Method for improved hash chaining authentication
A method for improving communication security implemented by a sending device. The method includes the sending device generating a first hash token based on a K generation hash (H K ) value of a seed known only to the sending device, where K is an integer value greater than one, and sending a first message that includes the first hash token. The method further includes the sending device performing a reversible combination of a K−1 generation hash (H K−1 ) value of the seed and a hash of the first message to generate a second hash token, and sending the second message that includes the second hash token.
1. A method for improving communication security implemented by a first device, the method comprising:
receiving a first message (M N ) that includes a first hash token based on a K generation hash (H K ) value of a seed, wherein K is an integer value greater than one;
storing the H K value and at least one of the first message (M N ) or a hash of the first message (H(M N ));
receiving a second message (M N+1 ) that includes a second hash token based on a first reversible combination of a K−1 generation hash (H K−1 ) value of the seed and the hash of the first message (H(M N ));
reversing the first reversible combination using the stored first message (M N ) or the stored hash of the first message (H(M N )) to determine the K−1 generation hash (H K−1 ) value from the second hash token;
determining whether a hash value of the hash of the K−1 generation hash (H K−1 ) value (H(H K−1 )) is equal to the H K value; and
authenticating the second message (M N+1 ) was from a second device that sent the first message (M N ) and that the first message (M N ) was received complete and unaltered when the hash value of the K−1 generation hash (H K−1 ) value (H(H K−1 )) is equal to the H K value.
2. The method of claim 1 , further comprising discarding the second message (M N+1 ) when the hash value of the K−1 generation hash (H K−1 ) value (H(H K−1 )) is not equal to the H K value.
3. The method of claim 1 , wherein determining the K−1 generation hash (H K−1 ) value from the second hash token comprises:
retrieving the stored hash of the first message (M N ) or hashing the stored first message (M N ) that was received by the first device; and
performing an exclusive-or (XOR) operation between the stored hash of the first message (M N ) or a hash of the stored first message (M N ) and the second hash token to determine the K−1 generation hash (H K−1 ) value from the second hash token.
4. The method of claim 1 , further comprising receiving a third message (M N+2 ) that includes a third hash token based on a second reversible combination of a K−2 generation hash (H K−2 ) value of the seed and a hash of the second message (M N+1 ).
5. The method of claim 4 , further comprising:
determining the K−2 generation hash (H K−2 ) value from the third hash token;
determining whether a hash value of the hash of the K−2 generation hash (H K−2 ) value (H(H K−2 )) is equal to the K−1 generation hash (H K−1 ) value; and
authenticating the third message (M N+2 ) was from the second device that sent the second message (M N+1 ) and that the second message (M N+1 ) was received complete and unaltered when the hash value of the K−2 generation hash (H K−2 ) value (H(H K−2 )) is equal to the K−1 generation hash (H K−1 ) value.
6. The method of claim 5 , further comprising verifying the second message (M N+1 ) was received complete and unaltered when the hash of the second message (M N+1 ) received by the first device is equal to the hash of the second message (M N+1 ) in the third message (M N+2 ).
7. A method for improving communication security implemented by a first device, the method comprising:
receiving a first incoming message from a second device, wherein the first incoming message includes a first incoming hash token comprising a first reversible combination of a J+1 generation hash (H J+1 ) value of a first seed known only to the second device and a hash of any last outgoing message from the first device, wherein J is an integer value greater than one;
generating a first outgoing hash token based on a second reversible combination of a K+1 generation hash (H K+1 ) value of a second seed known only to the first device and a hash of the first incoming message, wherein K is an integer value greater than one; and
sending a first outgoing message that includes the first outgoing hash token to the second device.
8. The method of claim 7 , further comprising:
determining the J+1 generation hash (H J+1 ) value of the first seed from the first incoming hash token; and
storing the J+1 generation hash (H J+1 ) value for use in authenticating a second incoming message from the second device.
9. The method of claim 8 , further comprising receiving the second incoming message from the second device, wherein the second incoming message includes a second incoming hash token based on a third reversible combination of a J generation hash (H J ) value of the first seed and the hash of the first outgoing message.
10. The method of claim 9 , further comprising:
determining the J generation hash (H J ) value from the second incoming hash token;
determining whether a hash value of the J generation hash (H J ) value is equal to the H J+1 value; and
authenticating the second incoming message was from the second device and that the first outgoing message was received complete and unaltered by the second device when the hash value of the J generation hash (H J ) value is equal to the H J+1 value.
