Electrical computers and digital processing systems: support – Multiple computer communication using cryptography – Particular node for directing data and applying cryptography
Reexamination Certificate
1999-09-24
2004-09-28
Peeso, Thomas R. (Department: 2132)
Electrical computers and digital processing systems: support
Multiple computer communication using cryptography
Particular node for directing data and applying cryptography
C713S155000, C713S156000
Reexamination Certificate
active
06799270
ABSTRACT:
FIELD OF THE INVENTION
The invention relates generally to client-server computer networks. More specifically, the invention relates to a system and method for securely distributing information among clients and servers in a network.
BACKGROUND OF THE INVENTION
Authentication of computer systems plays an important role in data communications over modem networks. With the rapidly increasing reliance on the electronic highways to convey sensitive data comes the greater need for increased security for such data transmissions. Computer systems need to be mutually assured of the identities of those computer systems with which they exchange information. Further, these computer systems need the assurance that the information in these communications has not been altered during transmission. These needs have led to various techniques that enable computer systems to exchange information securely.
One common authentication technique entails presenting a challenge to the computer system to which the computer system must correctly respond in order to gain permission for subsequent communication. Other authentication techniques involve encryption methods. Generally, there are two main types of encryption methods: asymmetric encryption and symmetric encryption. Asymmetric encryption methods use two different keys, one to encrypt the communication and the other to decrypt the communication. For example, public-key encryption is an asymmetric encryption technique in which one computer system encrypts a communication using a public key and another computer system decrypts the communication using a private key known only to that other computer system. In contrast, symmetric encryption uses one key for both encryption and decryption. Some authentication techniques combine asymmetric and symmetric encryption methods. One exemplary technique is to use public key encryption to distribute a session key to a pair of computer systems that these computer systems then use with symmetric encryption algorithms to exchange encrypted data communications.
An important factor to be considered when using encryption algorithms, however, is that some countries limit the key size for encryption within exported computer and software products. It is understood by those skilled in the art that such encryption algorithms, when constrained by the key size, may be broken.
SUMMARY OF THE INVENTION
In a network including a first node, a second node, and a third node, the invention features a method for securely delivering digital information to the first node from the third node by way of the second node. The method includes receiving a request at the third node from the first node. In response to the request, digital information is generated. The request and the digital information are then operated on to produce a first data structure. The first data structure includes a representation of the digital information. The request and the first data structure are then operated on to produce a second data structure, with the second data structure including the first data structure. The second data structure is transmitted to the second node.
In one embodiment, the digital information includes a session key for the first node to use when communicating with the second node. The session key is encoded using a key shared exclusively with the first node to conceal the session key within the first data structure. Also, the session key can be used to seal a portion of the first data structure. A second session key can be generated for the second node to use in communications with the first node. This second session key can be used to seal a portion of the second data structure containing the first data structure. Also, the second session key can be encoded using a key shared exclusively with the second node. The second data structure includes the encoded second session key.
In another aspect, the invention features a method for securely delivering a session key to a client node from an authentication server node in response to a request from the client node. The method includes sealing plaintext using the session key. The session key is encoded using a key shared with the client node. A data structure including the encoded session key and the sealed plaintext is transmitted to the client node. At the client node, the data structure can be extracted. The encoded session key is decoded using the shared key, and the seal of the plaintext checked using the decoded session key. The plaintext can be used to authenticate that the session key originated from the authentication server, that the decoded session key is unaltered during transmission from the authentication server, and that the data structure is a current response from the authentication server to the request from the client node.
In another aspect, the invention features a system for securely distributing a session key by way of a network. The network includes a first node transmitting a request to obtain the session key and a second node in communication with the first node. The system also includes a third node in communication with the second node for receiving the request by way of the second node. The third node has a processor that generates a first data structure by operating on the request and the session key. The resulting first data structure includes a representation of the session key. The processor also generates a second data structure by operating on the request and the first data structure. The second data structure includes the first data structure.
REFERENCES:
patent: 5491750 (1996-02-01), Bellare et al.
patent: 5956407 (1999-09-01), Slavin
patent: 0 405 215 (1991-01-01), None
patent: 0851628 (1998-04-01), None
P.Y.A. Ryan, S.A. Schneider, “An attack on a recursive authentication protocol A cautionary tale”Information Processing Letters 65, 1998 Elsevier Science B.V., pp. 7-10.
Dave Otway and Owen Rees, “Efficient and Timely Mutual Authentication”, The ANSA Project, 24 Hills Road, Cambridge CB21JP United Kingdom, pp. 8-10.
Lawrence C. Paulson, “Mechanized Proofs for a Recursive Authentication Protocol” Computer Laboratory, University of Cambridge, Pembroke Street, Cambridge CB2 3QG, England, pp. 84-94.
Li Gong, “Using One-Way Functions for Authentication” University of Cambridge Computer Laboratory, Cambridge CB2 3QG, England, Jul. 1989, pp. 8-11.
Examination Report under Section 18 (3), Application No. GB 9925678.6, 3 pgs.
Search Report under Section 17, Application No. GB 9925678.6, 3 pgs.
Bull et al. “The Authentication Protocol”, DRA/CIS3/PROJ/CORBA/SC/1/CSM/436-04/03, Feb. 25, 1997, 20 pgs.
Bull John A.
Otway David J.
Citrix Systems, Inc.
Lahive & Cockfield LLP
Lanza John D.
Peeso Thomas R.
LandOfFree
System and method for secure distribution of digital... does not yet have a rating. At this time, there are no reviews or comments for this patent.
If you have personal experience with System and method for secure distribution of digital..., we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and System and method for secure distribution of digital... will most certainly appreciate the feedback.
Profile ID: LFUS-PAI-O-3210408