RU2408991C2 - Protection of confidentiality in communication system - Google Patents

Abstract

FIELD: information technologies.

SUBSTANCE: user generates identifier of secondary key on the basis of secondary key and the first variable of session related to the first session, and sends identifier of secondary key to application, generates traffic key related to specified identifier of secondary key and executes safe communication with specified application with the help of specified traffic key during the first session. At the same time the second variable of session is matched with the specified application for communication during subsequent second session.

EFFECT: improved confidentiality of user in communication system.

33 cl, 3 dwg

Description

Priority Statement 35 U.S.C. §119

This patent application claims priority in provisional application No. 60 / 758,971, filed January 13, 2006, and provisional application No. 60 / 762,771, filed January 27, 2006, both of which are assigned to the assignee of this application, and the full disclosures of which, therefore, incorporated by reference in this document.

FIELD OF THE INVENTION

The present invention generally relates to communication, and more particularly to protecting user privacy in communication systems.

State of the art

Since modern devices have the ability to communicate with arbitrary application servers, there is a need to authenticate and secure such communications. On systems with an asymmetric or public key, a device (or “user”) can present the public key to the application server (or “application”), while a separate private key is kept confidential. On systems with a shared or symmetric key, the user can communicate with the application using a user identity, which may be “anonymous” in that the user identity may not reveal who the user actually is. Upon receiving this user identity, the application can then retrieve the key associated with this user identity to enter into encrypted communication with the user. The key can be known in advance by the application, or it can be obtained from a key server, for example, a third party that is trusted by both the user and the application.

There are specific ways in which user privacy may be compromised on these systems, even when a “anonymous” user identity is used. For example, if a user exchanges the same user identity with an application in multiple sessions, the application can display private user information by linking the user sessions to each other. This is called a "bind attack". For example, in a wireless network, using a single identity to access multiple base stations can lead to user tracking on the network. Alternatively, if a user accesses several different applications using the same user identity, then a third party can determine which applications the user has accessed and when the user has accessed them by passively listening to the transfer of the user identity between the application and the key server. This potentially reveals private information about user preferences. The same information may be obtained by a third party directly requesting the accessed applications.

Disclosure of invention

One aspect of the present invention is a method for protecting user privacy, comprising generating a secondary identity associated with the user based on a key and at least one parameter comprising a session variable; and sending said secondary identity to the application.

Another aspect of the present invention provides a method of protecting user privacy during communication in a system having a key server, said method comprising receiving from the user a secondary identity generated from a key and at least one parameter containing a session variable; transmitting said secondary identity to said key server; and receiving, from said server, keys of information related to said user.

Another aspect of the present invention provides a method for protecting user privacy, comprising: receiving from the user a secondary key identity generated from a key and at least one parameter comprising a session variable; and identifying said key from said secondary key identity.

Another aspect of the present invention provides a method of protecting user privacy during communication in a system having a key server, said method comprising receiving from a requesting application a secondary identity generated from a key and at least one parameter containing a session variable; and identifying said user from said secondary identity.

Another aspect of the present invention provides a device for protecting user privacy, comprising: a secondary identity generator for generating a secondary identity associated with the user based on a key and at least one parameter comprising a session variable; a transmitter for sending said secondary identity to the application.

Another aspect of the present invention provides a device for protecting user privacy during communication in a system having a key server, said device comprising a receiver for receiving from a user a secondary identity generated from a key and at least one parameter containing a session variable; and a transmitter for transmitting said secondary user identity to said key server.

Another aspect of the present invention provides a device for protecting user privacy, comprising: a receiver for receiving from a user a secondary key identity generated from a key and at least one parameter comprising a session variable; a processor for identifying said key from said secondary key identity.

Another aspect of the present invention provides a device for protecting user privacy during communication in a system having a key server, said device comprising a receiver for receiving from a requesting application a secondary identity generated from a key and at least one parameter containing a session variable; and a processor for identifying said user from said secondary identity.

Another aspect of the present invention provides an apparatus for protecting user privacy during communication with an application, said apparatus comprising means for generating a secondary identity; means for sending said secondary identity to the application.

