# US 8,543,817 B1 · Secure indentification and authorization apparatus and method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,543,817 B1 - Document ID: US8543817B1 - Status: Granted - Kind: B1 - Application number: 11/799,579 - Filed: 2007-05-02 - Granted: 2013-09-24 - Earliest claimed: 2006-05-03 - Applicants: Gregg Wood Robbins - Inventors: Gregg Wood Robbins - Web page: https://patentgrep.com/patent/US8543817B1 ## CPC - H04L 63/0869: {for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273)} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 2463/061: applying further key derivation, e.g. deriving traffic keys from a pair-wise master key - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A cryptographic system that continuously identifies both the client and server applications/systems without the need for long term secret keying material or traditional encryption techniques. This system continuously derives its keying material from the previous transactionally bound conversation between the client and the server as well as nonces from the server. Because the primary keying material is derived by both the client and server from the transactionally bounded conversation, you can not spoof either the client or the server. The provides for a method for both the client and the server to assure that they are talking to the appropriate peer. All attacks that attempt to copy, forge, or replay the keying material are detected and bound. ## Claims ### Claim 1 A mutual authentication method for authenticating a mutual relationship between a client device and a server device connected via a communication line using transactional data communicated between the client and the server to independently derive keying material for authentication; the method comprising the steps wherein; the client creates a data transmission to send to the server device, retrieves a previous transactional characteristics stored for the server and uses the retrieved transactional characteristics to encode the data transmission request sent to the server; the client calculates new transactional characteristics using the retrieved transactional characteristics and the data transmission to be sent to the server as input into a computational algorithm to derive a first new transactional characteristics; the client contacts the server over the communications line and the server processes the client transmission by first retrieving a previous transactional characteristics stored for the client and validates the identity of the client using the retrieved transactional characteristics and the client data transmission as input to an algorithm to perform the validation; the server calculates new transactional characteristics using the previous transactional characteristics and the client data transmission as input into a computational algorithm to derive a second new transactional characteristics; the server processes the client transmission and generates a data transmission to send to the client device using the second new transactional characteristics to encode the server data transmission response to the client; the server calculates new transactional characteristics using the previous transactional characteristics and the server data transmission to be sent to the client as input to a computational algorithm to derive a third new transactional characteristics; the server sends the server data transmission as a response to the client over the communications line; the client calculates new transactional characteristics using the previous transactional characteristics and the data transmission sent from the server as input to a computational algorithm to derive a fourth new transactional characteristic and the client validates the identity of the server using the fourth new transactional characteristics; the client processes the response and signals the server to complete the transaction wherein the server stores the current transactional characteristics associated with the client and acknowledges to the client that transaction is complete and the client receives the server acknowledgment and stores the current transactional characteristics associated with the server, wherein the transactional characteristics are used as keying material to encrypt the communication between the client and server devices. ### Claim 2 (depends on 1) The method according to claim 1, wherein multiple transmissions from the client to the server are processed in a single transaction so that the events align with external events. ### Claim 3 (depends on 1) The method according to claim 1, wherein the transactional characteristics are used as input to a computational algorithm to provide keying material to encrypt the communication between the client and the server devices. ### Claim 4 (depends on 1) The method according to claim 1, wherein the transactional characteristics are used as authentication tokens to external processes or systems separate from the communications between the client and server device. ### Claim 5 (depends on 1) The method according to claim 1, wherein an audit is facilitated by storing the transactional characteristics that were used during that transaction to identify a particular transaction. ### Claim 6 (depends on 1) The method according to claim 1, wherein the client is uniquely identified. ### Claim 7 (depends on 1) The method according to claim 1, wherein the server is uniquely identified. ### Claim 8 (depends on 1) The method according to claim 1, wherein the transactional characteristics are stored on a portable medium. ### Claim 9 (depends on 8) The method according to claim 8, wherein the client is identified not by the computer or device that is performing the operations of the client but by the transactional characteristics on the portable media. ### Claim 10 (depends on 8) The method according to claim 8, wherein the media itself is identified by the transactional characteristics on the portable media. ### Claim 11 (depends on 8) The method according to claim 8, wherein the portable media is uniquely identified. ### Claim 12 (depends on 2) The method according to claim 2, wherein the transactional characteristics are used to bound attacks. ### Claim 13 (depends on 1) The method according to claim 1, wherein attempted changes in the data communicated between the client and the server are detected. ### Claim 14 (depends on 13) The method according to claim 13, wherein the detection can bound attempted data changes. ### Claim 15 (depends on 1) The method according to claim 1, wherein duplicated transactional characteristics used to spoof a client or server is detected. ### Claim 16 (depends on 15) The method according to claim 15, wherein the attempted duplication is bound to a transaction or transactional range.