CRYPTOGRAPHIC METHOD FOR ANONYMOUS AUTHENTICATION AND SEPARATE IDENTIFICATION OF A USER

• US 20120072732A1
• Filed: 06/11/2010
• Published: 03/22/2012
• Est. Priority Date: 06/12/2009
• Status: Active Grant

• Current Assignee: Orange S.A.
• Original Assignee: Orange S.A.
• Inventors: Canard, Sébastien, Malville, Eric, Jambert, Amandine
• Granted Patent: US 8,650,403 B2
• Time in Patent Office: Days
• US Class Current: 713/176
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3247 involving digital signatures

Abstract

The invention relates to cryptographic method for the anonymous authentication and the identification of a user entity (U_i) respectively by a checking entity (D) and an identifying entity (O). According to this method, the checking entity (D) receives (130) from the user entity (U1) at least one first signature (σ) and a first message (m), and checks (140) the first signature (σ) using the first message (m) in order to authenticate the user (U), and the identifying entity (O) receives (150) from the checking entity (D) a second signature (σ′) connected to the first signature (σ) and identifies (160) the user using the second signature and a secret key particular thereto. The invention also relates to a cryptographic system for implementing said method.

Claims

1. A cryptographic method for anonymous authentication and identification of a user entity by a checking entity and an identifying entity respectively, wherein:

the checking entity receives from the user entity at least one first signature and a first message and verifies the first signature by means of the first message in order to authenticate the user entity; and

the identifying entity receives from the checking entity a second signature linked to the first signature and identifies the user entity by means of the second signature and a secret key specific to the identifying entity.

2. The cryptographic method according to claim 1, wherein the checking entity generates the second signature from the first signature as a function of at least a first part of the first message received.

3. The cryptographic method according to claim 2, wherein the checking entity generates a second message from the first message (m) by replacing the first part of the first message with substitution data and sends the second message to the identifying unit.

4. The cryptographic method according to claim 3, wherein the checking entity is able to provide a service to the user entity if the checking entity authenticates the user entity wherein the identifying entity is able to invoice the user entity for this service, and wherein the first part indicates a service requested by the user entity and the second message comprises at least one part indicating the invoicing level related to the requested service.

5. The cryptographic method according to claim 4, wherein the substitution data comprises the part indicating the invoicing level related to the requested service.

6. The cryptographic method according to claim 4, wherein the first message comprises a second part indicating the invoicing level related to the requested service, and wherein the substitution data of the first message is sent by the user entity to the checking entity.

7. The cryptographic method according to claim 6, wherein it comprises, in the identifying entity, the verification of the second signature by means of the second message.

8. The cryptographic method according to claim 1, wherein the first message comprises a first part, wherein, in the user entity, the first signature is generated as a function of the first message and the second signature is generated as a function of a second message, said second message corresponding to the first message in which the first part has been replaced by substitution data.

9. The cryptographic method according to claim 8, wherein the second signature comprises at least one supplemental part comprised in the first signature (σ

), wherein said method comprises a verification step in the verification entity, to verify that the first and second signatures comprise said supplemental part.

10. The cryptographic method according to claim 8, wherein the checking entity is able to provide a service to the user entity if the checking entity authenticates the user entity, wherein the identifying entity is able to invoice the user entity for this service, and wherein said first part indicates a service requested by the user entity and said substitution data indicates an invoicing level related to the requested service.

11. The cryptographic method according to claim 1, wherein a preliminary step of registering the user entity with a management entity in which the user entity obtains at least one element from the management entity, said element being used to generate the first signature.

12. The cryptographic method according to claim 11, wherein said element is a certificate generated by the management entity as a function of a random number generated by the user entity.

13. The cryptographic method according to claim 12, wherein the management entity provides the certificate to the identifying entity and wherein the identification of the user entity is done using at least a part of the certificate, a secret key specific to the identifying entity, and at least a part of the second signature.

14. A cryptographic system for the separate authentication and identification of a user entity, comprising at least one user entity and a checking entity and an identifying entity, said system being able to implement a cryptographic method according to claim 1.

15. A cryptographic for the separate authentication and identification of a user entity according to claim 14, wherein it additionally comprises a management entity and is able to implement a cryptographic method according to claim 11.