A Method and Apparatus for Anonymous and Trustworthy Authentication in Pervasive Social Networking

• US 20160127341A1
• Filed: 06/25/2013
• Published: 05/05/2016
• Est. Priority Date: 06/25/2013
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Technologies Oy (Nokia Corporation)
• Inventors: Yan, Zheng
• Granted Patent: US 10,291,587 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/601 Broadcast encryption
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees
• CPC Class Codes: H04W 4/21 for social networking applications

Abstract

A method for anonymous authentication may comprise: issuing token information to a first node registered with a network entity, wherein the token information indicates one or more tokens for the first node; distributing a token list to a plurality of nodes registered with the network entity, wherein the token list is associated with respective tokens for the plurality of nodes comprising at least the first node and a second node, and wherein the token information and the token list are used for an anonymous authentication between the first node and the second node.

Claims

1-55. -55. (canceled)

56. An apparatus, comprising:

at least one processor; and

at least one memory comprising computer program code,

the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following;

issuing token information to a first node registered with the apparatus, wherein the token information indicates one or more tokens for the first node;

distributing a token list to a plurality of nodes registered with the apparatus, wherein the token list is associated with respective tokens for the plurality of nodes comprising at least the first node and a second node, and wherein the token information and the token list are used for an anonymous authentication between the first node and the second node.

57. The apparatus according to claim 56, wherein the one or more tokens for the first node comprise:

a first token for the first node, at least one backup token of the first token, or a combination thereof; and

wherein the respective tokens for the plurality of nodes comprise at least;

the first token for the first node, the at least one backup token of the first token, a second token for the second node, and at least one backup token of the second token.

58. The apparatus according to claim 57, wherein the first token comprises:

a first validity period, and a pseudonym identifier and a trust value of the first node corresponding to the first validity period; and

wherein a backup token of the first token comprises;

an extended first validity period, and a pseudonym identifier and a trust value of the first node corresponding to the extended first validity period.

59. The apparatus according to claim 58, wherein the trust value of the first node corresponding to the extended first validity period is set based at least in part on an analysis of a change trend within the extended first validity period according to a trust value change pattern generated based at least in part on historical statistics for the first node.

60. The apparatus according to claim 56, wherein the token list is updated based at least in part on a change of the respective tokens for the plurality of nodes.

61. The apparatus according to claim 56, wherein the token list comprises an aggregated list of hashed tokens, which is certified by the apparatus.

62. The apparatus according to claim 56, wherein the apparatus comprises a trusted server which is authorized for social networking participated by the plurality of the nodes.

63. An apparatus, comprising:

at least one processor; and

at least one memory comprising computer program code,

the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus to perform at least the following;

obtaining token information from a network entity with which the apparatus is registered, wherein the token information indicates one or more tokens for the apparatus;

generating security information for the apparatus based at least in part on the token information; and

sending a message with authentication information to another apparatus from the apparatus, wherein the authentication information is associated with the security information and used for an anonymous authentication between the apparatus and the another apparatus.

64. The apparatus according to claim 63, wherein the one or more tokens for the apparatus comprise:

a first token for the apparatus, at least one backup token of the first token, or a combination thereof.

65. The apparatus according to claim 64, wherein the first token comprises:

a first validity period, and a pseudonym identifier and a trust value of the apparatus corresponding to the first validity period;

and wherein a backup token of the first token comprises;

an extended first validity period, and a pseudonym identifier and a trust value of the apparatus corresponding to the extended first validity period.

66. The apparatus according to claim 63, wherein the security information comprises a short-lived public and private key pair for the apparatus.

67. The apparatus according to claim 66, wherein the authentication information comprises:

the short-lived public key of the apparatus, and a signature generated by using the short-lived private key of the apparatus.

68. A computer program product comprising a computer-readable medium bearing computer program code embodied therein for use with a computer, the computer program code comprising:

code for obtaining token information from a network entity with which a first node is registered, wherein the token information indicates one or more tokens for the first node;

code for generating security information for the first node based at least in part on the token information; and

code for sending a message with authentication information to a second node from the first node, wherein the authentication information is associated with the security information and used for an anonymous authentication between the first node and the second node.

69. The computer program product according to claim 68, wherein the one or more tokens for the first node comprise:

a first token for the first node, at least one backup token of the first token, or a combination thereof.

70. The computer program product according to claim 69, wherein the first token comprises:

a first validity period, and a pseudonym identifier and a trust value of the first node corresponding to the first validity period; and

wherein a backup token of the first token comprises;

an extended first validity period, and a pseudonym identifier and a trust value of the first node corresponding to the extended first validity period.

71. The computer program product according to claim 68, wherein the security information comprises a short-lived public and private key pair for the first node.

72. The computer program product according to claim 71, wherein the authentication information comprises:

the short-lived public key of the first node, and a signature generated by using the short-lived private key of the first node.