Multi-TTP-based method and device for verifying validity of identity of entity

Patent metadata

Field	Value
Publication number	US-10615978-B2
Application number	US-201615766312-A
Country	US
Kind code	B2
Filing date	Aug 11, 2016
Priority date	Oct 10, 2015
Publication date	Apr 7, 2020
Grant date	Apr 7, 2020

Abstract

Provided are an entity identity validity verification method and device with multiple trusted third parties being involved. In the application, validity of identities of entities performing mutual identity validity verification can only be verified by different trusted third parties. During the verification process, the trusted third parties that are respectively trusted by the two entities interact with each other, and provide services for verifying validity of an identity of one entity by the other entity, to complete identity validity verification between the entities.

First claim

The invention claimed is:

1. An entity identity validity verification method with a plurality of trusted third parties (TTPs) being involved, wherein the method involves an entity A, an entity B, a trusted third party TTP A and a trusted third party TTP B , the trusted third party TTP A is capable of verifying validity of an identity of the entity A, the trusted third party TTP B is capable of verifying validity of an identity of the entity B, the entity A trusts the trusted third party TTP A , the entity B trusts the trusted third party TTP B , and wherein the method comprises:
step 1) transmitting, by the entity B, a message 1 to the entity A, wherein the message 1 comprises identity information I B of the entity B;
step 2) transmitting, by the entity A, a message 2 to the trusted third party TTP A after the entity A receives the message 1 , wherein the message 2 comprises the identity information I B and a random number R A generated by the entity A;
step 3) transmitting, by the trusted third party TTP A , a message 3 to the trusted third party TTP B after the trusted third party TTP A receives the message 2 transmitted by the entity A, wherein the message 3 comprises the identity information I B and a random number R TPA generated by the trusted third party TTP A ;
step 4) after the trusted third party TTP B receives the message 3 transmitted by the trusted third party TTP A , verifying, by the trusted third party TTP B , the validity of the identity of the entity B based on the identity information I B to acquire a verification result Res B , and transmitting, by the trusted third party TTP B , a message 4 to the trusted third party TTP A , wherein the message 4 comprises a token TokenTPBA, wherein the token TokenTPBA comprises the verification result Res B and a first signature of the trusted third party TTP B , wherein signature objects of the first signature of the trusted third party TTP B comprise the random number R TPA and the verification result Res B ;
step 5) after the trusted third party TTP A receives the message 4 transmitted by the trusted third party TTP B , verifying, by the trusted third party TTP A , the first signature of the trusted third party TTP B in the token TokenTPBA; after the first signature of the trusted third party TTP B passes the verification performed by the trusted third party TTP A , checking, by the trusted third party TTP A , whether the random number R TPA acquired from the message 4 is the same as the random number R TPA in the message 3 transmitted by the trusted third party TTP A to the trusted third party TTP B ; if the random number R TPA acquired from the message 4 is the same as the random number R TPA in the message 3 transmitted by the trusted third party TTP A to the trusted third party TTP B , constructing a message 5 and transmitting the message 5 to the entity A by the trusted third party TTP A , wherein the message 5 comprises a token TokenTA, wherein the token TokenTA comprises the verification result Res B and a first signature of the trusted third party TTP A , wherein signature objects of the first signature of the trusted third party TTP A comprise the verification result Res B and the random number R A ; and
step 6) after the entity A receives the message 5 from the trusted third party TTP A , verifying, by the entity A, the first signature of the trusted third party TTP A in the token TokenTA; after the first signature of the trusted third party TTP A passes the verification performed by the entity A, checking, by the entity A, whether the random number R A acquired from the message 5 is the same as the random number R A in the message 2 transmitted by the entity A to the trusted third party TTP A ; if the random number R A acquired from the message 5 is the same as the random number R A in the message 2 transmitted by the entity A to the trusted third party TTP A , determining, by the entity A, the validity of the identity of the entity B based on the verification result Res B .

2. The entity identity validity verification method according to claim 1 , wherein the trusted third party TTP B verifying the validity of the identity of the entity B based on the identity information I B after the trusted third party TTP B receives the message 3 transmitted by the trusted third party TTP A in step 4) comprises:
in a case that the identity information I B is a distinguisher of the entity B, extracting, by the trusted third party TTP B , a public key P B of the entity B, wherein the verification result Res B comprises P B ; and
in a case that the identity information I B is a certificate Cert B of the entity B, checking, by the trusted third party TTP B , validity of the certificate Cert B , wherein the verification result Res B comprises a validity state of the certificate Cert B ; wherein
if the trusted third party TTP B is incapable of acquiring the public key or the validity of the certificate of the entity B, the verification result Res B comprises content indicating failed verification.

3. The entity identity validity verification method according to claim 2 , wherein the random number R TPA in steps 3), 4) and 5) is replaced with the random number R A .

4. The entity identity validity verification method according to claim 1 , wherein the trusted third party TTP A acquiring the random number R TPA from the message 4 in step 5) comprises:
recovering, by the trusted third party TTP A , the random number R TPA directly from the first signature of the trusted third party TTP B after the first signature of the trusted third party TTP B passes verification performed by the trusted third party TTP A , in a case that the trusted third party trusted third party TTP A is capable of recovering the random number R TPA from the first signature of the trusted third party TTP B when the trusted third party TTP A verifies the first signature of the trusted third party TTP B ; and
acquiring, by the trusted third party TTP A , the random number R TPA directly from the message 4 comprising an R TPA field, in a case that the trusted third party TTP A is incapable of recovering the random number R TPA from the first signature of the trusted third party TTP B when the trusted third party TTP A verifies the first signature of the trusted third party TTP B ; and
the entity A acquiring the random number R A from the message 5 in step 6) comprises:
recovering, by the entity A, the random number R A directly from the first signature of the trusted third party TTP A after the first signature of the trusted third party TTP A passes verification performed by the entity A, in a case that the entity A is capable of recovering the random number R A from the first signature of the trusted third party TTP A when the entity A verifies the first signature of the trusted third party TTP A ; and
acquiring, by the entity A, the random number R A directly from the message 5 comprising an R A field, in a case that the entity A is incapable of recovering the random number R A from the first signature of the trusted third party TTP A when the entity A verifies the first signature of the trusted third party TTP A .

5. The entity identity validity verification method according to claim 4 , wherein the random number R TPA in steps 3), 4) and 5) is replaced with the random number R A .

6. The entity identity validity verification method according to claim 1 , wherein the random number R TPA in steps 3), 4) and 5) is replaced with the random number R A .

7. A first entity identity validity verification device for performing identity validity verification together with a second entity identity validity verification device with a first trus

Assignees

• China Iwncomm Co Ltd

Inventors

• Du Zhiqiang
• Zhang Bianling
• Li Qin
• Yan Xiang
• Zhang Guoqiang

Classifications

• H04L9/0869

  involving random numbers or seeds · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/3213

  using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807) · CPC title

• H04L63/0869 Primary

  for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273) · CPC title