Patent ID: 8799656

Claim:
A method comprising: initiating a two-way mutual authentication between a first device and a remote entity, wherein the first device remains anonymous to the remote entity after performing the authentication; establishing a mutually shared session key based on random values from the first device and the remote entity for use in secure communication, wherein the initiating and the establishing are in conjunction with direct anonymous at-testation (DAA), wherein the DAA to convince a verifier that the DAA possess uncompromised cryptographic information from an issuer of a trusted membership group without disclosure of any unique identification information associated with the first device, wherein the DAA includes a unique group membership certificate and a private member key to provide a private unique signature key to prove authenticity of the first device to the verifier that the first device is a member of the trusted membership group without disclosing the unique identification information; sending a first message comprising at least a key-exchange-protocol public key computed based on a first random value, wherein the first random value is selected; generating a session key and a message authentication code (MAC) key based at least on a shared value, wherein the MAC key is used to verify a first public key certificate associated with the remote entity; verifying, by using the MAC key, a first public key certificate associated with the remote entity; computing, based on a random value, a DH public key associated with the remote entity; computing a shared value based on the random number and a DH public key associated with the first device retrievable from the first message; secure erasing, the random value; and generating, by using a remote entity private key, a first digital signature based at least on combined public keys, wherein the combined public keys include the DH public key associated with the remote entity and the DH public key associated with the first device; and sending a second message comprising at least the first digital signature and the MAC.