Systems and methods for authenticating communications in a network medium

• US 20060174116A1
• Filed: 04/03/2006
• Published: 08/03/2006
• Est. Priority Date: 02/06/2002
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Inventors: Smetters, Diana, Lopes, Cristina, Balfanz, Dirk, Wong, Hao-Chi, Stewart, Paul
• Granted Patent: US 8,156,337 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: G06F 21/43 wireless channels
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04L 69/162 involving adaptations of sockets based mechanisms secure socket layer H04L63/168
• CPC Class Codes: H04L 69/168 specially adapted for link layer protocols, e.g. asynchronous transfer mode [ATM], synchronous optical network [SONET] or point-to-point protocol [PPP]
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

Pre-authentication information of devices is used to securely authenticate arbitrary peer-to-peer ad-hoc interactions. In one embodiment, public key cryptography is used in the main wireless link with location-limited channels being initially used to pre-authenticate devices. Use of public keys in the pre-authentication data allows for the broadening of types of media suitable for use as location-limited channels to include, for example, audio and infrared. Also, it allows a range of key exchange protocols which can be authenticated in this manner to include most public-key-based protocols. As a result, a large range of devices, protocols can be used in various applications. Further, an eavesdropper is forced to mount an active attack on the location-limited channel itself in order to access an ad-hoc exchange. However, this results in the discovery of the eavesdropper.

Claims

1. A method for securing communication over a network medium between at least two devices including a first device and a second device, comprising:

receiving over a location limited communication channel, by the second device, public authentication information transmitted by said first device, said location limited communication channel being difficult to actively attack without detection, wherein said public authentication information commits said first device to possession of secret information;

receiving a communication from said first device over said network medium,

authenticating said communication at said second device wherein said second device requires said first device to authenticate to said second device that said first device actually possesses said secret information.

2. The method of claim 1, wherein said public authentication information is a one-way function of an authenticator.

3. The method of claim 1, wherein said public authentication information is a public key or a one-way function of said public key.

4. The method of claim 1, wherein said public authentication information is a one-way function of said secret information known to said first device.

5. The method of claim 1, wherein authenticating said communication uses a key exchange protocol over said network medium.

6. The method of claim 1, wherein said location limited communication channel is an infra-red channel.

7. The method of claim 1, wherein said location limited communication channel is an audio channel.

20. The method claim 1, the method further comprising:

receiving over said location limited communication channel, by the first device, a second public authentication information transmitted by said second device, wherein said second public authentication information commits said second device to possession of a second secret information;

receiving a second communication from said second device over said network medium; and

authenticating said second communication at said first device wherein said first device requires said second device to authenticate to said first device that said second device actually possesses said second secret information.

8. A method for securing a communication over a network medium between a group of devices, each of said group of devices associated with its own public authentication information, the method comprising designating a group manager from said group of devices wherein said group of devices includes said group manager and a plurality of other devices, said plurality of other devices comprising a first device and a second device;

performing a key exchange protocol by said group manager, said key exchange protocol being dependent on an established trust relationship between said group of devices; and

securing said communication over said network medium;

wherein the improvement comprises;

sending, by said group manager over a location limited communication channel, public authentication information associated with said group manager to said first device and said second device, wherein said public authentication information commits said group manager to possession of group manager secret information, said location limited communication channel being difficult to actively attack without detection;

receiving, by said group manager over said location limited communication channel, public authentication information associated with said first device and public authentication information associated with said second device;

wherein said public authentication information associated with said first device commits said first device to possession of first device secret information and wherein said public authentication information associated with said second device commits said second device to possession of second device secret information, whereby sending and receiving over said location limited communication channel establishes said established trust relationship;

attempting to authenticate, by said group manager each of said plurality of other devices;

the attempting to authenticate by said group manager comprising said group manager requesting said first device to authenticate that said first device actually possesses said first device secret information and said group manager requesting said second device to authenticate that said second device actually possesses said second device secret information; and

attempting to authenticate, by each of said plurality of other devices, said group manager;

the attempting to authenticate by each of said plurality of other devices comprising said first device requesting said group manager to authenticate that said group manager actually possesses said group manager secret information and said second device requesting said group manager to authenticate that said group manager actually possesses said group manager secret information.

9. The method of claim 8, further comprising distributing, by said group manager, group key information over said network medium to said plurality of other devices.

10. The method of claim 8, further comprising:

receiving a new device into said group of devices;

sending, by said group manager over said location limited communication channel, said public authentication information associated with said group manager to said new device;

receiving, by said group manager over said location limited communication channel, public authentication information associated with said new device;

wherein said public authentication information associated with said new device commits said new device to possession of new device secret information; and

attempting to authenticate, by said group manager, said new device, the attempt comprising requesting said new device to authenticate that said new device actually possesses said new device secret information whereby said new device is included in said established trust relationship.

11. The method of claim 8, wherein the group of devices includes a third device, and wherein the method further comprises:

detecting when said third device leaves said group of devices; and

using said network medium to distribute a new group key information from said group manager to said plurality of other devices remaining in said group of devices.

12. A method of authenticating a communication over a network medium among a group of devices including a first device and a second device, the method comprising performing a key exchange protocol between said group of devices, said key exchange protocol being dependent on an established trust relationship between said group of devices, and securing said communication over said network medium, wherein the improvement comprises:

sending, by each of said group of devices over a location limited communication channel, public authentication information associated with said each of said group of devices to every other of said group of devices, wherein said public authentication information associated with said each of said group of devices commits said each of said group of devices to possession of secret information corresponding thereto, said location limited communication channel being difficult to actively attack without detection;

receiving, by said each of said group of devices over said location limited communication channel, said public authentication information associated with said each of said group of devices from every other of said group of devices, whereby sending and receiving over said location limited communication channel establishes said established trust relationship; and

attempting to authenticate, by said each of said group of devices, that every other of said group of devices possesses respective secret information thereof.

13. The method claim 12, wherein said group key exchange protocol is a Diffie-Hellman key exchange protocol.

14. A system for securing a communication over a network medium, the system comprising:

a first device and a second device, wherein

the second device receives, over a location limited communication channel public authentication information transmitted by said first device, said location limited communication channel being difficult to actively attack without detection, wherein said public authentication information commits said first device to possession of secret information,

the second device receives a communication from said first device over said network medium, and

the second device authenticates the communication by requiring the first device to authenticate to said second device that said first device actually possesses said secret information.

15. The system of claim 14, further comprising:

a memory that stores an authentication application used by a processor to authenticate the communication.

16. The system of claim 14, wherein the first device includes a infra-red receiver/transmitter.

17. The system of claim 14, wherein the first device includes an audio receiver/transmitter.

18. The system of claim 14, wherein the second device authenticates the communication using a public-key-based key exchange protocol.

19. A method for securing communication over a network medium between at least two devices including a first device and a second device, comprising:

transmitting, from said first device, public authentication information over a location limited communication channel, said location limited communication channel being difficult to actively attack without detection, wherein said public authentication information commits said first device to possession of secret information;

transmitting a communication from said first device to said second device over said network medium; and

demonstrating to said second device that said first device actually possesses said secret information.