SYSTEM AND METHOD FOR ENCRYPTION

• US 20180041333A1
• Filed: 06/02/2017
• Published: 02/08/2018
• Est. Priority Date: 06/12/2013
• Status: Active Grant

• Current Assignee: Cryptomathic Ltd
• Original Assignee: Cryptomathic Ltd
• Inventors: Forget, Guillaume, Pedersen, Torben Pryds, Landrock, Peter
• Granted Patent: US 9,900,148 B1
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/42 using separate channels for security data
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/06 the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method for validating a signature request for a first message M, comprising: receiving, a validation challenge (VC) from a signature creation device (SCD), the VC created by the SCD, in response to receiving the signature request and message M from a user, using a second message M′ which is based on message M and a secret shared between the SCD and user, the VC generated by encrypting message M′ using the secret; generating, the message M′ from the VC by decrypting the VC using the secret; displaying the message M′ to the user; receiving confirmation from the user that the displayed message M′ corresponds to the message M; generating, a validation code confirming the signature request to create a signature; and outputting the code to the SCD, to cause the SCD to generate the signature for the user for message M based on successfully verifying the code.

Claims

1-37. -37. (canceled)

38. A computer implemented method of validating a signature generation request for a first message M, the method comprising:

receiving, via an input-output system of a validation device, a validation challenge from a signature creation device, the validation challenge having been created by the signature creation device, in response to receiving said signature generation request and said first message M from a user, using a second message M′

which is based on the first message M and a first secret shared between said signature creation device and said user, wherein said validation challenge is generated by encrypting said second message M′

using said first shared secret;

generating, using a processor of the validation device, the second message M′

from the validation challenge by decrypting said validation challenge using said first shared secret;

displaying the second message M′

to the user on a display of the validation device;

receiving confirmation from the user via a user interface of the validation device that the second message M′

as displayed corresponds to the first message M;

generating, using the processor, a validation code confirming said signature generation request to create a digital signature; and

outputting the validation code via said input-output system to the signature creation device, to cause the signature creation device to generate the digital signature for the user for the first message M based on a successful verification of the validation code.

39. The method of claim 38, wherein said second message M′

is identical to said first message M.

40. The method of claim 38, further comprising generating said validation code using a second secret shared with the signature creation device.

41. The method of claim 40, further comprising generating said validation code using encryption with the second secret being a symmetric key.

42. The method of claim 38, wherein the signature creation device comprises an authentication and validation device, and the method further comprises receiving the validation challenge from an authentication and validation device.

43. The method of claim 42, further comprising outputting the validation code to the authentication and validation device.

44. The method of claim 38, further comprising receiving the validation challenge from a signature creation device.

45. A validation device for a user to validate a signature generation request for a first message M, the validation device comprising a memory storing instructions that configure the validation device to:

receive, via an input-output system of the validation device, a validation challenge from a signature creation device, the validation challenge having been created by the signature creation device, in response to receiving said signature generation request and said first message M from a user, using a second message M′

which is based on the first message M and a first secret shared between said signature creation device and said validation device, wherein said validation challenge is generated by encrypting said second message M′

using said first shared secret;

generate, using a processor of the validation device, the second message M′

from the validation challenge by decrypting said validation challenge using the first shared secret;

display the second message M′

to the user on a display of the validation device;

receive confirmation from the user via a user interface of the validation device that the second message M′

as displayed corresponds to the first message M;

generate, using said processor, a validation code confirming said signature generation request to create a digital signature; and

output the validation code via the input-output system to the signature creation device, to cause the signature creation device to generate the digital signature for the user for the first message M based on a successful verification of the validation code.

46. The validation device of claim 45, wherein said second message M′

is identical to said first message M.

47. The validation device of claim 45, wherein the validation device is further configured to generate said validation code using a second secret which is shared with the signature creation device and which is stored on the validation device.

48. The validation device of claim 47, wherein the validation device is further configured to generate said validation code using cryptographic methods with the second secret being a symmetric key.

49. The validation device of claim 45, wherein the signature creation device comprises an authentication and validation device, and the validation device is further configured to receive the validation challenge from the authentication and validation device.

50. The validation device of claim 49, wherein the validation device is further configured to output the validation code to the authentication and validation device.

51. The validation device of claim 45, wherein the validation device is further configured to receive the validation challenge from a signature creation device.