IP Library › Granted Patent US 12,132,839

Granted Patent B2

US 12,132,839 · App. 17/251,916 · Granted Oct 29, 2024

Decentralised authentication

Inventors: Christopher Patrick Autry (Essex, GB); Andrew William Roscoe (Essex, GB); Mykhailo Magal (Essex, GB)

Assignee: Iothic Ltd

H04L9/3228 H04L9/321 H04L9/3234 H04L9/3239 H04L63/0869 H04L63/0884 H04L9/006 H04L2209/76

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12,132,839
App. No.: 17/251,916
Granted: Oct 29, 2024
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

First and second devices store respective device data and private keys. The first-device data is additionally stored by the second device and by a proxy; and the second-device data is additionally stored by the first device and by the proxy. In a commitment phase, each of the first and second devices uses its respective device data, private key and a random nonce to generate a respective one-time first-device or second-device commitment value, which it sends to the proxy. In a checking phase, the devices communicate secret-key information to the proxy, which verifies the received one-time commitment values. In a digest phase, the proxy calculates a one-time digest, which it sends to the second device. The second device then verifies the received one-time digest to authenticate the first device.

Claims (80)

1. A method for authenticating a first device to a second device using a proxy device, wherein:

the first device stores first-device data and a first-device private key;

the second device stores second-device data and a second-device private key;

the proxy device stores proxy data and a proxy-device private key;

the first-device data is additionally stored by the second device and by the proxy device; and

the second-device data is additionally stored by the first device and by the proxy device,

the proxy data is additionally stored by the first device and by the second device;

the method comprising, in a commitment phase:

the first device using the first-device data and first-device secret-key information to generate a one-time first-device commitment value, the first-device secret-key information comprising, or being derived from, the first-device private key and a first random nonce;

the first device sending the one-time first-device commitment value to the proxy device;

the second device using the second-device data and second-device secret-key information to generate a one-time second-device commitment value, the second-device secret-key information comprising, or being derived from, the second-device private key and a second random nonce; and

the second device sending the one-time second-device commitment value to the proxy device,

the proxy device using the proxy data and proxy-device secret-key information to generate a one-time proxy-device commitment value, the proxy-device secret-key information comprising, or being derived from, the proxy-device private key and a third random nonce;

the proxy device sending the one-time proxy device commitment value to the first device and to the second device;

the method further comprising, in a checking phase performed after the commitment phase:

the first device communicating the first-device secret-key information to the proxy device;

the first device communicating the first-device secret-key information to the second device;

the second device communicating the second-device secret-key information to the proxy device;

the proxy device communicating the proxy-device secret-key information to the first device;

the proxy device communicating the proxy-device secret-key information to the second device;

the proxy device using the first-device data stored by the proxy device, and the first-device secret-key information received from the first device, to verify the one-time first-device commitment value received from the first device; and

the proxy device using the second-device data stored by the proxy device, and the second-device secret-key information received from the second device, to verify the one-time second-device commitment value received from the second device;

the first device using the proxy data stored in the first device and the proxy-device secret-key information received from the proxy device to verify the one-time proxy-device commitment value received from the proxy device;

the second device using the proxy data stored in the second device and the proxy-device secret-key information received from the proxy device to verify the one-time proxy-device commitment value received from the proxy device;

the method further comprising, in a digest phase, performed after a successful verification of the one-time first-device commitment value and of the one-time second-device commitment value in the commitment phase:

the proxy device calculating a one-time digest from i) the first-device data stored by the proxy device, ii) the second-device data stored by the proxy device, iii) the first-device secret-key information received from the first device, and iv) the second-device secret-key information received from the second device;

the proxy device sending the one-time digest to the second device;

the second device authenticating the first device by using at least i) the first-device data stored by the second device, ii) the second-device data stored by the second device, iii) the first-device secret-key information received from the first device, and iv) the second-device secret-key information, to verify the one-time digest received from the proxy device;

the proxy device sending the one-time digest to the first device;

the second device communicating the second-device secret-key information to the first device; and

the first device authenticating the second device by using at least i) the first-device data stored by the first device, ii) the second-device data stored by the first device, iii) the first-device secret-key information, and iv) the second-device secret-key information received from the second device, to verify the one-time digest received from the proxy device.

2. The method of claim 1 , wherein the first device verifies the one-time second-device commitment value, in addition to the verification of the one-time first-device and second-device commitment values performed by the proxy device.

3. The method of claim 1 , wherein the second device verifies the one-time first-device commitment value, in addition to the verification of the one-time first-device and second-device commitment values performed by the proxy device.

4. The method of claim 1 , wherein the proxy device calculating the one-time digest further comprises the proxy device additionally using the proxy data and the proxy-device secret-key information to calculate the one-time digest; and

wherein the second device verifying the one-time proxy-device commitment value further comprises the second device additionally using the proxy data stored by the second device, and the proxy-device secret-key information received from the proxy device, to verify the one-time digest received from the proxy device.

