Granted Patent B2

US 8,693,695 · App. 13/530,593 · Granted Apr 8, 2014

Abstract

Claims (65)

1. A method, carried out by a first system, for establishing secure bidirectional communication with a second system, the method comprising,

generating a first public key and a second public key, the second public key being generated based upon a secret shared by the first system and the second system;

sending the second public key and the first public key to the second system;

receiving a third public key and a fourth public key generated by the second system, the fourth public key having been generated based upon the shared secret;

calculating a first master key based upon the third public key and the fourth public key for encrypting or decrypting messages exchanged with the second system;

generating a new second public key;

receiving a new fourth public key from the second system; and

calculating a new master key based upon the third public key and the new fourth public key for encrypting or decrypting new messages exchanged with the second system.

2. The method of claim 1 , further comprising:

generating a first test string;

sending the first test string to the second system;

receiving a second test string generated by the second system; and

authenticating the second system with the second test string and either the first master key or the new master key.

3. The method of claim 2 , further comprising a step of receiving a data payload having a Universal Description, Discovery and Integration (UDDI) service entry prior to the step of receiving a second test string generated by the second system.

4. The method of claim 1 , wherein the shared secret is communicated over a secure out-of-band channel.

5. The method of claim 1 , wherein an elliptic curve calculation is used in calculating the first master key.

6. The method of claim 1 , further comprising encrypting one or messages using either the first master key or the new master key.

7. A first system, comprising:

means for generating a first public key and a second public key, the second public key being generated based upon a secret shared by the first system and the second system;

means for sending the second public key and the first public key to the second system;

means for receiving a third public key and a fourth public key generated by the second system, the fourth public key being generated based upon the shared secret;

means for calculating a first master key based upon the third public key and the fourth public key for encrypting or decrypting messages exchanged with the second system;

means for generating a new second public key;

means for receiving a new fourth public key from the second system, and

means for calculating a new master key based upon the third public key, and the new fourth public key for encrypting or decrypting new messages exchanged with the second system.

8. A first system, comprising:

a memory encoded with instructions; and

one or more processing units configured by the instructions, wherein the one or more processors are configured to:

generate a first public key and a second public key, the second public key being generated based upon a secret shared by the first system and the second system;

send the second public key and the first public key to the second system;

receive a third public key and a fourth public key generated by the second system, the fourth public key having been generated based upon the shared secret;

calculate a first master key based upon the third public key and the fourth public key, wherein the first master key is configured to be used in encryption of one or more messages;

generate a new second public key; and

receive a new fourth public key from the second system and calculate a new master key based upon the third public key and the new fourth public key.

9. The system of claim 8 , wherein the one or more processors are further configured to:

generate a first test string;

send the first test string to the second system;

receive a second test string generated by the second system; and

authenticate the second system with the second test string and either the first master key or the new master key.

10. The system of claim 9 , wherein the one or more processors are further configured to receive a data payload having a Universal Description, Discovery and Integration (UDDI) service entry prior to receiving a second test string generated by the second system.

11. The system of claim 8 , wherein the shared secret is communicated over a secure out-of-band channel.

12. The system of claim 8 , wherein an elliptic curve calculation is used in calculating the first master key.

13. The system of claim 8 , wherein the one or more processors are further configured to encrypt one or more messages using either the first master key or the new master key.

14. Non-transitory computer-readable storage media encoded with instructions that cause one or more processors in a first system to perform a method, said method comprising:

generating a first public key and a second public key, the second public key being generated based upon a secret shared by the first system and the second system;

sending the second public key and the first public key to the second system;

receiving a third public key and a fourth public key generated by the second system, the fourth public key having been generated based upon the shared secret;

calculating a first master key based upon the third public key and the fourth public key for encrypting or decrypting messages exchanged with the second system;

generating a new second public key;

receiving a new fourth public key from the second system; and

calculating a new master key based upon the third public key and the new fourth public key for encrypting or decrypting new messages exchanged with the second system.

15. A method for establishing a secure bidirectional communication path between a first system and a second system carried out by the second system, the method comprising:

receiving a first public key and a second public key at the second system, the second public key having been generated based upon a secret shared by the first system and the second system;

generating a third public key and a fourth public key, the fourth public key being generated based upon the shared secret;

transmitting the third public key and the fourth public key to the first system;

wherein a first master key is calculated by the first system based upon the third public key and the fourth public key for encrypting or decrypting messages exchanged with the second system;

generating a new fourth public key at the second system and transmitting the new fourth public key to the first system, wherein a new master key is calculated at the first system based upon the third public key, and the new fourth public key for encrypting or decrypting new messages exchanged with the second system.

16. The method of claim 15 , further comprising:

receiving a first test string generated by the first system; and

generating a second test string and transmitting the second test string to the first system;

wherein the first system authenticates the second system with the second test string and either the first master key or the new master key.

17. The method of claim 16 , further comprising a step of transmitting a data payload having a Universal Description, Discovery and Integration (UDDI) service entry prior to the step of transmitting the second test string generated by the second system.

18. The method of claim 15 wherein the shared secret is communicated over a secure out-of-band channel.

19. The method of claim 15 , wherein an elliptic curve calculation is used in calculating the first master key.

20. The method of claim 15 , further comprising encrypting one or messages using either the first master key or the new master key.

Assignments (8)