Another aspect of the present invention provides a device for protecting user privacy during communication in a system having a key server, said device comprising a receiver for receiving from a requesting application a secondary identity generated from a key and at least one parameter containing a session variable; means for identifying said user from said secondary identity; and a transmitter for transmitting information related to said user to said requesting application.

Brief Description of the Drawings

FIG. 1 illustrates an embodiment of the present invention in which a key server is used to facilitate encrypted communication between a user and an application.

FIG. 2 illustrates an embodiment of a process or method in which a user can establish secure communication with an application according to the embodiment shown in FIG. one.

FIG. 3 illustrates an embodiment of a process or method in which a user can securely contact an application without using a key server.

The implementation of the invention

To protect user privacy, there is a need to provide secure communication between the user and the application, without revealing the actual user identity to the application or third party eavesdropping on the communication, or otherwise allowing the application to determine that other sessions are starting from the same user. The invention disclosed herein eliminates this drawback.

The link is now directed to FIG. 1, which illustrates an embodiment of a communication system 100 in which a key server is used to facilitate encrypted communication between a user and an application.

The communication system 100 may be any voice system, data transmission system, or multimedia system, for example, operating on a communication standard and / or protocol, such as WCDMA (Code Division Multiple Access), cdma2000, or IP (Internet Protocol) or any other suitable standard or protocol. An embodiment may be used, for example, as an extension to a universal bootstrapping architecture, as defined in various communication standards. (See, for example, “Generic Authentication Architecture (GAA): Generic bootstrapping architecture,” 3GPP TS 33.220 and “Generic Bootstrapping Architecture (GBA) Framework,” 3GPP2 S.S0109-0 Version 1).

As illustrated in FIG. 1, user 114 (also referred to as user equipment) can access application 116 in system 100. Application 116 can be a dedicated server on the network serving a specific application, for example, VoIP (Voice over Internet Protocol), or the network element itself. Application 116 may also be a software application stored on servers or other devices on a network. In an embodiment (not shown), application 116 may reside in the same physical device as key server 126. Each application may have its own dedicated transmitter / receiver circuit (not shown) for communication with user 114 and / or key server 126, or several applications may share a common transmitter / receiver circuit. It may be noted that the application may include several physical entities, for example, the application may be a fully mobile network containing multiple base stations.

In one embodiment, user 114 may pre-store key 102 in his memory. Both the key 102 and the fact that it is stored with the user 114 are known to the key server 126. The key 102 may be unique to the user 114 or a group of users, which includes the user 114. The key 102 may be used continuously or only for a specific period of time. In an embodiment, key 102 is known only to authorized parties, such as key server 126 and user 114.

In one embodiment, both user 114 and key server 126 can generate temp_ID 108 (also called secondary identity) using the following general formula:

temp_id = F (key, m Equation (1)

In Equation (1), F is a predefined algorithmic function, such as a cryptographic hash function. Alternatively, F may be a function that sequentially associates one or more parameters with the output of one or more hash functions. F may also be a function that performs hashing by combining a number of parameters with the output of one or more other hash functions. In one embodiment, the predefined algorithmic function may be a SHA-1 protected hash algorithm. (See publication of Federal Information Processing Standard 180-1 (1995).)

Also in Equation (1), m means a set of parameters, which may include, for example, a user identity, one or more session-dependent variables and / or other parameters. A session can mean establishing a connection between a user and an application that uses the same temp_ID. In an embodiment, m typically includes at least one session variable that may change each time a temp_ID exchange is performed with the application. Such a variable may be a digital incrementing usage counter, timestamp or output of a pseudo random number generator. It will be appreciated that larger session variables can be used for greater security at the cost of greater implementation complexity. In an embodiment, the session variable may be a 16-bit counter value.

Referring again to FIG. 1, both F and m are known to user 114 and key server 126. In one embodiment, the key server 126 can pre-compute and store the temp_ID values based on the given key 102 and all possible values of the parameter m, so that the given temp_ID, the key 102 used to generate it, can be quickly identified.

