RU2359416C2 - Secured channel with authentication - Google Patents

Abstract

FIELD: physics, computer engineering.

SUBSTANCE: invention is related to the field of cryptography, mainly, to protected channel with authentication, and in particular, for calculation of session keys for creation of such channels to protect digital content. For the purpose the first single-range device selects the first short-term session key x and calculates the first corresponding short-term open key g^x, which is sent to the second single-range device. The second single-range device calculates the second short-term open key g^y in similar manner and short-term key (K_ePh) for collective use, determines hash-value for g^y, K_eph, K_perm and its identifier, and sends g^y and hash-value to the first from single-range devices. The first single-range device calculates K_eph, verifies hash-value and determines hash-value for g^x, K_eph, K_perm and its identifier and sends it to the second single-range device so that it verifies this hash-value. Afterwards both single-range devices receive session key with the help of hash coding of K_eph. Devices may later use session key for establishment of protected channel with authentication (SAC).

EFFECT: increased cryptographic security of channel with authentication.

6 cl, 1 dwg

Description

FIELD OF TECHNOLOGY

The present invention relates generally to a secure channel with authentication, in particular for calculating session keys for creating such channels for protecting digital content, for example, in a digital television system.

BACKGROUND

Secure authentication channels, well known in the field of cryptography, are established to allow two mutual authentication devices (often called peer-to-peer) to communicate privately. A secure channel with authentication should preferably have the following characteristics:

- mutual authentication of peer devices;

- confirmation of the key, that is, a shared secret is established and at least one peer device is able to verify that the secret is indeed shared;

- prospective secrecy, that is, old session keys cannot be calculated even when long-term secret keys are known (for example, certificate secret keys).

These characteristics can be formally proved mathematically, and it is proved that if there is a way to circumvent one of the characteristics described above for a given cryptographic protocol, then the entire protocol can be cracked with relative ease.

Over the years, the cryptographic community has proposed many protocols for secure channels with authentication. It is proved that only some of these channels implement the characteristics described above.

All protocols that provide channels with the required characteristics use several different cryptographic basis elements: at least one asymmetric basis element (for example, asymmetric encryption or digital signature), hash functions, message authentication code (MAC) and some of them are other basic elements, for example, symmetric encryption. The problem with these protocols is that they consume resources to a large extent and, as such, are difficult to implement in a device with limited computing capabilities, for example, in a portable security module like a smart card. Another problem is that using multiple cryptographic basic elements makes it difficult to confirm that the protocol is secure.

The present invention provides a secure channel access protocol that has the required characteristics and which, in particular, is suitable for implementation in a device with limited computing capabilities.

Throughout the description, it is accepted that, since cryptography is a developed level of technology, its basic principles are well known. These principles, due to clarity and brevity, will not be described more than is necessary for understanding the invention.

SUMMARY OF THE INVENTION

In the first aspect, the invention is directed to a method for calculating a session key common to the first and second devices (11, 21). The first device has a certificate (C _a ) containing a public key (g ^a ) and its corresponding identifier (ID _a ), and information on its corresponding identifier (ID _a ), secret key (a) and public key (g ^a ). The second device has the appropriate certificate and information. The first device selects the first short-term secret key (x), calculates the first short-term public key (g ^x ), and sends its certificate (C _a ) and the first short-term public key (g ^x ) to the second device. Upon receipt of the certificate of the first device (C _a ) and the first short-term public key (g ^x ), the second device verifies the certificate of the first device (C _a ), selects the second short-term secret key (y), calculates the second short-term public key (g ^y ), and calculates the short-term key (K _eph) shared the first short-term public key (g ^x) and a second short-term private key (y), calculates the permanent key (K _perm) from the public key (g ^a) and the first device of its own secret cells ca (b), calculates a first value _{^{(H (g y, K eph}} , K _perm, ID _b)) from the second short-term public key (g ^y), the short-term key (K _eph) for collective use, short permanent key (K _perm) and the corresponding identifier (ID _b ), sends the first device its certificate (C _b ), the second short-term public key (g ^y ) and the first value (H (g ^y , K _eph , K _perm , ID _b )). Upon receipt of the certificate (C _b ) of the second device, the second short-term public key (g ^y ) and the first value (H (g ^y , K _eph , K _perm , ID _b )) from the second device, the first device verifies the certificate (C _b ) of the second device , computes a short-term public key (K _eph ) from the second short-term public key (g ^y ) and the first short-term secret key (x), calculates a permanent key (K _perm ) from the public key (g ^b ) of the second device and its own private key ( a) verifies the first value (H (g ^y , K _eph , K _{per m} , ID _b )), computes the second value (H (g ^x , K _eph , K _perm , ID _a )) from the first short-term public key (g ^x ), short-term public key (K _eph ), permanent key (K _perm ) and its corresponding identifier (ID _a ), sends the second value (H (g ^x , K _eph , K _perm , ID _a )) to the second device. When receiving the second value (H (g ^x , K _eph , K _perm , ID _a )), the second device verifies the second value (H (g ^x , K _eph , K _perm , ID _a )) and calculates the session key (K _sess ) as short-term key function (K _eph ) for collective use. The first device also calculates a session key (K _sess ) as a function of a short-term key (K _eph ) shared.

