U.S. patent application number 12/685475 was filed with the patent office on 2011-08-04 for device authentication.
This patent application is currently assigned to Research In Motion Limited. Invention is credited to Michael Brown, Dinah Davis, Herbert Little.
Application Number | 20110191585 12/685475 |
Document ID | / |
Family ID | 35186913 |
Filed Date | 2011-08-04 |
United States Patent
Application |
20110191585 |
Kind Code |
A2 |
Brown; Michael ; et
al. |
August 4, 2011 |
Device Authentication
Abstract
Authentication of two devices in communication with a third
device is achieved where the first and second devices each possess
a shared secret value. The authentication includes communication of
authentication values from the first device to the second device
using the third device. Similarly, there is communication of values
from the second device to the first device using the third device.
The third device retains the communicated values. The values are
calculated to permit the third device to authenticate the first and
second devices without the third device receiving the shared secret
value. The authentication may be used to establish a communications
channel between the first and the second devices.
Inventors: |
Brown; Michael; (Waterloo,
ON) ; Little; Herbert; (Waterloo, ON) ; Davis;
Dinah; (Waterloo, ON) |
Assignee: |
Research In Motion Limited
295 Phillip Street
Waterloo
ON
N2L 3W8
|
Prior
Publication: |
|
Document Identifier |
Publication Date |
|
US 20100106970 A1 |
April 29, 2010 |
|
|
Family ID: |
35186913 |
Appl. No.: |
12/685475 |
Filed: |
January 11, 2010 |
Related U.S. Patent Documents
|
|
|
|
|
|
Application
Number |
Filing Date |
Patent Number |
|
|
10/836,107 |
Jan 12, 2010 |
7647498 |
|
|
12685475 |
Jan 11, 2010 |
|
|
|
Current U.S.
Class: |
713/168 ;
380/270; 380/278; 380/30; 380/44; 709/227; 709/230; 709/248;
713/169; 713/171; 713/180; 713/181; 726/10; 726/2 |
Current CPC
Class: |
G11C 7/24 20130101 |
Class at
Publication: |
713/168 ;
713/171; 713/180; 713/181; 726/002; 726/010; 380/270; 380/278;
380/030; 380/044; 709/227; 709/230; 709/248; 713/169 |
International
Class: |
H04L 9/00 20060101
H04L009/00; H04L 9/30 20060101 H04L009/30; H04K 1/00 20060101
H04K001/00 |
Claims
1. A method for determining whether a first device and a second
device both possess a value h, the method comprising: receiving and
storing a product R.sub.D from the first device, wherein R.sub.D is
a product of a random value r.sub.D and a public key value P;
receiving and storing a product R.sub.B and a challenge value
e.sub.D from the second device, wherein R.sub.B is a product of a
random value r.sub.B and the public key value P; transmitting the
challenge value e.sub.D to the first device; receiving and storing
a value y.sub.D and a challenge value e.sub.B from the first
device, wherein a first expression involving the value y.sub.D, the
random value r.sub.D and the challenge value e.sub.D has a value
equivalent to a product hP of the value h and the public key value
P; transmitting the challenge value e.sub.B to the second device;
receiving and storing a value y.sub.B from the second device,
wherein a second expression involving the value y.sub.B, the
challenge value e.sub.B and the random value r.sub.B has a value
equivalent to the product hP; and determining that the first device
and the second device are both in possession of the value h when a
condition y.sub.BP+e.sub.BR.sub.B=y.sub.DP+e.sub.DR.sub.D is
satisfied.
2. The method of claim 1, further comprising establishing a
communications channel between the first device and the second
device once having determined that the first device and the second
device are both in possession of the value h.
3. The method of claim 1, wherein the public key value P generates
a prime subgroup of the group E(F.sub.q) of order p, wherein
F.sub.q is a finite field of prime order q, wherein the random
values r.sub.D and r.sub.B are between the number 1 and the number
(p-1), and wherein the challenge values e.sub.D and e.sub.B are
between the number 1 and the number (p-1).
4. The method of claim 2, further comprising: receiving a product
R.sub.C from the second device, wherein R.sub.C is a product of a
random value r.sub.C and the public key value P, and further
wherein R.sub.C is constrained to have a different value than both
the product R.sub.B and the product R.sub.D; obtaining a challenge
value e.sub.C that is constrained to have a different value than
both the challenge value e.sub.B and the challenge value e.sub.D,
and communicating the challenge value e.sub.C to the second device;
receiving a value y.sub.C from the second device, wherein a third
expression involving the value y.sub.C, the random value r.sub.C,
and the challenge value e.sub.C has a value equivalent to the
product hP; and closing the communications channel when a condition
y.sub.CP+e.sub.C R.sub.C=y.sub.DP+e.sub.D R.sub.D is satisfied.
8. The method of claim 1, wherein the value h is derived from a
secret value s, the method further comprising: determining that the
first device and the second device are both in possession of the
secret value s when the condition
y.sub.BP+e.sub.BR.sub.B=y.sub.DP+e.sub.DR.sub.D is satisfied.
9. The method of claim 8, wherein the value h is a hash of the
secret value S.
11. A method, comprising: determining, at a third device, that a
condition y.sub.BP+e.sub.BR.sub.B=y.sub.DP+e.sub.DR.sub.D is
satisfied; and establishing, by the third device, a communications
channel between a first device and a second device upon determining
that said condition is satisfied, wherein: R.sub.D is defined at
the first device as a product of a random value r.sub.D and P,
wherein 1<r.sub.D<p-1, and further wherein R.sub.D is
provided to the second device via the third device; e.sub.B is
defined at the first device, wherein 1<e.sub.B<p-1, and
further wherein e.sub.B is provided to the second device via the
third device; R.sub.B is defined at the second device as a product
of a random value r.sub.B and P, wherein I<r.sub.B<p-1, and
further wherein R.sub.B is provided to the first device via the
third device; e.sub.D is defined at the second device, wherein
1<e.sub.D<p-1, and further wherein e.sub.D is provided to the
first device via the third device; y.sub.D is defined at the first
device by a first expression using r.sub.D and e.sub.D, the first
expression having a value equivalent to a product hP, wherein h is
a shared value stored at both the first device and the second
device, and further wherein y.sub.D is provided to the second
device via the third device; and y.sub.B is defined at the second
device by a second expression using e.sub.B and r.sub.B, the second
expression having a value equivalent to the product hP, wherein P
is a point in an elliptic curve E(F.sub.q), and p is defined as an
order of a prime subgroup of E(F.sub.q) generated by the point P in
E(F.sub.q).