FIG. 2 illustrates an embodiment of a process or method 200 in which user 114 can establish secure communication with an application 116 according to the embodiment shown in FIG. 1. First, at step 201, user 114 calculates temp_ID 108 from the key and a set of m parameters and sends temp_ID 108 to application 116.

At step 202, after the temp_ID 108 sent by the user 114 is received, the application 116 sends the temp_ID 108 to the key server 126.

As described previously, in one embodiment, the key server 126 has a previously stored set of temp_ID and keys in its memory. At step 203, the key server 126 uses temp_ID 108 received from the application 116 to identify the key 102. As mentioned earlier, each key can correspond to a unique user. In this example, the key 102 corresponds to the user 114. The key server 126 can therefore map temp_ID 108 to the user 114, as shown in step 203.

At step 203, the key server 126 may optionally generate a sub_key 238 (also called a traffic key in this document) based on the key 102. This subkey generation may use another algorithmic function and contain parameters known only to the user 114 and the key server 126. In one embodiment, temp_ID 108 can itself be used to form related subkeys. In an alternative embodiment, any number of subkeys 238 may be generated by taking a hash function (e.g., SHA-1) of key 102 and the corresponding sequence number.

At step 204, the key server 126 sends the sub_key 238 to the application 116. The key server 126 can also send other user information 114 to the application 116.

User 114 may independently generate sub_key 238 (or a “traffic key”) from parameters already known to him. Thus, using sub_key 238, known to both the application 116 and the user 114, both parties can use sub_key 238 to encrypt and decrypt the data 240 sent between them, as shown in step 205.

Turning back to FIG. 1, if user 114 subsequently accesses another application 122, temp_ID other than temp_ID 108 may be calculated in accordance with equation (1) as described above. If the function F is selected so that the connection between temp_ID 108 and other temp_IDs used by other users during other sessions is difficult to distinguish, it will be difficult for the unauthorized party to associate the intercepted temp_ID with any particular user, thus preserving the confidentiality of the user's identity.

In one embodiment, the set of m parameters used to generate temp_ID in equation (1) may include an application identity (app_ID) corresponding to the accessed application. In this method, the key server 126 may indicate from temp_ID 108 whether the user 114 actually accessed the application 116 requesting user information from the key server 126. For security, the key server 126 may choose to send user information 114, which includes the user's identity and user-specific key, only to the application 116, whose app_ID matches the app_ID used to generate temp_ID 108. This prevents receiving information about user 114 from the server 126 keys by another application, such as application 118, which was not accessed by user 114.

In an embodiment, user 114 may even be invited to generate temp_ID when user 114 does not yet know the app_ID of the application that he wishes to access. In this case, the user can, however, generate temp_ID using the fixed "universal" or "default" app_ID instead of the application-specific app_ID. In this embodiment, the key server can be configured to recognize a temp_ID containing such a “universal” or “default” app_ID, and provides user-specific data to the application, even if the universal app_ID does not match the app_ID of the requesting application. At a later time, after the user has determined the app_ID of the application, the user can generate a new temp_ID based on the correct app_ID.

In another embodiment of the invention, if the new set of m 'parameters is agreed upon by the user and the application during the session, then by requesting the key server, the application can determine the new temp_ID to be used during the subsequent session. To accomplish this, the application can provide, for example, a new set of m 'parameters along with temp_ID, originally received from the user, to the key server. This prevents the user from having to pass the new temp_ID to the application each time a new temp_ID is required.

FIG. 3 illustrates an embodiment of a process or method 300 in which user 114 can safely communicate with application 116 without using a key server. In this embodiment, it is assumed that the user 114 and the application 116 are already sharing the key K through some key distribution scheme before starting the communication shown in FIG. 3. In an embodiment, key K is a variable known only to authorized parties, such as a user and an application.

At step 301, user 114 may configure Derived_Key_ID 310 as follows:

Derived_Key_ID = F (K, session variable, other parameters) Equation (2),

where F is again a predefined algorithmic function, the session variable is a session-dependent variable, such as a counter value, and other parameters may include any parameter not explicitly listed in this document that is known to both user 114 and application 116. How previously noted, the session variable may change every time temp_ID is exchanged with the application, and may be a digital incrementing usage counter, timestamp or pseudo-random generator output sat down. It will be appreciated that larger session variables can be used for greater security at the cost of greater implementation complexity. In an embodiment, the session variable may be a 16-bit counter value.

