Secure file transfer

• US 7,707,424 B2
• Filed: 04/09/2002
• Issued: 04/27/2010
• Est. Priority Date: 04/09/2002
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Axelsson, Stefan
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US10/510,911
• Publication Number:
  US 20050204142A1
• Time in Patent Office: 2,940 Days
• Field of Search: None
• US Class Current: 713/179
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A method and apparatus are provided for identification/authentication of file transfers, that limits the attackers window of opportunity and that aims at incurring a minimum of overhead on the information processing between a client (CL) and a server (SV). According to a preferred embodiment of the invention hash functions (H1-H4) are involved at the server side and the client side. The client and server share a common secret value (S).

Claims

1. Method of authentication, wherein a client requests a file from a server, whereby the client and the server share a secret value and thereby belong to an accepted group, comprising the step of:

the client forms a first message including

a filename,

a nonce which is associated with the filename,

a first hash value according to a first hash function formed from the filename and the secret value;

further comprising the step of the server extracting

the filename of a received first message,

extracting the first hash value,

forming a value of the received filename and the secret value,

forming a second hash value according to the first hash function formed from the value of the filename and the secret value,

comparing the first hash value with the second hash value and if the values are the same, establishing that the first message stems from a client belonging to the accepted group, otherwise establishing that the client does not belong to the accepted group.

2. Method according to claim 1, the inputs to said first hash function are concatenated.

3. Method of authentication, wherein a client requests a file from a server, whereby the client and the server share a secret value and thereby belong to an accepted group, comprising the step of:

the client forms a first message including

a filename,

a nonce which is associated with the filename,

a first hash value according to a first hash function formed from the filename and the secret value;

wherein the server responds to the request from the client by forming a second message including

a file corresponding to the requested filename,

the received nonce which is associated with the given filename,

a third hash value according to a second hash function formed from the value of the received nonce and the secret value;

further comprising the step of the client

extracting the file of the received second message,

extracting the third hash value from the second message,

forming a value of the nonce associated with the filename and the secret value,

forming a fourth hash value according to the second hash function formed from the value of the nonce associated with the requested filename and the secret value,

comparing the third hash value with the fourth hash value and if the values are the same, establishing that the second message stems from a server belonging to the accepted group, otherwise establishing that the server does not belong to the accepted group.

4. Method according to claim 3, wherein the first hash function is the same as the second hash function.

5. A method of authentication, comprising:

a client sharing a secret value with a server, the client and the server thereby belonging to an accepted group, whereby

the client forms a first message comprising

a filename,

a nonce which is associated with the filename,

a first hash value according to a first hash function formed from the values of the filename and the secret value, and whereby

the client receives a second message from the server, the client

extracting a file of the received second message,

extracting a third hash value from the second message,

forming a value of the nonce and the secret value,

forming a fourth hash value according to a second hash function formed from the value of the nonce associated with the requested filename and the secret value,

comparing the third hash value with the fourth hash value and if the values are the same establishing that the second message stems from a server belonging to the accepted group, and if otherwise, establishing that the server does not belong to the accepted group.

6. A method of authentication, comprising:

a server sharing a secret value with a client, the client and the server thereby belonging to an accepted group, whereby the server receives a first message from the client, the server

extracting a filename and a nonce associated with the filename from the received first message,

extracting a first hash value from the received first message,

forming a value of the received filename and the secret value,

forming a second hash value according to the first hash function formed from the value of the filename and the secret value,

comparing the first hash value with the second hash value and if the values are the same establishing that the first message stems from a client belonging to the accepted group, otherwise establishing that the client does not belong to the accepted group.

7. The method according to claim 6, wherein the server responds by sending a second message comprising

a file corresponding to the requested filename,

a third hash value according to a second hash function formed from the value of the received nonce associated with the filename and the secret value.