US5633933A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and apparatus for a key-management scheme for internet protocols
Assignee: Sun Microsystems Inc
•
Filing: 1996-07-15
•
Granted: 1997-05-27
•
Expires: 2016-07-15
Abstract
Abstract A first data processing device (node I) is coupled to a private network which is in turn coupled to the Internet. A second data processing device (node J) is coupled to the same, or to a different network, which is also coupled to the Internet, such that node I communicates to node J using the Internet protocol. Node I is provided with a secret value i, and a public value α i mod p. Node J is provided with a secret value j, and a public value α j mod p. Data packets (referred to as "datagrams") are encrypted using the teachings of the present invention to enhance network security. A source node I obtains a Diffie-Helman (DH) certificate for node J, (either from a local cache, from a directory service, or directly from node J), and obtains node J's public value α j mod p from the DH certificate. Node I then computes the value of α ij mod p, and derives a key K ij from the value α ij mod p. A transient key K p is then generated at random, and K p is used to encrypt the datagram to be sent by node I. K p is then encrypted with key K ij . Upon receipt of the encrypted datagram by the receiving node J, the node J obtains a DH certificate for node I, (either from a local cache, from a directory service, or directly from node J), and obtains the public value α i mod p. Node I then computes the value of α ij mod p and derives the key K ij . Node J utilizes the key K ij to decrypt the transient key K p , and using the decrypted transient key K p , node J decrypts the datagram packet, thereby resulting in the original data in unencrypted form.
Inventors
- 👤 Ashar Aziz
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-01 08:40
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/02; H04L63/0272; H04L12/00; H04L12/28; H04L12/46; H04L12/4604; H04L63/04; H04L63/0428; H04L63/0435; H04L63/0442; H04L63/06; H04L63/061; H04L63/08; H04L63/0823; H04L9/00; H04L9/08; H04L9/0816; H04L9/0838; H04L9/0841; H04L9/40
Claims Analysis
Total Claims: 31
Claim 1
Independent Claim
205 words
In a computer network, a method for securely transmitting messages from a first node I to a second node J, said method comprising the steps of: providing a first secret value i to node I; keeping said first secret value i secret from nodes on said computer network other than I; providing a second secret value j to node J; keeping said second secret value j secret from nodes on said computer network other than J; computing a first public value P i using as input said secret value i; computing a second public value P j using as input said secret value j; computing an implicit shared secret value SS, using as input said secret value i and said public value P j ; deriving a key K 1 from said implicit shared secret value SS; generating a second key K 2 ; encrypting said second key K 2 with said key K 1 ; encrypting said message with said second key K 2 ; sending said encrypted second key K 2 and said encrypted message from node I to node J; and computing said implicit shared secret value SS, using as input said secret value j and said public value P i .
Claim 2
Dependent Claim
205 words
In a computer network, a method for securely transmitting messages from a first node I to a second node J, said method comprising the steps of: providing a first secret value i to node I; keeping said first secret value i secret from nodes on said computer network other than I; providing a second secret value j to node J; keeping said second secret value j secret from nodes on said computer network other than J; computing a first public value P i using as input said secret value i; computing a second public value P j using as input said secret value j; computing an implicit shared secret value SS, using as input said secret value i and said public value P j ; deriving a key K 1 from said implicit shared secret value SS; generating a second key K 2 ; encrypting said second key K 2 with said key K 1 ; encrypting said message with said second key K 2 ; sending said encrypted second key K 2 and said encrypted message from node I to node J; and computing said implicit shared secret value SS, using as input said secret value j and said public value P i .
Claim 3
Dependent Claim
62 words
The method of claim 1, further comprising the step of selecting a positive prime integer p and an integer α, where said secret values i and j are integers and said public values P i and P j equal α i mod p and α j mod p respectively, and where said implicit shared secret value SS equals α ij mod p.
Claim 4
Dependent Claim
51 words
The method of claim 1, further comprising the step of storing a cached version of said public value P i at a node different from node I, where said step of computing SS using as input j and P i uses said cached version of said public value P i .
Claim 5
Dependent Claim
61 words
The method of claim 1, further comprising the steps of generating a signed certificate containing said public value P i , verifying that said signed certificate is valid, and extracting said public value P i from said signed certificate, where said step of computing SS using as input P i uses said public value P i extracted from said signed certificate.
