Method and system for asymmetric key security

• US 7,822,200 B2
• Filed: 03/07/2005
• Issued: 10/26/2010
• Est. Priority Date: 03/07/2005
• Status: Active Grant

• Current Assignee: Zhigu Holdings Limited
• Original Assignee: Microsoft Corporation
• Inventors: Bortz, Andrew, Shewchuk, John P., Simon, Daniel R., Benaloh, Josh D., Nanda, Arun K., Cameron, Kim
• Primary Examiner(s): KIM, JUNG W
• Application Number:
  US11/074,885
• Publication Number:
  US 20060198517A1
• Time in Patent Office: 2,059 Days
• Field of Search: None
• US Class Current: 380/44
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/3218 using proof of knowledge, e.g. Fiat-Shamir, GQ, Schnorr, ornon-interactive zero-knowledge proofs

Abstract

Exemplary embodiments disclosed herein may include a method and system for creating pair-wise security keys, comprising receiving an identity key from a website, generating a master key, creating a pair-wise symmetric key or asymmetric key pair by utilizing an encryption function of the identity key and the master key, and storing the pair-wise public or symmetric key at the client and the website.

Claims

1. A method of creating asymmetric security keys for authenticating previous interaction with each of a plurality of servers, comprising:

receiving a first identity key associated with a first server of the plurality of servers;

generating a first master key corresponding to the first server;

creating one or more seeds by utilizing an encryption function of the first identity key and the first master key;

utilizing the one or more seeds to create an asymmetric public and an asymmetric private key pair corresponding to the first server; and

requesting the first server to store the asymmetric public key;

storing the asymmetric private key at a client; and

authenticating previous interaction with the first server, comprising;

when proof of knowledge of the asymmetric public key is required by the first server, presenting proof of knowledge of the asymmetric public key to the first server and accessing the first server without sending the asymmetric private key; and

when proof of possession of the asymmetric private key is required in addition to the proof of knowledge of the asymmetric public key by the first server, presenting proof of possession of the asymmetric private key to the first server and accessing the first server.

2. The method of claim 1, wherein creating the one or more seeds further comprises utilizing one or more constants.

3. The method of claim 1, further comprising utilizing the asymmetric public key to determine if the client has previously accessed the first server.

4. The method of claim 1, further comprising

responsive to determining that the client has previously accessed the first server, accessing the first server.

5. The method of claim 1, further comprising utilizing the asymmetric public key to authenticate the first server.

6. The method of claim 1, wherein the generating of the first master key comprises generating a random number.

7. The method of claim 1, wherein the creating the one or more seeds comprises utilizing a hash function of the first identity key, the first master key, and a constant.

8. The method of claim 1, wherein the first server comprises a web server.

9. The method of claim 1, further comprising creating a symmetric key utilizing the asymmetric key pair as seed.

10. The method of claim 1, wherein the asymmetric public key is based, at least in part, on the first identity key.

11. The method of claim 1, wherein receiving the first identity key comprises receiving a certificate associated with a web site.

12. A system for authenticating previous interaction with one or more servers utilizing an asymmetric key pair comprising:

a processor;

a communication channel connected with the processor; and

a memory coupled with and readable by the processor, the memory containing a series of instruction that, when executed by the processor, cause the processor to;

receive a first identity key associated with a first server;

generate a first master key;

create a seed by utilizing an encryption function of the first identity key and the first master key;

utilize the seed to create an asymmetric private and asymmetric public key pair; and

request the first server to store the asymmetric public key;

store the asymmetric private key at a client;

authenticate previous interaction with the first server, comprising;

request proof of knowledge of the asymmetric public key from the first server; and

upon receipt of the proof of knowledge of the asymmetric public key, access the first server.

13. The system of claim 12, wherein the generating the first master key comprises generating a random number.

14. The system of claim 12, wherein creating the seed comprises utilizing a hash function of the first identity key, the first master key, and one or more constants.

15. The system of claim 12, further comprising receiving a request for authentication from the first server based at least in part upon the asymmetric public key.

16. A computer storage medium encoding a computer program of instructions for executing a computer implemented method for authenticating previous interaction with one or more servers, the method comprising:

receiving a first identity key associated with a first server;

generating a first master key;

creating one or more seeds by utilizing an encryption function of the first identity key, the first master key, and one or more constants;

utilizing the one or more seeds to create an asymmetric private and asymmetric public key pair;

requesting the first server to store the asymmetric public key;

storing the asymmetric private key at a client;

authenticating previous interaction with the first server, comprising;

presenting proof of knowledge of the asymmetric public key to the first server;

receiving a request from the first server for proof of possession of the asymmetric private key;

presenting proof of possession of the asymmetric private key to the first server; and

receiving an indication from the first server that the client is authenticated and that access is permitted.

17. The computer storage medium of claim 16, wherein the asymmetric key functions as a symmetric key.

18. The computer storage medium of claim 16, wherein the encryption function is a hash function of the first identity key, the first master key, and one or more constants.