At step 302, user 114 sends Derived_Key_ID 310 to application 116. At step 303, application 116, which previously calculated the set of Derived_Key_ID from all possible values of the key K, the session variable, and other parameters, stored in memory, can identify the key K, the session variable used to form the received Derivded_Key_ID 310, and the associated user 114. When both parties know the values of K, the session variable 331, and other parameters, both sides can calculate the common key Derived_K 332 as the following:

Derived_K = G (K, session variable, other parameters) Equation (3),

where G is another predetermined algorithmic function, and the session variable 331 corresponds to the session variable used to generate Derived_key_ID 310 in equation (2). It may be noted that the function G can be selected to be the same as that used to generate the sub_key 238 described previously with reference to FIG. 2. A secure connection can now be made using Derived_K 332 to send and receive encrypted data 340, as shown in step 304.

In a further embodiment of the invention, if the new set m 'of parameters is agreed by the user and the application during the session, then the application can determine using equation (3) the new temp_ID to be used during the subsequent session. This will provide protection against attacks if possible by third party communications. For example, a user may change their temp_ID during sessions with different base stations on a mobile network in order to avoid tracking by an eavesdropping third party.

It may be noted that the above embodiments have been described in the context of shared key systems or symmetric cryptographic systems, public key systems or asymmetric cryptographic systems are also susceptible to communication attacks where the user reuses the same public key. Aspects of the present invention may also be used to modify the private key and, therefore, the public key according to the session-dependent variable and / or application identity. It may be noted, however, that in public-key systems, the registration overhead and certificate issuance processes required each time a public / private key pair is changed may result in the public / private key pair being preferably used for an extended period of time .

According to an embodiment, the memory in each of the key server 126 and the user 114 may be of either a volatile or non-volatile type, such as a hard disk drive or a RAM (random access memory) circuit. Alternatively, the memory can be made of other types of circuits, such as EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM (Electrically Programmable Read-Only Memory), ROM (Read-Only Memory), ASIC (Specialty Integrated Circuit), Magnetic Disk, optical disk and others well known in the art.

It should be noted that the invention can be implemented as a process or method and be encoded as machine-readable instructions carried on any computer-readable medium known in the art. Here, the term "machine-readable medium" refers to any medium that is involved in providing instructions to any processor, such as the processors in the key server 126 and user 114, shown in FIG. 1. Such a medium may be a storage type and may take the form of a volatile or non-volatile storage medium, as also described previously, for example, in the description of the memory and the key server 126 and user 114. Such a medium may also be a transmission type and may include a coaxial cable , copper wire, optical cable, and a radio interface that transmits sound or electromagnetic waves capable of transmitting signals read by machines or computers.

Those skilled in the art will understand that information and signals can be represented using any of a variety of different technologies and techniques. For example, data, instructions, commands, information, signals, bits, symbols, and microcircuits, which can be exemplified throughout the description above, can be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination of them.

Those skilled in the art will further appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computing software, or combinations thereof. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally based on their functionality. Whether this functionality is implemented as hardware or software depends on the particular application and structural constraints imposed on the system as a whole. Highly qualified specialists can implement the described functionality in various ways for each individual application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.

The various illustrative logical blocks, modules, and circuits described in connection with the embodiments disclosed herein may be implemented or implemented using a general purpose processor, digital signal processor (DSP), specialized integrated circuit (ASIC), user-programmable matrix LSI ( FPGA) or other programmable logic device, discrete logic element or transistor logic, discrete hardware components, or any combination thereof designed to I have to perform the functions described in this document. A general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor can also be implemented as a combination of computing devices, for example, a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors together with a DSP core, or any other similar configuration.