12. The method of claim 11, further comprising: determining, at the
third device, that a further condition y.sub.CP+e.sub.C
R.sub.C=y.sub.DP+e.sub.D R.sub.D is satisfied; and closing, by the
third device, the communications channel between the second device
and the third device upon determining that said further condition
is satisfied, wherein: R.sub.C is defined at the second device as a
product of a random value r.sub.C and P wherein
1<r.sub.C<p-1, and further wherein R.sub.C is constrained to
have a different value than both the product R.sub.B and the
product R.sub.D; e.sub.C is defined at the third device such that
1<e.sub.C<p-1 and further wherein e.sub.C is communicated to
the second device; and y.sub.C is defined at the second device such
that y.sub.C=h-e.sub.C r.sub.C mod p.
13. The method of claim 11, wherein e.sub.D and e.sub.B are random
values.
14. The method of claim 12, wherein e.sub.C is a random value.
15. A program product comprising a medium having executable program
code stored in said medium, the executable program code being
operative, when executed, to cause a communications device to:
receive and store a product R.sub.D from a first device, wherein
R.sub.D is a product of a random value r.sub.D and a public key
value P; receive and store a product R.sub.B and a challenge value
e.sub.D from a second device, wherein R.sub.B is a product of a
random value r.sub.B and the public key value P; transmit the
challenge value e.sub.D to the first device; receive and store a
value y.sub.D and a challenge value e.sub.B from the first device,
wherein a first expression involving the value y.sub.D, the random
value r.sub.D and the challenge value e.sub.D has a value
equivalent to a product hP of the value h and the public key value
P; transmit the challenge value e.sub.B to the second device;
receive and store the value y.sub.B from the second device, wherein
a second expression involving the value y.sub.B, the challenge
value e.sub.B and the random value r.sub.B has a value equivalent
to the product hP; and determine that the first device and the
second device are both in possession of the value h when a
condition y.sub.BP+e.sub.BR.sub.B=y.sub.DP+e.sub.DR.sub.D is
satisfied.
16. The program product of claim 15, the executable program code
further being operative, when executed, to cause a communications
device to establish a communications channel between the first
device and the second device once having determined that the first
device and the second device are both in possession of the value
h.
17. The program product of claim 15, further comprising: receiving
a product R.sub.C from the second device, wherein R.sub.C is a
product of a random value r.sub.C and the public key value P, and
further wherein R.sub.C is constrained to have a different value
than both the product R.sub.B and the product R.sub.D; obtaining a
challenge value e.sub.C that is constrained to have a different
value than both the challenge value e.sub.B and the challenge value
e.sub.D, and communicating the challenge value e.sub.C to the
second device; receiving a value y.sub.C from the second device,
wherein a third expression involving the value y.sub.C, the random
value r.sub.C, and the challenge value e.sub.C has a value
equivalent to the product hP; and closing the communications
channel when a condition y.sub.CP+e.sub.C R.sub.C=y.sub.DP+e.sub.D
R.sub.D is satisfied.
19. A communications device adapted to: receive and store a product
R.sub.D from a first device, wherein R.sub.D is a product of a
random value r.sub.D and a public key value P; receive and store a
product R.sub.B and a challenge value e.sub.D from a second device,
wherein R.sub.B is a product of a random value r.sub.B and the
public key value P; transmit the challenge value e.sub.D to the
first device; receive and store a value y.sub.D and a challenge
value e.sub.B from the first device, wherein a first expression
involving the value y.sub.D, the random value r.sub.D and the
challenge value e.sub.D has a value equivalent to a product hP of
the value h and the public key value P; transmit the challenge
value e.sub.B to the second device; receive and store the value
y.sub.B from the second device, wherein a second expression
involving the value y.sub.B, the challenge value e.sub.B and the
random value r.sub.B has a value equivalent to the product hP; and
determine that the first device and the second device are both in
possession of the value h when a condition
y.sub.BP+e.sub.BR.sub.B=y.sub.DP+e.sub.DR.sub.D is satisfied.
20. The communications device of claim 19, wherein the
communications device comprises a router.
21. The communications device of claim 19, further adapted to
establish a communications channel between the first device and the
second device.
22. The communications device of claim 21, further adapted to:
receive a product R.sub.C from the second device, wherein R.sub.C
is a product of a random value r.sub.C and the public key value P,
and further wherein R.sub.C is constrained to have a different
value than both the product R.sub.B and the product R.sub.D; obtain
a challenge value e.sub.C that is constrained to have a different
value than both the challenge value e.sub.B and the challenge value
e.sub.D, and communicating the challenge value e.sub.C to the
second device; receive a value y.sub.C from the second device,
wherein a third expression involving the value y.sub.C, the random
value r.sub.C, and the challenge value e.sub.C has a value
equivalent to the product hP; and close the communications channel
when a condition y.sub.CP+e.sub.C R.sub.C=y.sub.DP+e.sub.D R.sub.D
is satisfied.
25. A system comprising: a first device; a second device; and a
communications device adapted to: receive and store a product
R.sub.D from the first device, wherein R.sub.D is a product of a
random value r.sub.D and a public key value P; receive and store a
product R.sub.B and a challenge value e.sub.D from the second
device, wherein R.sub.B is a product of a random value r.sub.B and
the public key value P; transmit the challenge value e.sub.D to the
first device; receive and store a value y.sub.D and a challenge
value e.sub.B from the first device, wherein a first expression
involving the value y.sub.D, the random value r.sub.D and the
challenge value e.sub.D has a value equivalent to a product hP of
the value h and the public key value P; transmit the challenge
value e.sub.B to the second device; receive and store the value
y.sub.B from the second device, wherein a second expression
involving the value y.sub.B, the challenge value e.sub.B and the
random value r.sub.B has a value equivalent to the product hP; and
determine that the first device and the second device are both in
possession of the value h when a condition
y.sub.BP+e.sub.BR.sub.B=y.sub.DP+e.sub.DR.sub.D is satisfied.
