US 8,713,311 B1Granted

Encryption using alternate authentication key

AssigneeGoogle Inc.

InventorJames Roskind

Life of this patent

Estimating the term…

Loading patent…

Abstract

Methods for changing authentication keys when transmitting data are provided. In one aspect, a method includes receiving a first data packet including a first sender-generated authentication value generated using a first authentication key, and a first message encrypted using a first encryption key, and receiving an indication that subsequent packets will include authentication values generated using a second authentication key. The method also includes receiving a second packet includes a second sender-generated authentication value and an encrypted second message, and applying the second authentication key to the second packet to generate a recipient-generated authentication value. The encrypted second message is decrypted if these two authentication values match. Otherwise, the first authentication key is applied to the second packet to generate another recipient-generated authentication value. If these two authentication values match, the encrypted message is decrypted using the first encryption key. Systems and machine-readable media are also provided.

Claims18

Dependent claims

A computer-implemented method for changing authentication keys when transmitting data, the method comprising:

receiving a first data packet comprising a first sender-generated authentication value generated using a first authentication key, and a first message encrypted using a first encryption key;
receiving an indication that subsequent data packets will include authentication values generated using a second authentication key;
receiving a second data packet comprising a second sender-generated authentication value and an encrypted second message;
applying the second authentication key to the second data packet to generate a recipient-generated authentication value;
when the recipient-generated authentication value that is generated using the second authentication key matches the second sender-generated authentication value, decrypting the encrypted second message;
and
when the recipient-generated authentication value that is generated using the second authentication key does not match the second sender-generated authentication value:
applying the first authentication key to the second data packet to generate another recipient-generated authentication value;
and
when the recipient-generated authentication value that is generated using the first authentication key matches the second sender-generated authentication value, decrypting the encrypted message using the first encryption key,
wherein the first authentication key and the second authentication key comprise Message Authentication Code (MAC) keys, and
wherein the first authentication key and the first encryption key are included in a first cipher specification.

9 more elements

A system for changing authentication keys when transmitting data, the system comprising:

a memory comprising instructions;
and
a processor configured to execute the instructions to:
receive a first data packet comprising a first sender-generated authentication value generated using a first authentication key, and a first message encrypted using a first encryption key;
receive a cipher specification notification indicating that subsequent data packets will include authentication values generated using a second authentication key;
receive a second data packet comprising a second sender-generated authentication value and an encrypted second message;
apply the second authentication key to the second data packet to generate a recipient-generated authentication value;
when the recipient-generated authentication value that is generated using the second authentication key matches the second sender-generated authentication value, decrypt the encrypted second message;
and
when the recipient-generated authentication value that is generated using the second authentication key does not match the second sender-generated authentication value:
apply the first authentication key to the second data packet to generate another recipient-generated authentication value;
and
when the recipient-generated authentication value that is generated using the first authentication key matches the second sender-generated authentication value, decrypt the encrypted message using the first encryption key,
wherein the first authentication key and the second authentication key comprise Message Authentication Code (MAC) keys, and
wherein the first authentication key and the first encryption key are included in a first cipher specification.

12 more elements

Dependencies are inferred from the claim text.