Use and generation of a session key in a secure socket layer connection

• US 20020166048A1
• Filed: 04/30/2002
• Published: 11/07/2002
• Est. Priority Date: 05/01/2001
• Status: Active Grant

• Current Assignee: Onespan North America Incorporated (OneSpan, Inc.)
• Original Assignee: Vasco Data Security Incorporated (OneSpan, Inc.)
• Inventors: Coulier, Frank
• Granted Patent: US 7,975,139 B2
• Time in Patent Office: Days
• US Class Current: 713/169
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/166 at the transport layer

Abstract

The invention describes a method and system for verifying the link between a public key and a server'"'"'s identity as claimed in the server'"'"'s certificate without relying on the trustworthiness of the root certificate of the server'"'"'s certificate chain. The system establishes a secure socket layer type connection between a client and a server, wherein the server transmits information including the server'"'"'s public key to the client while establishing the connection. Next, a first information is sent from the client to the server. The client and the server create an identical authentication key using a shared secret known to the server and the client. Next, the server transmits a first encrypted message to the client, wherein the first encrypted message includes the server'"'"'s public key encrypted with the authentication key. Then, the client decrypts the first encrypted message and verifies the correctness of that message including comparing the public key included in the decrypted first encrypted message to the public key transmitted during the set-up of the secure socket layer type connection to authenticate the client and to establish the trustworthiness of the server'"'"'s public key and thereby the entire SSL connection. The client then transmits a second encrypted message to the server, wherein the second encrypted message is the first information encrypted with the authentication key. Finally, the server then decrypts the second encrypted message and verifies the correctness of the decrypted second encrypted message to authenticate the client.

Claims

1. A method for establishing a secure connection between a client and a server comprising:

establishing a secure connection, wherein a server public key is used to establish a symmetric key to encrypt communication for the duration of the connection;

generating a server authentication key by the server and a client authentication key by the client, the server authentication key and the client authentication key identical to each other and generated using a secret known to both the client and the server;

sending server authentication information to the client to authenticate the server, the server authentication information including the server'"'"'s public key, the server authentication information encrypted by the server using the server authentication key and decrypted by the client using the client authentication key, the correctness of the server information verified by the client; and

sending client information to the server to authenticate the client, the client information encrypted by the client using the client authentication key and decrypted by the server using the server authentication key, the correctness of the client information verified by the server.

2. The method of claim 1 wherein the server information includes a server certificate.

3. The method of claim 1 wherein the secure connection includes an SSL connection.

4. The method of claim 1 wherein the secure connection includes an WTLS connection.

5. The methods of claim 1 wherein the secure connection includes an IPSEC connection.

6. The method of claim 1 wherein the secure connection includes a TLS connection.

7. The methods of claim 1 wherein the secret is generated by a strong authentication token.

8. The methods of claim 7 wherein the strong authentication token is challenge response token, wherein generating an authentication key by both the server and the client includes:

sending a challenge from a server to a client;

generating a first strong authentication token response to the challenge by the client;

generating a second strong authentication token response to the challenge by the server, the first response identical to the second response;

deriving a client authentication key by the client from the first strong authentication token response;

deriving a server authentication key by the server from the second strong authentication token response.

9. The method of claim 7 wherein the strong authentication token is a time-based token, wherein generating an authentication key includes:

sending a synchronization challenge from the server to the client;

generating a strong authentication token time-based response by the client;

deriving a client authentication key from the response by the client;

encrypting the synchronization challenge with the client authentication key by the client;

sending the encrypted synchronization challenge from the client to the server; and

generating a server authentication key by the server that corresponds to the client authentication key used by the client.

10. A method for establishing a secure connection between a client and a server comprising:

establishing a secure connection, the connection establishing a symmetric key to encrypt communication for the duration of the connection, the server certificate transmitted from the server to the client while establishing the secure connection;

generating an identical and separate authentication key by both the server and the client using a secret known to both the client and the server, said generating the identical and separate authentication key including;

sending user authentication information from the client to the server;

exchanging dynamic information between the client and the server;

generating a secret by the client and the server from the response of a strong authentication token; and

generating the authentication key using the user authentication information, the dynamic information, and the secret;

sending server authentication information to the client, the server authentication information including an encrypted server certificate, the server certificate encrypted by the server using the authentication key generated by the server;

receiving and decrypting the server authentication information by the client, the client decrypting the server authentication information using the authentication key created by the client, the correctness of the server information verified by the client;

sending encrypted user authentication information to the server, the user authentication information encrypted by the client using the authentication key generated by the client; and

receiving and decrypting the user authentication information by the server, the server decrypting the user authentication information using the authentication key created by the server, the correctness of the user authentication information verified by the server.

11. The method of claim 10 wherein the user authentication information includes a user identification information.

12. The method of claim 10 wherein the secure connection is an SSL connection.

13. The method of claim 10 wherein the dynamic information includes random information.

14. The method of claim 10 wherein the strong authentication token includes a challenge-response strong authentication token, wherein the secret is the response of the challenge response token.

15. The method of claim 10 wherein the strong authentication token includes a time based token.

16. The method of claim 10 wherein the strong authentication token includes an event based token.