In a second aspect, the invention is directed to a first device (11) for participating with a second device (21) in calculating a session key. The first device has a certificate (C _a ) containing a public key (g ^a ) and its corresponding identifier (ID _a ), and information on its corresponding identifier (ID _a ), secret key (a) and public key (g ^a ). The first device comprises a processor (12) for selecting a short-term secret key (x); to calculate the first short-term public key (g ^x ); to send your certificate (C _a ) and the first short-term public key (g ^x ) to the second device; to receive the certificate (C _b ) of the second device, the second short-term public key (g ^y ) and the first value (H (g ^y , K _eph , K _perm , ID _b )) from the second device, while the certificate (C _b ) contains the public the key (g ^b ) and the identifier (ID _b ) of the second device, and the first value (H (g ^y , K _eph , K _perm , ID _b )) is calculated from the second short-term public key (g ^y ), short-term key (K _eph ) sharing and identifier (ID _b ) corresponding to the second device; to verify the certificate (C _b ) of the second device; for calculating a short-term key (K _eph ) for collective use from the second short-term public key (g ^y ) and short-term secret key (x); to calculate the permanent key (K _eph ) from the public key of the second device (g ^b ) and its own private key (a); to verify the first value (H (g ^y , K _eph , K _perm , ID _b )); to calculate the second value (H (g ^x , K _eph , K _perm , ID _a )) from the first short-term public key (g ^x ), the short-term key (K _eph ) for shared use, the permanent key (K _perm ) and the identifier (ID _a ); to send the second value (H (g ^x , K _eph , K _perm , ID _a )) to the second device and to calculate the session key (K _sess ) as a function of the short-term _shared key (K _eph ).

In a third aspect, the invention is directed to a second device (21) to participate with the first device (11) in calculating a session key. The second device has a certificate (C _b ) containing the public key (g ^b ) and its corresponding identifier (ID _b ), and the information of its corresponding identifier (ID _b ), secret key (b) and public key (g ^b ). The second device comprises a processor (22) for receiving the certificate (C _a ) of the first device and the first short-term public key (g ^x ), while the certificate (C _a ) contains the public key (g ^a ) and the identifier (ID _a ) of the first device; to verify the certificate (C _a ) of the first device; to select a short-term secret key (y); to calculate the second short-term public key (g ^y ); for calculating a short-term key (K _eph ) for collective use from the first short-term public key (g ^x ) and short-term secret key (y); to calculate the permanent key (K _perm ) from the public key (g ^a ) of the first device and its own private key (b); for calculating the first value (H (g ^y , K _eph , K _perm , ID _b )) from the second short-term public key (g ^y ), the short-term public key (K _eph ), the permanent key (K _perm ) and the corresponding identifier ( ID _b ); to send your certificate to the first device (C _b ), the second short-term public key (g ^y ) and the first value (H (g ^y , K _eph , K _perm , ID _b )); to receive the second value (H (g ^x , K _eph , K _perm , ID _a )) from the first device, the second value being calculated from the first short-term public key (g ^x ), the short-term public key (K _eph ), the permanent key ( K _perm ) and an identifier (ID _a ) corresponding to the first device; to verify the second value (H (g ^x , K _eph , K _perm , ID _a )); and for calculating a session key (K _sess ) as a function of a short-term key (K _eph ) shared.

BRIEF DESCRIPTION OF THE DRAWINGS

The drawing illustrates the exchange of session keys according to a variant implementation of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT

Before starting the method, the first device 11 knows its identifier ID _a , its own private key and public key g ^a . The public key g ^a is a short entry for g ^a mod p, as is well known in the art, where a is the secret key of the first device, g is a known generator and p is a known prime number. The second device 21 has relevant information: ID _b , b, g ^b . Certificates for devices contain the public key and identifier: C _a (g ^a , ID _a ) and C _b (g ^b , ID _b ), respectively. The devices 11, 12 also have processors (CPUs) 12, 22 adapted to carry out the steps of the method.

