message;
• signing the second message with the private key of the second asymmetric crypto-key;
• transmitting the signed second message to the third network user;
• authenticating the second network user applying the public key of the second asymmetric crypto-key to the signed second message;
• recovering the shared symmetric crypto-key by applying the private key of the third asymmetric crypto-key to the authenticated second message;
• encrypting the recovered shared symmetric crypto-key by applying a second of the multiple private key portions of the first asymmetric crypto-key to the recovered shared symmetric crypto-key to form a third message;
• transmitting the third message to the first network user;
• authenticating the second network user by applying the public key of the second asymmetric crypto-key to the signed first message;
• combining the authenticated first message and the transmitted third message to form a fourth message;
• applying a third of the multiple private key portions of the first asymmetric crypto-key to the fourth message to recover the shared symmetric crypto-key;
• encrypting a second authentication request with the shared symmetric crypto-key recovered from the fourth message;
• and
• transmitting the encrypted second authentication request to at least one of the second network user and the third network user.

A system for authenticating a network entity using symmetric and asymmetric crypto-keys, each network entity being associated with a different asymmetric crypto-key, and each asymmetric crypto-key having a public/private key pair with a public key and a private key, comprising:

• a data storage device storing logic;
• and
• a processor, representing a first network entity associated with a first asymmetric crypto-key, the private key of the first asymmetric crypto-key having multiple private key portions, wherein the processor is configured to execute the stored logic and thereby:
• direct transmission of a first request for authentication;
• receive, in response to the transmitted first request, (i) a first message, from a second network entity, having a shared symmetric crypto-key encrypted with a first of the multiple private key portions of the first asymmetric crypto-key, and (ii) a second message, from a third network entity, having the shared symmetric crypto-key encrypted with a second of the multiple private key portions of the first asymmetric crypto-key,
• combine the receive first message and the received second message to form a combined message,
• recover the shared symmetric crypto-key by applying a third of the multiple private key portions of the first asymmetric crypto-key to the combined message,
• encrypt a second authentication request with the recovered shared symmetric crypto-key, and
• transmit the encrypted second authentication request to authenticate the first network entity.