Claim 6
Dependent Claim
54 words
The method of claim 1, where said step of deriving a key K 1 from said implicit shared secret value SS comprises the steps of extracting a predetermined number of low order bits of said implicit shared secret value SS and deriving said key K 1 from said predetermined number of low order bits.
Claim 7
Independent Claim
196 words
A method for securely transmitting a message from a first node N to a plurality of other nodes on a computer network, said method comprising the steps of: providing a first secret value n to node N; providing a second secret value m; computing a first public value P n using as input said first secret value n; computing a second public value P m using as input said second secret value m; securely distributing said second secret value m to said plurality of other nodes; computing an implicit shared secret value SS, using as input said first secret value n and said second public value P m ; deriving a first key K 1 from said implicit shared secret value SS; generating a second key K 2 ; encrypting said second key K 2 with said first key K 1 ; encrypting a message with said second key K 2 ; multicasting said encrypted second key K 2 and said encrypted message from node N to said plurality of other nodes; and computing said implicit shared secret value SS, using as input said second secret value m and said first public value P n .
Claim 8
Independent Claim
196 words
A method for securely transmitting a message from a first node N to a plurality of other nodes on a computer network, said method comprising the steps of: providing a first secret value n to node N; providing a second secret value m; computing a first public value P n using as input said first secret value n; computing a second public value P m using as input said second secret value m; securely distributing said second secret value m to said plurality of other nodes; computing an implicit shared secret value SS, using as input said first secret value n and said second public value P m ; deriving a first key K 1 from said implicit shared secret value SS; generating a second key K 2 ; encrypting said second key K 2 with said first key K 1 ; encrypting a message with said second key K 2 ; multicasting said encrypted second key K 2 and said encrypted message from node N to said plurality of other nodes; and computing said implicit shared secret value SS, using as input said second secret value m and said first public value P n .
Claim 9
Dependent Claim
198 words
The method of claim 6, where said step of securely distributing said second secret value m to said plurality of other nodes comprises the steps of: selecting a node I which knows said second secret value m; selecting a third secret value i; computing a third public value P i using as input said third secret value i; selecting a node J different from I in said plurality of other nodes; selecting a fourth secret value j; computing a fourth public value P j using as input said fourth secret value j; computing a second implicit shared secret value SS', using as input said secret value i and said public value P j ; deriving a third key K 3 from said implicit shared secret value SS'; generating a fourth key K 4 ; encrypting said fourth key K 4 with said third key K 3 ; encrypting said secret value m with said key K 4 ; sending said encrypted fourth key and said encrypted secret value m from node I to node J; and computing said second implicit shared secret value SS', using as input said secret value j and said public value P i .
Claim 10
Dependent Claim
62 words
The method of claim 6, further comprising the step of selecting a positive prime integer p and an integer α, where said secret values m and n are integers and said public values P m and P n equal α m mod p and α n mod p respectively, and where said implicit shared secret value SS equals α mn mod p.
Claim 11
Dependent Claim
54 words
The method of claim 6, where said step of deriving a key K 1 from said implicit shared secret value SS comprises the steps of extracting a predetermined number of low order bits of said implicit shared secret value SS and deriving said key K 1 from said predetermined number of low order bits.
Claim 12
Dependent Claim
64 words
The method of claim 6, further comprising the steps of generating a signed certificate containing said public value P n , verifying that said signed certificate is valid, and extracting said public value P n , from said signed certificate, where said step of computing SS using as input m and P n uses said public value P n extracted from said signed certificate.
Claim 13
Dependent Claim
51 words
The method of claim 6, further comprising the step of storing a cached version of said public value P n at a node different from node N, where said step of computing SS using as input m and P n uses said cached version of said public value P n .
Claim 14
Independent Claim
224 words
An apparatus for securely transmitting messages from a first node I in a computer network to a second node J in said computer network, comprising: a first secret value generator configured to provide a first secret value i to node I; a second secret value generator configured to provide a second secret value j to node J; a device configured to compute a first public value P i using as input said secret value i; a device configured to compute a second public value P j using as input said secret value j; a device configured to compute an implicit shared secret value SS, using as input said secret value i and said public value P j ; a device configured to derive a key K 1 from said implicit shared secret value SS; a key generator configured to generate a second key K 2 ; a device configured to encrypt said second key K 2 with said second key K 1 ; a device configured to encrypt said message with said second key K 2 ; a device configured to send said encrypted second key K 2 and said encrypted message from node I to node J; and a device configured to compute said implicit shared secret value SS, using as input said secret value j and said public value P i .