26. The system of claim 25, wherein the first device comprises a
wireless handheld device.
27. The system of claim 25, wherein the second device comprises an
enterprise server.
28. The method of claim 1, further comprising: transmitting the
product R.sub.B to the first device and transmitting the value
y.sub.B to the first device, thus enabling the first device to
determine whether the second device is in possession of the value h
by the first device checking whether a condition
y.sub.BP+e.sub.BR.sub.B=hP is satisfied.
29. The method of claim 1, further comprising: transmitting the
product R.sub.D to the second device and transmitting the value
y.sub.D to the second device, thus enabling the second device to
determine whether the first device is in possession of the value h
by the second device checking whether a condition
y.sub.DP+e.sub.DR.sub.D=hP is satisfied.
30. The method of claim 2, wherein the communications channel is a
direct communications channel between the first device and the
second device.
31. The method of claim 2, wherein all communications over the
communications channel are routed through a third device.
32. The program product of claim 15, the executable further being
operative, when executed, to cause a communications device to:
transmit the product R.sub.B to the first device and transmit the
value y.sub.B to the first device, thus enabling the first device
to determine whether the second device is in possession of the
value h by the first device checking whether a condition
y.sub.BP+e.sub.BR.sub.B=hP is satisfied.
33. The program product of claim 15, the executable further being
operative, when executed, to cause a communications device to:
transmit the product R.sub.D to the second device and transmit the
value y.sub.D to the second device, thus enabling the second device
to determine whether the first device is in possession of the value
h by the second device checking whether a condition
y.sub.DP+e.sub.DR.sub.D=hP is satisfied.
34. The communications device of claim 19, further adapted to:
transmit the product R.sub.B to the first device and transmit the
value y.sub.B to the first device, thus enabling the first device
to determine whether the second device is in possession of the
value h by the first device checking whether a condition
y.sub.BP+e.sub.BR.sub.B=hP is satisfied.
35. The communications device of claim 19, further adapted to:
transmit the product R.sub.D to the second device and transmit the
value y.sub.D to the second device, thus enabling the second device
to determine whether the first device is in possession of the value
h by the second device checking whether a condition
y.sub.DP+e.sub.DR.sub.D=hP is satisfied.
Description
REFERENCE TO PRIOR APPLICATIONS
[0001] This application is a Continuation of U.S. patent
application Ser. No. 10/836,107, filed Apr. 30, 2004, now U.S. Pat.
No. 7,647,498.
FIELD OF THE INVENTION
[0002] This invention relates generally to communication between
electronic devices and, more particularly, to the authentication of
two electronic devices including authentication by a third
device.
BACKGROUND OF THE INVENTION
[0003] In communication between electronic devices, it is sometimes
desirable for two devices to communicate with each other using a
third device. Typically, one device will seek to establish
communication with a second device by making a request to the third
device. In such a circumstance, the third device may act as a
gatekeeper and prevent or allow such communication based on
permissions defined for the two devices.
[0004] Where the security of the communication between devices is
in issue, the two communicating devices may be provided with a
secret value or key that may be used to determine if a channel of
communication may be established between the two devices. A third
device may execute instructions to permit or deny communication
between the devices, based on the shared values held by the
respective communication devices.
[0005] In a more general way, there may be other reasons for
authenticating two devices to a third device. In cases where each
of the two devices to be authenticated each have the same secret
value, the third device may authenticate the two devices by each of
the devices providing their copies of the secret value to the third
device for comparison.
[0006] However, if the communication between the first or second
device and the third device is potentially not secure, or if the
third device itself is potentially not secure, direct communication
of the secret value or key to the third device is typically not
desirable as the secrecy of the shared value is placed at risk.
[0007] It is therefore desirable to have a mechanism for
authentication of two devices by a third device in which the risk
of exposure of the shared value is reduced.
SUMMARY OF THE INVENTION
[0008] According to an aspect of the invention there is provided an
improved method of device authentication.
[0009] According to another aspect of the invention there is
provided an authentication procedure, to authenticate two devices
each having a shared secret value, in which a third device is able
to determine if each of the communicating devices has the same
shared secret value without directly being provided with that
value.
[0010] According to another aspect of the invention there is
provided a method for a communications channel to be established
between two devices using a third device. The two devices seeking
to communicate are provided with a shared secret value. The
communicating devices are able to prove to the third device that
they each possess the same secret value (and are thus
authenticated). In this authentication procedure, the third device
is able to determine if each of the communicating devices has the
same shared secret value without the third device being provided
with that value.
[0011] According to another aspect of the invention there is
provided a method for securely closing the communications channel
established using the authentication described above.
[0012] According to another aspect of the invention there is
provided a method for the authentication of a first and a second
device by a third device, the first and the second devices each
possessing a shared secret key value h, each of the devices having
available to it a public key P, selected such that the operation of
deriving the secret key value h from the product hP is a
computationally difficult operation, the method comprising the
steps of the first and the second device communicating a set of
values to each other using the third device, such that the first
device is able to calculate a first expression with a value
equivalent to the product hP and the second device is able to
calculate a second expression with a value equal to the product hP,
the third device retaining copies of the values being communicated
between the first and the second device, the method further
comprising the step of the third device calculating and comparing
the values of the first expression and of the second expression to
authenticate the first and the second devices.
[0013] According to another aspect of the invention there is
provided the above method in which the first device is a wireless
handheld device, the second device is an enterprise server, and the
third device is a router and in which the step of the third device
authenticating the first and second devices comprises the step of
establishing a communications channel between the first and second
devices.
