BIDIRECTIONAL ENTITY AUTHENTICATION METHOD BASED ON THE CREDIBLE THIRD PARTY

• US 20110004767A1
• Filed: 03/04/2009
• Published: 01/06/2011
• Est. Priority Date: 03/06/2008
• Status: Active Grant

• Current Assignee: China Iwncomm Co., Ltd
• Original Assignee: China Iwncomm Co., Ltd
• Inventors: Huang, Zhenhai, Cao, Jun, Lai, Xiaolong, Tie, Manxia
• Granted Patent: US 8,510,565 B2
• Time in Patent Office: Days
• US Class Current: 713/178
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity

Abstract

A bidirectional entity authentication method based on the credible third party includes the steps that: entity A receives message 1 sent from entity B including the authentication parameters of said entity B, and sends message 2 to the credible third party TP, said message 2 including the authentication parameters of entity B and the authentication parameters of entity A; entity A receives message 3 sent from said credible third party TP, said message 3 including the checking result after checking that whether said entity A and entity B are legal based on said message 2 by said credible third party TP; entity A gets the authentication result of entity B after authenticating said message 3, and sends message 4 to said entity B to make entity B authenticating based on said message 4 and getting the authentication result of entity A. The invention simplifies the operation condition of the protocol, reduces the computing capability requirement of the authentication entity, and satisfies the high security requirement of the network device lack of resource.

Claims

1. A utility bidirectional entity authentication method based on the trusted third party, comprising:

after receiving, from an entity B, a message 1 comprising an authentication parameter of the entity B, sending, by an entity A, a message 2 to a trusted third party TP, the message 2 comprising the authentication parameter of the entity B and a authentication parameter of the entity A;

receiving, by the entity A, a message 3 sent from the trusted third party TP, a checking result is comprised in the message 3 which is obtained by checking whether the entities A and B are legal by the trusted third party TP on the basis of the message 2;

verifying the message 3, by the entity A, so as to obtain a verification result of the entity B, sending a message 4 to the entity B for causing the entity B to perform verification based on the message 4 and obtaining a verification result of the entity A.

2. The method according to claim 1, wherein the message 1 includes a time-varying parameter R_B, an identity ID_B, a token TokenBA, an option text Text1;

the message 2 includes time-varying parameters R_A and R_B, identities ID_A and ID_B, tokens TokenAT and TokenBA, option texts Text1 and Text2;

the message 3 includes a token TokenTA and an option text Text3 or includes tokens TokenTA1 and TokenTA2;

the message 4 includes a token TokenTA and an option text Text3 or includes a token TokenTA2.

3. The method according to claim 2, wherein checking whether the entities A and B are legal comprises:

if the identities ID_A and ID_B of the entities A and B in the message 2 are certificates, verifying the signs of the entities B and A in the TokenBA and TokenAT, if the verification is not successful, discarding the message 2 directly; and

if the verification is successful, checking the validity of the certificates;

if the certificates are invalid, discarding the message 2 directly or returning the message 3;

if the certificates are valid, returning the message 3 to the entity A.

4. The method according to claim 1, wherein checking whether the entities A and B are legal comprises:

if the identities ID_A and ID_B of the entities A and B in the message 2 are distinguishing identifiers, searching and checking the corresponding public keys of the entities A and B and their validity, if the corresponding public keys can not be searched out or the searched out corresponding public keys are invalid, discarding the message 2 directly or returning the message 3;

if the corresponding public keys are searched out and the searched out corresponding public keys are valid, verifying the signs of the entities B and A in the TokenBA and TokenAT;

if the verification of the signs is not successful, discarding the message 2 directly; and

if the verification of the signs is successful, returning the message 3 to the entity A.

5. The method according to claim 2, wherein verifying the message 3 by the entity A comprises:

verifying, by the entity A, the sign of the trusted third party TP in the TokenTA or TokenTA1, and checking whether the time-varying parameter R_A in the message 2 is consistent with the time-varying parameter R_A in the TokenTA or TokenTA1, if yes, obtaining a verification result Pub_B of the entity B.

6. The method according to claim 2, wherein performing verification, by the entity B, based on the message 4 comprises:

verifying, by the entity B, the sign of the trusted third party TP in the TokenTA or TokenTA2, and checking whether the time-varying parameter R_B in the message 1 is consistent with the time-varying parameter R_B in the TokenTA or TokenTA2, if yes, obtaining a verification result Pub_A of the entity A.

7. The method according to claim 1, wherein, before the entity A receives the message 1 sent from the entity B, the method further comprises:

sending, by the entity A, a message 0 comprising an authentication parameter of the entity A to the entity B, sending, by the entity B the message 1 to the entity A after reception of the message 0.

8. The method according to claim 7, wherein the message 0 comprises a time-varying parameter R_A, an identity ID_A and an option text Text0.

9. The method according to claim 1, wherein the time-varying parameter is a random number, a time stamp or a sequence number.

10. The method according to claim 2, wherein the time-varying parameter is a random number, a time stamp or a sequence number.

11. The method according to claim 3, wherein the time-varying parameter is a random number, a time stamp or a sequence number.

12. The method according to claim 4, wherein the time-varying parameter is a random number, a time stamp or a sequence number.

13. The method according to claim 5, wherein the time-varying parameter is a random number, a time stamp or a sequence number.

14. The method according to claim 6, wherein the time-varying parameter is a random number, a time stamp or a sequence number.

15. The method according to claim 7, wherein the time-varying parameter is a random number, a time stamp or a sequence number.

16. The method according to claim 8, wherein the time-varying parameter is a random number, a time stamp or a sequence number.