Patent ID: 7069435

Claim:
A system for authentication of network stations utilizing symmetric and asymmetric crypto-keys, each network station being associated with a different asymmetric crypto-key, and each asymmetric crypto-key having a public/private key pair with a public key and a private key, comprising: a first network station associated with a first asymmetric crypto-key, the private key of which has multiple private key portions, configured to transmit a first request for authentication; a second network station associated with a second asymmetric crypto-key, having a first of the multiple private key portions of the first asymmetric crypto-key stored thereat, configured to (i) generate a shared symmetric crypto-key, (ii) encrypt the generated shared symmetric crypto-key with the stored first private key portion of the first asymmetric crypto-key to form a first message and sign the first message with the private key of the second asymmetric crypto-key, (iii) transmit the signed first message to the first network station responsive to the transmitted first request for authentication, (iv) encrypt the generated shared symmetric crypto-key with the public key of a third asymmetric crypto-key to form a second message and sign the second message with the private key of the second asymmetric crypto-key, and (v) transmit the signed second message; and a third network station associated with the third asymmetric crypto-key, having a second of the multiple private key portions of the first asymmetric crypto-key stored thereat, configured to (i) authenticate the second network station by applying the public key of the second asymmetric crypto-key to the transmitted signed second message, (ii) recover the shared symmetric crypto-key by applying the private key of the third asymmetric crypto-key to the authenticated second message, (iii) encrypt the recovered shared symmetric crypto-key with the stored second private portion of the first asymmetric crypto-key to form a third message, and (iv) transmit the third message; wherein the first network station is further configured to (i) authenticate the second network station by applying the public portion of the second asymmetric crypto-key to the transmitted signed first message, (ii) combine the authenticated first message and the transmitted third message to form a fourth message, (iii) recover the shared symmetric crypto-key by applying a third of the multiple private key portions of the first asymmetric crypto-key to the fourth message, (iv) encrypt a second authentication request with the recovered shared symmetric crypto-key, and (v) transmit the encrypted second authentication request to authenticate the first network station.