Low-latency peer session establishment

• US 8,458,776 B2
• Filed: 10/21/2009
• Issued: 06/04/2013
• Est. Priority Date: 10/21/2009
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Steere, David, Galvin, Tom
• Primary Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US12/603,401
• Publication Number:
  US 20110093710A1
• Time in Patent Office: 1,322 Days
• Field of Search: None
• US Class Current: 726/5
• CPC Class Codes: H04L 2209/42 Anonymization, e.g. involving pseudonyms
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869

Abstract

A source device and a target device may endeavor to form a secure communication session whereby encrypted messages may be transmitted over an untrusted network, such as the internet. However, the exchange of many messages in the establishment of the communication session may involve considerable latency and computational resources, particularly in scenarios featuring many communication sessions (e.g., peer-to-peer communication sessions.) Techniques for initiating a communication session may be devised that enables the initiation of a communication session with only two exchanged messages, or even with a single message transmitted from the source device to the target device. Some embodiments of these techniques may also permit the inclusion of advantageous security features, such as authentication via public certificate to detect man-in-the-middle attacks and the inclusion of nonces to detect replay attacks, without increasing the number of messages involved in the initiation of the communication session.

Claims

1. A method of establishing a communication session by a source device having a source address, at least one source candidate address, a processor, and a source private key with a target device having a target public certificate, the method comprising:

executing on the processor of the source device instructions configured to;

generate a source session key;

transmit to the target device from the source address a session invite comprising at least one source candidate address that is different from the source address and the source session key, the session invite encrypted using the target public certificate; and

upon receiving from the target device a session acceptance comprising a target address and a target session key;

decrypt the session acceptance using the source private key;

generate a session key using the source session key and the target session key; and

initiate the communication session with the target device at the target address and from one of the source candidate addresses, the communication session encrypted using the session key.

2. The method of claim 1, the source device and the target device represented in a deployable computing environment hosted by a computing environment host.

3. The method of claim 1:

the source session key comprising a first randomly generated key;

the target session key comprising a second randomly generated key; and

the session key comprising a symmetric random session key generated using the first randomly generated key and the second randomly generated key.

4. The method of claim 1:

generating the session key comprising;

generating a session key set comprising at least two session keys, respective session keys generated using the source session key and the target session key and different from the other session keys in the session key set;

initiating the communication session comprising;

initiating the communication session with the target device at the target address, the communication session encrypted using a first session key; and

the method comprising;

after initiating the communication session;

selecting a second session key from the session key set, and

encrypting the communication session using the second session key.

5. The method of claim 1:

the source device operated by a source user;

the target device operated by a target user;

the session acceptance comprising a target user authenticator, and initiating the communication session comprising;

verifying the target user using the target user authenticator, and

upon verifying the target user, initiating the communication session with the target device, the communication session encrypted using the session key.

6. The method of claim 1:

the source device comprising a certificate cache;

the instructions configured to;

upon obtaining the target public certificate of the target device, store the target public certificate in the certificate cache, and

establish a subsequent communication session with the target device by retrieving the target public certificate from the certificate cache.

7. The method of claim 1:

the source device accessible at at least two candidate source addresses; and

the session invite comprising the at least two candidate source addresses.

8. The method of claim 1:

the session acceptance comprising at least two candidate target addresses, and

initiating the communication session with the target device comprising;

selecting at least one target address among the at least two candidate target addresses, and

initiating the communication session with the target device at at least one selected target address, the communication session encrypted using the session key.

9. The method of claim 1:

the instructions configured to generate a source nonce, and

the session invite comprising the source nonce.

10. The method of claim 1:

the session acceptance comprising a target nonce; and

initiating the communication session comprising;

verifying the target nonce, and

upon verifying the target nonce, initiating the communication session with the target device, the communication session encrypted using the session key.

19. The method of claim 1:

the source address comprising an anonymized address that is not publicly associated with the source device; and

the source candidate address comprising a non-anonymized address that is publicly associated with the source device.

11. A method of establishing a communication session by a target device having a processor and a target private key with a source device having a source public certificate, the method comprising:

executing on the processor of the target device instructions configured to;

upon receiving from the source device, from a source address, a session invite comprising a source session key and at least one source candidate address that is different from the source address;

decrypt the session invite using the target private key;

generate a target session key comprising a target session key;

generate a session key using the source session key and the target session key; and

transmit to the source device a session acceptance comprising a target address and the target session key, the session acceptance encrypted using the source public certificate; and

upon receiving from the source device an initiation of a communication session, initiate the communication session with the source device at one of the source candidate addresses, the communication session encrypted using the session key.

12. The method of claim 11:

the source device operated by a source user;

the target device operated by a target user;

the session invite comprising a source user authenticator, and

the instructions configured to, upon receiving the session invite;

verify the target user using the target user authenticator, and

upon verifying the target user, transmit to the source device the session acceptance.

13. The method of claim 11:

the session invite comprising at least two candidate source addresses;

the instructions configured to, upon receiving the session invite;

select at least one source address of the at least two candidate source addresses, and

transmit the session acceptance to the source device at at least one selected source address; and

the communication session initiated by the source device from at least one source address.

14. The method of claim 11:

the target device accessible at at least two candidate target addresses;

the session acceptance comprising the at least two candidate target addresses; and

the communication session initiated by the source device to at least one candidate target address.

15. The method of claim 11:

the session invite comprising a source nonce; and

the instructions configured to, upon receiving the session invite;

verify the source nonce, and

upon verifying the source nonce, transmit the session acceptance to the source device.

16. The method of claim 11:

the instructions configured to generate a target nonce, and

the session acceptance comprising the target nonce.

17. The method of claim 11, comprising:

initiate the communication session with the source device at the source address, the communication session encrypted using the session key.

20. The method of claim 11:

the target address comprising an anonymized address that is not publicly associated with the target device; and

the target candidate address comprising a non-anonymized address that is publicly associated with the target device.

18. A nonvolatile computer-readable storage device comprising instructions that, when executed on a processor of a source device operated by a source user and comprising a certificate cache and a source private key and having at least one source address, represented in a deployable computing environment hosted by a computing environment host and also representing a target device operated by a target user and having at least one target address, the source device having access to a certificate server comprising at least one public certificate including a target public certificate identifying the target device, establish a communication session with the target device by:

obtaining the target public certificate of the target device from the certificate server;

storing the target public certificate in the certificate cache;

generating a source session key;

generating a source nonce;

transmitting to the target device a session invite comprising the at least one source address, the source session key, and the source nonce, the session invite encrypted using the target public certificate;

upon receiving from the target device a session acceptance comprising at least one candidate target address, a target session key, a target nonce, and a target user authenticator;

decrypting the session acceptance using the source private key;

verifying the target nonce;

verifying the target user using the target user authenticator; and

upon verifying the target user and the target nonce;

selecting at least one target address among the at least two candidate target addresses,

generating a session key using the source session key and the target session key, and

initiating the communication session with the target device at a selected target address, the communication session encrypted using the session key; and

establishing a subsequent communication session with the target device by retrieving the target public certificate from the certificate cache.