WO2004017185A1 - Hardware-assisted credential validation - Google Patents
Hardware-assisted credential validation Download PDFInfo
- Publication number
- WO2004017185A1 WO2004017185A1 PCT/US2003/025370 US0325370W WO2004017185A1 WO 2004017185 A1 WO2004017185 A1 WO 2004017185A1 US 0325370 W US0325370 W US 0325370W WO 2004017185 A1 WO2004017185 A1 WO 2004017185A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- security credentials
- credential
- credentials
- security
- datagram
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/64—Protecting data integrity, e.g. using checksums, certificates or signatures
Definitions
- SOAP Simple Object Access Protocol
- HTTP has authentication measures such as the secure socket layer (SSL) which can be used by most web browsers to employ a key to encrypt and decrypt information transmitted over the Internet (or any Network) between partners in a secure transaction.
- SSL secure socket layer
- Other examples include the use of symmetric keys, asymmetric keys, session keys, tokens or other types of security credentials.
- An initiating partner sends its security credentials to a receiving partner.
- the receiving partner checks any incoming messages with the security credentials to ensure that each message it receives from the sending partner has credentials that match.
- Credentials may include a certificate, a token or a signature.
- these credentials are implemented and verified in software. This is not very efficient and may still be subjected to manipulation.
- keys stored in a file system are typically managed by software applications. During the processing of the software application, the keys may be exposed. Similarly, if the keys are stored in a database, they may be exposed after they
- Figure 1 shows a network over which a transaction may occur.
- Figure 2 shows an embodiment of a system with credential validation.
- Figure 3 shows an embodiment of a credential validation module.
- Figure 4 shows a flowchart of an embodiment of a method to validate security
- Figure 5 shows a flowchart of an embodiment of a method to validate digital
- Partner A 10 has confidential information related to transactions occurring on its web site
- Partner B 12 is a supplier of Partner A from which
- Partner A wishes to purchase parts in order to manufacture goods to fill the orders received
- Partner A will transmit a purchase order to Partner B.
- the purchase order may have sensitive information in it such as the financial
- Partner A the data transmitted from Partner A to Partner B would more than likely be transmitted across the Internet.
- the network could be any distributed network in which data transmitted from one endpoint to another may make intervening hops.
- the transmitted data could take many forms other than packets in an Internet Protocol (IP) network.
- IP Internet Protocol
- the discrete pieces of data transmitted will be referred to as datagrams.
- Partner A's transmission makes 5 intervening hops between endpoint 10 and endpoint 12.
- a hop could include a hop to an intermediate server at a financial organization, a desktop in a credit services bureau, or some third-party supplier to Partner A. Any one of these hops could be a point of attack for a hacker to assume the other partner's identity.
- an attacker could assume Partner B's identity and garner sensitive financial data on Partner A that could be manipulated.
- the system 20 of Figure 2 includes a security credential validation module 30.
- the system includes a credential validation module 22, a memory 24, a parser 26, and a port 28.
- a credential validation module 22 would reside separate from the credential validation module 30. Using this system embodiment, however, it is possible to see how a networked device can employ security measures to mitigate the likelihood of attacks.
- the credential generator 22 For outgoing data transmissions, the credential generator 22 generates security credentials.
- security credentials include public-private encryption key pairs, tokens, digital signatures or any other type of credential that can be used to verify the identify of the transmitting entity.
- the memory 24 may store credentials generated to allow the system 20 to include the credentials in outgoing data transmissions. These data transmissions would be sent out through port 28.
- Port 28 also allows the system 20 to receive datagrams.
- the security credentials in these datagrams would then be verified and validated by the credential validation module 30.
- a transmission may include a public key from a partner.
- the security validation module would then operate on the public key to ensure that the public key transmitted with the data matches the public key previously received from that partner. This allows the receiving party to determine that it is dealing with the right partner, not an impostor.
- a parser may extract the security credentials from the datagram payload data.
- payload data refers to the data contained inside the datagram that does not include information in the datagram necessary for transmission and management of the datagram, such as the header.
- the parser may not be required, however, as the credentials may be received in such a format that they do not require extraction, or the credential validation module may have the capability of extracting the credentials without need for a parser.
- the parser 26 provides an arithmetic logic unit (ALU) 36 with specific information about the security credentials, or the ALU receives it directly, as mentioned above, hi this embodiment, the security credentials have at least three parts.
- the first part is the actual credential.
- the second is the method that was used to generate the credential. This may include an arithmetic algorithm executed to obtain the credential.
