Method and system for securing communication

• US 9,009,484 B2
• Filed: 06/28/2013
• Issued: 04/14/2015
• Est. Priority Date: 03/25/2009
• Status: Active Grant

• Current Assignee: PACid Technologies, LLC
• Original Assignee: PACid Technologies, LLC
• Inventors: Fielder, Guy
• Primary Examiner(s): Homayounmehr, Farid
• Assistant Examiner(s): Debnath, Suman
• Application Number:
  US13/930,846
• Publication Number:
  US 20140006792A1
• Time in Patent Office: 655 Days
• Field of Search: 726 25- 27, 713168-181, 380/30, 380/285
• US Class Current: 713/181
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Abstract

A method for securing communication between a plurality of members. The method includes a first member sending a first input to a second member, receiving a second input from the second member, and generating, by an n-bit generator, an initial message digest using the first input and the second input. Communications between the first member and the second member are encrypted using the initial message digest.

Claims

1. A method for securing communication between a plurality of members, comprising:

sending, by a first member comprising a computer processor, a first input to a second member;

receiving, by the first member, second input from the second member;

generating, by a first n-bit generator, at least one message digest using the first input and the second input;

extracting, by the computer processor, first algorithm selector bits from the at least one message digest;

identifying, by the computer processor, a starting bit value and a first encryption algorithm using the first algorithm selector bits and an algorithm selector table;

obtaining a first encryption key using the starting bit value; and

encrypting, by the computer processor, a first communication using the first encryption algorithm and the first encryption key.

2. The method of claim 1, wherein the first member is a server, the second member is a client, the first input comprises a server challenge, and the second input comprises a password.

3. The method of claim 2, further comprising:

receiving, by the server, a client identifier from the client; and

determining whether the client is authorized based on the client identifier,

wherein sending the server challenge is performed in response to determining that the client is authorized.

4. The method of claim 3, further comprising:

verifying the password based on the client identifier,

wherein generating the at least one message digest is performed in response to determining that the password is valid.

5. The method of claim 2, further comprising:

receiving, by the server, a client challenge;

extracting a shared secret from an initial message digest, wherein the at least one message digest comprises the initial message digest;

generating, by the first n-bit generator, a second message digest using the shared secret and the client challenge;

extracting a server generated administrative command authentication secret (ACAS) from the second message digest;

generating, by the n-bit generator, a first command authentication message digest (CAMD) using a first encrypted communication and the server generated ACAS; and

sending, by the server, the CAMD and the first encrypted communication to the client,

wherein the client;

generates, by a second n-bit generator, a second command authentication message digest (CAMD) using the first encrypted communication and a client generated ACAS,

decrypts the first encrypted communication when the first CAMD is identical to the second CAMD.

6. The method of claim 1, further comprising:

creating, by the first member, a first challenge, wherein the first challenge is the first input;

identifying, by the first member, a public key of the second member;

encrypting the first challenge with the public key of the second member to create a first encrypted challenge, wherein sending the first input comprises sending the first encrypted challenge; and

decrypting, by the first member, an encrypted second challenge using a private key of the first member to create a decrypted second challenge, wherein the decrypted second challenge comprises the second input.

7. The method of claim 1, further comprising:

extracting a static secret and a dynamic secret from the at least one message digest;

generating, by the first n-bit generator, a second message digest using the static secret and the dynamic secret, wherein the first algorithm selector bits are extracted from the second message digest.

8. The method of claim 7, further comprising:

extracting a change value from the second message digest;

generating, by the first n-bit generator, a third message digest using the change value and a shared secret;

extracting, from the third message digest, a second encryption key and second algorithm selector bits;

identifying a second encryption algorithm specified by the second algorithm selector bits; and

encrypting a second communication using the second encryption algorithm and the second encryption key.

9. A computer device comprising:

a processor;

a memory; and

software instructions stored in memory for causing the computer device to;

send a first input to a second member of a plurality of members, wherein the computing device is a first member of the plurality of members;

receive a second input from the second member;

generate by a first n-bit generator, at least one message digest using the first input and the second input;

extract first algorithm selector bits from the at least message digest;

identify a starting bit value and a first encryption algorithm using the first algorithm selector bits and an algorithm selector table;

obtain a first encryption key using the starting bit value; and

encrypt a first communication using the first encryption algorithm and the first encryption key.

10. The computing device of claim 9, wherein the first member is a server, the second member is a client, the first input comprises a server challenge, and the second input comprises a password.

11. The computing device of claim 10, wherein the software instructions further cause the computing device to:

receive a client identifier from the client; and

determine whether the client is authorized based on the client identifier,

wherein sending the server challenge is performed in response to determining that the client is authorized.

12. The computing device of claim 11, wherein the software instructions further cause the computing device to:

verify the password based on the client identifier,

wherein generating the at least one message digest is performed in response to determining that the password is valid.