The steps of a method or algorithm described in connection with the embodiments disclosed herein may be implemented directly in hardware, in a software module executed by a processor, or in a combination thereof. The software module may reside in RAM, flash memory, ROM, EEPROM type memory, EEPROM type memory, registers, a hard disk, a removable disk, a compact disk, or any other form of storage medium known in the art. A typical storage medium is connected to a processor, wherein the processor can read information and write information to the storage medium. Alternatively, the storage medium may be integrated in the processor. The processor and storage medium may reside in an ASIC. ASIC can reside in a user terminal. Alternatively, the processor and the storage medium may reside as discrete components in a user terminal.

The foregoing description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. Various modifications in these embodiments will be apparent to those skilled in the art, and the general principles described herein may be applied to other embodiments without departing from the spirit and scope of the invention. Thus, the present invention is not intended to be limited by the embodiments shown herein, but rather should satisfy the broadest possible scope consistent with the principles and new features disclosed herein. While typical embodiments have been described, those skilled in the art will appreciate that these and other changes in form and detail can be made here without departing from the scope and spirit of the invention.

Claims (33)

1. A method for protecting user privacy, comprising the steps of:
generating a first secondary key identifier associated with the user based on the key and at least one parameter containing the first session variable associated with the first session;
sending said first secondary key identifier to the application;
generating a first traffic key associated with said first secondary key identifier; and
securely communicating with said application using said first traffic key during a first session, including negotiating a second session variable with said application for communication with a subsequent second session. 2. The method according to claim 1, in which said user is associated with the same application for at least two sessions. 3. The method according to claim 1, wherein said user communicates with another application in each session for at least two sessions. 4. The method of claim 1, wherein said first session variable comprises a counter value. 5. The method of claim 1, wherein said first session variable comprises a time stamp. 6. The method of claim 1, wherein said first session variable comprises outputting a pseudo random number generator. 7. The method of claim 4, wherein said counter value comprises an increment counter output, said output being different for each session. 8. The method of claim 1, wherein the other parameter of the at least one parameter comprises an application identifier associated with said application in communication with said user. 9. The method of claim 8, wherein said application identifier comprises a universal application identifier, said universal application identifier being used when the identifier of said application in communication with a user is unknown to the user. 10. The method according to claim 1, wherein said step of generating a first secondary key identifier based on said at least one parameter comprises the step of applying a hash function to said at least one parameter. 11. The method according to claim 1, wherein said step of generating a first secondary key identifier based on said at least one parameter comprises the step of connecting at least one of said at least one parameter to an output a hash function applied to at least one of the at least one parameter. 12. A method for protecting user privacy during communication in a system having a key server, said method comprising the steps of
receiving from the user a first secondary key identifier formed from a key and at least one parameter containing a first session variable associated with the first session;
transmitting said first secondary key identifier to said key server;
receive information from said key server related to said user; and
using said information to securely communicate with said user during the first session, including negotiating a second session variable with the user to communicate with the subsequent second session. 13. The method of claim 12, wherein said information associated with said user comprises a secondary key, and said secondary key is used to communicate with said user. 14. The method of claim 13, wherein said secondary key received from said key server is generated based on at least one of said at least one parameter. 15. The method of claim 12, wherein said first secondary key identifier is generated from said at least one parameter by applying a hash function to said at least one parameter. 16. The method of claim 12, wherein said first session variable comprises a counter value. 17. The method of claim 12, wherein the other parameter of the at least one parameter further comprises an application identifier associated with the application requested by said user. 18. The method of claim 17, wherein said key server is configured to not provide said information if said application identifier does not match an application identifier associated with the requesting application. 19. The method according to item 12, further comprising stages, in which
transmitting to said key server said second session variable associated with said subsequent second session;
receive from said key server additional information associated with said user based on said second session variable; and
using said additional information to securely communicate with said user during a subsequent second session with said user. 20. A method for protecting user privacy, comprising the steps of:
receiving from the user a first secondary key identifier formed from a key and at least one parameter containing a first session variable associated with the first session;
identifying said key from said first secondary key identifier;
forming a secondary key based on at least one of the at least one parameter;
during the first session, using encrypted communication with said user using said secondary key; and
agree with the user during the first session information related to the subsequent second session. 21. The method according to claim 20, in which said first session variable contains a counter value that increases in infinitely small increments before or after entering a communication session. 22. The method according to item 21, further containing a stage on which
