Multi-TTP-based method and device for verifying validity of identity of entity

Patent metadata

Field	Value
Publication number	US-10652029-B2
Application number	US-201615765223-A
Country	US
Kind code	B2
Filing date	Aug 23, 2016
Priority date	Oct 10, 2015
Publication date	May 12, 2020
Grant date	May 12, 2020

Abstract

Provided are an entity identity validity verification method and device with multiple trusted third parties being involved. In the application, validity of identities of entities performing mutual identity validity verification can only be verified by different trusted third parties. During the verification process, the trusted third parties that are respectively trusted by the two entities interact with each other, and provide services for mutual identity validity verification between the entities, to complete the identity validity verification between the entities.

First claim

The invention claimed is:

1. An entity identity validity verification method with a plurality of trusted third parties (TTPs) being involved, wherein the method involves an entity A, an entity B, a trusted third party TTP A and a trusted third party TTP B , the TTP A is capable of verifying validity of an identity of the entity A, the TTP B is capable of verifying validity of an identity of the entity B, the entity A trusts the TTP A , the entity B trusts the TTP B , and wherein the method comprises:
step 1) transmitting, by the entity B, a message 1 to the entity A, wherein the message 1 comprises identity information I B of the entity B, and a random number R B generated by the entity B;
step 2) transmitting, by the entity A, a message 2 to the trusted third party TTP A after the entity A receives the message 1 , wherein the message 2 comprises identity information I A of the entity A, a random number R A generated by the entity A, the identity information I B of the entity B, and the random number R B ;
step 3) after the trusted third party TTP A receives the message 2 transmitted by the entity A, verifying, by the trusted third party TTP A , the identity of the entity A based on I A , and transmitting, by the trusted third party TTP A , a message 3 to the trusted third party TTP B , wherein the message 3 comprises a random number R TPA generated by the TTP A and a token TokenTPAB, wherein TokenTPAB comprises Res A , I B , R B , and a first signature of the TTP A , wherein Res A is a verification result of verifying the entity A by the TTP A , and signature objects of the first signature of the TTP A comprise Res A , I B and R B ;
step 4) after the TTP B receives the message 3 transmitted by the TTP A , verifying, by the TTP B , the first signature of the TTP A in TokenTPAB; after the first signature of the TTP A passes the verification performed by the TTP B , verifying, by the TTP B , the identity of the entity B based on I B , and transmitting, by the TTP B , a message 4 to the TTP A , wherein the message 4 comprises a token TokenTPBA, wherein TokenTPBA comprises Res B , a first signature of the TTP B , and a second signature of the TTP B , wherein Res B is a verification result of verifying the entity B by the TTP B , signature objects of the first signature of the TTP B comprise Res A and R B , and signature objects of the second signature of the TTP B comprise R TPA and Res B ;
step 5) after the TTP A receives the message 4 transmitted by the TTP B , verifying, by the TTP A , the second signature of the TTP B in TokenTPBA; after the second signature of the TTP B passes the verification performed by the TTP A , checking, by the TTP A , whether R TPA acquired from the message 4 is the same as the random number R TPA in the message 3 transmitted by the TTP A to the TTP B ; if R TPA acquired from the message 4 is the same as the random number R TPA in the message 3 transmitted by the TTP A to the TTP B , constructing a message 5 and transmitting the message 5 to the entity A by the TTP A , wherein the message 5 comprises a token TokenTA, wherein TokenTA comprises Res A , Res B , a second signature of the TTP A , and the first signature of the TTP B , wherein signature objects of the second signature of the TTP A comprise Res B and R A ;
step 6) after the entity A receives the message 5 from the TTP A , verifying, by the entity A, the second signature of the TTP A in TokenTA; after the second signature of the TTP A passes the verification performed by the entity A, checking, by the entity A, whether R A acquired from the message 5 is the same as the random number R A in the message 2 transmitted by the entity A to the TTP A ; if the R A acquired from the message 5 is the same as the random number R A in the message 2 transmitted by the entity A to the TTP A , determining, by the entity A, the validity of the identity of the entity B based on the verification result Res B , and constructing a message 6 and transmitting the message 6 to the entity B by the entity A, wherein the message 6 comprises the first signature of the TTP B ; and
step 7) after the entity B receives the message 6 , verifying, by the entity B, the first signature of the TTP B ; after the first signature of the TTP B passes the verification performed by the entity B, checking, by the entity B, whether R B acquired from the message 6 is the same as the random number R B in the message 1 transmitted by the entity B to the entity A; if the R B acquired from the message 6 is the same as the random number R B in the message 1 transmitted by the entity B to the entity A, determining, by the entity B, the validity of the identity of the entity A based on the verification result Res A .

2. The entity identity validity verification method according to claim 1 , wherein the trusted third party TTP A verifying the identity of the entity A based on I A after the trusted third party TTP A receives the message 2 transmitted by the entity A in step 3) comprises:
in a case that I A is a distinguisher of the entity A, extracting, by the TTP A , a public key P A of the entity A, wherein Res A comprises P A ; and
in a case that I A is a certificate Cert A of the entity A, checking, by the TTP A , validity of the Cert A , wherein Res A comprises a validity state of Cert A ; wherein
if the TTP A is incapable of acquiring the public key or the validity of the certificate of the entity A, Res A comprises content indicating failed verification.

3. The entity identity validity verification method according to claim 2 , wherein R TPA in steps 3), 4) and 5) is replaced with R A .

4. The entity identity validity verification method according to claim 1 , wherein the trusted third party TTP B verifying the identity of the entity B based on I B after the trusted third party TTP B receives the message 3 transmitted by the TTP A in step 4) comprises:
in a case that I B is a distinguisher of the entity B, extracting, by the TTP B , a public key P B of the entity B, wherein Res B comprises P B ; and
in a case that I B is a certificate Cert B of the entity B, checking, by the TTP B , validity of the Cert B , wherein Res B comprises a validity state of Cert B ; wherein
if the TTP B is incapable of acquiring the public key or the validity of the certificate of the entity B, Res B comprises content indicating failed verification.

5. The entity identity validity verification method according to claim 4 , wherein R TPA in steps 3), 4) and 5) is replaced with R A .

6. The entity identity validity verification method according to claim 1 , wherein
the TTP A acquiring R TPA from the message 4 in step 5) comprises:
recovering, by the TTP A , R TPA directly from the second signature of the TTP B after the second signature of the TTP B passes verification performed by the TTP A , in a case that the TTP A is capable of recovering R TPA from the second signature of the TTP B when TTP A verifies the second signature of the TTP B ; and
acquiring, by the TTP A , R TPA directly from the message 4 comprising an R TPA field, in a case that the TTP A is incapable of recovering R TPA from the second signature of the TTP B when the TTP A verifies the second signature of the TTP B ;
the entity A acquiring R A from the message 5 in step 6) comprises:
recovering, by the entity A, R A directly from the second signature of the TTP A after the second signature of the TTP A passes verification performed by the entity A, in a case that the entity A is capable of recovering R A from the second signature of the TTP A when the entity A verifies the second signature of the TTP A ; and
acquiring, by the entity A, R A directly fr

Assignees

• China Iwncomm Co Ltd

Inventors

• Du Zhiqiang
• Zhang Bianling
• Li Qin
• Yan Xiang
• Zhang Guoqiang

Classifications

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L9/0869

  involving random numbers or seeds · CPC title

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title