Method and apparatus for offline cryptographic key establishment

• US 7,971,234 B1
• Filed: 09/15/2006
• Issued: 06/28/2011
• Est. Priority Date: 09/15/2006
• Status: Expired due to Fees

• Current Assignee: NetApp, Inc.
• Original Assignee: NetApp, Inc.
• Inventors: Subramanian, Ananthan, Chang, Lawrence, Sussland, Robert, Silberman, Joshua
• Primary Examiner(s): GEE, JASON KAI YIN
• Application Number:
  US11/532,468
• Time in Patent Office: 1,747 Days
• Field of Search: 726/5, 726/7, 713/168
• US Class Current: 726/5
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

The invention provides an authentication scheme that allows networked devices to establish trust in connection with the exchange of keys pursuant to an asymmetrical cryptographic technique, such as Diffie-Hellman. The invention provides a technique, referred to as offline key establishment, that establishes a trust relationship between two networked devices that use Diffie-Helman. Offline key sharing provides for the exchange of authentication information using a separate channel which, in the preferred embodiment does not constitute an IP connection. Thus, while communications between networked devices may ultimately proceed via a network connection, trust between the networked devices is established via a separate, offline channel, such as a telephone call or email message. The use of offline key establishment allows for such features as one way key sharing; and addresses situations where one party to the exchange does not want to share all of his keys, but just one or two keys.

Claims

1. An apparatus for establishment of a trust relationship between first and second security appliances which are communicatively connected over an insecure medium, comprising:

a module for generating a verifier code in the first security appliance in response to an input by a first user operatively connected to the first security appliance, wherein the first and second security appliances are configured to transparently encrypt data en route to one or more storage devices operatively connected to the first and second security appliances;

the first security appliance associated with the first user for generating a trust establishment package (TEP) and for forwarding the verifier code to a second user via the insecure medium in the TEP;

an offline channel over which the first user can communicate the TEP a second time to the second user in response to communicating the verifier code via the insecure medium;

the second security appliance associated with the second user configured to upload the TEP received from the first user via the insecure medium; and

wherein the trust establishment package is authentic when the verifier code in the TEP received from the first user via the offline channel is the same as the verifier code received from the first user via the insecure medium, and

wherein neither the first security appliance nor the second security appliance have to share all keys associated with the first and second security appliances to establish the trust relationship.

2. The apparatus of claim 1, wherein the trust relationship is established before sharing all the keys.

3. The apparatus of claim 1, wherein the second user confirms the verifier code to the first user via the offline channel.

4. The apparatus of claim 3, wherein the second user reads the verifier code from a display to the first user via a telephone call.

5. The apparatus of claim 1, wherein the trust establishment package comprises a hashed message.

6. The apparatus of claim 5, wherein the hashed message comprises a hash of any of a trust link establishment ID, the verifier code, and a public key.

7. The apparatus of claim 1, wherein the offline channel comprises any of a voice channel, an email channel, or a messaging channel.

8. The apparatus of claim 1, further comprising:

a second module of the second security appliance for generating a second verifier code;

the second module comprising a facility for generating a trust acceptance package, and for forwarding the second verifier code to the first user via the insecure medium in the trust acceptance package;

the offline channel for communicating the second verifier code to the first user;

the first module being associated with the first user for uploading the trust acceptance package received from the second user via the insecure medium, and for allowing the first user to enter the second verifier code received from the second user via the offline channel; and

wherein the trust acceptance package is authentic when the second verifier code received from the second user via the offline channel confirms an identify of the second user'"'"'s.