11. An apparatus configured to improve communication security, the apparatus comprising:
a memory configured to store instructions; and
one or more processors coupled to the memory and configured to execute the instructions to cause the apparatus to:
receive a first message (M N ) that includes a first hash token based on a K generation hash (H K ) value of a seed, wherein K is an integer value greater than one;
store the H K value and at least one of the first message (M N ) or a hash of the first message (H(M N ));
receive a second message (M N+1 ) that includes a second hash token based on a first reversible combination of a K−1 generation hash (H K−1 ) value of the seed and the hash of the first message;
reverse the first reversible combination using the stored first message (M N ) or the stored hash of the first message (H(M N )) to determine the K−1 generation hash (H K−1 ) value from the second hash token;
determine whether a hash value of the hash of the K−1 generation hash (H K−1 ) value (H(H K−1 )) is equal to the H K value; and
authenticate the second message (M N+1 ) was from a second device that sent the first message (M N ) and that the first message (M N ) was received complete and unaltered when the hash value of the K−1 generation hash (H K−1 ) value (H(H K−1 )) is equal to the H K value.
12. The apparatus of claim 11 , wherein the one or more processors are further configured to execute the instructions to cause the apparatus to discard the second message (M N+1 ) when the hash value of the K−1 generation hash (H K−1 ) value (H(H K−1 )) is not equal to the H K value.
13. The apparatus of claim 11 , wherein the one or more processors are further configured to execute the instructions to cause the apparatus to:
retrieve the stored hash of the first message (M N ) or hashing the stored first message (M N ) that was received by the apparatus; and
perform an exclusive-or (XOR) operation between the stored hash of the first message (M N ) or a hash of the stored first message (M N ) and the second hash token to determine the K−1 generation hash (H K−1 ) value from the second hash token.
14. The apparatus of claim 11 , wherein the one or more processors are further configured to execute the instructions to cause the apparatus to receive a third message (M N+2 ) that includes a third hash token based on a second reversible combination of a K−2 generation hash (H K−2 ) value of the seed and a hash of the second message (M N−1 ).
15. The apparatus of claim 14 , wherein the one or more processors are further configured to execute the instructions to cause the apparatus to:
determine the K−2 generation hash (H K−2 ) value from the third hash token;
determine whether a hash value of the hash of the K−2 generation hash (H K−2 ) value (H(H K−2 )) is equal to the K−1 generation hash (H K−1 ) value; and
authenticate the third message (M N+2 ) was from the second device that sent the second message (M N+1 ) and that the second message (M N+1 ) was received complete and unaltered when the hash value of the K−2 generation hash (H K−2 ) value (H(H K−2 )) is equal to the K−1 generation hash (H K−1 ) value.
16. The apparatus of claim 15 , wherein the one or more processors are further configured to execute the instructions to cause the apparatus to verify the second message (M N+1 ) was received complete and unaltered when the hash of the second message (M N+1 ) received by the apparatus is equal to the hash of the second message (M N+1 ) in the third message (M N+2 ).
17. A computer program product comprising computer-executable instructions stored on a non-transitory computer-readable storage medium, the computer-executable instructions when executed by one or more processors of an apparatus, cause the apparatus to:
receive a first incoming message from a device, wherein the first incoming message includes a first incoming hash token comprising a first reversible combination of a J+1 generation hash (H J+1 ) value of a first seed known only to a sender of the first incoming message and a hash of any last outgoing message from the apparatus, wherein J is an integer value greater than one;
generate a first outgoing hash token based on a second reversible combination of a K+1 generation hash (H K+1 ) value of a second seed known only to the apparatus and a hash of the first incoming message, wherein K is an integer value greater than one; and
send a first outgoing message that includes the first outgoing hash token to the device.
18. The computer program product of claim 17 , wherein the instructions when executed by the one or more processors, further causes the apparatus to:
determine the J+1 generation hash (H J+1 ) value of the first seed from the first incoming hash token; and
store the J+1 generation hash (H J+1 ) value for use in authenticating a second incoming message from the device.
19. The computer program product of claim 18 , wherein the instructions when executed by the one or more processors, further causes the apparatus to receive the second incoming message from the device, wherein the second incoming message includes a second incoming hash token based on a third reversible combination of a J generation hash (H J ) value of the first seed and the hash of the first outgoing message.
20. The computer program product of claim 19 , wherein the instructions when executed by the one or more processors, further causes the apparatus to:
determine the J generation hash (H J ) value from the second incoming hash token;
determine whether a hash value of the J generation hash (H J ) value is equal to the H J+1 value; and
authenticate the second incoming message was from the device and that the first outgoing message was received complete and unaltered by the device when the hash value of the J generation hash (H J ) value is equal to the H J+1 value.