System and Method for Establishing Trust Without Revealing Identity

• US 20070113077A1
• Filed: 01/11/2007
• Published: 05/17/2007
• Est. Priority Date: 11/27/2002
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Brickell, Ernie
• Granted Patent: US 7,454,611 B2
• Time in Patent Office: Days
• US Class Current: 713/164
• CPC Class Codes: H04L 2209/127 Trusted platform modules [TPM]
• CPC Class Codes: H04L 9/3221 interactive zero-knowledge proofs
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

One aspect of an embodiment of the invention provides a method, system, and device to prove to a challenger that a prover device has a signature from a device manufacturer without revealing the signature to the challenger. According to one implementation, a challenger is provided with the result of a one-way function of a secret held by a prover device. An interactive proof is employed, between the prover device and the challenger, to prove to the challenger that the secret used in the one-way function has been signed by a device signature without revealing the secret or the device signature or the prover device'"'"'s identity to the challenger.

Claims

1. A method comprising:

receiving an authentication request from a challenger device;

sending information to the challenger device from a prover device; and

convincing the challenger device that a valid signature is known by the prover device without revealing the signature to the challenger device.

2. The method of claim 1 wherein the information sent to the challenger device includes a device certificate for the prover device.

3. The method of claim 1 further comprising:

generating a value k based on a one-way function; and

generating a private-public key pair in the prover device, the private-public key pair including a private key and a public key, wherein value k and the public key are included in the information sent to the challenger device.

4. The method of claim 3 wherein the value k is defined as

k=h^m mod P, where h is a unique number generated by the prover device, m is a randomly generated number, and P is a large prime number.

5. The method of claim 1 wherein convincing the challenger device that a valid signature is known by a prover device without revealing the signature to the challenger device includes

sending the challenger device an interactive proof that the prover device knows the signature without revealing the signature to the challenger device.

6. The method of claim 1 further comprising:

convincing the challenger device that the prover device knows the valid signature without revealing the identity of the prover device.

7. The method of claim 1 wherein

convincing the challenger device that the signature known by the prover device is not on a revocation list of compromised device signatures without revealing the signature known by the prover device.

8. A device comprising:

a communication port; and

a processing unit, the processing unit configured to

communicate with a challenger platform over the communication port, and

convince the challenger platform that the device knows a secret without revealing the identity of the device.

9. The device of claim 8 wherein convincing the challenger platform that the device knows the secret without revealing the identity of the device includes

proving to the challenger platform that it has a valid signature of a known entity without revealing the signature, and

tying a value correlated with the secret to the communication with the challenger platform so that a different value cannot be substituted without violating the proof.

10. A system comprising:

a challenger device; and

a prover device communicatively coupled to the challenger device, the prover device configured to convince the challenger that the prover device has a valid signature of a known entity without revealing the signature.

11. The system of claim 31 wherein convincing the challenger device that the prover device has a valid signature of a known entity without revealing the signature includes

revealing to the challenger device the result of a one-way function of a secret held by the prover device, and

proving to the challenger device that the secret has a valid signature without revealing the secret to the challenger device.