Techniques for key distribution for use in encrypted communications

• US 8,281,136 B2
• Filed: 02/07/2006
• Issued: 10/02/2012
• Est. Priority Date: 10/21/2005
• Status: Expired due to Fees

• Current Assignee: RPX Corporation
• Original Assignee: Novell Incorporated (Open Text Corporation)
• Inventors: Ramakrishna, Preetam
• Primary Examiner(s): Hoffman, Brandon
• Assistant Examiner(s): Anderson, Michael D
• Application Number:
  US11/348,669
• Publication Number:
  US 20070094503A1
• Time in Patent Office: 2,429 Days
• Field of Search: 713/172, 713/201, 713/182, 709/30
• US Class Current: 713/172
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

Techniques for key distribution used with encrypted communications are provided. A shared secret associated with a principal is maintained securely and separately from the principal. If a principal is authenticated, then the shared secret is acquired from secure data store and used to encrypt a session key. An encrypted authentication token is also generated. The session key is used by the principal to encrypt communications with services and the authentication token vouches for an identity of the principal.

Claims

1. A machine-implemented method to execute on a proxy, the method, comprising:

receiving, from a principal and by the method, a request for an authentication token, the principal already authenticated to the method when the request is received from the principal;

obtaining, by the method, from a secure storage a secret associated with the principal, access to the secure storage is exclusive to the method and the secure storage is managed by the method, the secret is not shared with the principal, the secret supplied separately to the secret storage by an administrator for the principal and entered by the administrator on behalf of the principal using offline techniques during a different interaction than that which is associated with receiving the request from the principal, the secrete storage associated exclusively with the principal by the method; and

generating, by the method, the authentication token as an encrypted token, the authentication token when presented by the principal vouches for an identity of the principal when the principal subsequently interacts with the method and with other services or other principals, the other services or the other principals also interact with the method, the generated authentication token including some random information managed by the method to ensure subsequent encryption tokens generated are different in terms of their content even though a same encryption technique is being used with the encryption token and with the subsequent encryption tokens and storing the encrypted token and the subsequent encrypted tokens in the secret store.

2. The method of claim 1 further comprising:

encrypting a session key with the secret; and

storing the encrypted session key and the encrypted token in the secure storage for the principal.

3. The method of claim 2 further comprising:

authenticating the principal; and

delivering the encrypted session key and the encrypted token to the principal.

4. The method of claim 3, wherein authenticating further includes authenticating the principal using at least one of a smart card associated with a device of the principal and biometric information.

5. The method of claim 1 further comprising, processing the method within a directory service.

6. The method of claim 1 further comprising, revoking the authentication token upon an expiring event.

7. A machine-implemented method to execute on a device, the method, comprising:

automatically authenticating a principal without interaction of the principal, a separate directory service authenticating the principal separate from the method;

acquiring an encrypted version of a token and an encrypted version of a session key from a secure data store in response to authenticating the principal, the method having exclusive access to the secure data store and manages the secure data store and the secure data store, the secure data store exclusively associated with the principal, each different principal having a different secure data store that is exclusively managed by the method; and

delivering the encrypted version of the token and the encrypted version of the session key to the principal by permitting the principal via a separate interaction to download the encrypted version of the token and the encrypted version of the session key from the secure storage, the token vouching for an identity of the principal as the principal interacts with the method and the different principals, encryption is the same for the principal in subsequent sessions although content for subsequent encrypted versions of the token is different.

8. The method of claim 7 further comprising:

receiving a request for a service token from the principal, the request includes the encrypted version of the token and a message encrypted with the session key;

generating the service token and a temporary session key for interactions between the principal and a new principal;

encrypting the service token and the temporary session key with the session key; and

providing the encrypted versions of the service token and the temporary session key to the principal.

9. The method of claim 7, wherein acquiring further includes accessing the secure data store as a local secret data store associated with the principal, wherein the encrypted version of the token and the session key are encrypted with a shared secret of the principal that is maintained in the secure data store.

10. The method of claim 7, wherein acquiring further includes accessing the secure data store as a remote data store associated with the principal, wherein the encrypted version of the token and the session key are encrypted with a shared secret of the principal that is maintained in the secure data store.

11. The method of claim 7, wherein authenticating further includes authenticating the principal with different secret information of the principal from what is used to encrypt the encrypted versions of the token and the session key.

12. The method of claim 7 further comprising, acquiring a shared secret of the principal in a previous interaction with the principal and using the shared secret to generate the encrypted version of the session key, which is stored in the secure data store with the encrypted token.