System and method for obtaining a common session key between devices

Patent metadata

Field	Value
Publication number	US-11044081-B2
Application number	US-201916258109-A
Country	US
Kind code	B2
Filing date	Jan 25, 2019
Priority date	Jul 26, 2016
Publication date	Jun 22, 2021
Grant date	Jun 22, 2021

Abstract

This document describes a system and method for generating a common session key for encoding digital communications between devices. In particular, the system allows two devices to verify the veracity of each device before these authenticated devices proceed to generate a common session key that is then utilized to encode digital communications between these two devices.

First claim

What is claimed is:

1. A method of generating a common session key SK ij for encoding digital communications between a first entity and a second entity, comprising:
generating, by a secure server, a private key sk i for the first entity, wherein the private key sk i comprises a Discrete-Logarithm type digital signature [R i , s i ], of an identity of the first entity id i , and generating, by the secure server, a private key sk i for the second entity wherein the private key sk i comprises a Discrete-Logarithm type digital signature [R j , s j ], of an identity of the second entity id j , wherein R i and R j are group elements, and s i and s j comprise integers modulo q, whereby q is a prime number, wherein the private key sk i is communicated to the first entity and the private key sk i is communicated to the second entity;
sharing, by the first entity, a cryptographic nonce N i , the identity of the first entity id i , and R i with the second entity;
calculating, by the second entity, an implicitly shared secret k ji using the shared R i , and providing the implicitly shared secret k ji , the cryptographic nonce N i , and a cryptographic nonce N j to an Authentication Data Deriving Function to generate an authentication data Ad j ;
sharing, by the second entity, the cryptographic nonce N j , the identity of the second entity id j , R j , and the authentication data Ad j with the first entity; and
calculating, by the first entity, an implicitly shared secret k ij using the shared R j and verifying the authentication data Ad j using the implicitly shared secret k ij , the cryptographic nonce N i , and the cryptographic nonce N j , wherein if the authentication data Ad j is verified, generating the common session key SK ij by providing the implicitly shared secret k ij , the cryptographic nonce N i , the cryptographic nonce N j , the identity of the first entity id i and the identity of the second entity id j to a Key Deriving Function.

2. The method according to claim 1 further comprising:
providing, by the first entity, the implicitly shared secret k ij , the cryptographic nonce N i , and the cryptographic nonce N j to the Authentication Data Deriving Function to generate an authentication data Ad i , and communicating the authentication data Ad i to the second entity; and
verifying, by the second entity, the authentication data Ad i using the implicitly shared secret k ji , wherein if the authentication data Ad i is verified, providing the implicitly shared secret k ji , the cryptographic nonce N i , the cryptographic nonce N j , the identity of the first entity id i and the identity of the second entity id j to the Key Deriving Function to generate the common session key SK ij .

3. The method according to claim 1 , wherein the generation of the authentication data Ad j further comprises providing the identity of the first entity id i and the identity of the second entity id j to the Authentication Data Deriving Function.

4. The method according to claim 2 , wherein the generation of the authentication data Ad i further comprises providing the identity of the first entity id i and the identity of the second entity id j to the Authentication Data Deriving Function.

5. The method according to claim 1 , wherein the verifying the authentication data Ad j comprises:
providing the implicitly shared secret k ij , the cryptographic nonce N i , and the cryptographic nonce N j to the Authentication Data Deriving Function to obtain a result, and determining if the result matches with authentication data Ad j , wherein if a match is found, verifying the authentication data Ad j .

6. The method according to claim 2 , wherein the verifying the authentication data Ad i comprises:
providing the implicitly shared secret k ji , the cryptographic nonce N i , and the cryptographic nonce N j to the Authentication Data Deriving Function to obtain a result, and determining if the result matches with the authentication data Ad i , wherein if a match is found, verifying the authentication data Ad i .

7. The method according to claim 1 , wherein the cryptographic nonce N i comprises g a where a is a random number and wherein g is a generator of a cyclic group G.

8. The method according to claim 1 , wherein the cryptographic nonce N j comprises g b where b is a random number and wherein g is a generator of a cyclic group G.

9. The method according to claim 1 , wherein the private key sk i is a Schnorr signature of the identity of the first entity, id i , wherein R i =g r i , and s i =r i +xH(R i , id i ) (modulo q), and wherein the private key sk j is a Schnorr signature of the identity of the second entity, id j , wherein R j =g r j and s j =r j +xH(R j , id j ) (modulo q), where r i and r j are random numbers, x is a master secret key, and H( ) is a collision-resistant hash function, and
wherein the implicitly shared secret k ji =g si·sj , and the implicitly shared secret k ij =g sj·si , wherein g is a generator of a cyclic group G.

10. The method according to claim 1 , wherein the private key sk i is a first variant of an El Gamal signature of the identity of the first entity id i , wherein R i =g r i , and s i =x −1 ·(H(id i )−r i ·R i ) (modulo q), and wherein the private key sk j is a first variant of an El Gamal signature of the identity of the second entity id j , wherein R j =g r j and s j =x −1 ·(H(id j )−r j ·R j ) (modulo q), where r i and r j are random numbers, x is a master secret key, H( ) is a collision-resistant hash function and,
wherein the implicitly shared secret k ji =y si·sj , and the implicitly shared secret k ij =y sj·si , wherein y=g x is master public key, and wherein g is a generator of a cyclic group G.

11. The method according to claim 1 , wherein the private key sk i is a second variant of an El Gamal signature of the identity of the first entity id i , wherein R i =g r i , and s i =xR i +r i ·(H(id i ) (modulo q), and wherein the private key sk j is a second variant of an El Gamal signature of the identity of the second entity id j , wherein R j =g r j and s j =xR j +r j ·(H(id j ) (modulo q), wherein r i and r j are random numbers, x is a master secret key, and H( ) is a collision-resistant hash function, and
wherein the implicitly shared secret k ji =g si·sj , and the implicitly shared secret k ij =g sj·si , and wherein g is a generator of a cyclic group G.

12. The method according to claim 1 , wherein the private key sk i is a third variant of an El Gamal signature of the identity of the first entity id i , wherein R i =g r i , and s i =x·(H(id i )+r i ·R i (modulo q), and wherein the private key sk j is a third variant of an El Gamal signature of the identity of the second entity id j , wherein R j =g r j and s j =x·(H(id j )+r j ·R j (modulo q), wherein r i and r j are random numbers, x is a master secret key, and H( ) is a collision-resistant hash function, and
wherein the implicitly shared secret k ji =g si·sj , and the implicitly shared secret k ij =g sj·si , and wherein g is a generator of a cyclic group G.

13. The method according to claim 1 , wherein the private key sk i is a fourth variant of an El Gamal signature of the identity of the first entity id i , wherein R i =g r i , and s i =x −1 ·(R i −r i ·(H(id i )) (modulo q), and wherein the private key sk j is a fourth variant of an El Gamal signature of the identity of the second entity id j , wherein R j =g r j and s j =x −1 ·(R j −r j ·(H(id j )) (modulo q), where r i and r j are random numbers, x is a master secret key, and H( ) is a collision-resistan

Assignees

• Huawei Int Pte Ltd

Inventors

• Yang Yanjiang
• Shi Jie
• Wang Guilin

Classifications

• H04L9/0866

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title

• H04L9/0869

  involving random numbers or seeds · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L9/0841 Primary

  involving Diffie-Hellman or related key agreement protocols · CPC title