Method and system for authenticating messages exchanged in a communications system

• US 20060183489A1
• Filed: 02/02/2006
• Published: 08/17/2006
• Est. Priority Date: 02/17/2005
• Status: Active Grant

• Current Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Modeo, Leonardo
• Granted Patent: US 7,634,280 B2
• Time in Patent Office: Days
• US Class Current: 455/466
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/4012 Verifying personal identification numbers [PIN]
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 4/14 Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]

Abstract

In a communications system supporting the exchange of messages, a method for authenticating messages, comprising: having a message sender send a message to be authenticated to a signature generator entity in the communications system; having the signature generator entity generate a signature with respect to the received message, the signature being dependent on the message sender; having the signature generator entity send back to the message sender an authenticated message, the authenticated message including the generated signature; having the message sender forward the authenticated message to a message recipient; having the message recipient send the received message to a signature verifier entity in the communications system; having the signature verifier entity verify the validity of the signature, and notifying the message recipient of an outcome of the validity verification.

Claims

1. In a communications system supporting the exchange of messages, a method for authenticating messages, comprising the step of:

sending a message to be authenticated from a message sender to a signature generator entity in the communication system, the signature generator entity generating a signature with respect to the received message, the signature being dependent on the message sender, and sending back to the message sender an authenticated message, the authenticated message including the generated signature;

forwarding the authenticated message from the message sender to a message recipient;

sending the received message from the message recipient to a signature verifier entity; and

the signature verifier entity verifying the validity of the signature, and notifying the message recipient of an outcome of the validity verification.

2. The method of claim 1, wherein the signature generator entity includes the signature verifier entity.

3. The method according to claim 2, wherein the message includes a textual message.

4. The method of claim 1, wherein the communications system includes a wireless communications network.

5. The method according to claim 4, wherein the communications system supports a messaging service, particularly a Short Messaging Service (SMS), and the message to be authenticated includes an SMS message.

6. The method of claim 5, further comprising generating the signature based on a user-related key (Uka).

7. The method of claim 6, further comprising having the sender user providing to the signature generator entity a personal identification code (PINa), and having the signature generator entity authenticate the sender user based on the provided personal identification code.

8. The method of claim 7, further comprising the sender user placing the personal identification code in the SMS message to be authenticated.

9. The method of claim 8, further comprising the signature generator entity utilizing the personal identification code to obtain the user-related key.

10. The method of claim 9, further comprising having the signature generator entity generating said signature by applying a cryptographic hash function to the message to be authenticated, using the user-related key.

11. The method of claim 10, further comprising utilizing a signature generator entity-related key in addition to the user-related key for generating the signature, by applying a cryptographic hash function or a digesting function.

12. The method of claim 11, wherein the step of the signature verifier entity verifying the validity of the signature includes generating a signature of the message using the sender user-related key, and comparing the generated signature with the signature included in the message received from the recipient.

13. A communications network supporting a messaging system, a message authenticator system comprising means adapted for carrying out the method of claim 12.

14. A message authentication service for authenticating messages comprising implementing the method of claim 12 in the communication system.

15. A Web service for implementing the message authentication service according to claim 14.

16. A system for authenticating messages, comprising implementing the method of claim 1 in the communication system.