Method and system for identity authentication

• US 8,583,921 B1
• Filed: 06/30/2005
• Issued: 11/12/2013
• Est. Priority Date: 06/30/2004
• Status: Active Grant

• Current Assignee: Lingyan Shu
• Original Assignee: Lingyan Shu
• Inventors: Shu, Lingyan
• Primary Examiner(s): Schwartz, Darren B
• Assistant Examiner(s): Gyorfi, Thomas
• Application Number:
  US11/173,872
• Time in Patent Office: 3,057 Days
• Field of Search: 713/168, 713/170, 713/172
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

Used in a communication involving Entity 1 and Entity 2 to authenticate Entity 1'"'"'s identity, a digital identification of Entity 1 comprises an encrypted character string wherein the string is related to Entity 2 and is directly or indirectly encrypted with a key in a private/public key pair of Entity 1'"'"'s. Such digital identification is dynamic and can be used as one-time or multiple-time identification. Such digital identification of an entity allows for the entity'"'"'s being authenticated by another entity without the two entities having a one-to-one communication in advance. Also such a digital identification does not rely on the syntax of other messages or data as does a digital signature do and can be verified easily. The verification of such a digital identification can be easily confirmed by both human beings and machines.

Claims

1. In a multi-entity network environment, a method for creating a first entity'"'"'s digital identification dynamically for a second entity to authenticate said first entity, comprising:

disclosing a public key of said first entity;

receiving an electronic network request from a device of said second entity by a device of said first entity;

acquiring the network address of said second entity by a device of said first entity;

based on the acquired network address, determining the content of a character string comprising information related to said second entity;

creating a digital identification of said first entity by processing said string using a private key, said private key being the private key in a private and public key pair of said first entity'"'"'s where the public key being the disclosed public key;

transmitting a response comprising the dynamically created digital identification to said network address;

whereby said digital identification of said first entity is dynamically created for said second entity using said second entity'"'"'s information and is valid only when used by said second entity.

2. The method as recited in claim 1, wherein said content of said character string comprises said network address of said second entity.

3. The method as recited in claim 2, wherein said network address is an IP address.

4. The method as recited in claim 2, wherein said content of said character string comprises a date/time stamp indicating when said request was made.

5. The method as recited in claim 4, wherein said content of said character string comprises a message number.

6. The method as recited in claim 2, wherein said response comprises a digital certificate issued by said first entity.

7. The method as recited in claim 2,

wherein processing said string using a private key of said first entity'"'"'s comprising:

a) encrypting said string using a secret key in a symmetric encryption method;

b) encrypting said secret key with the private key, said private key being the private key in a private and public key pair of said first entity'"'"'s where the public key being the disclosed public key.

8. The method as recited in claim 2 wherein processing said string using a private key of said first entity'"'"'s comprising:

encrypting said string with the private key using an asymmetric encryption method, said private key being the private key in a private and public key pair of said first entity'"'"'s where the public key being the disclosed public key.

9. The method as recited in claim 8 wherein said asymmetric encryption method is a RSA public key crypto algorithm.

10. The method as recited in claim 2 wherein transmitting a response to said network address is conducted through a secured link.

11. The method as recited in claim 1, wherein said content of said character string comprises said second entity'"'"'s identity information.

12. The method as recited in claim 1, wherein said content of said character string comprises information related to what said first entity communicates to said second entity.

13. The method as recited in claim 1, wherein said content of said character string comprises said first entity'"'"'s identity information.

14. The method as recited in claim 1, wherein said content of said character string comprises an identifier that identifies said dynamic digital identification.

15. The method as recited in claim 1, wherein said response comprises a webpage.

16. In a multi-entity network environment, a method for authenticating a first entity'"'"'s identity by a second entity, comprising:

sending an electronic network request by a device of said second entity to a device of said first entity;

receiving a response comprising a dynamic digital identification of said first entity at said second entity'"'"'s network address, said dynamic digital identification being created based on said network address after said network request is received and said network address is acquired by said first entity, by encrypting a character string comprising information related to said second entity using an encryption key of said first entity'"'"'s;

acquiring a public key of said first entity'"'"'s, said public key being the public key in a public and private key pair;

decrypting said dynamic digital identification to produce a result by using said public key of said first entity'"'"'s;

verifying the identity of said first entity by matching said result against the expected content including information related to said second entity,

whereby said second entity authenticates said first entity with the dynamic digital identification created dynamically by said first entity for said second entity and the dynamic digital identification is valid only when used by said second entity.

17. The method as recited in claim 16 wherein decrypting said dynamic digital identification is done by a browser program.

18. The method as recited in claim 16 wherein receiving said dynamic digital identification is done through a secured link.

19. The method as recited in claim 16 wherein decrypting said dynamic digital identification is done by an Identification Match System.

20. The method as recited in claim 16, wherein matching said result against the expected content comprises matching an IP address in said result against the IP address where said digital identification was sent to.