Timing adjustment for session security protocol
View Patent ↗According to certain embodiments of the present invention, cryptosynchronization values are calculated on an initiating and/or responding device in a communications system such that cryptosynchronization-based procedures might succeed even when the discrepancy between the system times of the initiating and responding devices exceeds the cryptosync constraints imposed by the communications system. In one embodiment, the initiating device add/subtracts a cryptosynchronization adjustment value x to/from the initiating device's system time to yield an adjusted initiator cryptosynchronization value. In another embodiment, the receiving device adjusts the receiving device's system time to yield an adjusted receiver cryptosynchronization value.
1. A first node for a communication system comprising the first node and a second node, wherein, in a first communication procedure:
the first node derives (i) a first cryptosynchronization value (e.g., TimeStampLong(IR)) and (ii) a second cryptosynchronization value (e.g., TimeStampShort(IR)) based on (i) first node system time (e.g., SystemTime(IR)) and (ii) a cryptosynchronization adjustment value (e.g., x), wherein the cryptosynchronization adjustment value is selected to be greater than an expected maximum difference between the first node system time and the second node system time;
the first node generates an initiator message digest based on the first cryptosynchronization value;
the first node transmits the initiator message digest and the second cryptosynchronization value to the second node;
the second node generates a third cryptosynchronization value (e.g., TimeStampLong(RR)) based on (i) the second cryptosynchronization value received from the first node and (ii) second node system time (e.g., SystemTime(RR));
the second node generates a responder message digest based on the third cryptosynchronization value; and
the second node compares (i) the initiator message digest received from the first node and (ii) the responder message digest to determine whether the first communication procedure fails.
2. The invention of claim 1 , wherein the first node is an access network and the second node is an access terminal.
3. The invention of claim 2 , wherein the access network is adapted to communicate simultaneously with a plurality of access terminals, wherein, for each access terminal of the plurality, the access network performs the first communication procedure.
4. The invention of claim 1 , wherein the first node is an access terminal and the second node is an access network.
5. The invention of claim 1 , wherein the first communication procedure is part of a Diffie-Hellman key-exchange procedure.
6. The invention of claim 1 , wherein, in the first communication procedure:
the first node derives the first cryptosynchronization value TimeStampLong(IR) according to:
TimeStampLong(IR)=SystemTime(IR) −x
where SystemTime(IR) is the first node system time and x is the cryptosynchronization adjustment value; and
the first node derives the second cryptosynchronization value TimeStampShort(IR) according to:
TimeStampShort(IR)=TimeStampLong(IR)[15:0],
where TimeStampLong(IR)[15:0] are the 16 least significant bits of TimeStampLong(IR).
7. The invention of claim 1 , wherein the cryptosynchronization adjustment value is selected to ensure that specified cryptosynchronization constraints of the communication system are satisfied.
8. A first node for a communication system comprising the first and a second node, wherein, in a second communication procedure:
the second node derives a fourth cryptosynchronization value (e.g., CryptoSync(IR)) and a fifth cryptosynchronization value (e.g., CryptoSyncShort(IR)) based on second node system time (e.g., SystemTime(IR));
the second node generates an initiator message digest based on the fourth cryptosynchronization value;
the second node transmits the initiator message digest and the fifth cryptosynchronization value to the first node;
the first node generates a sixth cryptosynchronization value (e.g., CryptoSync(RR)) based on (i) the fifth cryptosynchronization value received from the second node, (ii) first node system time (e.g., SystemTime(RR)), and (iii) and a cryptosynchronization adjustment value (e.g., x), wherein the cryptosynchronization adjustment value is selected to be greater than an expected maximum difference between the access network system time and the access terminal system time;
the first node generates a responder message digest based on the sixth cryptosynchronization value; and
the first node compares (i) the initiator message digest received from the second node and (ii) the responder message digest to determine whether the second communication procedure fails.
9. The invention of claim 8 , wherein the first node is an access network and the second node is an access terminal.
10. The invention of claim 9 , wherein the access network is adapted to communicate simultaneously with a plurality of access terminals, wherein, for each access terminal of the plurality, the access network performs the second communication procedure.
11. The invention of claim 8 , wherein the first node is an access terminal and the second node is an access network.
12. The invention of claim 8 , wherein the second communication procedure is an SHA-1 authentication procedure.
13. The invention of claim 8 , wherein, in the second communication procedure, the first node derives the sixth cryptosynchronization value Cryptosync(RR) according to:
Cryptosync
(
RR
)
=
(
SystemTime
(
RR
)
-
x
-
(
(
(
SystemTime
(
RR
)
-
x
)
[
15
:
0
]
-
CryptosyncShort
(
IR
)
)
mod
2
16
)
)
mod
2
64
where SystemTime(RR) is the first node system time; x is the cryptosynchronization adjustment value; and CryptoSyncShort(IR) is the fifth cryptosynchronization value.
14. The invention of claim 8 , wherein the cryptosynchronization adjustment value is selected to ensure that specified cryptosynchronization constraints of the communication system are satisfied.
15. The invention of claim 8 , wherein the first node is further adapted to perform the first communication procedure of claim 1 .
16. A communication system comprising the first node and the second node of claim 1 .
17. A communication system comprising the first node and the second node of claim 8 .
18. A first node for a communication system comprising the first and a second node, wherein, in a second communication procedure:
the second node derives a fourth cryptosynchronization value (e.g., CryptoSync(IR)) and a fifth cryptosynchronization value (e.g., CryptoSyncShort(IR)) based on second node system time (e.g., SystemTime(IR));
the second node generates an initiator message digest based on the fourth cryptosynchronization value;
the second node transmits the initiator message digest and the fifth cryptosynchronization value to the first node;
the first node generates a sixth cryptosynchronization value (e.g., CryptoSync(RR)) based on (i) the fifth cryptosynchronization value received from the second node, (ii) first node system time (e.g., SystemTime(RR)), and (iii) and a cryptosynchronization adjustment value (e.g., x);
the first node generates a responder message digest based on the sixth cryptosynchronization value;
the first node compares (i) the initiator message digest received from the second node and (ii) the responder message digest to determine whether the second communication procedure fails; and
the first node derives the sixth cryptosynchronization value Cryptosync(RR) according to:
Cryptosync
(
RR
)
=
(
SystemTime
(
RR
)
-
x
-
(
(
(
SystemTime
(
RR
)
-
x
)
[
15
:
0
]
-
CryptosyncShort
(
IR
)
)
mod
2
16
)
)
mod
2
64
where SystemTime(RR) is the first node system time; x is the cryptosynchronization adjustment value; and CryptoSyncShort(IR) is the fifth cryptosynchronization value.