US6091820A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for achieving perfect forward secrecy in closed user groups
Assignee: Sun Microsystems Inc
•
Filing: 1997-04-30
•
Granted: 2000-07-18
•
Expires: 2017-04-30
Abstract
Abstract A method and apparatus for generating additional implicit keys from a key [K ij ] N without the necessity of generating a new Diffie-Helman (DH) certificate or requiring communication between nodes to change implicit master keys is disclosed. A first data processing device (node I) is coupled to a private network which is in turn coupled to the Internet. A second data processing device (node J) is coupled to the same, or to a different network, which is also coupled to the Internet, such that node I communicates with node J using the Internet protocol. Node I is provided with a secret value i and a public value. Data packets (referred to as "datagrams") are encrypted to enhance network security. Each node maintains an internal value of N which is incremented based on time and upon the receipt of a data packet from another node. The key [K ij ] N .sbsb.i is derived from the appropriate quantity of ∝ Nij by using high order key-sized bits of the respective quantity. The present invention then utilizes the key [K ij ] N .sbsb.i to encrypt a transient key which is referred to as K p . Node I encrypts the IP data in K p and encrypts K p in [K ij ] N .sbsb.i. Node I transmits the encrypted IP datagram packet in the encrypted key K p to the receiving node J. Node I further includes its current internal value of N i in the outgoing packet. The present invention also provides for the application of one-way functions to the shared secret to enhance security. Thus, either node I or node J may change the context such that if in the future [K ij ] Ni is compromised, or is not useable by a cracker-to either decrypt prior encrypted packets. The present invention discloses methods and apparatus for achieving perfect forward security for closed user groups, and for the application of the SKIP methodology to datagram multicast protocols.
Inventors
- 👤 Ashar Aziz
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-31 14:09
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/04; H04L12/00; H04L12/02; H04L12/16; H04L12/18; H04L12/28; H04L12/46; H04L12/4604; H04L63/0428; H04L63/0435; H04L63/0442; H04L63/06; H04L63/061; H04L63/08; H04L63/0823; H04L9/00; H04L9/08; H04L9/0816; H04L9/0838; H04L9/0841; H04L9/40
Claims Analysis
Total Claims: 33
Claim 1
Independent Claim
143 words
A method for a first data processing device (node I) to send data to a second data processing device (node J) in a closed user group having X nodes, comprising: providing a unique secret value and a public value to each of the X nodes; providing a context variable to each of said X nodes; obtaining a certificate for each of said other (X-1) nodes and determining said public values for each of said other (X-1) nodes from said certificates; precomputing a shared secret for each of said other (X-1) nodes; deleting the unique secret value for node I; computing a key from said precomputed shared secret for said nodes I and J; encrypting data to be transmitted to node J using said key to said node J; notifying said node J of the current value of said context variable for node I.
Claim 2
Independent Claim
143 words
A method for a first data processing device (node I) to send data to a second data processing device (node J) in a closed user group having X nodes, comprising: providing a unique secret value and a public value to each of the X nodes; providing a context variable to each of said X nodes; obtaining a certificate for each of said other (X-1) nodes and determining said public values for each of said other (X-1) nodes from said certificates; precomputing a shared secret for each of said other (X-1) nodes; deleting the unique secret value for node I; computing a key from said precomputed shared secret for said nodes I and J; encrypting data to be transmitted to node J using said key to said node J; notifying said node J of the current value of said context variable for node I.
Claim 3
Dependent Claim
42 words
A method as defined by claim 1, wherein each of said X nodes obtains a certificate and determines the public values and p recomputes a shared secret, the method further comprising each of said X nodes deleting its own unique secret value.
Claim 4
Independent Claim
182 words
An apparatus for encrypting data for transmission from a first data processing device (node I) to a second data processing device (node J) in a closed user group having X nodes, comprising: a storage device configured to store a unique secret value for node I, a public value for node I, and an internal context variable for node I; a computation device configured to precompute a shared secret for node I and each of said other (X-1) nodes, using a certificate for each of said other (X-1) nodes to determine said public value for said other (X-1) nodes; an encrypting device configured to encrypt data to be transmitted from node I to node J; said encrypting device deriving a key from the precomputed shared secret for said nodes I and J and the context variable of node I; and said encrypting device encrypting said data using said key; node I further including an interface circuit configured to transmit said encrypted data to said node J and to notify said node J of the value of the internal context variable for node I.