using said information to communicate with said user during a subsequent second session with said user. 23. A device for protecting user privacy, containing
a secondary key identifier generator for generating a first secondary key identifier associated with the user based on the key and at least one parameter containing a first session variable associated with the first session;
a transmitter for sending said first secondary key identifier to the application; and
a key generator for generating a first traffic key, said device safely communicating with said application using said generated first traffic key during the first session, including coordinating with the application a second session variable for communicating with the subsequent second session. 24. The device according to item 23, in which said device is associated with the same application for at least two sessions. 25. The device according to item 23, in which said user communicates with another application in each session for at least two sessions. 26. A device for protecting user privacy during communication in a system having a key server, said device comprising
a receiver for receiving from the user a first secondary key identifier generated from the key and at least one parameter containing the first session variable; and
a transmitter for transmitting said first secondary key identifier to said key server;
moreover, the receiver is further configured to receive information related to said user from said key server;
and wherein said information is used by said device to securely communicate with said user during a first session, including negotiating a second session variable with a user to communicate with a subsequent second session. 27. Device for protecting user privacy, containing
a receiver for receiving from the user a first secondary key identifier generated from the key and at least one parameter containing the first session variable;
a processor for identifying said key from said first secondary key identifier; and
a generator for generating a secondary key based on at least one of the at least one parameter;
wherein said device communicates with said user using said secondary key during the first session; and
moreover, the processor is made with the additional opportunity to coordinate with the user during the first session information related to the subsequent second session. 28. A device for protecting user privacy during communication with the application, said device comprising
means for generating a first secondary key identifier associated with the user based on the key and at least one parameter containing the first session variable associated with the first session;
means for sending said first secondary identifier to the application; and
means for generating a first traffic key associated with said first secondary key identifier, said device communicating securely with said application using said generated traffic key during the first session, including negotiating with the application a second session variable for communicating with the subsequent second session. 29. A machine-readable medium on which instructions are stored, the stored instructions, if executed by a processor, cause the processor to implement a method comprising the steps of
generating a first secondary key identifier associated with the user based on the key and at least one parameter containing the first session variable associated with the first session;
sending said first secondary key identifier to the application;
generating a first traffic key associated with said first secondary key identifier; and
safely communicating with the application using the first traffic key during the first session, including negotiating with the application a second session variable to communicate with the subsequent second session. 30. A device for protecting user privacy during communication in a system having a key server, the device comprising
means for receiving from a user a first secondary key identifier generated from a key and at least one parameter containing a first session variable associated with the first session;
means for transmitting said first secondary key identifier to said key server;
means for receiving, from said server, keys of information related to said user; and
means for using said information to securely communicate with said user during the first session, including negotiating with the user a second session variable for communicating with the subsequent second session. 31. A machine-readable medium on which instructions are stored, the stored instructions, if executed by the processor, cause the processor to implement a method comprising the steps of
receiving from the user a first secondary key identifier formed from a key and at least one parameter containing a first session variable associated with the first session;
transmitting said first secondary key identifier to a key server;
receive information from said key server related to said user; and
using said information to securely communicate with said user during the first session, including negotiating a second session variable with the user to communicate with the subsequent second session. 32. A device for protecting user privacy, comprising
means for receiving from a user a first secondary key identifier generated from a key and at least one parameter containing a first session variable associated with the first session;
means for identifying said key from said first identifier of a secondary key;
means for generating a secondary key based on at least one of said at least one parameter;
means for use during the first session of encrypted communication with said user using said secondary key; and
means for coordinating with the user during the first session information related to the subsequent second session. 33. A computer-readable medium on which instructions are stored, the stored instructions, if executed by the processor, cause the processor to implement a method comprising the steps of
receiving from the user a first secondary key identifier formed from a key and at least one parameter containing a first session variable associated with the first session;
identifying said key from said first secondary key identifier;
forming a secondary key based on at least one of the at least one parameter;
during the first session, using encrypted communication with said user using said secondary key; and
agree with the user during the first session information related to the subsequent second session.

Images