METHOD OF ESTABLISHING PROTECTED ELECTRONIC COMMUNICATION BETEEN VARIOUS ELECTRONIC DEVICES, ESPECIALLY BETWEEN ELECTRONIC DEVICES OF ELECTRONIC SERVICE PROVIDERS AND ELECTRONIC DEVICES OF USERS OF ELECTRONIC SERVICE

• US 20100205661A1
• Filed: 07/04/2008
• Published: 08/12/2010
• Est. Priority Date: 10/12/2007
• Status: Active Grant

• Current Assignee: Aducid S.R.O.
• Original Assignee: Anect A.S.
• Inventors: Neumann, Libor
• Granted Patent: US 8,353,010 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: H04L 2463/081 applying self-generating credentials, e.g. instead of receiving credentials from an authority or from another peer, the credentials are generated at the entity itself
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273

Abstract

A method of establishing protected electronic communication between various electronic devices equips users beforehand with a personal electronic identity gadget bearing no information about the user identity. Only at the first connection of the blank personal gadget to the electronic devices of an arbitrary electronic service provider, and/or to local electronic devices, the personal electronic identity gadget and the electronic devices and/or the local electronic devices mutually generate a verifiable electronic identity, which is stored in the personal electronic identity gadget and in the electronic devices and/or local electronic devices, for the needs of further mutual electronic communication, separately from other identities and without the knowledge of personal data about the user. Consequently only the generated and stored information is utilized for verification of the identity at every subsequent connection of the user to the electronic devices of the given electronic service provider and/or to the local electronic devices.

Claims

1. A method of establishing protected electronic communication between various electronic devices, especially between electronic devices of electronic service providers and electronic devices of users of electronic service and/or between local electronic devices and electronic devices of users of electronic service, wherein users of electronic service are beforehand equipped with a personal electronic identity gadget bearing no information about the user identity, and only at the first connection of the blank personal gadget to the electronic devices of an arbitrary electronic service provider, and/or to the local electronic devices, the personal electronic identity gadget and the electronic devices of the electronic service provider, and/or the local electronic devices mutually generate a verifiable electronic identity, which is stored in the personal electronic identity gadget and in the electronic devices of the electronic service provider, and/or in the local electronic devices, for the needs of further mutual electronic communication, separately from other identities and without the knowledge of personal data about the user of electronic service, whereas consequently only the generated and stored information is utilized for verification of the identity at every subsequent connection of the user of electronic service to the electronic devices of the given electronic service provider and/or to the local electronic devices.

2. The method according to claim 1, wherein the stored information is utilized for identity verification upon every subsequent connection of the user of electronic service to the electronic devices of the electronic service provider and/or to the local electronic devices prior to every change of the verifiable electronic identity, upon which the identifier is replaced by another identifier without losing the identity and personified context.

3. The method according to claim 1, wherein after providing personal data to the electronic devices of the electronic service provider and/or local electronic device, and after the consent of the user of electronic service with its handover to the electronic devices of at least one other electronic service provider and/or local electronic device, a temporary one-shot electronic identity is generated, by the personal electronic identity gadget together with electronic devices of the participating electronic service providers and/or together with local electronic devices, intended for the realisation realization of the handover of user personal data between the participating electronic service providers and/or local electronic devices.

4. The method according to claim 1, wherein the generation of verifiable electronic identity and identity verification is done symmetrically in such a manner, that by a combination of one part of the identifier generated by the personal electronic identity gadget and the second part of the identifier generated by electronic devices of the electronic service providers or local electronic devices, an identifier is created, which cannot be created and/or verified by either party alone, without the cooperation of the opposite party, whereas the personal electronic identity gadget verifies the identity on the side of the user of electronic service with the use of secret information connected with the identity, handed over by electronic devices of the electronic service providers or local electronic devices, and vice versa, the electronic devices of the electronic service providers or local electronic devices verify the identity on the side of the electronic service provider or at the side of the local electronic device with the use of secret information connected with the identity, handed over by the personal electronic identity gadget, and only after successful verification of the identifiers of both parties, the identity is considered as verified.

5. The method according to claim 1, wherein the execution of asymmetric cryptography with standard key pairs is realized with absence of all data structures containing personal data and in the absence of procedures and activities connected with such personal data.

6. The method according to claim 1, wherein in case of incorrect or unsuccessful activation of the personal electronic identity gadget, a self-destruction mechanism can be triggered, resulting in cancellation of the validity of the identification contained both in the personal electronic identity gadget on the side of the user of electronic service and in the electronic devices of the electronic service providers and/or local electronic devices on the side of the electronic service provider and/or local electronic devices.