In step 252, the first device 11 selects, preferably randomly, the first short-term secret key x and calculates the short-term public key g ^x , which it sends with its certificate C _a (g ^a , ID _a ) to the second device 21 in message 254.

Upon receipt of message 254 in step 256, the second device 21 verifies the certificate C _a (g ^a , ID _a ) of the first device 11. If the verification is unsuccessful, then the second device stops the method. However, if the verification is successful, then at step 258, the second device selects, preferably randomly, the second short-term secret key y and calculates the second short-term public key g ^y , the short-term public key K _eph = g ^xy and the constant key K _perm = g ^ab Diffie-Hellman .

In step 260, the second device 21 then calculates the first hash value H (g ^y , K _eph , K _perm , ID _b ) using the second short-term public key g ^y , the short-term public key K _eph , the constant key _{D perm} Diffie-Hellman and own identifier ID _b and a suitable hash function, for example, one of many functions known in the art. It is understood that other available functions, in addition to hash functions, can be used for this and subsequent calculations of the hash value according to an embodiment. The second device 21 then sends the second short-term public key g ^y , its certificate C _b (g ^b , ID _b ) and the first hash value H (g ^y , K _eph , K _perm , ID _b ) to the first device 11 in message 262.

Upon receipt of message 262 in step 264, the first device 11 verifies the certificate C _b (g ^b , ID _b ) of the second device 21. If verification is unsuccessful, then the first device 11 stops the method. However, if the verification is successful, then the first device 11 at step 266 calculates a short-term _shared key K _eph and a constant key K _perm Diffie-Hellman. In step 268, the first device 11 verifies the first hash value using the same hash function that the second device used in step 260. If the first hash value is not verified, then the first device stops the method, but if the first hash value is verified, then the first device 11 calculates the second hash value H (g ^x , K _eph , K _perm , ID _a ) in step 270 using the first short-term public key g ^x , the short-term public key K _eph , the constant key _{D perm} Diffie-Hellman and own identifier ID _a . The first device 11 sends a second hash value H (g ^x , K _eph , K _perm , ID _a ) to the second device 21 in message 272.

Upon receipt of message 272, the second device 21 in step 274 verifies the second hash value of H (g ^x , K _eph , K _perm , ID _a ) using the same hash function that the first device used in step 270. If the second hash the value is not verified, the second device 21 terminates the protocol, but if the second hash value is verified, the second device 21 calculates at step 276 the session key K _sess by calculating the hash value of the short-term _shared key K _eph . It then sends a 278 "ready" message to the first device 11 to indicate that the second hash value H (g ^x , K _eph , K _perm , ID _a ) has been verified successfully and the session key K _{sess has been} calculated.

Upon receipt of the Ready message 278 from the second device 21, the first device 11 calculates in step 280 the same session key K _sess by calculating the hash value of the short-term _shared key K _eph using the same hash function that the second device 21 used at step 276. Then, the first device 11 sends a ready message 282 to the second device 21 to indicate that it has also calculated the session key K _sess .

At this moment, both the first device 11 and the second device 21 have a session key K _sess , which can be used to protect information sent between them. The protocol of the invention guarantees confidentiality of secret keys, and authentication and key confirmation are mutual. Moreover, promising secrecy and stability against leakage of the previous session key are also guaranteed. One skilled in the art will understand that the three hash functions described in connection with steps 212, 220, and 226 may be different, the same, or two of them the same, and the third excellent.

It is clear that where references to random numbers are given in the description, these numbers are often pseudo-random in practice.

The expression “security module” covers any type of security module, portable or stationary, that contains a processor and can be used to establish a secure channel with authentication according to the invention, for example smart cards, PC cards (formerly known as PCMCIA cards) and integrated circuits soldered to the circuit board of a device such as a television.

The described embodiment is particularly suitable for implementation in a digital television and protection module. However, one skilled in the art will understand that the invention can be practiced and used by any kind of device with the necessary resources, i.e. a processor, and preferably a memory, storing the necessary information. Non-limiting examples of other devices are DVD players, computers that interact with external devices, ATMs and bank cards.