13. The computing device of claim 10, wherein the software instructions further cause the computing device to:

receive a client challenge;

extract a shared secret from an initial message digest, wherein the at least one message digest comprises the initial message digest;

generate, by the first n-bit generator, a second message digest using the shared secret and the client challenge;

extract a server generated administrative command authentication secret (ACAS) from the second message digest;

generate, by the first n-bit generator, a first command authentication message digest (CAMD) using a first encrypted communication and the server generated ACAS; and

send the CAMD and the first encrypted communication to the client,

wherein the client;

generates, by a second n-bit generator, a second command authentication message digest (CAMD) using the first encrypted communication and a client generated ACAS,

decrypts the first encrypted communication when the first CAMD is identical to the second CAMD.

14. The computing device of claim 9, wherein the software instructions further cause the computing device to:

create a first challenge, wherein the first challenge is the first input;

identify a public key of the second member;

encrypt the first challenge with the public key of the second member to create a first encrypted challenge, wherein sending the first input comprises sending the first encrypted challenge; and

decrypt an encrypted second challenge using a private key of the first member to create a decrypted second challenge, wherein the decrypted second challenge comprises the second input.

15. The computing device of claim 9, wherein the software instructions further cause the computing device to:

extract a static secret and a dynamic secret from the at least one message digest;

generate, by the first n-bit generator, a second message digest using the static secret and the dynamic secret, wherein the first algorithm selector bits are extracted from the second message digest.

16. The computing device of claim 15, wherein the software instructions further cause the computing device to:

extract a change value from the second message digest;

generate, by the first n-bit generator, a third message digest using the change value and a shared secret;

extract, from the third message digest, a second encryption key and second algorithm selector bits;

identify a second encryption algorithm specified by the second algorithm selector bits; and

encrypt a second communication using the second encryption algorithm and the second encryption key.

17. A non-transitory computer readable medium comprising computer readable program code embodied therein for causing a computer system to perform a method for securing communication between a plurality of members, the method comprising:

sending, by a first member, a first input to a second member;

receiving, by the first member, second input from the second member;

generating, by a first n-bit generator, at least one message digest using the first input and the second input;

extract first algorithm selector bits from the at least one message digest;

identify a starting bit value and a first encryption algorithm using the first algorithm selector bits and an algorithm selector table;

obtain a first encryption key using the starting bit value; and

encrypt a first communication using the first encryption algorithm and the first encryption key.

18. The non-transitory computer readable medium of claim 17, wherein the first member is a server, the second member is a client, the first input comprises a server challenge, and the second input comprises a password.

19. The non-transitory computer readable medium of claim 18, wherein the method further comprises:

receiving, by the server, a client identifier from the client; and

determining whether the client is authorized based on the client identifier,

wherein sending the server challenge is performed in response to determining that the client is authorized.

20. The non-transitory computer readable medium of claim 19, wherein the method further comprises:

verifying the password based on the client identifier,

wherein generating the at least one message digest is performed in response to determining that the password is valid.

21. The non-transitory computer readable medium of claim 18, wherein the method further comprises:

receiving, by the server, a client challenge;

extracting a shared secret from an initial message digest, wherein the least one message digest comprises the initial message digest;

generating, by the first n-bit generator, a second message digest using the shared secret and the client challenge;

extracting a server generated administrative command authentication secret (ACAS) from the second message digest;

generating, by the first n-bit generator, a first command authentication message digest (CAMD) using a first encrypted communication and the server generated ACAS; and

sending, by the server, the CAMD and the first encrypted communication to the client,

wherein the client;

generates, by a second n-bit generator, a second command authentication message digest (CAMD) using the first encrypted communication and a client generated ACAS,

decrypts the first encrypted communication when the first CAMD is identical to the second CAMD.

22. The non-transitory computer readable medium of claim 17, further comprising:

creating, by the first member, a first challenge, wherein the first challenge is the first input;

identifying, by the first member, a public key of the second member;

encrypting the first challenge with the public key of the second member to create a first encrypted challenge, wherein sending the first input comprises sending the first encrypted challenge; and

decrypting, by the first member, an encrypted second challenge using a private key of the first member to create a decrypted second challenge, wherein the decrypted second challenge comprises the second input.

23. The non-transitory computer readable medium of claim 17, wherein the method further comprises:

extracting a static secret and a dynamic secret from the at least one message digest;

generating, by the first n-bit generator, a second message digest using the static secret and the dynamic secret, wherein the first algorithm selector bits are extracted from the second message digest.

24. The non-transitory computer readable medium of claim 23, wherein the method further comprises:

extracting a change value from the second message digest;

generating, by the first n-bit generator, a third message digest using the change value and a shared secret;

extracting, from the third message digest, a second encryption key and second algorithm selector bits;

identifying a second encryption algorithm specified by the second algorithm selector bits; and

encrypting a second communication using the second encryption algorithm and the second encryption key.