Claim 5
Independent Claim
182 words
An apparatus for encrypting data for transmission from a first data processing device (node I) to a second data processing device (node J) in a closed user group having X nodes, comprising: a storage device configured to store a unique secret value for node I, a public value for node I, and an internal context variable for node I; a computation device configured to precompute a shared secret for node I and each of said other (X-1) nodes, using a certificate for each of said other (X-1) nodes to determine said public value for said other (X-1) nodes; an encrypting device configured to encrypt data to be transmitted from node I to node J; said encrypting device deriving a key from the precomputed shared secret for said nodes I and J and the context variable of node I; and said encrypting device encrypting said data using said key; node I further including an interface circuit configured to transmit said encrypted data to said node J and to notify said node J of the value of the internal context variable for node I.
Claim 6
Dependent Claim
32 words
An apparatus as defined in claim 3, wherein said encryption device for said node I deletes its own unique secret value after precomputing all of said shared secrets for said other nodes.
Claim 7
Independent Claim
249 words
An apparatus for receiving encrypted data into a first processing device (node J) from a second processing device (node I) in a closed user group having X nodes, wherein the encrypted data includes an initial context variable for node I and a transient key employed to encrypt other data to be transmitted to node J, the data being encrypted with a key, the apparatus comprising: a storage device configured to store a unique secret value for node J, a public value for node J, and an internal context variable for node J; a computation device configured to precompute a shared secret for node J and each of the other nodes, using a certificate for each of the other nodes to determine said public value for the other nodes; a receiver arranged to receive the encrypted data from node I; and a decrypting device coupled to the receiver for decrypting the encrypted data from node I, wherein the decrypting device comprises: a comparator configured to compare the internal context variable of node I and J; and a key-computation device configured to compute the key from the precomputed shared secret for the nodes I and J if the internal context variable for node I is greater than the context variable for node J, wherein the decrypting device utilizes the key to decrypt the transient key, decrypts the other data using the transient key, and sets the internal context variable for node J equal to the internal context variable for node I.
Claim 8
Independent Claim
249 words
An apparatus for receiving encrypted data into a first processing device (node J) from a second processing device (node I) in a closed user group having X nodes, wherein the encrypted data includes an initial context variable for node I and a transient key employed to encrypt other data to be transmitted to node J, the data being encrypted with a key, the apparatus comprising: a storage device configured to store a unique secret value for node J, a public value for node J, and an internal context variable for node J; a computation device configured to precompute a shared secret for node J and each of the other nodes, using a certificate for each of the other nodes to determine said public value for the other nodes; a receiver arranged to receive the encrypted data from node I; and a decrypting device coupled to the receiver for decrypting the encrypted data from node I, wherein the decrypting device comprises: a comparator configured to compare the internal context variable of node I and J; and a key-computation device configured to compute the key from the precomputed shared secret for the nodes I and J if the internal context variable for node I is greater than the context variable for node J, wherein the decrypting device utilizes the key to decrypt the transient key, decrypts the other data using the transient key, and sets the internal context variable for node J equal to the internal context variable for node I.
Claim 9
Dependent Claim
64 words
An apparatus as defined in claim 5, wherein if the internal context variable for node I is equal to the internal context variable for node J, the key-computation device computes the key from the precomputed shared secret for the nodes I and J, and wherein the decrypting device uses key to decrypt the transient key, and decrypts the other data using the transient key.
Claim 10
Dependent Claim
34 words
An apparatus as defined by claim 6, wherein if the internal context for node I is less than the internal context variable for node J, the receiver or the decrypting device discards the data.
Claim 11
Dependent Claim
26 words
An apparatus as defined by claim 7, further comprising an incrementor arranged to increment the internal context variable for node J after a predetermined time period.
Claim 12
Dependent Claim
55 words
An apparatus as defined by claim 8, wherein the computation device is further configured to compute a next shared secret based on the incremented internal context variable for node J from the shared secret based on the previous context variable for node J and deletes the previous shared secret for all of the other nodes.
Claim 13
Dependent Claim
21 words
An apparatus as defined by claim 9, wherein the internal context variable for node J is initially set equal to 1.
Claim 14
Dependent Claim
35 words
An apparatus as defined by claim 5, wherein the public value for each of said X nodes is α 1 mod p, where 1 is the unique secret value for each of the X nodes.
Claim 15
Dependent Claim
29 words
An apparatus as defined by claim 9, wherein the next shared secret is computed from the previous shared secret by applying a one-way function to the previous shared secret.
