Method and system for asymmetric key security

• US 20060198517A1
• Filed: 03/07/2005
• Published: 09/07/2006
• Est. Priority Date: 03/07/2005
• Status: Active Grant

• Current Assignee: Zhigu Holdings Limited
• Original Assignee: Microsoft Corporation
• Inventors: Shewchuk, John P., Simon, Daniel R., Benaloh, Josh D., Nanda, Arun K., Cameron, Kim, Bortz, Andrew
• Granted Patent: US 7,822,200 B2
• Time in Patent Office: Days
• US Class Current: 380/44
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/3218 using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs

Abstract

Exemplary embodiments disclosed herein may include a method and system for creating pair-wise security keys, comprising receiving an identity key from a website, generating a master key, creating a pair-wise symmetric key or asymmetric key pair by utilizing an encryption function of the identity key and the master key, and storing the pair-wise public or symmetric key at the client and the website.

Claims

1. A method of creating symmetric or asymmetric security key(s), comprising:

receiving an identity key associated with a server;

generating a master key;

creating one or more seeds by utilizing an encryption function of the identity key and the master key;

utilizing the seed to create a public and private key pair; and

storing the public key at the server.

2. The method of claim 1, wherein creating seed further comprises utilizing one or more constants.

3. The method of claim 1, further comprising presenting proof of knowledge of the public key when subsequently accessing the server.

4. The method of claim 1, further comprising utilizing the public key to determine if the client has previously accessed the server.

5. The method of claim 1, further comprising:

responsive to determining that client has previously accessed the server, allowing further interaction between the client and the server; and

responsive to determining that the client has not previously accessed the server, requesting information from the client.

6. The method of claim 1, further comprising utilizing the public key to authenticate the server.

7. The method of claim 1, further comprising utilizing the public key to authenticate the client.

8. The method of claim 1, wherein the generating of a master key comprises generating a random number.

9. The method of claim 1, wherein the creating seed comprises utilizing a hash function of the identity key, the master key, a constant.

10. The method of claim 1, wherein the server comprises a web server.

11. The method of claim 1, further comprising creating a symmetric key utilizing the asymmetric key pair as seed.

12. The method of claim 1, wherein public key is based, at least in part on the identity key.

13. The method of claim 1, wherein receiving an identity key comprises receiving a certificate associated with a web site.

14. A system for authenticating a system utilizing an asymmetric or symmetric key pair comprising:

a processor;

a communication channel connected with the processor; and

a memory coupled with and readable by the processor, the memory containing a series of instructions that, when executed by the processor, cause the processor to receive an identity key associated with a server;

generate a master key;

create seed by utilizing an encryption function of the identity key and the master key;

utilize the seed to create a private and public key pair; and

store the public key at the server.

15. The system of claim 14, wherein the generating of a master key comprises generating a random number.

16. The system of claim 14, wherein the creating seed comprises utilizing a hash function of the identity key, the master key, and one or more constants.

17. The method of claim 14, further comprising authenticating the client based at least in part upon the asymmetric public key or symmetric key.

18. A computer program product encoding a computer program of instructions for executing a computer implemented method for authenticating a system, the method comprising:

receiving an identity key associated with a server;

generating a master key;

creating one or more seeds by utilizing an encryption function of the identity key, the master key, and one or more constants;

utilizing the one or more seeds to create a key;

storing the public key at the server;

presenting proof of knowledge of the public to the server;

determining if the public key matches a stored key; and

authenticating the identity of the server or the client based at least in part upon the public key

19. The computer readable medium of claim 18, wherein the key created utilizing one or more seeds to create a key comprises a symmetric key.

20. The computer readable medium of claim 18, wherein the key created utilizing one or more seeds to create a key comprises an asymmetric key.