[0014] According to another aspect of the invention there is
provided the above method in which the communications channel
established includes the third device as part of the channel and
the third device having retained the values communicated between
the first device and the second device, the method further
comprising the step of closing the communication channel between
the second device and the third device, the step of closing the
said channel comprising the steps of the second device and the
third device exchanges sets of closing authentication values to
permit the third device to carry out a computation of an expression
based on the retained values and the closing authentication values
to authenticate the closing the communication channel.
[0015] According to another aspect of the invention there is
provided a method for the authentication of a first and a second
device by a third device, the first and second devices each
possessing a shared secret key value h, each of the devices is
operative to carry out mathematical operations on defined groups
E(F.sub.q) and Z.sub.p, where F.sub.q is a finite field of prime
order q, including scalar multiplication defined with reference to
the group, the method comprising the steps of: [0016] a) obtaining
a public key P, such that P generates a prime subgroup of the group
E(F.sub.q) of order p, and making available to each of the devices
the public key P, [0017] b) the first device obtaining a random
value r.sub.D such that 1<r.sub.D<p-1, and calculating a
value R.sub.D=r.sub.DP, [0018] c) the first device communicating
the value R.sub.D to the third device, [0019] d) the third device
retaining a copy of the value R.sub.D and forwarding the value
R.sub.D to the second device, [0020] e) the second device obtaining
a random value r.sub.B such that 1<r.sub.B<p-1, and
calculating a value R.sub.B=r.sub.BP, where R.sub.B is determined
such that it is not equal to R.sub.D, the second device obtaining a
random value e.sub.D such that 1<e.sub.D<p-1, the second
device communicating the values e.sub.D and R.sub.B to the third
device, [0021] f) the third device retaining copies of the values
R.sub.B and e.sub.D forwarding the said values to the first device,
[0022] g) the first device calculating a value
y.sub.D=h-e.sub.Dr.sub.D mod p, the first device obtaining a random
value e.sub.B such that 1<e.sub.B<p-1, the first device
communicating values y.sub.D and e.sub.B to the third device,
[0023] h) the third device retaining copies of the values y.sub.D
and e.sub.B forwarding the said values to the second device, [0024]
i) the second device calculating a value y.sub.B=h-e.sub.Br.sub.B
mod p, the second device communicating the value y.sub.B to the
third device, and [0025] j) the third device authenticating the
first and second devices when the condition y.sub.BP+e.sub.B
R.sub.B=y.sub.DP+e.sub.D R.sub.D is satisfied.
[0026] According to another aspect of the invention there is
provided the above method, further comprising the step of the first
device authenticating the second device when the condition
y.sub.BP+e.sub.B R.sub.B=hP is satisfied.
[0027] According to another aspect of the invention there is
provided the above method, further comprising the step of the
second device authenticating the first device when the condition
y.sub.DP+e.sub.D R.sub.D=hP is satisfied.
[0028] According to another aspect of the invention there is
provided the above method, in which the first device is identified
by a non-authenticating identifier and in which the second device
retains a set of key values which set includes a key value shared
with the secret key value of the first device, the method
comprising the step of the first device communicating the
non-authenticating identifier to the second device whereby the
second device may select the key value shared with the secret key
value of the first device from the set of key values.
[0029] According to another aspect of the invention there is
provided the above method, further comprising the step of deriving
the value h from a shared secret value s.
[0030] According to another aspect of the invention there is
provided the above method, in which the step of deriving the value
h comprises the step of carrying out a one-way hash function on the
shared secret value s.
[0031] According to another aspect of the invention there is
provided the above method, further comprising the steps of one or
more of the first, second and third devices checking that the value
e.sub.D is not zero and/or that the value e.sub.B is not zero.
[0032] According to another aspect of the invention there is
provided the above method, further comprising the steps of one or
more of the first, second and third devices checking that the value
R.sub.B is not equal to the point at infinity and/or that the value
R.sub.D is not equal to the point at infinity.
[0033] According to another aspect of the invention there is
provided the above method, further comprising the steps of one or
more of the first, second and third devices checking that the value
R.sub.B is not equal to the value R.sub.D.
[0034] According to another aspect of the invention there is
provided the above method in which the first device is a wireless
handheld device, the second device is an enterprise server, and the
third device is a router and in which the step of the third device
authenticating the first and second devices comprises the step of
establishing a communications channel between the first and second
devices.
[0035] According to another aspect of the invention there is
provided the above method in which the communications channel is
defined by the assignment of an Internet Protocol address to the
first device.
[0036] According to another aspect of the invention there is
provided the above method in which the communications channel
established includes the third device as part of the channel and
the third device having retained the values y.sub.D, P, e.sub.D,
and R.sub.D, the method further comprising the step of closing the
communication channel between the second device and the third
device, the step of closing the said channel comprising the steps
of: [0037] k) the second device obtaining a random value r.sub.C
such that 1<r.sub.C<p-1, and calculating a value
R.sub.C=r.sub.CP, whereby R.sub.C is constrained to have a
different value than both R.sub.B and R.sub.D, [0038] l) the second
device communicating the value R.sub.C to the third device, [0039]
m) the third device obtaining a random value e.sub.C such that
1<e.sub.C<p-1, the third device communicating the value
e.sub.C to the second device, [0040] n) the second device
authenticating the close operation when the condition
y.sub.CP+e.sub.CR.sub.C=y.sub.DP+e.sub.D R.sub.D is satisfied.
[0041] According to another aspect of the invention there is
provided the above method further comprising the steps of the
second device checking that the value e.sub.C is not zero.
[0042] According to another aspect of the invention there is
provided the above method, further comprising the steps of the
third device checking that the value R.sub.C is not equal to the
point at infinity.
[0043] According to another aspect of the invention there is
provided the above method, further comprising the steps of one or
both of the second and third devices checking that the value
R.sub.C is not equal to the value R.sub.B and is not equal to the
value R.sub.D.
[0044] According to another aspect of the invention there is
provided the above method, further comprising the steps of one or
both of the second and third devices checking that the value
e.sub.C is not equal to the value e.sub.D and is not equal to the
value e.sub.B.
