Apparatus and method of security identity checker
A method and apparatus that establish secure communications between two stations. The apparatus includes a low power communication processor and a host processor in a sleep mode. The low power communication processor receives a protocol message to initiate a communication. The protocol message includes an encrypted cryptographic identity token and triggers a wake-up event in order to wake up the host processor according to a result of identity a freshness checks performed by the low power communication processor.
1. A method comprising:
establishing an identity exchange via a network with a remote device to generate an identity context message that includes an encrypted cryptographic freshness identity token;
placing a host processor into a sleep mode while maintaining presence on the network with a communication processor;
while operating the host processor in a sleep mode, receiving from a sending device a protocol message with the communication processor to initiate a communication, wherein the protocol message includes the identity context message;
checking identity and freshness of the protocol massage based at least in part on the identity context message, wherein checking a freshness of the protocol massage comprises comparing a value of an incoming protocol message a counter with a received protocol messages counter; and
waking up the host processor if the identity and freshness check of the protocol message is passed.
2. The method of claim 1 , wherein said establishing comprises generating and encrypting a random number to be used as an encrypted counter value for the identity context message.
3. The method of claim 1 , wherein the protocol message comprises an existing network protocol message and the identity context message is contained in an Identity Context field added to the protocol message.
4. The method of claim 1 , wherein said checking identity comprises determining if the sending station is the remote device of the identity exchange.
5. The method of claim 1 , wherein said checking freshness comprises determining if the identity context message is not an already used identity context message.
6. The method of claim 1 , wherein said checking is executed by a security processor or by a security module of the communication processor.
7. The method of claim 1 , further comprising generating a different identity message for different remote devices.
8. An apparatus, comprising:
a host processor; and
a communication processor coupled with the host processor, wherein the communication processor is configured to:
establish an identity exchange via a network with a remote device to generate an identity context message that includes an encrypted cryptographic freshness identity token, wherein the communication processor is further configured to check a freshness of the protocol massage by comparing a value of an incoming protocol message a counter with a received protocol messages counter;
maintain a presence on the network while the host processor is in a sleep mode;
receiving from a sending device a protocol message to initiate a communication, wherein the protocol message includes the identity context message;
check identity and freshness of the protocol massage based at least in part on the identity context message; and
wake up the host processor if the identity and freshness check of the protocol message is passed.
9. The apparatus of claim 8 , wherein the communication processor is further configured to establish the identity exchange by generating and encrypting a random number to be used as an encrypted counter value for the identity context message.
10. The apparatus of claim 8 , wherein the protocol message comprises an existing network protocol message and the identity context message is contained in an Identity Context field added to the protocol message.
11. The apparatus of claim 8 , wherein the communication processor is further configured to check identity by determining if the sending station is the remote device of the identity exchange.
12. The apparatus of claim 8 , wherein the communication processor is further configured to check freshness by determining if the identity context message is not an already used identity context message.
13. The apparatus of claim 8 , further comprising a security processor to perform said checking.
14. The apparatus of claim 8 , wherein the communication processor is further configured to generate a different identity message for different remote devices.
15. An article of manufacture comprising a non-transitory machine readable medium having instructions stored thereon that, if executed, result in:
establishing an identity exchange via a network with a remote device to generate an identity context message that includes an encrypted cryptographic freshness identity token;
placing a host processor into a sleep mode while maintaining presence on the network with a communication processor;
while operating the host processor in a sleep mode, receiving from a sending device a protocol message with the communication processor to initiate a communication, wherein the protocol message includes the identity context message;
checking identity and freshness of the protocol massage based at least in part on the identity context message, wherein checking a freshness of the protocol massage comprises comparing a value of an incoming protocol message a counter with a received protocol messages counter; and
waking up the host processor if the identity and freshness check of the protocol message is passed.
16. The article of manufacture of claim 15 , wherein said establishing comprises generating and encrypting a random number to be used as an encrypted counter value for the identity context message.
17. The article of manufacture of claim 15 , wherein the protocol message comprises an existing network protocol message and the identity context message is contained in an Identity Context field added to the protocol message.
18. The article of manufacture of claim 15 , wherein said checking identity comprises determining if the sending station is the remote device of the identity exchange.
19. The article of manufacture of claim 15 , wherein said checking freshness comprises determining if the identity context message is not an already used identity context message.
20. The article of manufacture of claim 15 , wherein said checking is executed by a security processor or by a security module of the communication processor.
21. The article of manufacture of claim 15 , further comprising generating a different identity message for different remote devices.