Patent ID: 7908482

Claim:
A computer-implemented method for key confirmed (KC) authenticated key exchange (AKE) with derived ephemeral keys protocol using a mathematical group, the method comprising: generating, by a first party being a computing system configured for KC-AKE with derived ephemeral keys protocol using a mathematical group, a first-party derived ephemeral public key; sending to a second party, by the first party, the first-party derived ephemeral public key for validation; receiving from the second party, by the first party, a second-party derived ephemeral public key and a second-party signature; responsive to receiving the second-party derived ephemeral public key and the second-party signature, verifying, by the first party, that the second-party derived ephemeral public key is valid; if the second-party derived ephemeral public key is not valid, terminating, by the first party, the KC-AKE with derived ephemeral keys protocol; if the second-party derived ephemeral public key is valid, then: generating, by the first party, a secret confirmation key, the secret confirmation key facilitating demonstration that the first party has the ability to compute an agreed session key value; generating, by the first party, a validation second-party signature using the secret confirmation key value and a first-party message input into a message authentication code (MAC) function, the secret key confirmation value being based on registered identities of the first and second parties, a session identifier and elements of the mathematical group, the elements being based on the second-party derived ephemeral public key, a long-term secret key of the first party, a second party public key, and a derived ephemeral secret key of the first party; verifying, by the first party, that the validation second-party signature matches the received second-party signature; if the validation second-party signature does not match the received second-party signature, terminating, by the first party, the KC-AKE with derived ephemeral keys protocol; if the validation second-party signature matches the received second-party signature, then: generating, by the first party, a first-party signature using the secret confirmation key value and a second-party message input into the MAC function; sending to the second party, by the first party, the first-party signature; and generating, by the first party, a session key, the session key being based on registered identities of the first and second parties, the session identifier, and elements of the mathematical group.