[0045] According to another aspect of the invention there is
provided the a program product comprising a medium having
executable program code embodied in said medium, the executable
program code being variously executable on a first device, a second
device and a third device, the executable program code being
operative to cause the above methods to be carried out.
[0046] According to another aspect of the invention there is
provided a system comprising a first device, a second device, and a
third device, the first and the second devices each possessing a
shared secret key value h, each of the devices having available to
it a public key P, selected such that the operation of deriving the
secret key value h from the product hP is a computationally
difficult operation, the first device, the second device and the
third device each comprising memory units and processors for
storing and executing program code, [0047] the program code being
operative to cause communication of a set of values between the
first device and the second device using the third device, [0048]
the program code being operative to cause the first device to
calculate a first expression with a value equivalent to the product
hP and the second device to calculate a second expression with a
value equal to the product hP, [0049] the program code being
operative to cause the third device to retain copies of the values
being communicated between the first and the second device, and
[0050] the program code being operative to cause the third device
to calculate and compare the values of the first expression and of
the second expression to authenticate the first and the second
devices.
[0051] According to another aspect of the invention there is
provided the above system in which the first device is a wireless
handheld device, the second device is an enterprise server, and the
third device is a router and in which the program code operative to
cause the third device to authenticate the first and second devices
comprises program code operative to establish a communications
channel between the first and second devices.
[0052] According to another aspect of the invention there is
provided the above system in which the communications channel
established includes the third device as part of the channel and
the third device comprises memory to retain the values communicated
between the first device and the second device, the program code
further comprising the program code operative to close the
communication channel between the second device and the third
device, the said code comprising program code operative to exchange
sets of closing authentication values between the second device and
the third device to permit the third device to carry out a
computation of an expression based on the retained values and the
closing authentication values to authenticate the closing the
communication channel.
[0053] According to another aspect of the invention there is
provided a system comprising a first device, a second device, and a
third device, the first and second devices each possessing a shared
secret key value h, each of the devices being operative to carry
out mathematical operations on defined groups E(F.sub.q) and
Z.sub.p, where F.sub.q is a finite field of prime order q,
including scalar multiplication defined with reference to the
group, the first device, the second device and the third device
each comprising memory units and processors for storing and
executing program code [0054] o) the program code being operative
to obtain a public key P, such that P generates a prime subgroup of
the group E(F.sub.q) of order p, and to make available to each of
the devices the public key P, [0055] p) the program code being
operative to cause the first device to obtain a random value
r.sub.D such that 1<r.sub.D<p-1, and to calculate a value
R.sub.D=r.sub.DP, [0056] q) the program code being operative to
cause the first device to communicate the value R.sub.D to the
third device, [0057] r) the program code being operative to cause
the third device to retain a copy of the value R.sub.D and to
forward the value R.sub.D to the second device, [0058] s) the
program code being operative to cause the second device to obtain a
random value r.sub.B such that 1<r.sub.B<p-1, and to
calculate a value R.sub.B=r.sub.BP, where R.sub.B is determined
such that it is not equal to R.sub.D, and to cause the second
device to obtain a random value e.sub.D such that
1<e.sub.D<p-1, and to communicate the values e.sub.D and
R.sub.B to the third device, [0059] t) the program code being
operative to cause the third device to retain copies of the values
R.sub.B and e.sub.D and to forward the said values to the first
device, [0060] u) the program code being operative to cause the
first device to calculate a value y.sub.D=h-e.sub.Dr.sub.D mod p,
to cause the first device to obtain a random value e.sub.B such
that 1<e.sub.B<p-1, and to cause the first device to
communicate values y.sub.D and e.sub.B to the third device, [0061]
v) the program code being operative to cause the third device to
retain copies of the values y.sub.D and e.sub.B and to forward the
said values to the second device, [0062] w) the program code being
operative to cause the second device to calculate a value
y.sub.B=h-e.sub.Br.sub.B mod p, and to cause the second device to
communicate the value y.sub.B to the third device, and [0063] x)
the program code being operative to cause the third device to
authenticate the first and second devices when the condition
y.sub.BP+e.sub.BR.sub.B=y.sub.DP+e.sub.D R.sub.D is satisfied.
[0064] According to another aspect of the invention there is
provided the above system in which the first device is a wireless
handheld device, the second device is an enterprise server, and the
third device is a router and in which the program code operative to
cause the third device to authenticate the first and second devices
comprises program code operative to establish a communications
channel between the first and second devices.
[0065] Advantages of the invention include authentication of two
devices to a third device, without the need for the third device to
have communicated to it, or to have direct information about, a
shared secret value possessed by the two authenticated devices.
BRIEF DESCRIPTION OF THE DRAWINGS
[0066] In drawings which illustrate by way of example only a
preferred embodiment of the invention,
[0067] FIG. 1 is block diagram showing two devices and a third
device used in the authentication of the first two devices.
DETAILED DESCRIPTION OF THE INVENTION
[0068] There are many different contexts in which communications
are sought to be established between two different electronic
devices and a third device is used to control whether such
communication is to take place or not.
[0069] FIG. 1 is a block diagram that shows device 10 and device
12, for which a communications channel is to be established. In the
example of FIG. 1, device 14 determines whether such communications
may take place, or not. The determination is made on the basis of
authentication of devices 10, 12 by establishing that each device
has the shared secret value. In the example of FIG. 1, a direct
communications channel is shown between devices 10, 12. Other
arrangements are also possible in which devices 10, 12 use device
14 to establish communications and in which, for example, all
communications are routed through device 14.
[0070] The description of the preferred embodiment refers to
communicating devices but it will be understood by those in the art
that approach of the preferred embodiment may be implemented for
other contexts where authentication of two devices is carried out
by a third device. Each of devices 10, 12 must be able to
communicate with device 14, but the ultimate purpose of the
authentication of devices 10, 12 need not be for their
communication with each other.