Claim 16
Dependent Claim
26 words
An apparatus as defined in claim 12, wherein the key is an implicit pair wise secret used as a key for a shared key cryptosystem (SKCS).
Claim 17
Dependent Claim
26 words
An apparatus as defined in claim 13, wherein α and p are system parameters, and wherein p is a composite number which is difficult to factor.
Claim 18
Dependent Claim
23 words
An apparatus as defined in claim 14, wherein the data packet includes a source address, a destination address and an SKCS identifier field.
Claim 19
Dependent Claim
17 words
An apparatus as defined in claim 9, wherein the data packet further includes a message indicator field.
Claim 20
Independent Claim
178 words
A method for receiving encrypted data into a first processing device (node J) from a second processing device (node I) in a closed user group having X nodes, wherein the encrypted data includes an initial context variable for node I and a transient key employed to encrypt other data to be transmitted to node J, the data being encrypted with a key, the apparatus comprising: providing a unique secret value and a public value to each of the X nodes; providing a context variable to each of said X nodes; precomputing a shared secret for node J and each of the other nodes; deleting the unique secret value for node J; receiving the encrypted data from node I; and comparing the internal context variable of node I and J; and computing the key from the precomputed shared secret for the nodes I and J and setting the internal context variable for node J equal to the internal context variable for node I when the internal context variable for node I is greater than the context variable for node.
Claim 21
Independent Claim
178 words
A method for receiving encrypted data into a first processing device (node J) from a second processing device (node I) in a closed user group having X nodes, wherein the encrypted data includes an initial context variable for node I and a transient key employed to encrypt other data to be transmitted to node J, the data being encrypted with a key, the apparatus comprising: providing a unique secret value and a public value to each of the X nodes; providing a context variable to each of said X nodes; precomputing a shared secret for node J and each of the other nodes; deleting the unique secret value for node J; receiving the encrypted data from node I; and comparing the internal context variable of node I and J; and computing the key from the precomputed shared secret for the nodes I and J and setting the internal context variable for node J equal to the internal context variable for node I when the internal context variable for node I is greater than the context variable for node.
Claim 22
Dependent Claim
37 words
A method as defined in claim 17, further comprising: decrypting the transient key using the key; and decrypting the other data with the transient key whereby node J decrypts data received and previously encrypted by node I.
Claim 23
Dependent Claim
39 words
A method as defined by claim 18, further comprising computing the key from the precomputed shared secret for nodes I and J if the internal context for node I is equal to the internal context variable for node J.
Claim 24
Dependent Claim
34 words
A method as defined by claim 19, further comprising discarding the data and denoting an error condition if the internal context for node I is less than the internal context variable for node J.
Claim 25
Dependent Claim
25 words
A method as defined by claim 20, further comprising incrementing a value of the internal context variable for node J after a predetermined time period.
Claim 26
Dependent Claim
48 words
An apparatus as defined by claim 21, further comprising: computing a next shared secret based on the incremented internal context variable for node J from the shared secret based on the previous context variable for the other nodes; and deleting the previous shared secret for the other nodes.
Claim 27
Dependent Claim
21 words
A method as defined by claim 22, wherein the internal context variable for node J is initially set equal to 1.
Claim 28
Dependent Claim
29 words
A method as defined by claim 23, wherein the next shared secret is computed from the previous shared secret by applying a one-way function to the previous shared secret.
Claim 29
Dependent Claim
16 words
A method as defined by claim 24, wherein the one-way function is f(z)=z M mod p.
Claim 30
Dependent Claim
30 words
A method as defined by claim 23, wherein the key is an implicit pair wise secret used as a key for a shared key cryptosystem (SKCS) and derived from α.sup.(M.spsp.N.sup.)ij.
Claim 31
Dependent Claim
26 words
A method as defined by claim 26, wherein α and p are system parameters, and wherein p is a composite number which is difficult to factor.
Claim 32
Dependent Claim
28 words
A method as defined by claim 27, wherein the other data comprises a data packet which includes a source address, a destination address and an SKCS identifier field.
Claim 33
Dependent Claim
17 words
A method as defined by claim 28, wherein the data packet further includes a message indicator field.
References Cited (Backward Citations)
US5668877A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-07-18 | 2004-01-17 | 2004-07-18 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-07-18 | 2008-01-17 | 2008-07-18 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-07-18 | 2012-01-17 | 2012-07-18 | $7700.00 | Window Closed / Lapsed |