# US 8,572,378 B2 · Method for protecting the first message of security protocol

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,572,378 B2
- Document ID: US8572378B2
- Status: Granted
- Kind: B2
- Application number: 13/140,632
- Filed: 2009-12-07
- Published: 2011-10-13
- Granted: 2013-10-29
- Earliest claimed: 2008-12-18
- Assignees: China Iwncomm Co., Ltd.
- Applicants: Xiaolong Lai; Jun Cao; Yuelei Xiao; Manxia Tie; Zhenhai Huang; Bianling Zhang; Yanan Hu
- Inventors: Xiaolong Lai; Jun Cao; Yuelei Xiao; Manxia Tie; Zhenhai Huang; Bianling Zhang; Yanan Hu
- Web page: https://patentgrep.com/patent/US8572378B2

## CPC

- H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 9/3273: {for mutual authentication (network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869)}
- H04L 63/123: {received data contents, e.g. message integrity}
- H04W 12/106: Packet or message integrity
- H04L 2209/80: Wireless
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

The present invention provides a method for protecting the first message of a security protocol and the method includes the following steps: 1) initialization step; 2) the initiating side sends the first message; 3) the responding side receives the first message. The method for protecting the first message of the security protocol provided by the present invention can implement that: 1) Pre-Shared Master Key (PSMK), which is shared by the initiating side and responding side, and the security parameter in the first message are bound by using computation function of Message Integrality Code (MIC) or Message Authentication Code (MAC), and thus the fabrication attack of the first message in the security protocol is avoided effectively; 2) during computing the MIC or MAC of the first message, only PSMK and the security parameter of the first message are selected to be computed, and thus the computation load of the initiating side and the responding side is effectively reduced and the computation resource is saved.

## Claims

### Claim 1

A method for protecting a fist message of a security protocol, comprising the steps of:
1) initializing
pre-sharing, by an initiating device and a responding device, private information of a Pre-Shared Master Key, wherein the initiating device and the responding device possess the same Master Key Identifier identifying the Pre-Shared Master Key and support the same function of calculating a Message Integrity Code or a Message Authentication Code;
2) transmitting a first message by the initiating device
calculating, by the initiating device, a Message Integrity Code or a Message Authentication Code on security parameters to be transmitted in the first message and the Pre-Shared Master Key with the function of calculating a Message Integrity Code or a Message Authentication Code, and transmitting to the responding device the first message comprising a non-security parameter, the security parameters, the Master Key Identifier and the Message Integrity Code or the Message Authentication Code;
3) receiving the first message by the responding device
verifying, by the responding device, the non-security parameter in the first message for legality upon reception of the first message; and
if the non-security parameter is illegal, discarding the first message and setting a status code to notify the initiating device or disconnecting a link; or if the non-security parameter is legal, calculating a Message Integrity Code or a Message Authentication Code on the security parameters in the first message and the locally stored Pre-Shared Master Key and comparing the calculated Message Integrity Code or Message Authentication Code with the received Message Integrity Code or Message Authentication Code; and
if the calculated Message Integrity Code or Message Authentication Code is different from the received Message Integrity Code or Message Authentication Code, discarding the first message and setting a status code to notify the initiating device or disconnecting the link; otherwise, further verifying the security parameters in the first message for legality; and
if there is an illegal value in the security parameters, discarding the first message and setting a status code to notify the initiating device or disconnecting the link.

### Claim 2 (depends on 1)

The method for protecting a fist message of a security protocol according to claim 1, wherein in the step 1), the function of calculating a Message Integrity Code or a Message Authentication Code is a unidirectional extension function f(x,y∥str), wherein x represents a value of a key for extension, y represents the security parameters for extension, str represents a padding character string for extension, and ∥ represents a cascade of character strings.

### Claim 3 (depends on 2)

The method for protecting a fist message of a security protocol according to claim 2, wherein in the step 2), the first message is MN∥SC∥PTKID∥MKID∥I-Nonce∥f(PSMK, PTKID∥I-Nonce∥-MAC∥R-MAC∥str), wherein the I-MAC and the R-MAC represent MAC addresses of the initiating device and the responding device respectively, the Message Number, MN, =1, the Status Code, SC, =0, the Pairwise Temporal Key Identifier, PTKID, represents a value selected randomly by the initiating device and different from a Temporal Key Identifier locally stored or used in an ongoing Pairwise Temporal Key negotiation protocol or Group Temporal Key distribution protocol, the I-Nonce represents a random number generated by the initiating device, the f(PSMK, PTKID∥I-Nonce∥-MAC∥R-MAC∥str) represents the Message Integrity Code or the Message Authentication Code, and the str represents the padding character string for extension.

