METHODS AND SYSTEMS FOR SECURE CHANNEL INITIALIZATION

• US 20090164774A1
• Filed: 12/21/2007
• Published: 06/25/2009
• Est. Priority Date: 12/21/2007
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Sherkin, Alexander
• Granted Patent: US 8,495,375 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/3066 involving algebraic varieties, e.g. elliptic or hyper-elliptic curves

Abstract

Methods and systems for secure channel initialization between a client network element and a server network element are disclosed. In accordance with one embodiment of the present disclosure, the method includes: sending a secure channel initialization request from the client network element to the server network element; receiving the secure channel initialization request at the server network element; creating a server credential and a client credential at the server network element; and sending a secure channel initialization response from the server network element to the client network element, the secure channel initialization response including the server credential and the client credential, wherein said server credential and said client credential are used to establish a secure session.

Claims

1. A method for secure channel initialization for a client network element, the method comprising:

sending a secure channel initialization request from the client network element; and

receiving a secure channel initialization response at the client network element, the secure channel initialization response including a server credential and a client credential

wherein said server credential and said client credential are used to establish a secure session.

2. The method of claim 1, wherein the server credential and client credential comprise Secure Socket Layer/Transport Layer Security Certificates.

3. The method of claim 1, wherein the client credential comprises a user name and password.

4. The method of claim 1 wherein the client network element has a shared low-entropy secret.

5. The method of claim 4, wherein the sending of a secure channel initialization request includes sending a client ephemeral public key.

6. The method of claim 1, wherein the secure channel initialization response includes a payload that is encrypted and includes a message authentication code ‘

MAC’

.

7. The method of claim 6, wherein the secure channel initialization response further includes an ephemeral public key for a server network element.

8. The method of claim 7, wherein the client network element utilizes the ephemeral public key of the server network element to create the high-entropy shared secret to decrypt the payload and verify the MAC in the secure channel initialization response.

9. The method of claim 6, wherein encryption utilizes Simple Password Exponentiation Key Exchange.

10. The method of claim 6, wherein encryption utilizes Elliptical Curve Simple Password Exponentiation Key Exchange.

35. A computer readable medium storing program code executable by a processor of a computing system for causing said computing system to perform the method of claim 1.

11. A method for secure channel initialization for a server network element, the method comprising:

receiving a secure channel initialization request at the server network element;

creating a server credential and a client credential at the server network element; and

sending a secure channel initialization response from the server network element, the secure channel initialization response including the server credential and the client credential,

wherein said server credential and said client credential are used to establish a secure session.

12. The method of claim 11, wherein the server credential and client credential comprise Secure Socket Layer/Transport Layer Security Certificates.

13. The method of claim 12, wherein the client credential is created for every secure channel initialization request.

14. The method of claim 11, wherein the client credential comprises a user name and password.

15. The method of claim 14, wherein the client user name and password are generated by the server network element and added as a valid user account on the server network element for every secure channel initialization request

16. The method of claim 11 wherein the server network element has a low-entropy secret.

17. The method of claim 16, wherein the secure channel initialization request includes a client ephemeral public key.

18. The method of claim 17 wherein the server network element utilizes the client ephemeral public key to create a high-entropy shared secret.

19. The method of claim 18, wherein the high-entropy shared secret is utilized to create a MAC and encrypt a payload for the secure channel initialization response.

20. The method of claim 19, wherein the secure channel initialization response further includes an ephemeral public key for the server network element, said ephemeral public key for the server network element being created utilizing the low-entropy shared secret.

21. A client network element adapted for secure channel initialization, the client network element comprising a processor;

a communications subsystem; and

memory;

the client network element being adapted to;

send from said communications subsystem a secure channel initialization request;

receive at the communications subsystem a secure channel initialization response at the client network element, the secure channel initialization response including a server credential and a client credential,

wherein said server credential and said client credential are used to establish a secure session.

22. The client network element of claim 21, wherein the server credential and client credential comprise Secure Socket Layer/Transport Layer Security Certificates.

23. The client network element of claim 21, wherein the client credential comprises a user name and password.

24. The client network element of claim 21 further adapted to store the client credential in a trust store in the memory of the client network element.