Claim 15
Independent Claim
224 words
An apparatus for securely transmitting messages from a first node I in a computer network to a second node J in said computer network, comprising: a first secret value generator configured to provide a first secret value i to node I; a second secret value generator configured to provide a second secret value j to node J; a device configured to compute a first public value P i using as input said secret value i; a device configured to compute a second public value P j using as input said secret value j; a device configured to compute an implicit shared secret value SS, using as input said secret value i and said public value P j ; a device configured to derive a key K 1 from said implicit shared secret value SS; a key generator configured to generate a second key K 2 ; a device configured to encrypt said second key K 2 with said second key K 1 ; a device configured to encrypt said message with said second key K 2 ; a device configured to send said encrypted second key K 2 and said encrypted message from node I to node J; and a device configured to compute said implicit shared secret value SS, using as input said secret value j and said public value P i .
Claim 16
Dependent Claim
57 words
The apparatus of claim 12, further comprising a device configured to store a cached version of said public value P i at a node in said computer network different from node I, where said device configured to compute SS using as input j and P i uses said cached version of said public value P i .
Claim 17
Independent Claim
242 words
An apparatus for securely transmitting a message from a first node N to a plurality of other nodes on a computer network, said apparatus comprising: a device configured to provide a first secret value n to said node N; a device configured to provide a second secret value m; a device configured to compute a first public value P n using as input said first secret value n; a device configured to compute a second public value P m using as input said second secret value m; a device configured to securely distribute said second secret value m to said plurality of other nodes; a device configured to compute an implicit shared secret value SS, using as input said first secret value n and said second public value P m ; a device configured to derive a first key K 1 from said implicit shared secret value SS; a device configured to generate a second key K 2 ; a device configured to encrypt said second key K 2 with said first key K 1 ; a device configured to encrypt a message with said second key K 2 ; a device configured to multicast said encrypted second key K 2 and said encrypted message from node N to said plurality of other nodes; and a device configured to compute said implicit shared secret value SS, using as input said second secret value m and said first public value P n .
Claim 18
Independent Claim
242 words
An apparatus for securely transmitting a message from a first node N to a plurality of other nodes on a computer network, said apparatus comprising: a device configured to provide a first secret value n to said node N; a device configured to provide a second secret value m; a device configured to compute a first public value P n using as input said first secret value n; a device configured to compute a second public value P m using as input said second secret value m; a device configured to securely distribute said second secret value m to said plurality of other nodes; a device configured to compute an implicit shared secret value SS, using as input said first secret value n and said second public value P m ; a device configured to derive a first key K 1 from said implicit shared secret value SS; a device configured to generate a second key K 2 ; a device configured to encrypt said second key K 2 with said first key K 1 ; a device configured to encrypt a message with said second key K 2 ; a device configured to multicast said encrypted second key K 2 and said encrypted message from node N to said plurality of other nodes; and a device configured to compute said implicit shared secret value SS, using as input said second secret value m and said first public value P n .
Claim 19
Dependent Claim
57 words
The apparatus of claim 14, further comprising a device configured to store a cached version of said public value P n at a node in said computer network different from node N, where said device configured to compute SS using as input m and P n uses said cached version of said public value P n .
Claim 20
Dependent Claim
307 words
A computer program product comprising a computer usable medium having computer readable code embodied therein for securely transmitting messages from a first node I in a computer network to a second node J in said computer network, said computer usable medium comprising: a computer readable program code device configured to provide a first secret value n to said node N; a computer readable program code device configured to provide a second secret value m; a computer readable program code device configured to compute a first public value P n using as input said first secret value n; a computer readable program code device configured to compute a second public value P m using as input said second secret value m; a computer readable program code device configured to securely distribute said second secret value m to said plurality of other nodes; a computer readable program code device configured to compute an implicit shared secret value SS, using as input said first secret value n and said second public value P m ; a computer readable program code device configured to derive a first key K 1 from said implicit shared secret value SS; a computer readable program code device configured to generate a second key K 2 ; a computer readable program code device configured to encrypt said second key K 2 with said first key K 1 ; a computer readable program code device configured to encrypt a message with said second key K 2 ; a computer readable program code device configured to multicast said encrypted second key K 2 and said encrypted message from node N to said plurality of other nodes; and a computer readable program code device configured to compute said implicit shared secret value SS, using as input said second secret value m and said first public value P n .