[0071] It will be understood by those skilled in the art that
electronic devices, as referred to in this description, include all
manner of devices that are able to establish communications with
other devices and are able to carry out computations as described
below. In particular, the devices include communications servers
such as e-mail and other message servers for use in conjunction
with networks such as the Internet, wireless handheld
communications devices, and other server, desktop, portable or
handheld devices, including devices typically used in a computing
environment or in telephony.
[0072] The preferred embodiment is described as a method that is
implemented with respect to such electronic devices. The
implementation may be embodied in a computer program product that
includes program code on a medium that is deliverable to the
devices referred to in this description. Such program code is
executable on the devices referred to so as to carry out the method
described.
[0073] One example of an implementation of the preferred embodiment
includes a configuration in which device 14 of FIG. 1 is a router
used to assign an IP (Internet Protocol) address to device 10 which
is a wireless handheld device. The router of device 14 sets up the
connection between the wireless handheld device 10 and an
enterprise server, represented in the example of FIG. 1 by device
12. In this example, the device 14 router forwards traffic to the
device 10 handheld from device 12 enterprise server. To ensure that
no other device is able to improperly obtain an IP address from the
device 14 router, in the preferred embodiment both the device 10
handheld and the device 12 enterprise server have a secret value s.
As is set out below, the device 14 router is able to establish that
the device 10 (handheld) is a trusted device and a communications
channel with the device 12 (enterprise server) should be set up by
the device 14 (router). In this example, once the authentication
has been done by the device 14 router, it forwards communications
to the handheld of device 10 by using an assigned IP address and
forwarding communications from the enterprise server of device 12
using the Internet.
[0074] The description of the preferred embodiment set out below
includes several steps in which values as sent between devices are
checked. To ensure that there is only one point of failure in the
method, when such a check determines that there is an error
condition, the approach of the preferred embodiment is to redefine
one of the values in a manner that will cause the method to fail to
authenticate the devices in its final steps. As will be appreciated
by those skilled in the art, there may be other approaches used for
carrying out such checking that will result in the method being
terminated at an earlier point or in an error condition being
specified in another manner.
[0075] The preferred embodiment is described with reference to
devices 10, 12, 14, each of which are capable of carrying out
cryptographic functions and which share, in the embodiment, the
following cryptosystem parameters. The mathematical operations
described are carried out in groups E(F.sub.q) and Z.sub.p. The
group E(F.sub.q) is defined in the preferred embodiment as the
National Institute of Standards and Technology (NIST) approved
521-bit random elliptic curve over F.sub.q. This curve has a
cofactor of one. The field F.sub.q is defined as a finite field of
prime order q. Z.sub.p is the group of integers modulo p. In the
description below, the public key P is defined as a point of
E(F.sub.q) that generates a prime subgroup of E(F.sub.q) of order
p. The notation xR represents elliptic curve scalar multiplication,
where x is the scalar and R is a point on E(F.sub.q). This elliptic
curve point R sometimes needs to be represented as an integer for
some of the calculations. This representation is R _ = ( x _
.times. .times. mod .times. .times. 2 f 2 ) + 2 f 2 , ##EQU1##
where x is the integer representation of the x-coordinate of the
elliptic curve point R and f=log.sub.2 p+1 is the bit length of
p.
[0076] As will be appreciated, for different implementations of the
preferred embodiment, the choice for the groups over which the
operations of the preferred embodiment are to be carried out may
vary. The elliptic curve is a common group for such operations in
cryptography. Any mathematically defined group can be used for the
implementation of the preferred embodiment. For example, the group
defined by integers modulo a prime number can be used for an
implementation.
[0077] In Table 1, set out as follows, the calculations and
communications of the preferred embodiment are set out. In the
preferred embodiment, s is the shared value known to both device 10
and device 12, but not to device 14. In the preferred embodiment,
device 12 may communicate with one or more devices and therefore
device 10 is provided with an identifier Key ID that specifies
which device or class of devices is seeking to communicate with
device 12. Similarly, device 12 may, in other implementations, be
provided with an identifier to allow device 10 to specify which
device is seeking to be authenticated. It will be appreciated that
the Key ID described is not sufficient, in itself, to authenticate
the device. It will also be appreciated that if the identity of
device 10 is obvious from the context, the Key ID may not be
necessary. For instance, if device 12 communicates with a single
device 10, and no other such devices, then the Key ID may not be
necessary. TABLE-US-00001 TABLE 1 DEVICE 10 DEVICE 14 DEVICE 12
Compute: Compute: h = SHA-512(s) h =SHA-512(s) Generate random
r.sub.D, 1 < r.sub.D < P Calculate R.sub.D = r.sub.DP Send
R.sub.D to Device 14; Send Key ID to Device 14. While R.sub.D ==
point of infinity, then R.sub.D = rand( ). Send R.sub.D to Device
12; Send Key ID to Device 12 While R.sub.D == point at infinity,
then R.sub.D =rand( ). Generate random r.sub.B, 1 < r.sub.B
<p-1 Calculate R.sub.B = r.sub.BP While R.sub.D == R.sub.B, then
choose another R.sub.B. Generate random e.sub.D, 1 < e.sub.D
<p-1 Send Key ID, e.sub.D and R.sub.B to Device 14. While
R.sub.B == point at infinity or R.sub.D == R.sub.B, then R.sub.B =
rand( ). While e.sub.D == 0, then e.sub.D =rand( ). Send Key ID,
e.sub.D and R.sub.B to Device 10. While R.sub.B == point at
infinity or R.sub.D == R.sub.B, then R.sub.B = rand( ). While
e.sub.D == 0, then e.sub.D = rand( ). Compute y.sub.D= h - e.sub.D
r.sub.D mod p Generate random e.sub.B, 1 < e.sub.B <p-1 Send
y.sub.D and e.sub.B to Device 14. While e.sub.B == 0 or e.sub.B ==
e.sub.D, then e.sub.B = rand( ). Send y.sub.D and e.sub.B to Device
12. While e.sub.B == 0 or e.sub.B == e.sub.D, then e.sub.B = rand(
). Compute y.sub.B= h - e.sub.B r.sub.B mod p. Send y.sub.B to
Device 14. Send y.sub.B to Device 10. If y.sub.BP + e.sub.B R.sub.B
!= hP, If y.sub.BP + e.sub.B R.sub.B != y.sub.DP If y.sub.DP +
e.sub.D R.sub.D != hP, then then reject + e.sub.D R.sub.D, then
reject reject
[0078] The above table specifies steps taken in the process of the
preferred embodiment for carrying out authentication of the two
communicating devices (devices 10, 12) that includes third party
authentication (device 14). It will be understood by those skilled
in the art that certain steps may be taken in different order and
that, as indicated below, certain steps may be omitted.
