Ticket-based secure time delivery in digital networks

• US 20050005114A1
• Filed: 07/05/2003
• Published: 01/06/2005
• Est. Priority Date: 07/05/2003
• Status: Abandoned Application

• Current Assignee: General Instrument Corporation (CommScope Holding Company, Inc.)
• Original Assignee: General Instrument Corporation (CommScope Holding Company, Inc.)
• Inventors: Medvinsky, Alexander
• Application Number:
  US10/613,911
• Publication Number:
  US 20050005114A1
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/725 operating on a secure reference time value
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

A ticket-based secure time protocol is used to provide client devices, or users, with secure time signals. In a preferred embodiment, the secure time signals are provided by a secure time server so that multiple clients can be time-synchronized. Ticket-based authentication uses digital certificates and public key cryptography, such as Elliptic Curve Cryptography (ECC) to reduce key administration overhead and decryption processing. Standard authentication architectures and approaches, such as Kerberos, can be used for some aspects of the invention. A preferred embodiment uses Request and Reply messages that provide added security and functionality, such as authentication, sequence-checking and verification of target destination.

Claims

1. A method for providing a secure time signal from a time source to a time requestor over a digital network, the method comprising

using an information object to request the secure time signal wherein the information object includes an identification of the requestor and a session key for transferring the secure time signal.

2. The method of claim 2, wherein the information object includes a ticket.

3. The method of claim 2, wherein the ticket is obtained from a key distribution center.

4. The method of claim 2, wherein the ticket is obtained from an authentication server.

5. The method of claim 2, wherein the ticket is obtained from a ticket-granting-server.

6. The method of claim 2, further comprising

associating a request for a secure time signal with the ticket;

transferring the ticket with the request to a secure time server; and

receiving a secure time signal from the secure time server.

7. The method of claim 6, wherein the request includes a request message, the method further comprising

generating a nonce to be included in the request message;

including a service ticket for the secure time server in the request message; and

including a keyed checksum over the request message

8. The method of claim 6, wherein the secure time signal includes a reply message, the method further comprising

including a secure time signal;

including a nonce copied from the client request;

including a keyed checksum over the reply message

9. The method of claim 6, wherein the step of receiving a secure time signal includes the following substeps:

matching a nonce in the received message with the corresponding nonce in the sent message; and

confirming a keyed checksum.

10. The method of claim 6, further comprising

using the secure time signal to update a clock value.

11. An apparatus for providing a secure time signal to a time requestor over a digital network, the apparatus comprising

a process for accepting a ticket from the time requestor to request a secure time signal;

and

a process for providing a secure time signal to the time requestor.

12. An apparatus for providing a secure time signal to a time requestor over a digital network, the apparatus comprising

means for accepting a ticket from the time requestor to request a secure time signal;

and

means for providing a secure time signal to the time requestor.

13. A computer-readable medium including instructions for providing a secure time signal to a time requestor over a digital network, the computer-readable medium comprising

one or more instructions for accepting a ticket from the time requestor to request a secure time signal;

and

one or more instructions for providing a secure time signal to the time requester.