Authentication method and communications system used for authentication
An authentication method authenticates between subscribers of a communications system using an asymmetric elliptic curve encryption algorithm. The method involves providing a first and at least one second subscriber having a first or second secret key known only to the respective subscriber and a public key; authenticating an inquiry transmitted by the first subscriber with respect to the validity of the first certificate contained therein and associated with the first subscriber; calculating the response of the second subscriber associated with the inquiry; randomized encryption of the calculated response and a second certificate associated with the second subscriber using the public key; decryption and authentication of the response transmitted by the second subscriber with respect to the validity of the second certificate contained therein.
1. A method for authenticating communication between participants in a communication system, comprising:
causing one or more processors to execute:
providing a public key to at least a first participant and a second participant, the first and second participants respectively having first and second secret keys, known only to the participant concerned;
authenticating an inquiry, transmitted by the first participant, the inquiry containing a first certificate belonging to the first participant, the inquiry being authenticated by checking validity of the first certificate;
calculating a reply at the second participant appropriate to the inquiry, the reply containing a second certificate belonging to the second participant;
performing randomized encryption of the calculated reply and the second certificate, using the public key;
decrypting and authenticating the calculated reply, transmitted by the second participant, the calculated reply being authenticated by checking validity of the second certificate, wherein
the first participant comprises a first processor, and
the second participant comprises a second processor.
2. The method as claimed in claim 1 , wherein each secret key has an associated public key.
3. The method as claimed in claim 2 , wherein the public key is contained in the first certificate and is determined by the second participant from the first certificate for the first participant.
4. The method as claimed in claim 1 , wherein
the first and second participants engage in data communication using a challenge/response method,
the inquiry is transmitted from first participant to the second participant and contains items of inquiry data as a challenge, and
the reply is transmitted from the second participant to the first participant and contains items of reply data as a response to the challenge.
5. The method as claimed in claim 4 , wherein in decrypting and authenticating the reply, the reply data is checked.
6. The method as claimed in claim 1 , wherein the inquiry from the first participant is independent of the second certificate for the second participant.
7. The method as claimed in claim 1 , wherein
system parameters are provided for the communication system, and
the system parameters comprise an elliptical curve suitable for cryptographic methods, an affine x-coordinate of a base point, and a public key for signature checking.
8. The method as claimed in claim 1 , wherein
first participant parameters are provided for the first participant, and
the first participant parameters comprise the first secret key and the first certificate.
9. The method as claimed in claim 1 , wherein
second participant parameters are provided for the second participant, and
the second participant parameters comprise the second secret key and the second certificate.
10. The method as claimed in claim 1 , wherein
in authenticating the inquiry, a signature check is performed, and
the signature check checks validity of the first certificate using the public key.
11. The method as claimed in claim 1 , wherein in performing randomized encryption of the calculated reply, a symmetric key is generated randomly, and
randomized encryption is carried out using a symmetric encryption method.
12. The method as claimed in claim 1 , wherein before performing randomized encryption of the calculated reply, the calculated reply and the second certificate are arranged one after another by concatenation.
13. The method as claimed in claim 11 , wherein in decrypting and authenticating the calculated reply, the first participant calculates the symmetric key, from data transmitted by the second participant, using the first secret key.
14. The method as claimed in claim 13 , wherein
in decrypting and authenticating the calculated reply, the first participant decrypts the calculated reply and the second certificate for the second participant, using the calculated symmetrical key.
15. The method as claimed in claim 13 ,
wherein in decrypting and authenticating the calculated reply, the second certificate and the calculated reply are checked for authenticity.
16. The method as claimed in claim 1 ,
wherein encryption is performed based on scalar multiplications over an elliptical curve.
17. The method as claimed in claim 16 , wherein
the scalar multiplications are performed using a Montgomery algorithm.
18. The method as claimed in claim 16 ,
wherein scalar multiplications are performed using a shift register which performs multiplication and/or addition cyclically.
19. A communication system for communication between at least first and second participants with mutual authentication, both the first and second participants being provided with a public key, the first and second participants respectively having first and second secret keys, known only to the participant concerned, the system comprising:
an authentication module provided in the first participant to generate an inquiry containing a first certificate belonging to the first participant
a transmitter provided in the first participant to transmit the inquiry to the second participant;
an authentication module provided in the second participant to authenticate the inquiry, to calculate a reply to the inquiry and to encrypt the reply, the inquiry being authenticated by checking validity of the first certificate, the reply containing a second certificate belonging to the second participant, the reply being encrypted with randomized encryption of the reply and the second certificate, using the public key; and
a transmitter provided in the second participant to transmit the encrypted reply to the first participant, wherein
the authentication module provided in the first participant decrypts and authenticates the reply, the reply being authenticated by checking validity of the second certificate,
wherein
the first participant comprises a first processor, and
the second participant comprises a second processor.
20. The system as claimed in claim 19 , wherein
each authentication module has a computational device to perform calculations, checks and authentications.
21. The system as claimed in claim 19 , wherein each authentication module has an encryption/decryption device for encryption and/or decryption.
22. The system as claimed in claim 19 , wherein each participant has a memory that hold system parameters together with parameters associated with the respective participant.
23. The system as claimed in claim 19 , wherein
the first and second participants both function as transceivers, and
the transceiver communicate over a radio frequency ID (RFID) communication link in an RFID communication system.
24. The system as claimed in claim 19 , wherein the first participant is a radio frequency ID (RFID) base station and the second participant is an.