[0079] The first step carried out in the preferred embodiment is
for each of devices 10, 12 to compute a hash function based on the
shared secret value s. In the preferred embodiment this hash
function is the SHA-512 hash function as defined in the Federal
Information Processing Standards Publication 180-2. Other similar
hash functions may be used. The value h that is arrived at by
applying the hash function is used by both devices 10, 12. Use of a
hash function value h instead of direct use of the value s makes
the process more secure as the secret shared value s is not
directly used in the different calculations set out below. In the
preferred embodiment, to provide the shared value s to both devices
at an initialization stage, the value s may be randomly generated
by one of devices 10, 12 and then communicated to the other using a
secure communications channel. For example, where device 10 is a
wireless handheld device and device 12 is an enterprise server, the
value of the shared secret value can be generated by the enterprise
server and then communicated to the wireless handheld when that
device is in a cradle that is connected to the enterprise server by
a secure network connection.
[0080] After determining the value h, the next step in the
authentication process of the preferred embodiment is for device 10
to generate a random r.sub.D value to be combined with a public key
value P. This random value is defined to be greater than 1 and less
than p-1. In this example, p is defined to be the order of the
prime subgroup of E(F.sub.q) generated by the point P in elliptic
curve E(F.sub.q). Once the random r.sub.D value is obtained, the
value R.sub.D is calculated by taking the result of the scalar
multiplication r.sub.DP. This randomized public key value (R.sub.D)
is then sent, with the Key ID value, to device 14. At device 14, an
error check on the R.sub.D value is carried out. If R.sub.D is
equal to the point of infinity then there is an error in the public
key value (if P is a valid public key then the scalar product will
not equal the point of infinity). According to the preferred
embodiment, error handling is carried out by setting the R.sub.D
value equal to a random value (specified by the pseudo code
R.sub.D=rand( ) in Table 1). The R.sub.D value and the Key ID value
are then forwarded by device 14 to device 12. It will be noted that
in the preferred embodiment, device 14 will retain in memory
certain of the values that it receives and forwards. These retained
values are used in a final authorization step, as is described
below.
[0081] At device 12, there is a further error check on the R.sub.D
value (in comparison with the point of infinity) and a similar
error handling step is carried out if necessary. Device 12 also
generates its own random value for combination with the public key
P. The random value r.sub.B is defined in the range of 1 to p-1 and
the scalar product r.sub.BP defines the value R.sub.B. An error
check at device 12 is carried out to ensure that R.sub.B is not
equal to R.sub.D. If these values are equivalent then a new random
value r.sub.B is defined and a new R.sub.B value is calculated.
This step is taken because where R.sub.B is the equivalent of
R.sub.D, it is possible for an attacker to determine the value of
h.
[0082] Also in this step at device 12 a randomly defined challenge
value e.sub.D is obtained. This e.sub.D value is generated so as to
be greater than 1 and less than p-1. Both the e.sub.D and R.sub.B
values as determined by device 12 are sent by device 12 to device
14. Device 14 may be carrying out multiple similar transactions
simultaneously with a set of devices that includes device 10. In
order to allow device 14 to determine which of the set of devices
including device 10 to send the values to, the Key ID value is also
returned to device 14 by device 12, along with the e.sub.D and
R.sub.B values.
[0083] At device 14, there is an error check carried out on the
R.sub.B value. The R.sub.B value is compared to the point of
infinity and an error handling step is potentially taken. The
comparison and error handling are carried out for the R.sub.B value
in the same way as R.sub.D was compared and an error handling step
taken in the earlier steps set out above. Similarly, the values of
R.sub.D and R.sub.B are compared to each other and if they are
determined to be equivalent then as an error handling step, R.sub.B
is defined to be a random value. The equivalence of R.sub.D and
R.sub.B is recognized as an error condition because device 12
generates R.sub.B in a manner that ensures that it has a different
value than R.sub.D. If, on receipt by device 14, the two values are
identical then there must have been an error in transmission or an
attacker has redefined the values.
[0084] A further check is carried out at device 14 at this time to
ensure that e.sub.D does not have a value of 0. If the value is 0
then the e.sub.D value is set to a random value. If e.sub.D has
been set to a value of 0 (potentially by an attacker seeking to
obtain information to allow a false authentication) then the value
of h may become known. To avoid this, e.sub.D is given a random
value. It will be appreciated that although the check to ensure
that R.sub.D is not equal to R.sub.B and the check to ensure that
e.sub.D is not equal to 0 may be referred to as error checks, these
checks are carried out to ensure that an attacker is not able to
obtain information about the value of h.
[0085] Once the checking referred to above is complete, device 14
sends Key ID, R.sub.B and e.sub.D to device 10.
[0086] In the preferred embodiment, on receipt of the Key ID,
R.sub.B and e.sub.D values, device 10 will carry out the same
checks that were carried out at device 10, and take the same error
handling steps (setting either R.sub.B or e.sub.D to 0, as needed).
As was the case with the communication of the values between device
12 and device 14, the communication between device 14 and device 10
is a potential point at which an attacker may seek to alter values
to gain access to the communication channel through improper
authentication of a device.
[0087] As is shown in Table 1, once the checking of values R.sub.B
and e.sub.D has taken place at device 10, there is a calculation of
a y.sub.D value. The definition of the value is:
y.sub.D=h-e.sub.Dr.sub.D mod p As is described in more detail
below, the y.sub.D value is used in comparisons that will
authenticate the devices 10, 12 to each other and to device 14.