- the third part is the value of the credential.
- the ALU 36 uses the digest method provided to recalculate the credential value by operating on the credential.
- the comparator 38 compares the recalculated result with the original value and determines if the credential is valid.
- An incoming datagram with associated security credentials is optionally parsed at 40.
- the actual security credentials are received. As mentioned previously, the validation
- a digest or a 'hash' is a representation of the security
- the recalculated representation or digest is compared to the provided
- the data can be trusted as being from where it appears to originate. Also, if the security
- credentials are valid, they may be stored at 48. Having a stored credential to be checked
- SOAP Simple Object Access Protocol
- the SOAP payload is parsed, producing three elements of the SOAP
- the SignatureMethod element 52 is the method that is used to convert the canonicalized Signedhrfo into the SignatureNalue 54.
- the process then uses the SignatureMethod and the Signedfrifo to recalculate the
- Each Reference element includes the digest method and resulting digest value calculated over the identified data object.
- a data object is signed by computing its digest value and a signature over that value. The signature is later checked via reference and signature validation.
- the recalculated digest is compared to a provided digest value 66 as a second check on the signature validation. If that match is correct, the signature may be optionally stored at 68 for future comparison in transactions with that partner. If the match is not correct, the signature is assumed to be invalid and the process either returns to validating another signature, as shown, or progresses to handle the invalid signature. Handling of invalid signatures is outside the scope of this disclosure.
- the required Signedfrifo element is the information that is actually signed. Note that the algorithms used in calculating the SignatureNalue are also included in the signed information while the SignatureNalue element is outside Signedfrifo.
- the CanonicalizationMethod is the algorithm that is used to canonicalize the Signedfrifo element before it is digested as part of the signature operation. Note that this example is not in canonical form. This is an optional process and not required for implementation of embodiments of the invention.
- the SignatureMethod is the algorithm that is used to convert the canonicalized Signedfrifo into the SignatureNalue. It is a combination of a digest algorithm and a key dependent algorithm and possibly other algorithms. The algorithm names are signed to protect against attacks based on substituting a weaker algorithm. To promote application interoperability one may specify a set of signature algorithms that must be implemented, though their use is at the discretion of the signature creator. One may specify additional algorithms as 'recommended' or 'optional' for implementation; the design also permits arbitrary user specified algorithms.
- Each Reference element includes the digest method and resulting digest value calculated over the identified data object. It also may include transformations that produced the input to the digest operation.
- a data object is signed by computing its digest value and a signature over that value. The signature is later checked via reference and signature validation.
- Keyfrifo indicates the credential to be used to validate the signature.
- Possible forms for credentials include digital certificates, tokens, key names, and key agreement algorithms and information, as examples.
- Keyfrifo is optional for two reasons. First, the signer may not wish to reveal key information to all document processing parties. Second, the information may be known within the application's context and need not be represented explicitly. Since Keyfrifo is outside of Signedfrifo, if the signer wishes to bind the keying information to the signature, a Reference can easily identify and include the Keyfrifo as part of the signature.
Abstract
Description
Claims
Priority Applications (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
AU2003258211A AU2003258211A1 (en) | 2002-08-16 | 2003-08-13 | Hardware-assisted credential validation |
EP03788442A EP1543402A1 (en) | 2002-08-16 | 2003-08-13 | Hardware-assisted credential validation |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US10/222,111 | 2002-08-16 | ||
