Secure communications
There are disclosed processes and systems for establishing secure, communication channels between computing devices. The computing devices include respective agents which verify the relative identity of one another and thereby authenticate the communication channel. The agents continue to play a role in the communications to ensure that the communication channel is secure.
1. A method for providing a secure trustworthy communication channel between a first agent operative on a first computing device connected to a network and a second agent operative on a second computing device connected to the network, the method comprising:
a third computing device initially establishing a relative identity relationship between the first agent and the second agent including:
defining a first relative identity for the first agent,
defining a second relative identity for the second agent;
wherein the first relative identity and second relative identity are both unique to the relationship between the first agent and the second agents, and there is a mathematical relationship between the first relative identity and the second relative identity;
wherein a key for communicating between the first and second agent is generated based on the mathematical relationship by:
using a first intermediate key defined by a mathematical algorithm, function, or hash of an absolute key of the first agent, a partial relative key of the first agent, and a partial relative key of the second agent,
using a second intermediate key defined by a mathematical algorithm, function, or hash of an absolute key of the second agent, the partial relative key of the first agent, and the partial relative key of the second agent,
generating a first encryption key by using a mathematical algorithm, function or hash of the first intermediate key and the second absolute key of the second agent
generating a second encryption key by using a mathematical algorithm, function, or hash of the second intermediate key and the first absolute key of the first agent
wherein the first encryption key and the second encryption key are equivalent;
a fourth computing device verifying the first and second relative identities at the start of subsequent communication between the first and second agents;
wherein the third computing device is either the first computing device, the second computing device or another computing device;
wherein the fourth computing device is either the first computing device, the second computing device, the third computing device or another computing device;
wherein relative identity uniquely identifies one particular agent's relationship to another particular agent.
2. The method for providing a secure trustworthy communication channel of claim 1 , wherein
the first relative identity is not known to the second agent
the second relative identity is not known to the first agent.
3. The method for providing a secure trustworthy communication channel of claim 2 , wherein verifying the first and second relative identities additionally comprises
the first agent sending the second agent first information derived, at least in part, from the first relative identity
the second agent sending the first agent second information derived, at least in part, from the second relative identity
the second agent using the first information to verify the relative identity of the first agent
the first agent using the second information to verify the relative identity of the second agent.
4. The method for providing a secure trustworthy communication channel of claim 1 , wherein
initially establishing a relative identity relationship between the first agent and the second agent is supervised by a third agent, the third agent verifying the identities of the first agent and the second agent.
5. The method for providing a secure trustworthy communication channel of claim 1 wherein the method is executed on a banking application.
6. The method for providing a secure trustworthy communication channel of claim 1 wherein the first computing device is on a financial bank network.
7. The method for providing a secure trustworthy communication channel of claim 6 wherein the first agent has multiple relative identities for each of a plurality of bank customers.
8. A method for providing a secure trustworthy communication channel between a first agent on a first computing device connected to a network and a second agent on a second computing device connected to a network, the method comprising:
the first agent on the first computing device defining a first relative identity for the first agent with respect to the second agent;
the first agent on the first computing device sending first information derived, at least in part, from the first relative identity to the second agent;
the first agent on the first computing device receiving second information from the second agent wherein the second information is derived, at least in part, from a second relative identity of the second agent with respect to the first agent;
the first agent on the first computing device verifying the relative identity of the second agent using the second information;
wherein relative identity uniquely identifies one particular agent's relationship to another particular agent;
wherein there is a mathematical relationship between the first relative identity and the second relative identity;
wherein a key for communicating between the first and second agent is generated based on the mathematical relationship by:
using a first intermediate key defined by a mathematical algorithm, function, or hash of an absolute key of the first agent, a partial relative key of the first agent, and a partial relative key of the second agent,
using a second intermediate key defined by a mathematical algorithm, function, or hash of an absolute key of the second agent, the partial relative key of the first agent, and the partial relative key of the second agent,
generating a first encryption key by using a mathematical algorithm, function or hash of the first intermediate key and the second absolute key of the second agent
generating a second encryption key by using a mathematical algorithm, function, or hash of the second intermediate key and the first absolute key of the first agent;
wherein the first encryption key and the second encryption key are equivalent.
9. A computing device for providing a secure trustworthy communication channel between a first agent on the computing device connected to a network and a second agent on a remote computing device connected to the network, the computing device comprising
a processor
a memory coupled with the processor
a storage medium having instructions stored thereon which when executed cause the computing device to perform actions comprising
defining a first relative identity for the first agent with respect to the second agent
sending first information derived, at least in part, from the first relative identity to the second agent
receiving second information from the second agent wherein the second information is derived, at least in part, from a second relative identity of the second agent with respect to the first agent
verifying the second relative identity of the second agent using the second information
wherein relative identity uniquely identifies one particular agent's relationship to another particular agent
wherein there is a mathematical relationship between the first relative identity and the second relative identity
wherein there is a mathematical relationship between the first relative identity and the second relative identity;
wherein a key for communicating between the first and second agent is generated based on the mathematical relationship by:
using a first intermediate key defined by a mathematical algorithm, function, or hash of an absolute key of the first agent, a partial relative key of the first agent, and a partial relative key of the second agent,
using a second intermediate key defined by a mathematical algorithm, function, or hash of an absolute key of the second agent, the partial relative key of the first agent, and the partial relative key of the second agent,
generating a first encryption key by using a mathematical algorithm, function or hash of the first intermediate key and the second absolute key of the second agent,
generating a second encryption key by using a mathematical algorithm, function, or hash of the second intermediate key and the first absolute key of the first agent;
wherein the first encryption key and the second encryption key are equivalent.
10. A non-transitory storage medium having instructions stored thereon which when executed by a processor will cause the processor to perform actions comprising
defining a first relative identity for a first agent unique to a relationship between the first agent and a second agent wherein the first agent is located on a first computing device and the second agent is located on a second computing device
sending first information derived, at least in part, from the first relative identity to the second agent
receiving second information from the second agent wherein the second information is derived, at least in part, from a second relative identity of the second agent with respect to the first agent
verifying the second relative identity of the second agent using the second information
wherein relative identity uniquely identifies one particular agent's relationship to another particular agent
wherein there is a mathematical relationship between the first relative identity and the second relative identity
wherein there is a mathematical relationship between the first relative identity and the second relative identity;
wherein a key for communicating between the first and second agent is generated based on the mathematical relationship by:
using a first intermediate key defined by a mathematical algorithm, function, or hash of an absolute key of the first agent, a partial relative key of the first agent, and a partial relative key of the second agent,
using a second intermediate key defined by a mathematical algorithm, function, or hash of an absolute key of the second agent, the partial relative key of the first agent, and the partial relative key of the second agent,
generating a first encryption key by using a mathematical algorithm, function or hash of the first intermediate key and the second absolute key of the second agent,
generating a second encryption key by using a mathematical algorithm, function, or hash of the second intermediate key and the first absolute key of the first agent;
wherein the first encryption key and the second encryption key are equivalent.