Claims (6)

1. A method of calculating a session key common to the first and second device (11, 21), wherein the first device has a certificate (C _a ) containing the public key (g ^a ) and its corresponding identifier (ID _a ) and information of the corresponding identifier (ID _a ), private key (a) and public key (g ^a ), the second device has a certificate (C _b ) containing the public key (g ^b ) and its corresponding identifier (ID _b ), and information on its corresponding identifier (ID _b ) the private key (b) and the public key (g ^b ),
The method contains steps in which:
in the first device:
selecting a first short-term secret key (x);
calculating a first short-term public key (g ^x );
send their certificate (C _a ) and the first short-term public key (g ^x ) to the second device;
in the second device:
accept the certificate of the first device (C _a ) and the first short-term public key (g ^x );
verify the certificate (C _a ) of the first device;
choose a second short-term secret key (y);
calculating a second short-term public key (g ^y );
calculating a short-term key (K _eph ) for collective use from the first short-term public key (g ^x ) and the second short-term secret key (y);
calculating a constant key (K _perm ) from the public key (g ^a ) of the first device and its own private key (b);
calculate the first value (H (g ^y , K _eph , K _perm , ID _b )) from the second short-term public key (g ^y ), the short-term public key (K _eph ), the permanent key (K _perm ) and the corresponding identifier (ID _b );
send the first device a certificate (C _b ) of the second device, the second short-term public key (g ^y ) and the first value (H (g ^y , K _eph , K _perm , ID _b ));
in the first device:
receive a certificate (C _b ) of the second device, a second short-term public key (g ^y ) and a first value (H (g ^y , K _eph , K _perm , ID _b )) from the second device;
verify the certificate (C _b ) of the second device;
calculating a short-term key (K _eph ) for collective use from the second short-term public key (g ^y ) and the first short-term secret key (x);
calculating a constant key (K _perm ) from the public key (g ^b ) of the first device and its own private key (a);
verify the first value (H (g ^y , K _eph , K _perm , ID _b ));
calculate the second value (H (g ^x , K _eph , K _perm , ID _a )) from the first short-term public key (g ^x ), the short-term public key (K _eph ), the permanent key (K _perm ) and the corresponding identifier (ID _a );
sending a second value (H (g ^x , K _eph , K _perm , ID _a )) to the second device;
in the second device:
take a second value (H (g ^x , K _eph , K _perm , ID _a ));
verify the second value (H (g ^x , K _eph , K _perm , ID _a )); and
calculating a session key (K _sess ) as a function of a short-term key (K _eph ) for shared use; and
in the first device:
compute the session key (K _sess ) as a function of the short-term key (K _eph ) shared. 2. The first device (11) to participate with the second device (21) in calculating the shared session key, the first device having a certificate (C _a ) containing the public key (g ^a ) and its corresponding identifier (ID _a ), and information its corresponding identifier (ID _a ), secret key (a) and public key (g ^a ),
wherein the first device comprises a processor (12) for:
selecting a short-term secret key (x);
computing the first short-term public key (g ^x );
sending your certificate (C _a ) and the first short-term public key (g ^x ) to the second device;
receiving the certificate (C _b ) of the second device, the second short-term public key (g ^y ) and the first value (H (g ^y , K _eph , K _perm , ID _b )) from the second device, the certificate (C _b ) containing the public key ( g ^b ) and the identifier (ID _b ) of the second device and the first value (H (g ^y , K _eph , K _perm , ID _b )) are calculated from the second short-term public key (g ^y ), the short-term public key (K _eph ) , a permanent key (K _perm ) and an identifier (ID _b ) corresponding to the second device;
verification of the certificate (C _b ) of the second device;
computing a short-term key (K _eph ) for collective use from a second short-term public key (g ^y ) and a short-term secret key (x);
computing a constant key (K _perm ) from the public key of the second device
(g ^b ) and its own private key (a);
verification of the first value (H (g ^y , K _eph , K _perm , ID _b ));
computing the second value (H (g ^x , K _eph , K _perm , ID _a )) from the first short-term public key (g ^x ), the short-term public key (K _eph ), the permanent key (K _perm ), and the corresponding identifier (ID _a );
sending a second value (H (g ^x , K _eph , K _perm , ID _a )) to the second device; and
computing a session key (K _sess ) as a function of a short-term key (K _eph ) shared. 3. The second device (21) for participating with the first device (11) in calculating the shared session key, the second device having a certificate (C _b ) containing the public key (g ^b ) and its corresponding identifier (ID _b ), and information of the corresponding identifier (ID _b ), secret key (b) and public key (g ^b ),
