METHOD FOR ESTABLISHING A SECURE COMMUNICATION CHANNEL

• US 20130301828A1
• Filed: 09/06/2011
• Published: 11/14/2013
• Est. Priority Date: 09/24/2010
• Status: Active Grant

• Current Assignee: Thales DIS France SA
• Original Assignee: Gemalto SA (Thales SA)
• Inventors: Gouget, Aline, Faher, Mourad
• Granted Patent: US 9,531,532 B2
• Time in Patent Office: Days
• US Class Current: 380/44
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1475 Passive attacks, e.g. eavesdropping or listening without modification of the traffic monitored
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

The present invention provides a method for establishing a secure communication channel between a client (C) and a remote server (S), said client (C) and remote server (S) exchanging data through an intermediate entity (G), said client (C) having a long-term key pair (sk_c,pk_c), said remote server generating an ephemeral key (sk_s,pk_s), the method comprising a mutual authentication step wherein the client (C) sends a public key (pk_c) of said long-term key pair (sk_c, pk_c) and the proof that said public key (pk_c) is valid to the server (S), and wherein the remote server (S) sends the public key (pk_s) of said ephemeral key pair (sk_s,pk_s) to the client (C). The client (C) generates an ephemeral key pair (skC_c,pkC_c) and sends the public key (pK_cc) of said ephemeral key pair (sk_cc,pk_cc) to the server (S) so as to generate a secret common to the client (C) and to the remote server (S) for opening the secure communication channel.

Claims

1. A method for establishing a secure communication channel between a client (C) and a remote server (S), said client (C) and remote server (S) exchanging data through an intermediate entity (G), said client (C) having a long-term key pair (sk_c,pk_c), the method comprising:

said remote server generating an ephemeral key (sk_s,pk_s), the method comprising a mutual authentication step wherein the client (C) sends a public key (pk_c) of said long-term key pair (sk_c, pk_c) and the proof that said public key (pk_c) is valid to the server (S), and wherein the remote server (S) sends the public key (pks) of said ephemeral key pair (sk_s, pk_s) to the client (C), the client (C) generates an ephemeral key pair (sk_cc,pk_cc) and sends the public key (pk_cc) of said ephemeral key pair (sk_cc,pk_cc) to the server (S) so as to generate a secret common to the client (C) and to the remote server (S) for opening the secure communication channel.

2. The method for establishing a secure communication channel between a client (C) and a remote server (S) according to claim 1, comprising generating said common secret by the client (C) and by the server (S), said common secret being based on the ephemeral secret key (sk_cc) of said ephemeral key pair (sk_cc,pk_cc) of the client (C).

3. The method for establishing a secure communication channel between a client (C) and a remote server (S) according to one of the previous claims, comprising generating the common secret according to the Diffie-Hellman protocol.

4. A method for establishing a secure communication channel between a client (C) and a remote server (S) according to claim 1 or 2, comprising using a gateway or a middle-ware as intermediate entity (G).

5. A method for establishing a secure communication channel between a client (C) and a remote server (S) according to claim 1 or 2, comprising using a smartcard as client (C).

6. A method for establishing a secure communication channel between a client (C) and a remote server (S) according to claim 5, comprising using a middle-ware acting as a gateway (G) hosted on a smartcard host.

7. A method for establishing a secure communication channel between a client (C) and a remote server (S) according to claim 1 or 2, comprising establishing a secure communication channel between the client (C) and the intermediate entity (G).

8. A method for establishing a secure communication channel between a client (C) and a remote server (S) according to claim 4, comprising establishing a secure communication channel between the intermediate entity (G) and the remote server (S).

9. A method for establishing a secure communication channel between a client (C) and a remote server (S) according to claim 3, comprising using a gateway or a middle-ware as intermediate entity (G).

10. A method for establishing a secure communication channel between a client (C) and a remote server (S) according to claim 3, comprising using a smartcard as client (C).

11. A method for establishing a secure communication channel between a client (C) and a remote server (S) according to claim 4, comprising using a smartcard as client (C).