Method and system for authenticating messages

• US 20040010683A1
• Filed: 09/12/2002
• Published: 01/15/2004
• Est. Priority Date: 07/12/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Huitema, Christian
• Granted Patent: US 7,370,197 B2
• Time in Patent Office: Days
• US Class Current: 713/162
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

A method and system for authenticating a message is described, in which the message contains a network address, at least a portion of which is a digital fingerprint. Embedded in the message is data, such as a code, that indicates the size of the digital fingerprint. A device receiving the message uses the size data and, for example, the public key of the sender to attempt to reproduce the digital fingerprint. If successful, the device receiving the message verifies the identity of the sender.

Claims

1. A method for authenticating messages, the method comprising:

creating a network address, at least a portion of which matches the result of a cryptographic function; and

indicating, within the address, how much of the created network address matches the result of the cryptographic function.

2. A computer-readable medium having stored thereon computer-executable instructions for performing the method of claim 1.

3. The method of claim 1, wherein the indicating step comprises setting one or more bits in the network address, wherein the number of bits set is proportional to the size of the portion of the network address that matches the result of the cryptographic function.

4. The method of claim 1, further comprising including in the message a public key that is usable to derive the portion of the network address that matches the result of the cryptographic function.

5. The method of claim 1, wherein the step of creating the network address comprises calculating a hash of public key of a device to which the network address is assigned and using at least some of the calculated hash as the network address.

6. The method of claim 1, wherein the step of creating the network address comprises:

calculating a hash of a public key according to the cryptographic function to obtain a result; and

using at least a portion of the result as the network address.

7. The method of claim 1, wherein the creating step comprises:

creating a route prefix for the network address;

choosing a key such that executing the cryptographic function on the key yields at least a portion of the route prefix;

executing the cryptographic function on the key to obtain the result; and

populating a node selectable portion of the network address with at least a portion of the result.

8. The method of claim 1, wherein the creating step comprises:

obtaining a route prefix for the network address;

executing the cryptographic function in such a way that the result yields at least a portion of the route prefix and a node selectable portion; and

populating the network address with the route prefix and the node selectable portion.

9. The method of claim 1, wherein the creating step comprises:

executing the cryptographic function in such a way that the result yields a route prefix and a node selectable portion; and

populating the network address with the route prefix and the node selectable portion.

10. The method of claim 1, wherein the creating step comprises:

executing the cryptographic function on a key;

choosing the key such that the result of executing the cryptographic function on the key yields a route prefix and a node selectable portion; and

populating the network address with the route prefix and the node selectable portion.

11. The method of claim 1, wherein:

the step of creating the network address comprises calculating a hash of a public key according to the cryptographic function to obtain a result, and using at least a portion of the result as at least a portion of the network address; and

the indicating step comprises populating at least a portion of the network address with a code representing the number of bits in length of the portion of the network address that is represented by the result.

12. The method of claim 1, the method further comprising:

creating a message;

including a public key in the message;

calculating a hash of the public key according to the cryptographic function to obtain the result; and

including the network address in the message.

13. The method of claim 1, further comprising:

creating a message;

including a public key in the message;

calculating a hash of the public key according to the cryptographic function to obtain the result;

using at least a portion of the result as a node selectable portion of the network address; and

inserting a code in the message, the code representing the number of bits of the address that matches the result.

14. A method for authenticating messages, the method comprising:

creating a first portion of a network address according to a cryptographic function;

creating a second portion of the network address without using the cryptographic function;

creating a message comprising the first portion of the network address and the second portion of the network address; and

indicating, within the message, the size of the first portion of the network address.

15. A computer-readable medium having stored thereon computer-executable instructions for performing the method of claim 14.

16. The method of claim 14, wherein the indicating step comprises setting one or more bits in the message, wherein the number of bits set is proportional to the size of the first portion of the network address.

17. The method of claim 14, further comprising including in the message a public key that is usable to derive the first portion of the network address.

18. The method of claim 14, wherein the step of creating the first portion comprises calculating a hash of public key of a device to which the network address is assigned and using at least some of the calculated hash as the first portion.

19. The method of claim 14, further comprising:

taking a cryptographic hash of a public key of a device;

using at least part of the cryptographic hash as the first portion of the network address; and

assigning the network address to the device.

20. The method of claim 14, wherein the step of creating the first portion comprises:

calculating a hash of a public key according to the cryptographic function to obtain a result; and

using at least a portion of the result as the first portion of the network address.

