Patent ID: 8707046
Filing Date: 2014-04-22
Classification: H04L

Abstract:
1. A method of two-way mutual authentication and key sharing between a first computing platform and a second computing platform, the first computing platform remaining anonymous to the second computing platform after performing the authentication and key sharing comprising: selecting a first random value; sending a first message, having at least a first key-exchange-protocol public key generated based at least in part on the first random value, from the first computing platform to the second computing platform; generating, by the first computing platform in response to receiving a second message from the second computing platform, a shared value based at least in part on the first random value and a second key-exchange-protocol public key associated with the second computing platform; generating a mutually shared session key and a message authentication code (MAC) key based at least in part on the shared value; verifying a public key certificate associated with the second computing platform; verifying, by using the MAC key, a MAC of the second computing platform's public key certificate; verifying a first digital signature from the second message based at least in part on a combination of key-exchange-protocol public keys, wherein the first digital signature is associated with the second computing platform and is retrievable using the second key-exchange-protocol public key from the second computing platform's public key certificate; generating, by using a Direct Anonymous Attestation (DAA)-based private key of the first computing platform, a DAA-based signature based at least in part on a combination of the key-exchange-protocol public keys; generating, by using the MAC key, a MAC of the first key-exchange-protocol public key, a DAA-based group certificate associated with the first computing platform, and the DAA-based signature; sending a third message from the first computing platform to the second computing platform, the third message comprising the MAC of the first key-exchange-protocol public key, the DAA-based group certificate associated with the first computing platform, and the DAA-based signature; detecting whether there is a failure during certificate verification, MAC verification, or signature verification; and aborting the authentication if a failure is detected.