Method for establishing a communication between two devices

• US 20050125670A1
• Filed: 11/16/2004
• Published: 06/09/2005
• Est. Priority Date: 11/18/2003
• Status: Active Grant

• Current Assignee: STMicroelectronics SRL (STMicroelectronics NV)
• Original Assignee: STMicroelectronics SRL (STMicroelectronics NV)
• Inventors: Sozzani, Fabio, Fragneto, Pasqualina, Bertoni, Guido Marco, Pelosi, Gerardo, Sannino, Roberto Valerio
• Granted Patent: US 7,716,483 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3073 involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing

Abstract

A method establishes a communication between a first electronic device associated with a first trusted authority and a second electronic device. The method includes: making a first key available to the first device for the communication between the first authority and the first device. A second trusted authority, associated with the second device and distinct and autonomous with respect to the first authority, generates a second key in order to communicate with the second device. Furthermore, the method includes: making the second key available to the second device; and providing the first and second devices with a communication key, to be used communication between the first and second devices, through at least one of the first and second authorities.

Claims

1. A method for establishing an encrypted communication by using keys, between an electronic first device associated with a trusted first authority and an electronic second device, the method comprising the steps of:

making a first secret key available to the first device for encrypted communication between the first authority and the first device, said first authority being able to generate the first secret key;

providing a trusted second authority, associated with the second device and distinct and autonomous with respect to said first authority, the second authority being able to generate a second secret key for the encrypted communication between the second authority and the second device;

making the second secret key available to the second device; and

providing a communication key to the first and second devices to be used in said communication, through at least one of said first and second authorities.

2. The method according to claim 1 wherein said step of providing the communication key to the first and second devices comprises, in turn, the steps of:

generating said communication key by one of said authorities;

sending encrypted messages containing said communication key to the first and second devices, by the one of said authorities.

3. The method according to claim 2, further comprising the step of generating, by the one of said authorities, an electronic signature by starting from said communication key.

4. The method according to claim 3 wherein the step of sending encrypted messages to the first and second devices further comprises the steps of:

generating a first message to be sent to the first device, encoding said communication key by using the first secret key;

generating a second message to be sent to the second device encoding said communication key and said electronic signature by using a second public key assigned to the second device by the second authority.

5. The method according to claim 4 wherein the communication key to be sent to the first device is encoded in accordance with a symmetrical type encryption method or in accordance with an asymmetric identity based encryption method.

6. The method according to claim 5 wherein said symmetrical encryption method is a GSM communication standard encryption method.

7. The method according to claim 4 wherein the communication key and the electronic signature to be sent to the second device are encoded in accordance with an identity based encryption method.

8. The method according to claim 1 wherein first and second identities are associated with the first and the second devices respectively and further first and second identities are associated with the first and the second authorities respectively;

the method additionally comprising the steps of;

generating a first public key associated with the first device, obtained by starting from the first identity of the first device;

generating a second public key associated with the second device, obtained by starting from the second identity of the second device;

generating a first intermediate private key associated with the first device, obtained by starting from the first public key and from a first master key available to the first authority;

generating a second intermediate private key associated with the second device, obtained by starting from the second public key and from a second master key available to the second authority; and

generating, by said first authority, the first secret key associated with the first device and to be used for a symmetrical type encrypted communication between the first device and said first authority, said first secret key being obtained by starting from the first intermediate key.

9. The method according to claim 8, comprising the additional steps of:

sending the further first identity to the second device, by the first device; and

sending the second identity and the further second identity to the first device, by the second device.

10. The method according to claim 9, further comprising an encrypted transmission step of the second identity of the second device, and of the further second identity of the second authority by the first device to the first authority.

11. The method according to claim 10 wherein the transmission step of the second and of the further second identities is carried out symmetrically using the first secret key or by using a session key in accordance with a GSM communication standard.

12. The method according to claim 10 wherein the transmission step of the second and of the further second identities is carried out by using an identity based encryption method and by using a further first public key obtained by starting from the identity of the first trusted authority and a further first intermediate private key in turn obtained by starting from the further first public key.

13. The method according to claim 8 wherein said first secret key associated with the first device is generated directly by the first trusted authority without using the first intermediate key.

14. The method according to claim 1 wherein said first device is a smart card and the second device is a mobile telephone or a remote internet server.

30. The method of claim 1 wherein the first device is a smart card and the second device is a mobile telephone or a remote internet server.

15. An encrypted communication system using keys, comprising:

an electronic first device associated with a trusted first authority, the first device including;

means for receiving a first secret key from the first authority; and

means for receiving a communication key from the first authority

an electronic second device associated with a trusted second authority, the second device including;

means for receiving a second secret key from the second authority;

means for receiving the communication key from the first authority; and

means for having an encrypted communication with the first device using the communication key to encrypt the communication.

16. The system of claim 15 wherein the communication key is received by the first device in encrypted form, and the first device further includes means for decoding the encrypted communication key using the first secret key.

17. The system of claim 15 wherein the communication key is received by the second device in encrypted form, and the second device further includes:

means for receiving a public key from the second authority; and

means for decoding the encrypted communication key using the public key.

18. The system of claim 17 wherein the second device includes means for transmitting an identifier to the first device and the first device includes means for transmitting the identifier to the first authority to enable the first authority to generate the public key from the identifier and encode the communication key using the public key.

19. The system of claim 15 wherein said first device is a smart card and the second device is a mobile telephone or a remote internet server.

20. A method for establishing an encrypted communication between an electronic first device associated with a trusted first authority and an electronic second device associated with a trusted second authority, the method comprising:

receiving at the first device a first secret key from the first authority;

using the first secret key for encrypted communication between the first device and the first authority;

receiving at the second device a second secret key from the second authority;

using the second secret key for encrypted communication between the second device and the second authority;

receiving, at the first and second devices, a communication key from the first authority; and

using the communication key for encrypted communication between the first and second devices.

21. The method of claim 20, further comprising receiving at the second device an electronic signature created from the communication key by the first authority.

22. The method of claim 20 wherein the step of receiving the communication key at the first device includes receiving the communication key in an encrypted message, the method further comprising decoding the encrypted message using the first secret key.

23. The method of claim 20 wherein the step of receiving the communication key at the second device includes receiving the communication key in an encrypted message, the method further comprising decoding the encrypted message using a public key provided to the second device by the second authority.

24. The method of claim 23, further comprising:

transmitting an identifier from the second device to the first device; and

transmitting the identifier from the first device to the first authority to enable the first authority to generate the public key from the identifier and encode the communication key using the public key.

25. The method of claim 20 wherein the communication key is received by the first device in encrypted form and the method further comprises decoding the encrypted communication key in accordance with a symmetrical type decryption method or in accordance with an asymmetric identity based decryption method.

26. The method of claim 20 wherein first and second device identities are associated with the first and the second devices, respectively and first and second authority identities are associated with the first and the second devices, respectively;

the method further comprising;

sending the first authority identity from the first device to the second device; and

sending the second device identity and the second authority identity from the second device to the first device.

27. The method of claim 26, further comprising transmitting, in encrypted form, the second device identity and the second authority identity from the first device to the first authority.

28. The method of claim 27 wherein the transmitting step is carried out symmetrically using the first secret key or by using a session key in accordance with a GSM communication standard.

29. The method of claim 27 wherein the transmitting step is carried out by using an identity based encryption method and by using a further first public key obtained from the first authority identity and an intermediate private key received from the first authority.