CLIENT CREDENTIAL BASED SECURE SESSION AUTHENTICATION METHOD AND APPARATUS

• US 20080114983A1
• Filed: 11/15/2006
• Published: 05/15/2008
• Est. Priority Date: 11/15/2006
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: SHENFIELD, Michael, SHERKIN, Alexander
• Granted Patent: US 8,418,235 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226

Abstract

A method and apparatus for client credential based authentication of messages between a client and a server, the client and server both knowing the client credential, the method comprising the steps of: utilizing the client credential to create a key; and using the key to authenticate messages between the client and the server.

Claims

1. A method for client credential based authentication of messages between a client and a server, said client and server both knowing said client credential, the method comprising the steps of:

utilizing the client credential to create a key; and

using the key to authenticate messages between the client and the server.

2. The method of claim 1, wherein said client credential is a password.

3. The method of claim 1, wherein said key is created by repeating said password until a desired key length is achieved.

4. The method of claim 1, wherein said key is created by utilizing a hash function known to both the client and server.

5. The method of claim 4, wherein the results of the hash function are truncated to a desired key length.

6. The method of claim 2, wherein the password is combined with a security token prior to the creation of the key.

7. The method of claim 6, wherein the security token includes information provided by the client to the server offline, said information including one or more items selected from the group consisting of:

birthdate, birthplace, mother'"'"'s maiden name, and security answers.

8. The method of claim 1, wherein said utilizing step further combines the client credential with a session identifier to create the key.

9. The method of claim 1, wherein said utilizing step further combines the client credential with a nonce from an activation message.

10. The method of claim 1, wherein said creating of the key utilizes a secure pseudo-random number generator.

11. The method of claim 10, wherein the secure pseudo-random number generator uses the client credential as a seed.

12. The method of claim 11, wherein the pseudo-random number generator uses the client credential combined with a security token as a seed.

13. The method of claim 11, wherein the pseudo-random number generator uses the client credential combined with a session identifier as a seed.

14. The method of claim 11, wherein the pseudo-random number generator uses the client credential combined with a nonce as a seed.

15. The method of claim 1, wherein said using the key to authenticate messages comprises:

creating a message authentication code using the key and a message;

adding the message authentication code to the message to create a secure message; and

sending the secure message.

16. The method of claim 15, wherein said secure message is verified as authentic and unaltered by recreating the message authentication code upon receipt of the secure message and comparing the recreated message authentication code with the received message authentication code.

17. The method of claim 15, wherein said message is an activation request message and includes a client identifier.

18. The method of claim 15, wherein said message is an activation reply, and includes a session identifier.

19. The method of claim 15, wherein the message is an HTTP message, and the message authentication code is added to an HTTP footer.

20. The method of claim 1, further comprising the step of adding a sequence number to the message before said using step.

21. The method of claim 1, further comprising the step of negotiating a symmetric key utilizing said key created with said client credential.

22. A client device adapted for client credential based authentication of messages between the client device and a server, said client device and server both knowing said client credential, the client device comprising:

memory for storing the shared credential;

a processor communicating with said memory and adapted to;

utilize the client credential to create a key;

use the key and a message to create a message authentication code; and

add the message authentication code to the message to create a secure message; and

a communication subsystem adapted to send the secure message.

23. The client device of claim 22, wherein said client credential is a password.

24. The client device of claim 22, wherein said processor is adapted to create the key by repeating the password until a desired key length is achieved.

25. The client device of claim 22, wherein said processor is adapted to create the key by utilizing a hash function known to both the client and server.

26. The client device of claim 25, wherein the processor is further adapted to truncate the results of the hash function to a desired key length.

27. The client device of claim 23, wherein the processor is further adapted to combine the password with a security token prior to the creation of the key.

28. The client device of claim 27, wherein the security token includes information provided by the client device to the server offline, said information including one or more items selected from the group consisting of:

birthdate, birthplace, mother'"'"'s maiden name, and security answers.

29. The client device of claim 22, wherein said processor is adapted to combine the client credential with a session identifier to create the key.

30. The client device of claim 22, wherein the processor is further adapted to combine the client credential with a nonce from an activation message.

31. The client device of claim 22, wherein said processor is adapted to create the key utilizing a secure pseudo-random number generator.

32. The client device of claim 31, wherein the secure pseudo-random number generator uses the client credential as a seed.

33. The client device of claim 32, wherein the pseudo-random number generator uses the client credential combined with a security token as a seed.

34. The client device of claim 32, wherein the pseudo-random number generator uses the client credential combined with a session identifier as a seed.

35. The client device of claim 32, wherein the pseudo-random number generator uses the client credential combined with a nonce as a seed.

36. The client device of claim 22, wherein said message is an activation request message and includes a client identifier.

37. The client device of claim 22, wherein said message is an activation reply, and includes a session identifier.

38. The client device of claim 22, wherein the processor is further adapted to add a sequence number to the message.

39. The client device of claim 22, wherein said processor is further adapted to negotiate a symmetric key utilizing said key created with said client credential.

40. The client device of claim 22, wherein said client device is a mobile device.