Abstract:
A method for facilitating an authentication related to an electronic transaction between a first and a second user is provided. Authentication data is received from the first user along with transaction data defining the first user and the electronic transaction to be authenticated. This authentication data is compared to enrollment authentication data associated with the first user in order to verify the identity of the first user. When the user is properly verified, access to at least one private cryptographic key stored on a secure server is available for use in securing the electronic transaction. The particular private cryptographic key need not be released from the secure server. Data indicating the status of the authentication may then be sent to one of either the first or second user.
Abstract:
A method of allocating the risk associated with a false authentication during an electronic transaction is provided when a confidence gap exists between an authentication confidence level and a desired confidence level. The confidence gap represents the difference between the level of security required for the electronic transaction and that which is currently available. Insurance is offered to at least one of the parties to the transaction. The insurance may be used to close the confidence gap by either raising the authentication confidence level or lowering the desired confidence level. The insurance seller bears the increased risk of a false authentication.
Abstract:
The invention relates to a code exchange protocol in which communication partners (A, B) each have a secret code (S) and a public code (P). According to the invention, communication partner (A) selects a random number (x), and communication partner (B) selects a random number (y). A first partial code (Ax) is formed by communication partner (A), and a second partial code (By) is formed by communication partner (B) by using the public code (P) of the respective partner (B, A). Each partial code is transmitted to the other communication partner (B, A). A session code (g , g ) is formed from each of the personal random numbers (x, y) and from the partial code (By, Ax) of the respective communication partner (B, A) by using the personal secret code (S), whereby the partial codes (Ax, By), and the session codes (g , g ) can be calculated in a manner which is analogous to the Diffie-Hellman protocol.
Abstract:
A cryptographic protocol establishes shared secrets such as encryption/decryption keys by exchanging public signals generated from transformations of private signals and one or more authentication factors including "what you know", "what you have" and "what you are" factors. A novel use of the authentication factors provides resistance against various types of cryptanalysis including dictionary attacks and man-in-the-middle attacks, allows detection of prior occurrences of unauthorized parties successfully masquerading as an authorized party, and provides enhanced security in cryptosystems that rely on "what you know" authentication factors such as passwords which are often weak in a cryptographic sense.
Abstract:
A key establishment protocol between a pair of correspondents includes the generation by each correspondent of respective signatures. The signatures are derived from information that is private to the correspondent and information that is public. After exchange of signatures, the integrity of exchange messages can be verified by extracting the public information contained in the signature and comparing it with information used to generate the signature. A common session key may then be generated from the public and private information of respective ones of the correspondents.
Abstract:
Systems and methods prevent fraudulent registration of devices associated with remuneration vehicles by bootstrapping the device to be registered with a bootstrap URL. The bootstrap URL may provide access to a registration server hosted by the vehicle provider. The vehicle provider may verify a single use of the bootstrap URL. Moreover, if access to the bootstrap URL is provided to the device, the vehicle provider may provide a server access communication to the device allowing the device and vehicle provider to set up a secure communication (even if communicating via an unsecure communication path). The secure communication may be used by the vehicle provider and the device to negotiate a symmetric communication key. At least the secure access communication and the symmetric communication key may operate based on one or more of an Elliptic Curve-, Diffie Hellman-, or Elliptic Curve Diffie Hellman (ECDH)-based secure connection scheme.
Abstract:
A method and secret origination service are provided for calculating and distributing a shared secret. The secret origination service receives a first shared secret request from a first device. The first shared secret request includes a first identity token associated with a first user of the first device and a second participant identifier associated with a second user. The secret origination service verifies the first identity token to produce a first verified requestor identity and calculates a first shared secret based on the first verified requestor identity and the second user. The secret origination service sends the first shared secret to the first device. The secret origination service also receives a second shared secret request from the second device, which includes a second identity token associated with the second user of the second device and a first participant identifier associated with the first user. The secret origination service verifies the second identity token to produce a second verified requestor identity and calculates a second shared secret based on the second verified requestor identity and the first user. Because the inputs are the same, the second shared secret is identical to the first shared secret. The secret origination service sends the second shared secret to the second device.
Abstract:
A first network node is provided arranged to obtain a second certificate and a second authentication token from a second network node. An identity unit is arranged to obtain a second identifier from the second certificate. An identity-based shared key unit (147) arranged to generate an identity-based shared key by applying a key establishment algorithm of the identity-based key pre-distribution scheme on the second identifier and the first local 5 key material. An authentication unit (148) is arranged to authenticate the second network node by cryptographically verifying that the second authentication token has been computed from at least the identity-based shared key.
Abstract:
A method (300) and system (1) of determining a common secret for two nodes (3, 7). Each node (3, 7) has a respective asymmetric cryptography pair, each pair including a master private key and a master public key. Respective second private and public keys may be determined based on the master private key, master public key and a deterministic key. A common secret may be determined at each of the nodes based on the second private and public keys. In one example, a node (3, 7) may determine the common secret based on (i) a second private key based on the node's own master private key and the deterministic key; and (ii) a second public key based on the other node's master public key and the deterministic key. The invention may be suited for use with, but not limited to, digital wallets, blockchain (e.g. Bitcoin) technologies and personal device security.
Abstract:
A computer implemented method of authenticating communication between a first node and a second node, using a function of combined information obtained from at least one of the nodes, the method comprising: sending a commitment message from the first node to the second node, the message containing content based on (at least) a first part of the combined information, which content commits the first node to a first value of the function, and wherein the first part of the combined information is communicated from the first node to the second node with a delay mechanism that only allows the first part of the information to be determined by the second node after a predetermined time; and in response to receiving notification at the first node that the second node has received the message, which receipt commits the second node to the first function value: sending a subsequent message comprising the first part of the information from the first node to the second node, or waiting until after the predetermined time; and in response to the second node receiving the subsequent message before the predetermined time, or in response to waiting until after the predetermined time: compiling the combined information at the second node by combining the first part of the information, obtained from the subsequent message or determined after the predetermined time using the delay mechanism, with the remainder of the combined information at least part of which has been received from the first node, calculating the function of the combined information at each of the first node and the second node, thereby to enable comparison of the calculated function values of each node using an empirical channel.