Enhanced subscriber authentication protocol
AssigneeCerticom Corp.
InventorsPrakash Panjwani, Simon Blake-Wilson
Life of this patent
Estimating the term…
Abstract
The present invention provides a method of authenticating a pair of correspondents in a communication system, such as in a mobile phone network by utilizing a blend of public-key cryptography and symmetric cryptography. Each session between the mobile phone and the network consists of public-key based mutual authentication and key exchange followed by symmetric-key secure data exchange.
Claims24
A method of a first correspondent authenticating a second correspondent in a communication system, said method comprising:
- said first correspondent exchanging cryptographic keys with said second correspondent based on a public key mutual authentication scheme, said mutual authentication comprising:
- said first correspondent transmitting a short term public key along with an identifier to said second correspondent to enable said second correspondent to combine its private key with said short term public key and generate a pair of shared secret keys therefrom wherein a first of said shared secret keys is used for said mutual authentication and a second of said shared secret keys is used for establishing a secret session key, said first correspondent using a short term private key and a public key of said second correspondent to generate said pair of shared secret keys, and said first correspondent using said second of said shared secret keys to establish said session key;
- and
- said first correspondent using said session key for encrypting data in a symmetric-key data exchange.
A communication system comprising a first correspondent and a second correspondent, each of said correspondents having a respective identity, said first correspondent having a private key and a public key derived therefrom, said system being configured for establishing communication between said first and second correspondent by:
- a) said second correspondent obtaining said public key of said first correspondent;
- b) said second correspondent sending a short-lived public key and said second correspondent's identity to said first correspondent;
- c) said first correspondent combining its private key with said short-lived public key and generating a pair of secret keys therefrom;
- d) said first correspondent using a first of said pair of secret keys to compute a first MAC on its identity, said second correspondent's identity, a random challenge, and said short-lived public key;
- e) said first correspondent sending its identity, said random challenge, and said first MAC to said second correspondent, thereby requesting registration;
- f) said second correspondent using a short-lived private key corresponding to said short-lived public key and said first correspondent's public key to generate said pair of secret keys;
- g) said second correspondent using said first of said pair of secret keys to compute a second MAC on its identity, said first correspondent's identity, said random challenge, and said short-lived public key;
- h) said second correspondent verifying said first MAC using said first of said pair of secret keys;
- i) said second correspondent sending said second MAC to said first correspondent, thereby registering said first correspondent;
- j) said first correspondent verifying said second MAC using said first of said pair of secret keys;
- k) said correspondents each computing a pair of session keys from a second of said pair of secret keys, said short-lived public key, and said random challenge;
- and
- l) said correspondents using at least one of said session keys in a secure communication.
A method of establishing communications between a mobile station and a base station, said mobile station and said base station each having a respective identity, said mobile station having a private key and a public key derived from said private key, said method comprising said mobile station;
- a) providing its public key to be obtained by said base station;
- b) receiving from said base station, a short-lived public key computed by said base station from a short-lived private key, and said second correspondent's identity;
- c) combining its private key with said short-lived public key and generating a pair of secret keys therefrom;
- d) using a first of said pair of secret keys to compute a first MAC on its identity, said second correspondent's identity, a random challenge, and said short-lived public key;
- e) sending its identity, said random challenge, and said first MAC to said base station, thereby requesting registration;
- f) receiving from said base station, a second MAC registering said mobile station, said second MAC having been computed by said base station on its identity, said mobile station's identity, said random challenge and said short-lived public key using a first of said pair of secret keys, said pair of secret keys having been generated by said base station using said short-lived private key and said mobile station's public key;
- said first MAC enabling said base station to verify said mobile station;
- g) verifying said second MAC using said first of said pair of secret keys;
- and
- h) computing a pair of session keys from a second of said pair of secret keys, said short-lived public key and said random challenge to enable said mobile station to use at least one of said session keys in a secure communication.
A mobile station for use in a communication system having a base station, said mobile station and said base station each having a respective identity, said mobile station having a private key and a public key derived from said private key, said mobile station being configured for communicating with said base station by:
- a) providing its public key to be obtained by said base station;
- b) receiving from said base station, a short-lived public key computed by said base station from a short-lived private key, and said second correspondent's identity;
- c) combining its private key with said short-lived public key and generating a pair of secret keys therefrom;
- d) using a first of said pair of secret keys to compute a first MAC on its identity, said second correspondent's identity, a random challenge, and said short-lived public key;
- e) sending its identity, said random challenge, and said first MAC to said base station, thereby requesting registration;
- f) receiving from said base station, a second MAC registering said mobile station, said second MAC having been computed by said base station on its identity, said mobile station's identity, said random challenge and said short-lived public key using a first of said pair of secret keys, said pair of secret keys having been generated by said base station using said short-lived private key and said mobile station's public key;
- said first MAC enabling said base station to verify said mobile station;
- g) verifying said second MAC using said first of said pair of secret keys;
- and
- h) computing a pair of session keys from a second of said pair of secret keys, said short-lived public key and said random challenge to enable said mobile station to use at least one of said session keys in a secure communication.
Dependencies are inferred from the claim text.