wherein the second device comprises a processor (22) for:
receiving a certificate (C _a ) of the first device and the first short-term public key (g ^x ), the certificate (C _a ) containing the public key (g ^a ) and identifier (ID _a ) of the first device;
verification of the certificate (C _a ) of the first device;
selection of a short-term secret key (y);
computing a second short-term public key (g ^y );
computing a short-term key (K _eph ) of collective use from the first short-term public key (g ^x ) and short-term secret key (y);
computing a permanent key (K _perm ) from the public key (g ^a ) and your own private key (b);
computing the first value (H (g ^y , K _eph , K _perm , ID _b )) from the second short-term public key (g ^y ), the short-term public key (K _eph ), the permanent key (K _perm ), and the corresponding identifier (ID _b );
sending the first device its certificate (C _b ), the second short-term public key (g ^y ) and the first value (H (g ^y , K _eph , K _perm , ID _b ));
receiving a second value (H (g ^x , K _eph , K _perm , ID _a )) from the first device, the second value being calculated from the first short-term public key (g ^x ), the short-term public key (K _eph ), the permanent key
(K _perm ) and an identifier (ID _a ) corresponding to the first device;
verification of the second value (H (g ^x , K _eph , K _perm , ID _a )); and
computing a session key (K _sess ) as a function of a short-term key (K _eph ) shared. 4. The first device (11), adapted to verify the hash value, the first device having a certificate (C _a ) containing the public key (g ^a ) and its corresponding identifier (ID _a ), and information on its corresponding identifier (ID _a ) , private key (a) and public key (g ^a ),
wherein the first device comprises a processor (12) for:
selecting a short-term secret key (x);
computing the first short-term public key (g ^x );
sending your certificate (C _a ) and the first short-term public key
(g ^x ) a second device;
receiving the certificate (C _b ) of the second device, the second short-term public key (g ^y ) and the first hash value (H (g ^y , K _eph , K _perm , ID _b )) from the second device, the certificate (C _b ) containing public key (g ^b ) and identifier
(ID _b ) of the second device, and the first hash value (H (g ^y , K _eph , K _perm , ID _b )) is calculated from the second short-term public key (g ^y ), the short-term public key (K _eph ), the permanent key (K _perm ) and an identifier (ID _b ) corresponding to the second device;
verification of the certificate (C _b ) of the second device;
computing a short-term key (K _eph ) for collective use from a second short-term public key (g ^y ) and a short-term secret key (x);
computing a constant key (K _perm ) from the public key of the first device
(g ^b ) and its own private key (a); and
verification of the first hash value (H (g ^y , K _eph , K _perm , ID _b )). 5. The first device according to claim 4, in which the processor is additionally designed for:
computing a second hash value (H (g ^x , K _eph , K _perm , ID _a )) from the first short-term public key (g ^x ), the short-term public key (K _eph ), the permanent key (K _perm ), and the corresponding identifier (ID _a );
sending a second hash value (H (g ^x , K _eph , K _perm , ID _a )) to the second device. 6. A second device (21) adapted to verify the hash value, the second device having a certificate (C _b ) containing the public key (g ^b ) and its corresponding identifier (ID _b ), and information on its corresponding identifier (ID _b ) , private key (b) and public key (g ^b ),
wherein the second device comprises a processor (22) for:
receiving a certificate (C _a ) of the first device and the first short-term public key (g ^x ), the certificate (C _a ) containing the public key (g ^a ) and identifier (ID _a ) of the first device;
verification of the certificate (C _a ) of the first device;
selection of a short-term secret key (y);
computing a second short-term public key (g ^y );
computing a short-term key (K _eph ) of collective use from the first short-term public key (g ^x ) and short-term secret key (y);
computing a permanent key (K _perm ) from the public key (g ^a ) of the first device and its own private key (b);
computing the first hash value (H (g ^y , K _eph , K _perm , ID _b )) from the second short-term public key (g ^y ), the short-term public key (K _eph ), the permanent key (K _perm ), and the corresponding identifier (ID _b );
sending the first device its certificate (C _b ), the second short-term public key (g ^y ) and the first hash value (H (g ^y , K _eph , K _perm , ID _b ));
receiving a second hash value (H (g ^x , K _eph , K _perm , ID _a )) from the first device, the second value being calculated from the first short-term public key (g ^x ), the short-term public key (K _eph ), the permanent key (K _perrn ) and an identifier (ID _a ) corresponding to the first device; and
verification of the second hash value (H (g ^x , K _eph , K _perm , ID _a )).