Method and system for authenticating messages

• US 7,370,197 B2
• Filed: 09/12/2002
• Issued: 05/06/2008
• Est. Priority Date: 07/12/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Huitema, Christian
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Yalew; Fikremarima
• Application Number:
  US10/242,705
• Publication Number:
  US 20040010683A1
• Time in Patent Office: 2,063 Days
• Field of Search: 713/162, 713/150, 713/176
• US Class Current: 713/162
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions

Abstract

A method and system for authenticating a message is described, in which the message contains a network address, at least a portion of which is a digital fingerprint. Embedded in the message is data, such as a code, that indicates the size of the digital fingerprint. A device receiving the message uses the size data and, for example, the public key of the sender to attempt to reproduce the digital fingerprint. If successful, the device receiving the message verifies the identity of the sender.

Claims

1. A method of operating a computer, the method being for authenticating messages, the method comprising:

creating a network address, at least a portion of which matches a result of a cryptographic function, the step of creating the network address comprising calculating a hash of a public key according to the cryptographic function to obtain the result, and using at least a portion of the result as at least a portion of the network address; and

indicating, within the address, how much of the created network address matches the result of the cryptographic function, the indicating step comprising populating at least a portion of the network address with a code representing the number of bits in length of the portion of the network address that is represented by the result.

2. The method of claim 1, further comprising creating a message, wherein the network address and the public key are included in the message.

3. The method of claim 1, wherein the portion of the result is used as at least a portion of a route prefix of the network address.

4. The method of claim 1, wherein the portion of the result is used as at least a portion of a node selectable portion of the network address.

5. A method of operating a computer, the method being for authenticating messages, the method comprising:

creating a network address, at least a portion of which matches a result of a cryptographic function;

indicating, within the address, how much of the created network address matches a result of the cryptographic function;

creating a message;

including a public key in the message;

calculating a hash of the public key according to the cryptographic function to obtain the result; and

including the network address in the message.

6. The method of claim 5, wherein the indicating step comprises setting one or more bits in the network address, wherein the number of bits set is proportional to the size of the portion of the network address that matches the result of the cryptographic function.

7. The method of claim 5, wherein at least a portion of the result is used as at least a portion of a route prefix of the network address.

8. The method of claim 5, wherein at least a portion of the result is used as at least a portion of a node selectable portion of the network address.

9. A method of operating a computer, the method being for authenticating messages, the method comprising:

creating a network address, at least a portion of which matches a result of a cryptographic function;

indicating, within the address, how much of the created network address matches the result of the cryptographic function;

creating a message;

including a public key in the message;

calculating a hash of the public key according to the cryptographic function to obtain the result;

using at least a portion of the result as a node selectable portion of the network address; and

inserting a code in the message, the code representing the number of bits of the address that matches the result.

10. The method of claim 9, wherein at least another portion of the result is used as at least a portion of a route prefix of the network address.

11. A method of operating a computer, the method being for authenticating messages, the method comprising:

creating a first portion of a network address according to a cryptographic function;

creating a second portion of the network address without using the cryptographic function;

creating a message comprising the first portion of the network address and the second portion of the network address;

indicating, within the message, the size of the first portion of the network address;

including a public key in the message;

calculating a hash of the public key according to the cryptographic function to obtain a result; and

using at least a portion of the result as the first portion of the network address; and

inserting a code within the message, the code representing the number of bits in length of the first portion.

12. A method of operating a computer, the method being for authenticating messages, the method comprising:

creating a first portion of a network address according to a cryptographic function, wherein the step of creating the first portion comprises calculating a hash of a public key according to the cryptographic function to obtain a result, and using at least a portion of the result as the first portion of the network address;

creating a second portion of the network address without using the cryptographic function;

creating a message comprising the first portion of the network address and the second portion of the network address;

indicating, within the message, the size of the first portion of the network address, wherein the indicating step comprises creating a third portion of the network address using a code representing the number of bits in length of the first portion, thereby indicating how many bits are to be used by a device to verify the sender of the message.

13. The method of claim 12, wherein the public key is included in the message.

14. A method for authenticating messages, the method comprising:

a sending device calculating a cryptographic hash of a public key;

the sending device creating a network address comprising a digital fingerprint made up of at least some portion of the cryptographic hash and a code indicating the number of bits that are in the digital signature;

a receiving device receiving a message from the sending device, the message comprising the digital fingerprint and the code indicating the size of the digital fingerprint;

the receiving device calculating a second cryptographic hash using the public key of the sending device and the code;

the receiving device comparing at least part of the second cryptographic hash with the digital fingerprint;

based on the comparing step, the receiving device complying with or ignoring the message.