Method and system with authentication, revocable anonymity and non-repudiation

• US 7,840,813 B2
• Filed: 11/14/2003
• Issued: 11/23/2010
• Est. Priority Date: 11/14/2002
• Status: Expired due to Fees

• Current Assignee: Orange S.A.
• Original Assignee: Orange S.A.
• Inventors: Traore, Jacques, Canard, Sebastien, Guilloteau, Stephane, Malville, Eric
• Primary Examiner(s): Korzuch; William R
• Assistant Examiner(s): Vaughan; Michael R
• Application Number:
  US10/534,857
• Publication Number:
  US 20060155985A1
• Time in Patent Office: 2,566 Days
• Field of Search: 380/277, 703/17, 705/26, 705/37, 705/44, 705/64, 705/74, 705/76, 705/401, 707/9, 707/202, 709/221, 709/225, 713/155, 713/156, 713/158, 713/168, 713/170, 713/172, 713/180, 726/10, 726/27
• US Class Current: 713/176
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06Q 20/383 Anonymous user system
• CPC Class Codes: G06Q 40/04 Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3255 using group based signatures, e.g. ring or threshold signatures

Abstract

The present invention relates to a method of access to a service consisting in i) identifying and registering a client (C), ii) authenticating the client to an anonymous certification authority, iii) authenticating the client by producing an anonymous signature and opening and maintaining an anonymous authentication session with a server (Se), and iv) selectively allowing contact between the server (Se) and the anonymous certification authority (ACA) to revoke the anonymity of the client (C) using the signature provided in step iii). The invention also relates to a system for opening and maintaining an authentication session guaranteeing non-repudiation.

Claims

1. A method of accessing a service with authentication and revocable anonymity, comprising the steps of:

i) identifying and registering a client and providing the client with means for authenticating the client to an anonymous certification authority;

ii) authenticating the client to the anonymous certification authority using the means provided in step i) and supplying the client with an anonymous certificate associated to a public key and configured to enable the client to authenticate the client anonymously to a server;

iii) the client calculating data formed as a series of tokens, wherein an initialization token of the series of tokens is configured to enable an authentication session to be opened and tokens of the series of tokens other than the initialization token are configured to enable the authentication session to be maintained;

iv) authenticating the client by producing an anonymous signature of the initialization token, the signatures being obtained using a private key associated with said public key and opening an anonymous authentication session with the server, wherein said anonymous signature is a unique signature used for said authentication session;

v) maintaining the anonymous authentication session with the aid of the series of tokens, thereby enabling the server to prove each of the actions of the client; and

vi) selectively allowing contact between the server and the anonymous certification authority to revoke the anonymity of the client using the anonymous signature provided in step iv.

2. The method according to claim 1, further comprising:

effecting communication between the anonymous certification authority and the server, before the authenticating of the client to the anonymous certification authority, whereby the server presents to said anonymous certification authority a request to obtain means enabling verification of the anonymous authentication supplied by a client.

3. The method according to claim 1, wherein each of the tokens of the series of tokens is configured for one-time use and each of the tokens of the series of tokens is strongly interdependent.

4. The method according to claim 3, wherein a first token W_i of the series of tokens is obtained by applying a hashing function H to a random number, a second token W_z of the series of tokens is obtained by applying the hashing function to the first token obtained, and so on until a token of rank n of the series of tokens defines the initialization token W_n as:

H(W₀)=^W₁H)(W<sub>n−

1</sub>)=W_n.

5. The method according to claim 4, wherein on each new authentication the client sends the server a token of the series of tokens of at least one unit lower rank than that previously used.

6. The method according to claim 4, wherein on each new authentication the client sends the server a token W_i of the series of tokens whose rank (i) is representative of a value of an operation.

7. The method according to claim 6, wherein the rank is representative of a number of bid increments.

8. The method according to claim 4, wherein the steps are applied to bidding and steps of the client submitting an increased bid are effected by sending successive tokens of lower rank.

9. The method according to claim 1, wherein the tokens of the series of tokens are calculated using two cryptographic primitives.

10. The method according to claim 9, wherein the two cryptographic primitives are a hashing function and a random number.

11. The method according to claim 1, further comprising using a group signature by associating a plurality of identifiers and respective private keys with a single group public key.

12. The method according to claim 11, wherein a power to revoke anonymity is shared between two or more authorities.

13. The method according to claim 1, wherein the anonymous signature is a blind signature.

14. A system adapted to open and maintain an anonymous authentication session with revocable anonymity, the system comprising:

an identifier configured to identify and register a client and to provide the client with means for authenticating the client to an anonymous certification authority;

an authentication device configured to authenticate the client to the anonymous certification authority using the authenticating means and to supply the client with an anonymous certificate associated to a public key and configured to enable the client to authenticate the client anonymously to a server;

a calculator configured to calculate data formed as a series of tokens, wherein an initialization token of the series of tokens is configured to enable an authentication session to be opened and tokens of the series of tokens other than the initialization token are configured to enable the authentication session to be maintained;

a producer for producing an anonymous signature of the initialization token, the signatures being obtained using a private key associated with said public key and opening an anonymous authentication session with the server, wherein said anonymous signature is a unique signature used for said authentication session to authenticate the client;

wherein the anonymous authentication session is maintained with the aid of the series of tokens, thereby enabling the server to prove each of the actions of the client; and

wherein selective contact is provided between the server and the anonymous certification authority to revoke the anonymity of the client using the anonymous signature.

15. The system according to claim 14, wherein the calculator calculates the series of tokens based on two cryptographic primitives, wherein the two cryptographic primitives are a hashing function and a random number.

16. The system according to claim 14, wherein the system is configured to use a group signature by associating a plurality of identifiers and respective private keys with the public key being a single group public key.

17. The system according to claim 14, wherein the unique anonymous signature is a blind signature.

18. The system according to claim 14, wherein power to revoke anonymity is divided between two or more authorities.