Claim 21
Dependent Claim
307 words
A computer program product comprising a computer usable medium having computer readable code embodied therein for securely transmitting messages from a first node I in a computer network to a second node J in said computer network, said computer usable medium comprising: a computer readable program code device configured to provide a first secret value n to said node N; a computer readable program code device configured to provide a second secret value m; a computer readable program code device configured to compute a first public value P n using as input said first secret value n; a computer readable program code device configured to compute a second public value P m using as input said second secret value m; a computer readable program code device configured to securely distribute said second secret value m to said plurality of other nodes; a computer readable program code device configured to compute an implicit shared secret value SS, using as input said first secret value n and said second public value P m ; a computer readable program code device configured to derive a first key K 1 from said implicit shared secret value SS; a computer readable program code device configured to generate a second key K 2 ; a computer readable program code device configured to encrypt said second key K 2 with said first key K 1 ; a computer readable program code device configured to encrypt a message with said second key K 2 ; a computer readable program code device configured to multicast said encrypted second key K 2 and said encrypted message from node N to said plurality of other nodes; and a computer readable program code device configured to compute said implicit shared secret value SS, using as input said second secret value m and said first public value P n .
Claim 22
Dependent Claim
71 words
The computer program product of claim 16, said computer usable medium further comprising a computer readable program code device configured to store a cached version of said public value P i at a node in said computer network different from node I, where said computer readable program code device configured to compute SS using as input j and P i uses said cached version of said public value P i .
Claim 23
Dependent Claim
301 words
A computer program product comprising a computer usable medium having computer readable code embodied therein for securely transmitting a message from a first node N to a plurality of other nodes on a computer network, said computer usable medium comprising: a computer readable program code device configured to provide a first secret value n; a computer readable program code device configured to provide a second secret value m; a computer readable program code device configured to compute a first public value P n using as input said first secret value n; a computer readable program code device configured to compute a second public value P m using as input said second secret value m; a computer readable program code device configured to securely distribute said second secret value m to said plurality of other nodes; a computer readable program code device configured to compute an implicit shared secret value SS, using as input said first secret value n and said second public value P m ; a computer readable program code device configured to derive a first key K 1 from said implicit shared secret value SS; a computer readable program code device configured to generate a second key K 2 ; a computer readable program code device configured to encrypt said second key K 2 with said first key K 1 ; a computer readable program code device configured to encrypt a message with said second key K 2 ; a computer readable program code device configured to multicast said encrypted second key K 2 and said encrypted message from node N to said plurality of other nodes; and a computer readable program code device configured to compute said implicit shared secret value SS, using as input said second secret value m and said first public value P n .
Claim 24
Dependent Claim
301 words
A computer program product comprising a computer usable medium having computer readable code embodied therein for securely transmitting a message from a first node N to a plurality of other nodes on a computer network, said computer usable medium comprising: a computer readable program code device configured to provide a first secret value n; a computer readable program code device configured to provide a second secret value m; a computer readable program code device configured to compute a first public value P n using as input said first secret value n; a computer readable program code device configured to compute a second public value P m using as input said second secret value m; a computer readable program code device configured to securely distribute said second secret value m to said plurality of other nodes; a computer readable program code device configured to compute an implicit shared secret value SS, using as input said first secret value n and said second public value P m ; a computer readable program code device configured to derive a first key K 1 from said implicit shared secret value SS; a computer readable program code device configured to generate a second key K 2 ; a computer readable program code device configured to encrypt said second key K 2 with said first key K 1 ; a computer readable program code device configured to encrypt a message with said second key K 2 ; a computer readable program code device configured to multicast said encrypted second key K 2 and said encrypted message from node N to said plurality of other nodes; and a computer readable program code device configured to compute said implicit shared secret value SS, using as input said second secret value m and said first public value P n .
Claim 25
Dependent Claim
71 words
The computer program product of claim 18, said computer usable medium further comprising a computer readable program code device configured to store a cached version of said public value P i at a node in said computer network different from node I, where said computer readable program code device configured to compute SS using as input j and P i uses said cached version of said public value P i .
