Method and system for a flexible lightweight public-key-based mechanism for the GSS protocol

• US 20050154889A1
• Filed: 01/08/2004
• Published: 07/14/2005
• Est. Priority Date: 01/08/2004
• Status: Abandoned Application

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Fyfe, Robert Andrew, Ashley, Paul Anthony, Thomas, Michael James
• Application Number:
  US10/753,842
• Publication Number:
  US 20050154889A1
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement

Abstract

A method for establishing a secure context for communicating messages between a client and a server is presented that is compliant with the Generic Security Service application programming interface (GSS-API). The client sends to the server a first message containing a first symmetric secret key generated by the client and an authentication token; the first message is secured with the public key from the server'"'"'s public key certificate. After the server authenticates the client based on the authentication token, the client then receives from the server a second message that has been secured with the first symmetric secret key and that contains a second symmetric secret key. The client and the server employ the second symmetric secret key to secure subsequent messages sent between the client and the server. The authentication token may be a public key certificate associated with the client, a username-password pair, or a secure ticket.

Claims

1. A method for establishing a secure context for communicating messages between a first system and a second system, the method comprising:

obtaining by the second system a first public key certificate of the first system, wherein the second system is able to validate the first public key certificate that contains a public key;

generating by the second system a transport key, wherein the transport key is a symmetric secret key;

placing by the second system the transport key and an authentication token into a first message secured with the public key;

sending the first message from the second system to the first system;

receiving at the second system from the first system a second message secured with the transport key in response to sending the first message to the first system;

extracting by the second system a session key from the second message, wherein the session key is a symmetric secret key; and

employing the session key to secure subsequent messages sent by the second system to the first system.

2. The method of claim 1 wherein the authentication token comprises a second public key certificate of the second system, and wherein the first system is able to validate the second public key certificate.

3. The method of claim 2 further comprises:

decrypting, by the second system using a private key associated with the second public key certificate, a digital envelope in the second message containing the session key, wherein the digital envelope was created by the first system using a public key contained in the second public key certificate.

4. The method of claim 1 wherein the authentication token comprises a username-password pair.

5. The method of claim 1 wherein the authentication token comprises a secure ticket.

6. A method for establishing a secure context for communicating messages between a first system and a second system, the method comprising:

providing by the first system a public key certificate associated with the first system, wherein the second system is able to validate the public key certificate;

receiving at the first system from the second system a first message, wherein the first message is secured with a public key from the public key certificate associated with the first system, wherein the first message contains a transport key and an authentication token, and wherein the transport key is a symmetric secret key;

authenticating the second system by the first system based on the authentication token;

generating by the first system a session key, wherein the session key is a symmetric secret key;

placing by the first system the session key into a second message secured with the transport key;

sending the second message from the first system to the second system in response to receiving the first message; and

receiving at the first system from the second system subsequent messages secured with the session key.

7. The method of claim 6 wherein the authentication token comprises a public key certificate associated with the second system.

8. The method of claim 7 further comprising:

creating, by the first system using a public key contained in the public key certificate associated with the second system, a digital envelope in the second message containing the session key.

9. The method of claim 6 wherein the authentication token comprises a username-password pair.

10. The method of claim 6 wherein the authentication token comprises a secure ticket.

11. A computer program product on a computer readable medium for use in a second system for establishing a secure context for communicating messages between a first system and the second system, the computer program product comprising:

means for obtaining a public key certificate containing a public key associated with the first system;

means for generating a transport key, wherein the transport key is a symmetric secret key;

means for placing the transport key and an authentication token into a first message secured with the public key;

means for sending the first message to the first system;

means for receiving from the first system a second message secured with the transport key in response to sending the first message to the first system;

means for extracting a session key from the second message, wherein the session key is a symmetric secret key; and

means for employing the session key to secure subsequent messages sent to the first system.

12. The computer program product of claim 11 wherein the authentication token comprises a second public key certificate associated with the second system, a username-password pair, or a secure ticket.

13. A computer program product on a computer readable medium for use in a first system for establishing a secure context for communicating messages between a first system and the second system, the computer program product comprising:

means for providing a public key certificate associated with the first system;

means for receiving a first message from the second system, wherein the first message is secured with a public key from the public key certificate associated with the first system, wherein the first message contains a transport key and an authentication token, and wherein the transport key is a symmetric secret key;

means for authenticating the second system based on the authentication token;

means for generating a session key, wherein the session key is a symmetric secret key;

means for placing the session key into a second message secured with the transport key;

means for sending the second message to the second system in response to receiving the first message; and

means for receiving from the second system subsequent messages secured with the session key.

14. The computer program product of claim 13 wherein the authentication token comprises a public key certificate associated with the second system, a username-password pair, or a secure ticket.

15. An apparatus for establishing a secure context for communicating messages between a first system and a second system, the apparatus comprising:

means for obtaining a public key certificate containing a public key associated with the first system;

means for generating a transport key, wherein the transport key is a symmetric secret key;

means for placing the transport key and an authentication token into a first message secured with the public key;

means for sending the first message to the first system;

means for receiving from the first system a second message secured with the transport key in response to sending the first message to the first system;

means for extracting a session key from the second message, wherein the session key is a symmetric secret key; and

means for employing the session key to secure subsequent messages sent to the first system.

16. The apparatus of claim 15 wherein the authentication token comprises a second public key certificate associated with the second system, a username-password pair, or a secure ticket.

17. An apparatus for establishing a secure context for communicating messages between a first system and a second system, the apparatus comprising:

means for providing a public key certificate associated with the first system;

means for receiving a first message from the second system, wherein the first message is secured with a public key from the public key certificate associated with the first system, wherein the first message contains a transport key and an authentication token, and wherein the transport key is a symmetric secret key;

means for authenticating the second system based on the authentication token;

means for generating a session key, wherein the session key is a symmetric secret key;

means for placing the session key into a second message secured with the transport key;

means for sending the second message to the second system in response to receiving the first message; and

means for receiving from the second system subsequent messages secured with the session key.

18. The apparatus of claim 17 wherein the authentication token comprises a public key certificate associated with the second system, a username-password pair, or a secure ticket.