Mutual secure communications

Patent metadata

Field	Value
Publication number	US-11457010-B2
Application number	US-201916376162-A
Country	US
Kind code	B2
Filing date	Apr 5, 2019
Priority date	Apr 5, 2019
Publication date	Sep 27, 2022
Grant date	Sep 27, 2022

Abstract

A sending device may send data intended for a target device. An intermediate device may intercept the data sent from the sending device and forward the communications to the target device. Security data (e.g., a security certificate for authentication) along with an encrypted version of the security data may be sent at the application layer such that it passes from the sending device, through the intermediate device, and to the target device without being analyzed or modified by the intermediate device. The target device may use the encrypted security data and the security data to verify the identity of the sending device.

First claim

The invention claimed is:

1. A method comprising:
determining, by a sending device, a target device for receipt of data;
determining, by the sending device, certificate data associated with the sending device;
encrypting the certificate data, using a public key associated with the target device, to generate encrypted certificate data that comprises an encrypted version of the certificate data;
generating, by the sending device, request data comprising:
the certificate data; and
the encrypted certificate data comprising the encrypted version of the certificate data;

sending, by the sending device, the request data; and
establishing, based on the request data, a secure communication channel.

2. The method of claim 1 , wherein the generating the request data further comprises:
generating a nonce;
generating a timestamp;
generating an indication of a type of the certificate data; and
including the nonce, the timestamp, and the indication of the type in the request data.

3. The method of claim 1 , further comprising encrypting the request data using a private key associated with the sending device.

4. The method of claim 1 , wherein the request data is included in a header of a message.

5. The method of claim 1 , further comprising receiving, by the sending device and from a certificate authority, the certificate data.

6. The method of claim 1 , further comprising encoding, by the sending device and using a Base64 encoding, the request data.

7. The method of claim 1 , wherein the establishing, based on the request data, the secure communication channel further comprises:
sending, by the sending device and to an intermediate device, a request message; and
receiving, by the sending device and from the intermediate device, a response message.

8. The method of claim 1 , wherein the establishing, based on the request data, the secure communication channel further comprises:
receiving, by the sending device, a message from an intermediate device, the message indicating at least one of a chosen protocol version, a random number, cipher suite, a compression method, a session identifier, a public key associated with the intermediate device, or the public key associated with the target device.

9. The method of claim 1 , further comprising sending, by the sending device, to the target device, and via an intermediate device, data that is encrypted by the sending device, wherein the sending device and the target device are managed by a first service provider, and the intermediate device is managed by a second service provider.

10. The method of claim 9 , wherein the intermediate device is an endpoint of the secure communication channel established between the sending device and the target device.

11. A method comprising:
receiving, by a target device and from an intermediate device, request data comprising:
certificate data associated with a sending device; and
encrypted certificate data comprising an encrypted version of the certificate data;

decrypting the encrypted certificate data using a private key associated with the target device to obtain decrypted certificate data;
validating the request data based on the decrypted certificate data and the certificate data; and
verifying an identity of the sending device based on the certificate data.

12. The method of claim 11 , further comprising decrypting the request data using a public key associated with the sending device.

13. The method of claim 11 , further comprising decoding, by the target device and using a Base64 decoding, the request data.

14. The method of claim 11 , wherein the validating the request data further comprises:
comparing, by the target device, a timestamp indicated in the request data to a current time maintained by the target device; and
validating the request data based on the current time being within a threshold period of the timestamp.

15. The method of claim 11 , wherein the validating the request data further comprises:
comparing, by the target device:
a nonce value indicated in the request data; and
a database of previously received nonce values.

16. The method of claim 11 , wherein the verifying the identity of the sending device further comprises:
sending, by the target device and to a certificate authority, the certificate data; and
receiving, by the target device and from the certificate authority, validated certificate data.

17. The method of claim 16 , wherein the validating the request data further comprises:
decoding a digital signature based on the validated certificate data.

18. A method comprising:
determining, by a sending device, an encrypted digital signature based on certificate data associated with the sending device;
generating, by the sending device, request data comprising the encrypted digital signature;
establishing a secure communication channel between the sending device and an intermediate device, wherein the secure communication channel comprises a HyperText Transfer Protocol (HTTP) session encrypted using Transport Layer Security (TLS);
sending, by the sending device, to the intermediate device, and via the secure communication channel, the request data;
receiving, by a target device and from the intermediate device, the request data;
decrypting, by the target device, the encrypted digital signature to extract the certificate data;
validating the certificate data; and
validating the request data based on the validated certificate data.

19. The method of claim 18 , wherein the determining the encrypted digital signature further comprises:
using a private key associated with the sending device.

Assignees

• Comcast Cable Comm Llc

Inventors

• Haque Asad
• Douglas Ahmad
• Altamimi Ahmad
• Long Liesheng

Classifications

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L9/3297

  involving time stamps, e.g. generation of time stamps · CPC title

• H04L9/321

  involving a third party or a trusted authority · CPC title

• H04L2463/062

  applying encryption of the keys · CPC title