25. The client network element of claim 21, wherein client network element has a shared low-entropy secret.

26. The client network element of claim 25, wherein the processor of the client network element is further adapted to decrypt an encrypted secure channel initialization response using the shared low-entropy secret and a Simple Password Exponentiation Key Exchange.

27. The client network element of claim 25, wherein the processor of the client network element is further adapted to decrypt an encrypted secure channel initialization response using the shared low-entropy secret and an Elliptical Curve Simple Password Exponentiation Key Exchange.

28. A server network element adapted for secure channel initialization, the server network element comprising a processor;

a communications subsystem; and

memory;

the server network element being adapted to;

receive at the communications subsystem a secure channel initialization request;

create at the processor a server credential and a client credential at the server network element; and

send from the communications subsystem a secure channel initialization response, the secure channel initialization response including the server credential and the client credential,

wherein said server credential and said client credential are used to establish a secure session.

29. The server network element of claim 28, wherein the server credential and client credential comprise Secure Socket Layer/Transport Layer Security Certificates.

30. The server network element of claim 28, wherein the client credential comprises a user name and password.

31. The server network element of claim 28 further adapted to store the client credential in a trust store in the memory of the server network element.

32. The server network element of claim 28, wherein the server network element has a shared low-entropy secret.

33. The server network element of claim 32, wherein the processor of the server network element is further adapted to encrypt the secure channel initialization response using the low-entropy secret and a Simple Password Exponentiation Key Exchange.

34. The server network element of claim 32, wherein the processor of the server network element is further adapted to encrypt the secure channel initialization response using the low-entropy secret and an Elliptical Curve Simple Password Exponentiation Key Exchange.

36. A method for secure channel initialization between a client network element and a server network element, the method comprising the steps of:

sending a secure channel initialization request from the client network element to the server network element;

receiving the secure channel initialization request at the server network element;

creating a server credential and a client credential at the server network element; and

sending a secure channel initialization response from the server network element to the client network element, the secure channel initialization response including the server credential and the client credential,

wherein said server credential and said client credential are used to establish a secure session.

37. The method of claim 36, wherein the server credential and client credential are Secure Socket Layer/Transport Layer Security Certificates.

38. The method of claim 36, wherein the client credential is a user name and password.

39. The method of claim 36 wherein the server network element and client network element share a low-entropy secret.

40. The method of claim 39, wherein the sending of a secure channel initialization request includes sending a client ephemeral public key.

41. The method of claim 40 wherein the server network element utilizes the client ephemeral public key to create a high-entropy shared secret.

42. The method of claim 41, wherein the high-entropy shared secret is utilized to create a MAC and encrypt a payload for the secure channel initialization response.

43. The method of claim 42, wherein the secure channel initialization response further includes an ephemeral public key for the server, said ephemeral public key for the server being created utilizing the low-entropy shared secret.

44. The method of claim 43, wherein the client network element utilizes the ephemeral public key of the server to create the high-entropy shared secret to decrypt the payload and verify the MAC in the secure channel initialization response.

45. The method of claim 44, wherein encryption utilizes Simple Password Exponentiation Key Exchange

46. The method of claim 44, wherein encryption utilizes Elliptical Curve Simple Password Exponentiation Key Exchange.

47. A system for secure channel initialization comprising:

a client network element, the client network element having a processor;

a communications subsystem; and

memory; and

a server network element, the server network element having;

a processor;

a communications subsystem; and

memory,

the system being adapted to;

send a secure channel initialization request from the communications subsystem of client network element to the communications subsystem of the server network element;

create, using the processor of the server network element, a server credential and a client credential; and

send a secure channel initialization response from the server network element to the client network element, the secure channel initialization response including the server credential and the client credential,

wherein said server credential and said client credential are used to establish a secure session.

48. The system of claim 47, wherein the server credential and client credential are Secure Socket Layer/Transport Layer Security Certificates.

49. The system of claim 47, wherein the client credential is a user name and password.

50. The system of claim 47 further adapted to store the client credential in a trust store in the memory of the server network element and storing the server credential in a trust store of the memory of the client network element.

51. The system of claim 47, wherein the server network element and client network element share a low-entropy secret.