METHOD AND SYSTEM FOR SECURE COMMUNICATION

• US 20110208965A1
• Filed: 02/16/2011
• Published: 08/25/2011
• Est. Priority Date: 02/24/2010
• Status: Active Grant

• Current Assignee: IQVIA, Inc. (IQVIA Holdings, Inc.)
• Original Assignee: Diversinet Corporation
• Inventors: MACHANI, Salah
• Granted Patent: US 9,077,521 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

A system and method for secure communication is provided. Outgoing messages to another computing device are encrypted using a first shared key shared with said other computing device, and a first counter, said first shared key and said first counter being stored in storage of a computing device. Incoming messages from said other computing device are decrypted using said first shared key and a second counter stored in said storage of said computing device.

Claims

1. A method for secure communication, comprising:

encrypting outgoing messages to another computing device using a first shared key shared with said other computing device, and a first counter, said first shared key and said first counter being stored in storage of a computing device; and

decrypting incoming messages from said other computing device using said first shared key and a second counter stored in said storage of said computing device.

2. The method of claim 1, further comprising:

generating a first hash-based message authentication code from said first shared key and a first value of said first counter;

generating a second hash-based message authentication code from said first shared key and a second value of said first counter; and

generating a first encryption key as a first function of said first hash-based message authentication code and said second hash-based message authentication code,

wherein said encrypting comprises encrypting using said first encryption key.

3. The method of claim 1, further comprising:

generating a first one-time password using a second shared key and said first counter.

4. The method of claim 3, further comprising:

communicating said first one-time password to said other computing device to enable determination of the value of said first counter.

5. The method of claim 2, wherein said first function includes at least a portion of a concatenation of said first and second hash-based message authentication codes.

6. The method of claim 2, further comprising:

combining said first encryption key with an initialization vector for encrypting said message.

7. The method of claim 6, wherein said encrypting comprises:

generating an initialization vector as a second function of at least one of said first and second hash-based message authentication codes; and

encrypting said message using said first encryption key concatenated with said initialization vector.

8. The method of claim 7, wherein said generating comprises setting said initialization vector as a portion of said second hash-based message authentication code.

9. The method of claim 1, further comprising:

communicating an identifier for said first shared key and said first counter with said encrypted message.

10. The method of claim 1, further comprising:

receiving a second one-time password from said other computing device; and

synchronizing said second counter using said second one-time password.

11. The method of claim 10, further comprising:

generating a third hash-based message authentication code from said first shared key and a first value of said second counter;

generating a fourth hash-based message authentication code from said first shared key and a second value of said second counter; and

generating a second encryption key as a first function of said third hash-based message authentication code and said fourth hash-based message authentication code,

wherein said decrypting comprises decrypting using said second encryption key.

12. A system for secure communication, comprising:

a computing device having a storage storing a first shared key, and a first counter and a second counter, and a processor executing an encryption module, said encryption module for encrypting outgoing messages to another computing device using the first shared key and for decrypting incoming messages from said other computing device using said first shared key and said second counter, said other computing device also storing said first shared key and said first and second counters.

13. The system of claim 12, wherein said encryption module generates a first hash-based message authentication code from said first shared key and a first value of said first counter, and a second hash-based message authentication code from said first shared key and a second value of said first counter, said encryption module generating a first encryption key as a first function of said first hash-based message authentication code and said second hash-based message authentication code, and encrypting one of said outgoing messages using said first encryption key, said encryption module causing said network interface to communicate said one encrypted outgoing message.

14. The system of claim 12, wherein said encryption module generates a first one-time password using a second shared key and said first counter.

15. The system of claim 14, wherein said computing device communicates said first one-time password to said other computing device to enable determination of the value of said first counter.

16. The system of claim 13, wherein said first function includes at least a portion of a concatenation of said first and second hash-based message authentication codes.

17. The system of claim 13, wherein said encryption module combines said first encryption key with an initialization vector for encrypting said one outgoing message.

18. The system of claim 17, wherein said encryption module generates an initialization vector as a second function of at least one of said first and second hash-based message authentication codes, and encrypts said one outgoing message using said first encryption key concatenated with said initialization vector.

19. The system of claim 18, wherein said encryption module sets said initialization vector as a portion of said second hash-based message authentication code.

20. The system of claim 12, wherein said encryption module communicates an identifier for said shared key and said first counter with said one encrypted outgoing message.

21. The system of claim 12, wherein said encryption module synchronizes said second counter with said other computing device using a second one-time password received therefrom.

22. The system of claim 21, wherein said encryption module generates a third hash-based message authentication code from said first shared key and a first value of said second counter, a fourth hash-based message authentication code from said first shared key and a second value of said second counter, and a second encryption key as a first function of said third hash-based message authentication code and said fourth hash-based message authentication code, wherein said encryption module decrypts one of said incoming messages using said second encryption key.