IP Library › Granted Patent US 10,659,228
Granted Patent B2
US 10,659,228 · App. 16/021,125 · Granted May 19, 2020

Method for establishing a secure communication session in a communications system

Inventors: Vakul Garg (Shahdara, IN); Peter Doliwa (Hamburg, DE)
Assignee: NXP B.V.
H04L9/3066H04L9/14H04L63/0478H04L63/166
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 10,659,228
App. No.
16/021,125
Granted
May 19, 2020
Kind
B2
Abstract

A method is provided for establishing a secure communication session in a communications system. The method includes providing a handshake layer functional block and providing a record layer functional block separate from the handshake layer functional block. A first ephemeral key pair is generated by the record layer functional block of a first communication peer. A public key of the first ephemeral key pair is transmitted to a second communication peer. The handshake layer functional block of the first communication peer generates a second ephemeral key pair. A public key of the second ephemeral key pair is transmitted to the second communication peer. The second communication peer generates a third ephemeral key pair. A handshake key is generated from the public key of the second communication peer and a private key of the handshake layer block of the first communication peer. A session key is generated from the public key of the second communication peer and a private key of the record layer block of the first communication peer

Claims (53)

1. A method for establishing a secure communication session in a communications system, the method comprising:

providing, in a first communication peer, a handshake layer functional block;

providing, in the first communication peer, a record layer functional block separate from the handshake layer functional block, wherein functionality of the record layer functional block is not duplicated in the handshake layer functional block;

generating, by the record layer functional block of the first communication peer, a first ephemeral key pair;

transmitting a public key of the first ephemeral key pair to a second communication peer;

generating, by a handshake layer functional block of the first communication peer, a second ephemeral key pair;

transmitting a public key of the second ephemeral key pair to a second communication peer;

generating, by the second communication peer, a third ephemeral key pair;

transmitting a public key of the third ephemeral key pair to the first communication peer;

generating, by the handshake layer functional block, a handshake key using a public key of the third ephemeral key pair and the private key of the second ephemeral key pair;

protecting handshake messages communicated between the first communication peer and the second communication peer using the second ephemeral key pair;

generating a session key using the public key of the third ephemeral key pair and the private key of the first ephemeral key pair; and

protecting messages communicated between the first communication peer and the second communication peer using the session key.

2. The method of claim 1 , wherein the first, second and third ephemeral key pairs are further characterized as being first, second, and third ephemeral elliptic curve key pairs.

3. The method of claim 1 , wherein the first communication peer is characterized as being a transport layer security (TLS) client and the second communication peer is characterized as being a TLS server.

4. The method of claim 1 , wherein the first communication peer is characterized as being a transport layer security (TLS) server and the second communication peer is characterized as being a TLS client.

5. The method of claim 1 , wherein handshake messages between the handshake layer functional block and the second communication peer are provided through the record layer functional block.

6. The method of claim 1 , wherein handshake messages between the handshake layer functional block and the second communication peer are not routed through the record layer functional block.

7. The method of claim 1 , wherein handshake messages are unencrypted.

8. A method for establishing a secure communication session in a communications system, the method comprising:

providing, in a first communication peer, a handshake layer functional block;

providing, in the first communication peer, a record layer functional block separate from the handshake layer functional block, wherein functionality of the record layer functional block is not duplicated in the handshake layer functional block;

generating, by the record layer functional block of the first communication peer, a first ephemeral elliptic curve key pair;

transmitting a public key of the first ephemeral elliptic curve key pair to a second communication peer;

generating, by a handshake layer functional block of the first communication peer, a second ephemeral elliptic curve key pair;

transmitting a public key of the second ephemeral elliptic curve key pair to the second communication peer;

generating, by the second communication peer, a third ephemeral elliptic curve key pair;

transmitting a public key of the third ephemeral elliptic curve key pair to the first communication peer;

generating, by the handshake layer functional block, a handshake key using a public key of the third ephemeral elliptic curve key pair and the private key of the second ephemeral elliptic curve key pair;

protecting handshake messages communicated between the first communication peer and the second communication peer using the second ephemeral elliptic curve key pair;

generating a session key using the public key of the third ephemeral elliptic curve key pair and the private key of the first ephemeral elliptic curve key pair; and

protecting messages communicated between the first communication peer and the second communication peer using the session key.

9. The method of claim 8 , wherein the first communication peer is characterized as being a transport layer security (TLS) client and the second communication peer is characterized as being a TLS server.

10. The method of claim 8 , wherein the first communication peer is characterized as being a transport layer security (TLS) server and the second communication peer is characterized as being a TLS client.

11. The method of claim 8 , wherein handshake messages between the handshake layer functional block and the second communication peer are provided through the record layer functional block.

12. The method of claim 8 , wherein handshake messages between the handshake layer functional block and the second communication peer are not routed through the record layer functional block.

13. The method of claim 8 , wherein handshake messages are unencrypted.

14. A method for establishing a secure communication session in a communications system, the method comprising:

providing, in a transport layer security (TLS) client, a handshake layer functional block;

providing, in the TLS client, a record layer functional block separate from the handshake layer functional block, wherein functionality of the record layer functional block is not duplicated in the handshake layer functional block;

generating, by the record layer functional block of the TLS client, a first ephemeral elliptic curve key pair;

transmitting a public key of the first ephemeral elliptic curve key pair to a TLS server;

generating, by a handshake layer functional block of the TLS client, a second ephemeral elliptic curve key pair;

transmitting a public key of the second ephemeral elliptic curve key pair to the TLS server;

generating, by the TLS server, a third ephemeral elliptic curve key pair;

transmitting a public key of the third ephemeral elliptic curve key pair to the TLS client;

generating, by the handshake layer functional block, a handshake key using a public key of the third ephemeral elliptic curve key pair and the private key of the second ephemeral elliptic curve key pair;

protecting handshake messages communicated between the TLS client and the TLS server using the second ephemeral elliptic curve key pair;

generating a session key using the public key of the third ephemeral elliptic curve key pair and the private key of the first ephemeral elliptic curve key pair; and

protecting messages communicated between the TLS client and the TLS server using the session key.

15. The method of claim 14 , wherein handshake messages between the handshake layer functional block and the TLS server are provided through the record layer functional block.

16. The method of claim 14 , wherein handshake messages between the handshake layer functional block and the TLS server are not routed through the record layer functional block.

17. The method of claim 14 , wherein handshake messages are unencrypted.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jun 28, 2018
From: GARG, VAKUL; DOLIWA, PETER
To: NXP B.V.
Reel/Frame 046223/0983 →
Continuity (1)
Related Publication 20200007327A1 · Jan 2, 2020