[0088] Another step carried out by device 10 is the generation of a
challenge value. This challenge value is an e.sub.B value that is
randomly chosen from the range greater than 1 and less than p-1.
Both y.sub.D and e.sub.B values are then sent to device 14.
[0089] At device 14, the e.sub.B value is compared with 0 and with
e.sub.D. If e.sub.B has a value equal to either of these, then
e.sub.B is set to a random value.
[0090] The e.sub.B value is then sent by device 14 to device 12,
along with the y.sub.D value. At device 12 the e.sub.B value is
again checked (against 0 and e.sub.D) and if the check is not
successful, e.sub.B is set to a random value. A y.sub.B value is
then calculated: y.sub.B=h-e.sub.Br.sub.B mod p
[0091] As will be seen, the value y.sub.B is defined in a manner
symmetrical to the definition of y.sub.D. The y.sub.B value is sent
by device 12 where was calculated, to device 14 and from there to
device 10.
[0092] At this point in the process, the y.sub.D and R.sub.D values
have been sent by device 10 to device 12, and the y.sub.B and
R.sub.B values has been sent by device 12 to device 10. Further,
copies of the values that have been forwarded to and sent from
device 14 have also be retained at device 14. Consequently, as will
be seen in the last step of Table 1, authentication steps are
carried out to authenticate that both device 10 and device 12 have
the same shared secret value s.
[0093] In particular, at device 14, there is an authentication of
the two devices if and only if
y.sub.BP+e.sub.BR.sub.B=y.sub.DP+e.sub.DR.sub.D.
[0094] At device 10, there is authentication of device 12 if and
only if y.sub.BP+e.sub.BR.sub.B=hP.
[0095] At device 12, there is authentication of device 10 if and
only if y.sub.DP+e.sub.DR.sub.D=hP.
[0096] As will be apparent to those skilled in the art, the process
of authentication set out above makes use of certain of the
mathematical operations and equivalencies described and used in the
Schnorr identification scheme (see for example A. Menezes, P. van
Oorschot and S. Vanstone. Handbook of Applied Cryptography, CRC
Press, New York, 1997). The preferred embodiment, however, permits
two devices to mutually authenticate each other and to permit a
third device to authenticate both devices. The authentication is
carried out by the third device (device 14 in the example) despite
the fact that the third device does not know the secret value s
that is shared between the two devices 10, 12. It will be noted
that the mutual authentication between devices 10, 12 is carried
out at the same time, as a result of a series of overlapping steps
having been taken.
[0097] The authentication process of the preferred embodiment is
suitable for use where a communications channel between two devices
is being defined and a third device will provide information to
allow the channel to be set up. This may occur where a wireless
handheld uses a routing device to gain access to an enterprise
server. The routing device acts as the third device that requires
authentication of the server and the wireless handheld device. The
above process permits such authentication to be carried out and to
have the third device (the router, for example) make the
authentication without having knowledge of the secret value and
with a reduced set of state information.
[0098] The above description of the preferred embodiment includes
error checking applied to the R value. This is carried out to
determine if R is a valid public key value. As will be appreciated,
this error checking may be omitted from the method of the preferred
embodiment if it can be ensured that R.sub.D is not equal to
R.sub.B, although it is generally preferable to carry out these
checks to ensure that the process is being carried out correctly.
Further, the preferred embodiment describes the computation of a
hash value of the secret value at device 10 and at device 12. The
use of a hash function to encode the secret value s as the value h,
is not required although it is a preferred step to minimize the
direct use of the secret value. If there is no use of a hash
function in this manner, the secret value is used directly to
calculate the different authentication values.
[0099] As referred to above, the authentication process may be used
in establishing a communications channel from one device to a
second device through a third device. In this case, it is
advantageous to use an authenticated protocol to close the channel
as between the third device and one of the other two. In the
preferred embodiment such an authenticated close protocol may be
put in place on the basis that the third device retains certain
values. In particular, after the authentication has taken place
prior to establishing the communications channel, the third device
(device 14, in the example of FIG. 1) retains values
y.sub.DP+e.sub.DR.sub.D, R.sub.D, R.sub.B, e.sub.D, e.sub.B. Device
12 retains values R.sub.D, R.sub.B, e.sub.D, e.sub.B, h. In Table
2, an authentication process is set out for use where device 14 has
authenticated device 12, as is set out above and device 12 seeks to
close the communications channel. TABLE-US-00002 Device 14 Device
12 Device 12 initiates closing the connec- tion with device 14.
Pick random r.sub.C, 1 < r.sub.C <p-1 Calculate R.sub.C =
r.sub.CP While R.sub.C == R.sub.B or R.sub.C == R.sub.B, then
choose another R.sub.C. Send to R.sub.C device 14. While R.sub.C ==
point at infinity or R.sub.C == RB or R.sub.C == R.sub.D, then
R.sub.C = rand( ). Generate random e.sub.C, 1<e.sub.C <p-1
While or e.sub.C == e.sub.D or e.sub.C == e.sub.B, then choose
another e.sub.C. Send to e.sub.C device 12. While e.sub.C == 0 or
e.sub.C == e.sub.D or e.sub.C == e.sub.B, then e.sub.C = rand( ).
Compute y.sub.C= h - e.sub.Cr.sub.C mod p Send to y.sub.C device
14. If y.sub.CP + e.sub.CR.sub.C != y.sub.DP + e.sub.DR.sub.D, then
reject
[0100] As will be seen from the above, the authentication for the
close protocol is available, even though device 14 (the third
device) does not possess or use directly security value s or the
hash value h. In this case, the authentication follows the Schnorr
identification scheme, based on the values that are retained by the
devices referred to above (devices 12, 14 in the example given).
These values are available to the third device as a result of using
the authentication process described above.
[0101] Various embodiments of the present invention having been
thus described in detail by way of example, it will be apparent to
those skilled in the art that variations and modifications may be
made without departing from the invention. The invention includes
all such variations and modifications as fall within the scope of
the appended claims.
* * * * *