Secured data channel authentication implying a shared secret
The invention solves the way of authentication of secured data channel between two sides (A, B) when there is at first established a non-authenticated protected data channel ( 1 ), with ending ( 3 ) of the data channel ( 1 ) on the first side (A) and ending ( 4 ) of the data channel ( 1 ) on the other side (B) and with target application ( 7 ) on the first side (A) and target application ( 8 ) on the other side (B), while the endings ( 3 ) and ( 4 ) have a non-authenticated shared secret ( 5 ), consequently, on both sides (A, B) of the data channel ( 1 ) there are calculated the data derived from non-authenticated shared secret ( 5 ), then the data derived from the non-authenticated shared secret ( 5 ) are passed via external communication means out of the data channel ( 1 ) to two sides ( 11, 12 ) of the external authentication system ( 2 ), which consequently performs authentication of communicating sides (A, B) including authentication of the data channel ( 1 ).
1. A method of authentication of secured data channel between a first side (A) and a second side (B), said method comprising the steps of:
establishing a non-authenticated protected data channel ( 1 ) with an ending ( 3 ) of the data channel ( 1 ) on the first side (A) and an ending ( 4 ) of the data channel ( 1 ) on the second side (B), and having a target application ( 7 ) on the first side (A) and a target application ( 8 ) on the second side (B), while the endings ( 3 ) and ( 4 ) have a non-authenticated shared secret ( 5 );
calculating data derived from the non-authenticated shared secret ( 5 ) on both the first and second sides (A, B) of the data channel ( 1 ); and
passing the data derived from the non-authenticated shared secret ( 5 ) by way of external communication means outside the data channel ( 1 ) to two sides ( 11 , 12 ) of an external authentication system ( 2 ), which subsequently performs authentication of the first and second sides (A, B) and authentication of the data channel ( 1 );
wherein the external authentication system is a system, a set of programs and devices or an electronic service capable of independently performing authentication of users or systems, respectively.
2. The method according to claim 1 , characterized by that the data derived from the non-authenticated shared secret ( 5 ) are obtained in such a way that the endings ( 3 ) and ( 4 ) calculate a derivate ( 6 ) of the non-authenticated shared secret ( 5 ) or the endings ( 3 ) and ( 4 ) calculate a derivate ( 6 ) from the non-authenticated shared secret ( 5 ) and additional data ( 14 ); and the derivate ( 6 ) is further modified by additional data ( 16 ).
3. The method according to claim 2 , characterized by that modification of the derivate ( 6 ) of the non-authenticated shared secret ( 5 ) is performed on each of the first and second sides (A, B) independently by at least one component selected from the group consisting of the endings ( 3 ) and ( 4 ) of the data channel ( 1 ), the target application ( 7 , 8 ) and the two sides ( 11 , 12 ) of the external authentication system ( 2 ).
4. The method according to claim 2 , characterized by that the additional data ( 14 ) and/or the additional data ( 16 ) are created on each of the first and second sides (A, B) independently by at least one component selected from the group consisting of the endings ( 3 ) and ( 4 ) of the data channel ( 1 ), the target application ( 7 , 8 ) and the two sides ( 11 , 12 ) of the external authentication system ( 2 ).
5. The method according to claim 2 , characterized by that the data derived from the non-authenticated shared secret ( 5 ) are obtained in such a way that the endings ( 3 ) and ( 4 ) calculate the derivate ( 6 ) of the non-authenticated shared secret ( 5 ).
6. The method according to claim 2 , characterized by that the data derived from the non-authenticated shared secret ( 5 ) are obtained in such a way that the endings ( 3 ) and ( 4 ) calculate the derivate ( 6 ) of the non-authenticated shared secret ( 5 ) and the additional data ( 14 ).
7. The method according to claim 2 , characterized by that the data derived from the non-authenticated shared secret ( 5 ) are obtained in such a way that the endings ( 3 ) and ( 4 ) calculate the derivate ( 6 ) of the non-authenticated shared secret ( 5 ) and consequently modify the derivate ( 6 ) of the target application ( 7 ) and ( 8 ) with additional data ( 16 ).
8. The method according to claim 2 , characterized by that the data derived from the non-authenticated shared secret ( 5 ) are obtained in such a way that the endings ( 3 ) and ( 4 ) calculate the derivate ( 6 ) of the non-authenticated shared secret ( 5 ) and the additional data ( 14 ), and consequently the target applications ( 7 ) and ( 8 ) modify it with the additional data ( 16 ).
9. The method according to claim 2 , wherein the derivate ( 6 ) of the non-authenticated shared secret ( 5 ) is passed to the external authentication system ( 2 ) by way of an external interface ( 15 ).
10. The method according to claim 1 , characterized by that the authentication of the data derived from the non-authenticated shared secret ( 5 ) is performed using the external authentication system ( 2 ) using a cryptographic signature using an authenticated signature key of the user and/or the system.
11. The method according to claim 1 , characterized by that the authentication of the data derived from the non-authenticated shared secret ( 5 ) is performed using the external authentication system ( 2 ) by encryption using an authenticated encryption key of the user and/or the system.
12. The method according to claim 1 , characterized by that the authentication of the data derived from the non-authenticated shared secret ( 5 ) is performed using the external authentication system ( 2 ) by comparison of derivates created from the data derived from the non-authenticated shared secret ( 5 ) and authenticated secret of the user and/or the system.
13. The method according to claim 1 , characterized by that the authentication of the data derived from the non-authenticated shared secret ( 5 ) is performed using the external authentication system ( 2 ) using a cryptographic signature using a temporary authenticated signature key of the user and/or the system and/or the system using the external authentication system ( 2 ).
14. The method according to claim 1 , characterized by that the authentication of the data derived from the non-authenticated shared secret ( 5 ) is performed using the external authentication system ( 2 ) by encryption using a temporary encryption key authenticated during authentication of the user and/or the system and/or using the external authentication system ( 2 ).
15. The method according to claim 1 , characterized by that the authentication of the data derived from the non-authenticated shared secret ( 5 ) is performed using the external authentication system ( 2 ) by comparison of derivates created from the data derived from the non-authenticated shared secret ( 5 ) and a temporary authenticated secret of the user and/or the system using the external authentication system ( 2 ).
16. The method according to claim 1 , characterized by that the authentication of the data derived from the non-authenticated shared secret ( 5 ) is performed using the external authentication system ( 2 ) in such a way that handed over data derived from the non-authenticated shared secret ( 5 ) of the data channel ( 1 ) is used by the external authentication system ( 2 ) for authentication of the user in such a way that they replace the challenge in using authentication protocols of a challenge-response type.
17. The method according to claim 1 , wherein the first side (A) and the second side (B) of the data channel ( 1 ) and the two sides ( 11 , 12 ) of the external authentication system ( 2 ) communicate by way of a wide area network or a local network.