Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Protection at a particular protocol layer
Reexamination Certificate
1999-06-25
2003-10-14
Peeso, Thomas R. (Department: 2132)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Protection at a particular protocol layer
C713S164000, C713S165000
Reexamination Certificate
active
06633979
ABSTRACT:
TECHNICAL FIELD OF THE INVENTION
The present invention relates to secure communications, and more particularly to methods and arrangements that provide a logical relationship between entity authentication processes and ciphering key generation processes during a secure communication.
BACKGROUND
Secure communications, for example, between two nodes in a communications system, typically require that at least an initial authentication process be conducted to ensure that the connected nodes are authorized to conduct the secure communications. This initial authentication process allows the nodes to establish that they are indeed establishing a communications link with the correct counterpart node, is secure enough prior to transmitting data. Additional authentication processes can be conducted at various times during a secure communication session to further verify that the nodes are legitimate and that the link is still secure.
In this manner, the authentication processes are designed to provide the communicating nodes with a reasonable level of protection against potential eaves-droppers, impersonators, and/or hijackers (spoofers) that may attempt to steal the transmitted data.
By way of example, in certain conventional communications systems protection is provided against such unauthorized entities by combining authentication processes with data encryption processes. The authentication processes typically employs a challenge response scheme through which the nodes prove to each other that they have a common secretly shared key or public/private cryptography pair. The challenge/response is also used as input to a ciphering key generator to produce the ciphering key that is used for the encryption of the data subsequently transmitted over the authenticated link.
Depending upon the needs of the parties, the authentication process can be either mutual or one-way. In a mutual authentication process, each of the nodes will challenge the other node by sending a challenge message that requires a response message generated using the secret key. In a one-way authentication process, only one of the nodes challenges the other node.
In either case, there is a requisite level of message traffic that needs to be exchanged between the two nodes. This additional message traffic tends to reduce the efficiency of the communications, since during an authentication process no data is transmitted. This additional “overhead” can become burdensome when there is a need to conduct a plurality of link authentication processes during a communications session. For example, if the parties to the secure transaction require that the ciphering key be changed every minute, then a new link authentication process would usually be required each minute, or the ciphering key would otherwise be generated without re-verifying that the other node is authorized.
Consequently, it would be desirable to have new methods and arrangements that would reduce the overhead associated with this type of secure communications. Preferably, the methods and arrangements will provide for a significantly trusted secure link, while reducing the amount of overhead message traffic associated with maintaining the trust between the communicating nodes.
SUMMARY
In accordance with certain aspects of the present invention, new methods and arrangements are provided for use in a communications system that tend to reduce the overhead associated with repeated entity authentication processes.
Thus, for example, a method for generating ciphering keys in a secured link set-up between a first node and a second node is provided, in accordance with certain embodiments of the present invention. The method includes the steps of conducting an authentication process between the first node and the second node using a cryptography key and related techniques, generating a ciphering offset value during the authentication process, storing the ciphering offset value in each of the nodes, and subsequently generating a ciphering key in each of the nodes using at least one random input value, the cryptography key and the ciphering offset value. In this manner, the ciphering key, which can be used to encrypt and decrypt transmitted data, is logically related to the authentication process. In certain further embodiments, the first node is a base station and the second node is a mobile station, each of which are each part of a mobile telecommunications system, such as, for example, an enhanced global system for mobile (GSM) communications system.
The above stated needs and others are also met by an arrangement for generating ciphering keys in a communications node, in accordance with certain embodiments of the present invention. The arrangement includes memory that is configured to store data, a transceiver that can be configured to send and receive data over a communications link, and a processor that is connected to the memory and the transceiver. The arrangement is configured to conduct an authentication process over the communications link with an external communications node using a cryptography key, generate a ciphering offset value during the authentication process, store the ciphering offset value in memory, and subsequently generating a ciphering key using at least one generated random input value, the cryptography key and the ciphering offset value.
In accordance with still other embodiments of the present invention a communication system is provided. The communication system includes a communications link that is connected between a first node and a second node. Both the first and second nodes are configured to send and receive data over the communications link, conduct an authentication process over the communications link using a cryptography key, generate a ciphering offset during the link authentication process, store the ciphering offset, and subsequently generate a ciphering key using at least one generated random input value, the cryptography key and the ciphering offset. As such, the resulting ciphering key is logically related to the authentication process.
REFERENCES:
patent: 5091942 (1992-02-01), Dent
patent: 5179591 (1993-01-01), Hardy et al.
patent: 5351293 (1994-09-01), Michener et al.
patent: 5748734 (1998-05-01), Mizikovsky
patent: RS 103432 (1999-08-01), None
patent: WO 96/01546 (1996-01-01), None
patent: WO 99/26124 (1999-05-01), None
A. Menezes, P. van Oorschot, and S. Vanstone, “Challenge-Response by Symmetric-Key Techniques”, Section 10.3.2.,Handbook of Applied Cryptography, CRC Press, 1997, pp. 400-403.
Jenkens & Gilchrist P.C.
Peeso Thomas R.
Telefonaktiebolaget LM Ericsson (publ)
LandOfFree
Methods and arrangements for secure linking of entity... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with Methods and arrangements for secure linking of entity..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Methods and arrangements for secure linking of entity... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3164087