US10/222,111 US7512975B2 (en) | 2002-08-16 | 2002-08-16 | Hardware-assisted credential validation |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2004017185A1 true WO2004017185A1 (en) | 2004-02-26 |
Family
ID=31714883
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/US2003/025370 WO2004017185A1 (en) | 2002-08-16 | 2003-08-13 | Hardware-assisted credential validation |
Country Status (6)
Country | Link |
---|---|
US (1) | US7512975B2 (en) |
EP (1) | EP1543402A1 (en) |
CN (1) | CN100367143C (en) |
AU (1) | AU2003258211A1 (en) |
TW (1) | TWI241104B (en) |
WO (1) | WO2004017185A1 (en) |
Families Citing this family (29)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8180051B1 (en) * | 2002-10-07 | 2012-05-15 | Cisco Technology, Inc | Methods and apparatus for securing communications of a user operated device |
KR20090000228A (en) * | 2007-02-05 | 2009-01-07 | 삼성전자주식회사 | Method of providing and using contents enabled to verify integrity and apparatus thereof |
US7866551B2 (en) | 2007-02-15 | 2011-01-11 | Visa U.S.A. Inc. | Dynamic payment device characteristics |
US10008067B2 (en) * | 2008-06-16 | 2018-06-26 | Visa U.S.A. Inc. | System and method for authorizing financial transactions with online merchants |
CN101848085B (en) * | 2009-03-25 | 2013-12-18 | 华为技术有限公司 | Communication system, verification device, and verification and signature method for message identity |
US9715681B2 (en) * | 2009-04-28 | 2017-07-25 | Visa International Service Association | Verification of portable consumer devices |
US8326759B2 (en) * | 2009-04-28 | 2012-12-04 | Visa International Service Association | Verification of portable consumer devices |
US8893967B2 (en) | 2009-05-15 | 2014-11-25 | Visa International Service Association | Secure Communication of payment information to merchants using a verification token |
US8534564B2 (en) | 2009-05-15 | 2013-09-17 | Ayman Hammad | Integration of verification tokens with mobile communication devices |
US8602293B2 (en) | 2009-05-15 | 2013-12-10 | Visa International Service Association | Integration of verification tokens with portable computing devices |
US7891560B2 (en) | 2009-05-15 | 2011-02-22 | Visa International Service Assocation | Verification of portable consumer devices |
US9038886B2 (en) | 2009-05-15 | 2015-05-26 | Visa International Service Association | Verification of portable consumer devices |
US10846683B2 (en) | 2009-05-15 | 2020-11-24 | Visa International Service Association | Integration of verification tokens with mobile communication devices |
US9105027B2 (en) | 2009-05-15 | 2015-08-11 | Visa International Service Association | Verification of portable consumer device for secure services |
US8332325B2 (en) * | 2009-11-02 | 2012-12-11 | Visa International Service Association | Encryption switch processing |
TW201121280A (en) * | 2009-12-10 | 2011-06-16 | Mao-Cong Lin | Network security verification method and device and handheld electronic device verification method. |
US10255591B2 (en) | 2009-12-18 | 2019-04-09 | Visa International Service Association | Payment channel returning limited use proxy dynamic value |
US9667626B2 (en) | 2010-01-27 | 2017-05-30 | Keypasco Ab | Network authentication method and device for implementing the same |
CN107967602A (en) | 2011-03-04 | 2018-04-27 | 维萨国际服务协会 | Ability to pay is bound to the safety element of computer |
US10282724B2 (en) | 2012-03-06 | 2019-05-07 | Visa International Service Association | Security system incorporating mobile device |
RU2019111186A (en) | 2013-12-19 | 2019-05-07 | Виза Интернэшнл Сервис Ассосиэйшн | METHODS AND SYSTEMS OF CLOUD TRANSACTIONS |
US9922322B2 (en) | 2013-12-19 | 2018-03-20 | Visa International Service Association | Cloud-based transactions with magnetic secure transmission |
EP3146747B1 (en) | 2014-05-21 | 2020-07-01 | Visa International Service Association | Offline authentication |
US9775029B2 (en) | 2014-08-22 | 2017-09-26 | Visa International Service Association | Embedding cloud-based functionalities in a communication device |
US10187363B2 (en) | 2014-12-31 | 2019-01-22 | Visa International Service Association | Hybrid integration of software development kit with secure execution environment |
US10135899B1 (en) * | 2016-12-16 | 2018-11-20 | Amazon Technologies, Inc. | Dynamic archiving of streaming content |
US11017077B2 (en) | 2018-03-21 | 2021-05-25 | Nxp Usa, Inc. | Run-time security protection system and method |
AU2019256002B2 (en) * | 2018-04-20 | 2023-08-17 | Vishal Gupta | Decentralized document and entity verification engine |
CN112084484B (en) * | 2020-09-11 | 2022-08-02 | 山东英信计算机技术有限公司 | Equipment hardware safety detection method and device, electronic equipment and storage medium |
Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP0717337A1 (en) * | 1994-12-13 | 1996-06-19 | International Business Machines Corporation | Method and system for the secured distribution of programs |
US6061794A (en) * | 1997-09-30 | 2000-05-09 | Compaq Computer Corp. | System and method for performing secure device communications in a peer-to-peer bus architecture |
WO2001063385A1 (en) * | 2000-02-21 | 2001-08-30 | Ncipher Corporation Limited | Controlling access to a resource by a program using a digital signature |
US6389537B1 (en) * | 1999-04-23 | 2002-05-14 | Intel Corporation | Platform and method for assuring integrity of trusted agent communications |
Family Cites Families (27)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5963649A (en) * | 1995-12-19 | 1999-10-05 | Nec Corporation | Message authorization system for authorizing message for electronic document |
TW338865B (en) * | 1997-06-03 | 1998-08-21 | Philips Eloctronics N V | Authentication system |
JP3671611B2 (en) * | 1997-08-05 | 2005-07-13 | 富士ゼロックス株式会社 | Access credential authentication apparatus and method |
US6457066B1 (en) * | 1997-11-10 | 2002-09-24 | Microsoft Corporation | Simple object access protocol |
US7146618B1 (en) * | 1997-11-10 | 2006-12-05 | Microsoft Corporation | Simple object access protocol |
US6138235A (en) * | 1998-06-29 | 2000-10-24 | Sun Microsystems, Inc. | Controlling access to services between modular applications |
US6088268A (en) * | 1998-09-17 | 2000-07-11 | Atmel Corporation | Flash memory array with internal refresh |
FI107486B (en) * | 1999-06-04 | 2001-08-15 | Nokia Networks Oy | Providing authentication and encryption in a mobile communication system |
US7149965B1 (en) * | 1999-08-10 | 2006-12-12 | Microsoft Corporation | Object persister |
IL138109A (en) * | 2000-08-27 | 2009-11-18 | Enco Tone Ltd | Method and devices for digitally signing files by means of a hand-held device |
US7681032B2 (en) * | 2001-03-12 | 2010-03-16 | Portauthority Technologies Inc. | System and method for monitoring unauthorized transport of digital content |
US6714778B2 (en) * | 2001-05-15 | 2004-03-30 | Nokia Corporation | Context sensitive web services |
WO2003003276A2 (en) * | 2001-06-29 | 2003-01-09 | Oki Electric Industry Co., Ltd. | Method and system for watermarking an electrically depicted image |
EP1451761A1 (en) * | 2001-06-29 | 2004-09-01 | Oki Electric Industry Co., Ltd. | Method and system for watermarking an electrically depicted image |
JP2003051853A (en) * | 2001-08-07 | 2003-02-21 | Matsushita Electric Ind Co Ltd | Communication method and communication device |
US6978223B2 (en) * | 2001-09-06 | 2005-12-20 | Bbnt Solutions Llc | Systems and methods for network performance measurement using packet signature collection |
US7103773B2 (en) * | 2001-10-26 | 2006-09-05 | Hewlett-Packard Development Company, L.P. | Message exchange in an information technology network |
US6687390B2 (en) * | 2001-12-04 | 2004-02-03 | Applied Neural Conputing Ltd. | System for and method of web signature recognition system based on object map |
US7480799B2 (en) * | 2001-12-11 | 2009-01-20 | Actional Corporation | Traffic manager for distributed computing environments |
US7571314B2 (en) * | 2001-12-13 | 2009-08-04 | Intel Corporation | Method of assembling authorization certificate chains |
WO2003055130A1 (en) * | 2001-12-13 | 2003-07-03 | Digimarc Corporation | Reversible watermarking |
US7251730B2 (en) * | 2001-12-21 | 2007-07-31 | Qualcomm Incorporated | Method and apparatus for simplified audio authentication |
US7016948B1 (en) * | 2001-12-21 | 2006-03-21 | Mcafee, Inc. | Method and apparatus for detailed protocol analysis of frames captured in an IEEE 802.11 (b) wireless LAN |
US7603469B2 (en) * | 2002-01-15 | 2009-10-13 | International Business Machines Corporation | Provisioning aggregated services in a distributed computing environment |
AU2003243169B2 (en) * | 2002-04-24 | 2009-03-19 | Intel Corporation | System and method for processing of XML documents represented as an event stream |
US7519819B2 (en) * | 2002-05-29 | 2009-04-14 | Digimarc Corporatino | Layered security in digital watermarking |
US7627761B2 (en) * | 2002-07-22 | 2009-12-01 | Xerox Corporation | System for authentication of JPEG image data |
-
2002
- 2002-08-16 US US10/222,111 patent/US7512975B2/en not_active Expired - Fee Related
-
2003
- 2003-06-26 TW TW092117464A patent/TWI241104B/en not_active IP Right Cessation
- 2003-08-13 EP EP03788442A patent/EP1543402A1/en not_active Ceased