Claim 26
Dependent Claim
226 words
A computer network configured to securely transmit messages from a first node I in said computer network to a second node J in said computer network, comprising: a first secret value generator configured to provide a first secret value i to node I; a second secret value generator configured to provide a second secret value j to node J; a device configured to compute a first public value P i using as input said secret value i; a device configured to compute a second public value P j using as input said secret value j; a device configured to compute an implicit shared secret value SS, using as input said secret value i and said public value P j ; a device configured to derive a key K 1 from said implicit shared secret value SS; a key generator configured to generate a second key K 2 ; a device configured to encrypt said second key K 2 with said second key K 1 ; a device configured to encrypt said message with said second key K 2 ; a device configured to send said encrypted second key K 2 and said encrypted message from node I to node J; and a device configured to compute said implicit shared secret value SS, using as input said secret value j and said public value P i .
Claim 27
Dependent Claim
226 words
A computer network configured to securely transmit messages from a first node I in said computer network to a second node J in said computer network, comprising: a first secret value generator configured to provide a first secret value i to node I; a second secret value generator configured to provide a second secret value j to node J; a device configured to compute a first public value P i using as input said secret value i; a device configured to compute a second public value P j using as input said secret value j; a device configured to compute an implicit shared secret value SS, using as input said secret value i and said public value P j ; a device configured to derive a key K 1 from said implicit shared secret value SS; a key generator configured to generate a second key K 2 ; a device configured to encrypt said second key K 2 with said second key K 1 ; a device configured to encrypt said message with said second key K 2 ; a device configured to send said encrypted second key K 2 and said encrypted message from node I to node J; and a device configured to compute said implicit shared secret value SS, using as input said secret value j and said public value P i .
Claim 28
Dependent Claim
58 words
The computer network of claim 20, further comprising a device configured to store a cached version of said public value P i at a node in said computer network different from node I, where said device configured to compute SS using as input j and P i uses said cached version of said public value P i .
Claim 29
Dependent Claim
245 words
A computer network configured to securely transmit a message from a first node N to a plurality of other nodes on said computer network, said computer network comprising: a device configured to provide a first secret value n to said node N; a device configured to provide a second secret value m; a device configured to compute a first public value P n using as input said first secret value n; a device configured to compute a second public value P m using as input said second secret value m; a device configured to securely distribute said second secret value m to said plurality of other nodes; a device configured to compute an implicit shared secret value SS, using as input said first secret value n and said second public value P m ; a device configured to derive a first key K 1 from said implicit shared secret value SS; a device configured to generate a second key K 2 ; a device configured to encrypt said second key K 2 with said first key K 1 ; a device configured to encrypt a message with said second key K 2 ; a device configured to multicast said encrypted second key K 2 and said encrypted message from node N to said plurality of other nodes; and a device configured to compute said implicit shared secret value SS, using as input said second secret value m and said first public value P n .
Claim 30
Dependent Claim
245 words
A computer network configured to securely transmit a message from a first node N to a plurality of other nodes on said computer network, said computer network comprising: a device configured to provide a first secret value n to said node N; a device configured to provide a second secret value m; a device configured to compute a first public value P n using as input said first secret value n; a device configured to compute a second public value P m using as input said second secret value m; a device configured to securely distribute said second secret value m to said plurality of other nodes; a device configured to compute an implicit shared secret value SS, using as input said first secret value n and said second public value P m ; a device configured to derive a first key K 1 from said implicit shared secret value SS; a device configured to generate a second key K 2 ; a device configured to encrypt said second key K 2 with said first key K 1 ; a device configured to encrypt a message with said second key K 2 ; a device configured to multicast said encrypted second key K 2 and said encrypted message from node N to said plurality of other nodes; and a device configured to compute said implicit shared secret value SS, using as input said second secret value m and said first public value P n .
Claim 31
Dependent Claim
54 words
The computer network of claim 22, further comprising a device configured to store a cached version of said public value P n at a node different from node N, where said device configured to compute SS using as input m and P n uses said cached version of said public value P n .
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2000-05-26 | 2000-11-25 | 2001-05-27 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2004-05-26 | 2004-11-25 | 2005-05-27 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2008-05-26 | 2008-11-25 | 2009-05-27 | $7700.00 | Window Closed / Lapsed |