Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/321—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving a third party or a trusted authority
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3236—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using cryptographic hash functions
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
  • H04L2209/80—Wireless

Definitions

• the present invention relates to telecommunication.
• the present invention concerns a new type of method for creating a global unambiguous identifier for predetermined data structures.
• the invention relates to concentrated and reliable storage of identifiers.
• Encryption is used to prevent transmitted information from getting into the wrong hands in a plain language form.
• the public and private key method is a means used to achieve this end.
• the public keys of private persons are often only locally known to other people, and finding out the keys requires a considerable deal of work.
• the availability of public key pairs must be simple and feasible in hardware- independent environments. These factors make it possible for encryption and signature by the public and private key method to meet the objective aimed at - simplicity and efficiency.
• the problem at present is the management of key pairs. As queries for keys may have to be made globally in any part of the network, using local data- bases is difficult or almost impossible. Likewise, the key pair has to be provided with unambiguous data allowing the key pair to be associated with the holder of the key. This is another problem which has not yet been properly solved.
• the object of the present invention is to eliminate the drawbacks referred to above or at least to significantly alleviate them.
• a specific object of the invention is to dis- close a new type of method whereby the management of encryption keys is converted from a distributed system into a centralized one.
• a further object of the invention is to disclose a method in which an unambiguous hash code is generated from each key comprised in an encryption procedure and from the juridical person associated with the key. This hash code functions as an identifier by means of which the key pair and the key holder are associated with each other.
• the method of the invention relates to the creation of a global unambiguous identifier for prede- termined data structures and to the storage of the identifiers created.
• a juridical name is added to encryption keys, preferably to a public encryption and signing key.
• a hash code is generated by a function appropriate for the purpose, e.g. a hash function.
• a function appropriate for the purpose e.g. a hash function.
• One of such functions is the MD5 (MD, Message Digest) .
• MD5 MD, Message Digest
• the hash function works in a way that makes it impossible to deduce from the result the starting values used to generate the hash code.
• the hash code created works as a reference pointer pointing to the data from which it has been generated. In other words, if a hash code created from information representing a given person is known, then, based on the hash code, it will be possible to unambiguously determine the public keys in use and the juridical person behind the keys.
• the hash code produced by the hash function may be very long, it is possible to use a given part of the hash code, e.g. the last five bytes, to identify a desired party. Five bytes is sufficient to cover over 1000 billion different identifiers.
• the hash codes created and the public information from which the hash code has been generated are placed in the custody of a trusted third party (TTP) .
• TTP trusted third party
• the hash code of the present invention can be used e.g. as a part of an encrypted short message in a mobile communication system. This part unambiguously tells the receiver of the message whose public keys are needed to decrypt the message.
• the present invention provides the advantage that the authenticity of information received is recognized locally.
• the invention does not restrict the structure of the pointer record in any way.
• Another advantage of the invention is that the unambiguous hash code created constitutes a kind of "fist" by means of which the receiver can easily ascertain who is the sender and which keys are needed to decrypt the information received. LIST OF ILLUSTRATIONS
• FIG. 1 illustrates a preferred method according to the invention for creating an unambiguous identifier
• Fig. 2 represents the registration of an identifier according to Fig. 1.
• Fig. 1 presents an example illustrating the creation of an identifier, e.g. a net identification.
• encryption is implemented using the public and private key method.
• the method illustrated in Fig. 1 is designed to create an unambiguous identi- fier for associating a key pair with the holder of the keys.
• the identifier is created from a public key pair and the juridical name of the holder of the key pair. 'Juridical name' refers to the person who has the right to use the encryption keys.
• the procedure of creating an identifier is started by first creating a secret and a public encryption key.
• the identifiers created are recorded by means of a running counter, which is at first reset to zero (3) .
• the juridical name (4) is associated with the (public) keys created. From the public keys, counter and juridical name, a hash code (5) is generated.
• the hash code is produced e.g. using the MD5 function (MD, Message Digest) . This is a one-way function, which means that the starting values used to generate the hash code can not be deduced from this function.
• Part of the hash code e.g. the last five bytes of the hash code, may be used as a reference to the juridical name .
• a check is performed to establish whether the reference number obtained is already in use (6) .
• the counter value is incremented by one if the identifier is already in use (7) . Incrementing the counter has the effect that the identifier to be generated next will differ somewhat from the previous identifier attempted. If at this point the counter value exceeds an allowed limit (11), e.g. 2 32 , then the creation of the identifier is started again from the beginning .
• the reference number just created is reserved in a reference index (8).
• the reference index is maintained e.g. by a trusted third party. If for some reason the attempt to reserve (9) the reference number failed, then the counter value is incremented by one (7) and action is resumed at step 5 if the counter did not exceed a maximum allowed value. If the maximum value was ex- ceeded (11) , then the creation of the identifier is started from the beginning.
• X5 index means a database of juridical persons, maintained by a trusted third party.
• the reference index reference pointer is set to contain a pointer to the juridical person in the X5 index.
• Fig. 2 illustrates a situation where an iden- tifier thus created is to be registered.
• 'Card issuer' means e.g. an operator or card manufacturer.
• 'card' means a subscriber identity module (SIM) as used in mobile stations.
• the card issuer (CI) sends a request for the registration of an iden- tifier to a certificate authority (CA) (21) .
• the CA is a so-called trusted third party, which functions as an independent party and is in no way linked with the parties using it.
• In the custody of or available to the CA is a NIDS (Net ID Server) .
• the CA sends to the NIDS a request for making a reservation (22) .
• the NIDS checks whether the same identifier is already in use. If the identifier is not in use, then the NIDS will send the CA information confirming successful reservation (23) .
• the CA sends a confirmation (24) of successful registration to the card issuer.
• the card issuer may also verify himself whether a given identifier is already in use or check whether a given identifier was successfully reserved. To carry out a verification, the CI sends to the NIDS a request to check a given NID (25) . As a result, the NIDS sends the card issuer an answer to the inquiry (26) .

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Storage Device Security (AREA)
• Mobile Radio Communication Systems (AREA)

Applications Claiming Priority (3)

Publications (1)

Family

ID=8553826

Family Applications (1)

Country Status (5)

Family Cites Families (3)

• 1999
  • 1999-02-17 FI FI990336A patent/FI990336A/fi unknown
• 2000
  • 2000-02-17 WO PCT/FI2000/000124 patent/WO2000049767A1/en not_active Application Discontinuation
  • 2000-02-17 EP EP00905104A patent/EP1157501A1/en not_active Withdrawn
  • 2000-02-17 CA CA002363655A patent/CA2363655A1/en not_active Abandoned
  • 2000-02-17 AU AU26754/00A patent/AU2675400A/en not_active Abandoned

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events