### Claim 4 (depends on 3)

The method for protecting a fist message of a security protocol according to claim 3, wherein in the step 3), the responding device verifies whether the locally stored Master Key Identifier is the Master Key Identifier comprised in the first message upon reception of the first message; and
if so, the responding device discards the first message; otherwise, the responding device verifies whether a negotiation handshake protocol with a Pairwise Temporal Key, PTK, is being performed locally with the Master Key Identifier; and
if so, the responding device discards the first message and sets a Status Code, SC, =2 to notify the initiating device or disconnects the link; otherwise, the responding device calculates f(PSMK, PTKID|I-Nonce∥I-MAC∥R-MAC∥str) from the locally stored I-MAC and R-MAC and compares the calculated f(PSMK, PTKID∥I-Nonce∥I-MAC∥R-MAC∥str) with the received f(PSMK, PTKI D∥I-Nonce∥I-MAC∥R-MAC∥str); and
if the calculated f(PSMK, PTKID∥I-Nonce∥I-MAC∥R-MAC∥str) is different from the received f(PSMK, PTKID∥I-Nonce∥I-MAC∥R-MAC∥str), the responding device discards the first message and sets a Status Code, SC, =1 to notify the initiating device or disconnects the link; otherwise, the responding device verifies whether the Pairwise Temporal Key Identifier, PTKID, is the same as the Temporal Key Identifier, TKID, locally stored or used in the ongoing Pairwise Temporal Key, PTK, negotiation handshake protocol or Group Temporal Key, GTK, distribution protocol; and
if so, the responding device discards the first message and sets a Status Code, SC, =3 to notify the initiating device or disconnects the link; otherwise, the responding device sets the Status Code, SC, =0 and constructs and transmits to the initiating device a second message to proceed with the Pairwise Temporal Key, PTK, negotiation handshake protocol.

### Claim 5 (depends on 4)

The method for protecting a fist message of a security protocol according to claim 4, wherein the security parameters are parameters related to the security of the first message and comprise all variable parameters and a part of non-variable parameters.

### Claim 6 (depends on 5)

The method for protecting a fist message of a security protocol according to claim 5, wherein the variable parameter is a parameter determined from a reference value other than a unique reference value by the responding device upon verification.

### Claim 7 (depends on 5)

The method for protecting a fist message of a security protocol according to claim 5, wherein the non-variable parameter is a parameter determined from a unique reference value by the responding device upon verification.

### Claim 8 (depends on 3)

The method for protecting a fist message of a security protocol according to claim 3, wherein the security parameters are parameters related to the security of the first message and comprise all variable parameters and a part of non-variable parameters.

### Claim 9 (depends on 8)

The method for protecting a fist message of a security protocol according to claim 8, wherein the variable parameter is a parameter determined from a reference value other than a unique reference value by the responding device upon verification.

### Claim 10 (depends on 8)

The method for protecting a fist message of a security protocol according to claim 8, wherein the non-variable parameter is a parameter determined from a unique reference value by the responding device upon verification.

### Claim 11 (depends on 2)

The method for protecting a fist message of a security protocol according to claim 2, wherein the security parameters are parameters related to the security of the first message and comprise all variable parameters and a part of non-variable parameters.

### Claim 12 (depends on 11)

The method for protecting a fist message of a security protocol according to claim 11, wherein the variable parameter is a parameter determined from a reference value other than a unique reference value by the responding device upon verification.

### Claim 13 (depends on 11)

The method for protecting a fist message of a security protocol according to claim 11, wherein the non-variable parameter is a parameter determined from a unique reference value by the responding device upon verification.

### Claim 14 (depends on 1)

The method for protecting a fist message of a security protocol according to claim 1, wherein the security parameters are parameters related to the security of the first message and comprise all variable parameters and a part of non-variable parameters.

### Claim 15 (depends on 14)

The method for protecting a fist message of a security protocol according to claim 14, wherein the variable parameter is a parameter determined from a reference value other than a unique reference value by the responding device upon verification.

### Claim 16 (depends on 14)

The method for protecting a fist message of a security protocol according to claim 14, wherein the non-variable parameter is a parameter determined from a unique reference value by the responding device upon verification.