21. The method of claim 14, wherein:

the step of creating the first portion comprises calculating a hash of a public key according to the cryptographic function to obtain a result, and using at least a portion of the result as the first portion of the network address; and

the indicating step comprises inserting a code within the message, the code representing the number of bits in length of the first portion.

22. The method of claim 14, the method further comprising:

including the public key in the message;

calculating a hash of the public key according to the cryptographic function to obtain a result; and

using at least a portion of the result as the first portion of the network address.

23. The method of claim 14, further comprising:

including the public key in the message;

calculating a hash of the public key according to the cryptographic function to obtain a result;

using at least a portion of the result as the first portion of the network address; and

inserting a code within the message, the code representing the number of bits in length of the first portion.

24. The method of claim 14, wherein:

the step of creating the first portion comprises calculating a hash of a public key according to the cryptographic function to obtain a result, and using at least a portion of the result as the first portion of the network address; and

the indicating step comprises creating a third portion of the network address using a code representing the number of bits in length of the first portion, thereby indicating how many bits are to be used by a device to verify the sender of the message.

25. A computer-readable medium having stored thereon a data structure, the data structure comprising:

a network address comprising;

a digital fingerprint created using a cryptographic function and

a code indicating the size of the digital fingerprint.

26. The computer-readable medium of claim 25, wherein the code indicates the number of bits in the digital fingerprint.

27. The computer-readable medium of claim 25, wherein the network address is an IPv6 address.

28. The computer-readable medium of claim 26, wherein the network address is an IPv6 address.

29. A method for authenticating messages, the method comprising:

a receiving device receiving a message from a sending device, the message comprising a digital fingerprint and a code indicating the size of the digital fingerprint;

the receiving device calculating a cryptographic hash using a public key of the sending device and the code;

the receiving device comparing at least part of the calculated hash with the digital fingerprint; and

based on the comparing step, the receiving device complying with or ignoring the message.

30. A computer-readable medium having stored thereon computer-executable instructions for performing the method of claim 29.

31. The method of claim 29, further comprising:

the sending device calculating a cryptographic hash of its public key; and

the sending device creating a network address comprising a digital fingerprint made up of at least some portion of the cryptographic hash and a code indicating the number of bits that are in the digital signature.

32. A system for authenticating messages, the system comprising:

a first computing device that performs steps comprising;

creating a first portion of a network address;

creating a second portion of the network address so that it represents the size of the first portion; and

transmitting a message containing the network address;

and a second computing device that performs steps comprising;

receiving the message transmitted by the first computing device;

using the second portion of the network address to determine which part of the network address constitutes the first portion;

executing a mathematical function on the network address using a public key of the first computing device; and

comparing the result of the mathematical function with the first portion.

33. The method of claim 32, wherein the second computing device performs further steps comprising:

determining, based on the comparing step, whether or not the first computing device is the proper device to be sending the message.

34. The method of claim 32, wherein the second computing device performs further steps comprising:

if the result of the mathematical function matches the first portion, processing the message.

35. The method of claim 32, wherein the second computing device performs further steps comprising:

if the result of the mathematical function does not match the first portion, disregarding the message.

36. The method of claim 32, wherein the first computing device has a public key, and wherein the first computing device performs further steps comprising:

calculating a hash of the public key; and

using at least a portion of the hash as the first portion of the network address.

37. The method of claim 32,

wherein the first computing device has a public key and performs further steps comprising calculating a hash of the public key, and using at least a portion of the hash as the first portion of the network address;

and

wherein the second computing device performs further steps comprising determining, based on the comparing step, whether or not the first computing device is the proper device to be sending the message.

38. The method of claim 32, wherein

the first computing device has a public key, and performs further steps comprising calculating a hash of the public key, and using at least a portion of the hash as the first portion of the network address;

and

wherein the second computing device performs further steps comprising processing the message if the result of the mathematical function matches the first portion, and disregarding the message if the result of the mathematical function does not match the first portion.

39. The method of claim 32, wherein the step of creating a second portion of the network address comprises using, as the second portion, a code that represents the number of bits that make up the first portion.

40. The method of claim 32, wherein the step of using the second portion of the of the network address comprises referencing a look-up table with the second portion to determine how many bits of the modified network address constitute the first portion.

41. A system for authenticating messages, the system comprising:

means for creating a digital fingerprint portion of a network address;

means for creating a message comprising the digital fingerprint portion of the network address and a code indicating the size of the digital fingerprint portion of the network address;

means for transmitting the message;

means for receiving the message;

means for calculating a cryptographic hash of a public key;

means for comparing the cryptographic hash with the digital fingerprint portion and outputting a result; and

means for complying with the message based on output result.