5. The method of claim 1 , wherein the proxy device calculating the one-time digest further comprises the proxy device additionally using the proxy data and the proxy-device secret-key information to calculate the one-time digest; and

wherein the first device verifying the one-time proxy-device commitment value further comprises the first device additionally using the proxy data stored by the first device, and the proxy-device secret-key information received from the proxy device, to verify the one-time digest received from the proxy device.

6. A communication system comprising:

a first device;

a second device; and

a proxy device,

wherein:

the first device stores first-device data and a first-device private key;

the second device stores second-device data and a second-device private key;

the proxy device stores proxy data and a proxy-device private key;

the first-device data is additionally stored by the second device and by the proxy device;

the second-device data is additionally stored by the first device and by the proxy device; and

the proxy data is additionally stored by the first device and by the second device;

wherein the first device is configured, in a commitment phase, to:

use the first-device data and first-device secret-key information to generate a one-time first-device commitment value, the first-device secret-key information comprising, or being derived from, the first-device private key and a first random nonce; and

send the one-time first-device commitment value to the proxy device,

wherein the second device is configured, in the commitment phase, to:

use the second-device data and second-device secret-key information to generate a one-time second-device commitment value, the second-device secret-key information comprising, or being derived from, the second-device private key and a second random nonce; and

send the one-time second-device commitment value to the proxy device,

wherein the proxy device is configured, in the commitment phase, to:

use the proxy data and proxy-device secret-key information to generate a one-time proxy-device commitment value, the proxy-device secret-key information comprising, or being derived from, the proxy-device private key and a third random nonce; and

send the one-time proxy device commitment value to the first device and to the second device;

wherein:

the first device is configured, in a checking phase, performed after the commitment phase, to communicate the first-device secret-key information to the proxy device and to the second device;

the second device is configured, in the checking phase, to communicate the second-device secret-key information to the proxy device;

the proxy device is configured, in the checking phase, to use the first-device data stored by the proxy device, and the first-device secret-key information received from the first device, to verify the one-time first-device commitment value received from the first device; and

the proxy device is further configured, in the checking phase, to use the second-device data stored by the proxy device, and the second-device secret-key information received from the second device, to verify the one-time second-device commitment value received from the second device and to communicate the proxy-device secret-key information to the first device and to the second device;

the first device is further configured to use the proxy data stored in the first device, and the proxy-device secret-key information received from the proxy device, to verify the one-time proxy-device commitment value received from the proxy device;

and

the second device is further configured to use the proxy data stored in the second device, and the proxy-device secret-key information received from the proxy device, to verify the one-time proxy-device commitment value received from the proxy device;

and wherein:

the proxy device is configured to enter a digest phase in response to a successful verification of the one-time first-device commitment value and of the one-time second-device commitment value in the commitment phase;

the proxy device is configured, when in the digest phase, to calculate a one-time digest from i) the first-device data stored by the proxy device, ii) the second-device data stored by the proxy device, iii) the first-device secret-key information received from the first device, and iv) the second-device secret-key information received from the second device, and to send the one-time digest to the second device;

the second device is configured to authenticate the first device by using at least i) the first-device data stored by the second device, ii) the second-device data stored by the second device, iii) the first-device secret-key information received from the first device, and iv) the second-device secret-key information, to verify the one-time digest received from the proxy device; and

wherein the proxy device is further configured to send the one-time digest to the first device, wherein the second device is further configured to communicate the second-device secret-key information to the first device and the first device is configured to authenticate the second device by using at least i) the first-device data stored by the first device, ii) the second-device data stored by the first device, iii) the first-device secret-key information, and iv) the second-device secret-key information received from the second device, to verify the one-time digest received from the proxy device.

7. The communication system of claim 6 , wherein at least one of the first device, the second device, and the proxy device is a sensor or a sensor hub.

8. The communication system of claim 6 , wherein:

the proxy device is configured, when calculating the one-time digest value, to additionally use the proxy data and the proxy-device secret-key information; and

the second device is configured, when verifying the one-time digest received from the proxy device, to additionally use the proxy data stored by the second device, and the proxy-device secret-key information received from the proxy device.

9. The communication system of claim 6 , wherein:

the proxy device is configured, when calculating the one-time digest value, to additionally use the proxy data and the proxy-device secret-key information; and

the first device is configured, when verifying the one-time digest received from the proxy device, to additionally use the proxy data stored by the first device, and the proxy-device secret-key information received from the proxy device.

10. The communication system of claim 6 , wherein the first-device data comprises first identification data that identifies the first device, and the second-device data comprises second identification data that identifies the second device.

11. The communication system of claim 6 , wherein the first device, second device, and proxy device comprise radios and are configured to communicate by radio.

12. The communication system of claim 6 , wherein the first device, second device, and proxy device are configured to communicate over one or more wired links.

Assignments (1)

ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Mar 2, 2021

From: AUTRY, CHRISTOPHER PATRICK; ROSCOE, ANDREW WILLIAM; MAGAL, MYKHAILO

To: IOTHIC LTD

Reel/Frame 055456/0379 →

Priority Claims (1)

GB 1809887 · Jun 15, 2018 · national

Continuity (1)

Related Publication 20210167963A1 · Jun 3, 2021