- 2003-08-13 AU AU2003258211A patent/AU2003258211A1/en not_active Abandoned
- 2003-08-13 WO PCT/US2003/025370 patent/WO2004017185A1/en not_active Application Discontinuation
- 2003-08-13 CN CNB038192845A patent/CN100367143C/en not_active Expired - Fee Related
Patent Citations (4)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP0717337A1 (en) * | 1994-12-13 | 1996-06-19 | International Business Machines Corporation | Method and system for the secured distribution of programs |
US6061794A (en) * | 1997-09-30 | 2000-05-09 | Compaq Computer Corp. | System and method for performing secure device communications in a peer-to-peer bus architecture |
US6389537B1 (en) * | 1999-04-23 | 2002-05-14 | Intel Corporation | Platform and method for assuring integrity of trusted agent communications |
WO2001063385A1 (en) * | 2000-02-21 | 2001-08-30 | Ncipher Corporation Limited | Controlling access to a resource by a program using a digital signature |
Non-Patent Citations (2)
Title |
---|
BOX D ET AL: "Simple Object Access Protocol (SOAP) 1.1", W3C WORLD WIDE WEB CONSORTIUM, 8 May 2000 (2000-05-08), XP002163943, Retrieved from the Internet <URL:http://www.w3.org> [retrieved on 20010222] * |
BROWN A., FOX B., SATOSHI H., LAMACCHIA B., MARUYAMA H.: "SOAP Security Extensions: Digital Signature", W3C WORLD WIDE WEB CONSORTIUM, 2001, pages 1 - 5, XP002263657, Retrieved from the Internet <URL:http://www.w3.org/TR/SOAP-dsig/> [retrieved on 20031203] * |
Also Published As
Publication number | Publication date |
---|---|
TW200403936A (en) | 2004-03-01 |
US7512975B2 (en) | 2009-03-31 |
CN100367143C (en) | 2008-02-06 |
CN1675608A (en) | 2005-09-28 |
TWI241104B (en) | 2005-10-01 |
EP1543402A1 (en) | 2005-06-22 |
AU2003258211A1 (en) | 2004-03-03 |
US20040034790A1 (en) | 2004-02-19 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US7512975B2 (en) | Hardware-assisted credential validation | |
US11652644B1 (en) | Quantum-resistant double signature system | |
CN108432180B (en) | Method and system for PKI-based authentication | |
US6105137A (en) | Method and apparatus for integrity verification, authentication, and secure linkage of software modules | |
US6189096B1 (en) | User authentification using a virtual private key | |
US7546452B2 (en) | Hardware-based credential management | |
RU2307391C2 (en) | Method for remote changing of communication password | |
US8392980B1 (en) | Trusted host list for TLS sessions | |
US20070250904A1 (en) | Privacy protection system | |
US20080163337A1 (en) | Data Certification Methods and Apparatus | |
US20060195402A1 (en) | Secure data transmission using undiscoverable or black data | |
JP4783340B2 (en) | Protecting data traffic in a mobile network environment | |
KR101253683B1 (en) | Digital Signing System and Method Using Chained Hash | |
GB2395304A (en) | A digital locking system for physical and digital items using a location based indication for unlocking | |
WO2020101471A1 (en) | Secure framework for transaction signing | |
KR100381710B1 (en) | Method For Security In Internet Server Based Upon Membership Operating System And Server Systems Regarding It | |
CN112118108B (en) | SIP anti-theft verification method and system | |
Téllez et al. | Security in mobile payment systems | |
Xu et al. | On the Verification of Signed Messages | |
Tsague et al. | Secure firmware updates for point of sale terminals | |
Zizhao et al. | WEEK 5 Lecture Note | |
Pasley | Hash Algorithms. | |
Daswani et al. | MACs and Signatures | |
Protocol | Network Working Group M. Nystroem Request for Comments: 4758 RSA Security Category: Informational November 2006 |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AK | Designated states |
Kind code of ref document: A1 Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SY TJ TM TN TR TT TZ UA UG UZ VC VN YU ZA ZM ZW |
|
AL | Designated countries for regional patents |
Kind code of ref document: A1 Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LU MC NL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application | ||
WWE | Wipo information: entry into national phase |
Ref document number: 2003788442 Country of ref document: EP Ref document number: 532/DELNP/2005 Country of ref document: IN |
|
WWE | Wipo information: entry into national phase |
Ref document number: 20038192845 Country of ref document: CN |
|
WWP | Wipo information: published in national office |
Ref document number: 2003788442 Country of ref document: EP |
|
NENP | Non-entry into the national phase |
Ref country code: JP |
|
WWW | Wipo information: withdrawn in national office |
Ref document number: JP |