Method and apparatus for efficiently initializing secure communications among wireless devices

• US 6,886,095 B1
• Filed: 05/21/1999
• Issued: 04/26/2005
• Est. Priority Date: 05/21/1999
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Hind, John Raithel, Peters, Marcia Lambert
• Primary Examiner(s): Song, Hosuk
• Application Number:
  US09/316,805
• Time in Patent Office: 2,167 Days
• Field of Search: 713/150, 713/156, 713168-170, 713/171, 713/173, 713/176, 713/189, 713/175, 380/277, 380/278, 380/279, 380/282, 380/285
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A method and system for efficiently establishing secure communications between mobile devices in a radio network. The present invention utilizes public key cryptography and unique hardware identifiers to enable authorizations for access to wireless networks, such as picocells. The present invention prevents the mobile user from maintaining a plurality of secrets such as user identifier/password pairs, PINs, or encryption keys, for access to each device to which he might require access.

Claims

1. A method for initializing secure communications between a first device and a second device, said first and second devices each having a public key of a Certificate Authority and a device certificate, said device certificate having a unique hardware identifier associated with said respective device, and a public key associated with said respective device, said method comprising the steps of:

establishing a session between said first device and said second device;

negotiating two-way session encryption and mutual authentication requirements between said first and said second device;

exchanging device certificates of said first device and said second device;

cryptographically verifying the received certificate using the public key of said Certificate Authority;

exchanging challenges created by each of said first and second devices;

responding to said respective challenges by signing said received challenge, using the receiving device'"'"'s private key, said private keys residing in the respective protected write-only storage in each said device;

returning said signed challenges;

cryptographically verifying that said received challenge signature is of the challenge previously sent by said receiving device;

establishing a key agreement between said first and second devices; and

,

establishing secure communications if all of said prior verifying steps succeed.

2. A method as claimed in claim 1 wherein said first established session is non-secure.

3. A method as claimed in claim 1 wherein said first established session is an authenticated connection.

4. A method as claimed in claim 1 wherein said first established session is an encrypted connection.

5. A method as claimed in claim 1 wherein said unique hardware identifier is a machine (MAC) address for said associated device.

6. A method as claimed in claim 1 wherein said write-only storage is a write-only storage with the ability to perform computations involving previously-written data.

7. A method as claimed in claim 1 wherein said public key of a certificate Authority is a public key of a root Certificate Authority.

8. A program for initializing secure communications between a first device and a second device, said first and second devices each having a public key of a Certificate Authority and a device certificate, said device certificate having a unique hardware identifier associated with said respective device, and a public key associated with said respective device, said program code comprising:

computer program code means for establishing a session between said first device and said second device;

computer program code means for negotiating two-way session encryption and mutual authentication requirements between said first and said second device;

computer program code means for exchanging device certificates of said first device and said second device;

computer program code means for cryptographically verifying the received certificate using the public key of said Certificate Authority;

computer program code means for exchanging challenges created by each of said first and second devices;

computer program code means for responding to said respective challenges by signing said received challenge, using the receiving device'"'"'s private key, said private keys residing in respective write-only storage in each said device;

computer program code means for returning said signed challenges;

computer program code means for cryptographically verifying that said received challenge signature is of the challenge previously sent by said receiving device;

computer program code means for establishing a key agreement between said first and said second devices; and

,

computer program code means for establishing secure communications if all of said prior verifying steps succeed.

9. A program as claimed in claim 8 wherein said first established session is non-secure.

10. A program as claimed in claim 8 wherein said first established session is an authenticated connection.

11. A program as claimed in claim 8 wherein said first established session is an encrypted connection.

12. A program as claimed in claim 8 wherein said unique hardware identifier is a machine (MAC) address for said associated device.

13. A program as claimed in claim 8 wherein said write only storage is a write-only storage with the ability to perform computations involving previously-written data.

14. A program as claimed in claim 8 wherein said public key of a Certificate Authority is a public key of a root Certificate Authority.

15. A system for initializing secure communications between a first device and a second device, said first and second devices each having a public key of a Certificate Authority and a device certificate, said device certificate having a unique hardware identifier associated with said respective device, and a public key associated with said respective device, said system comprising:

a communications mechanism for establishing a session between said first device and said second device, negotiating two-way session encryption and mutual authentication requirements between said first and said second device, and exchanging device certificates of said first device and said second device;

a verifier for cryptographically verifying the received certificate using the public key of said Certificate Authority;

a negotiation mechanism for exchanging challenges created by each of said first and second devices, responding to said respective challenges by signing said received challenge, using the receiving device'"'"'s private key, said private keys residing in the respective write-only storage in each said device, returning said signed challenges,

crytographically verifying that said received challenge signature is of the challenge previously sent by said receiving device, establishing a key agreement between said first and said second devices; and

, establishing secure communications if all of said prior verifying steps succeed.

16. A system as claimed in claim 15 wherein said first established session is non-secure.

17. A system as claimed in claim 15 wherein said first established session is an authenticated connection.

18. A system as claimed in claim 15 wherein said first established session in an encrypted connection.

19. A system as claimed in claim 15 wherein said unique hardware identifier is a machine (MAC) address for said associated device.

20. A system as claimed in claim 17 wherein said write-only storage with the ability to perform computations involving previously-written data.

21. A system as claimed in claim 15 wherein said public key of a Certificate Authority is a public key of a root Certificate Authority.