Context limited shared secret
In a communication system in which two communication entities seek to have a private or confidential communication session, a trust relationship needs first be established. The trust relationship is based on the determination of a shared secret which in turn is generated from contextual information. The contextual information can be derived from the circumstances surrounding the communication session. For example, the contextual information can include topological information, time-based information, and transactional information. The shared secret may be self-generated or received from a third party. In either event, the shared secret may be used as key material for any cryptographic protocol used between the communication entities.
1. A method for establishing a trust relationship with a communication entity, comprising:
sending, from a mobile device, a request to receive a service from a communication entity as part of a communication session;
generating, by the mobile device, a shared secret from contextual information and a master secret shared only with a home carrier, wherein the mobile device is a subscriber of the home carrier, the contextual information is derived from at least one circumstance corresponding to the communication session, and the home carrier is configured to independently generate the shared secret of the mobile device; and
establishing, by the mobile device, a secure communication with the communication entity to obtain the requested service based on the shared secret, wherein the communication entity has no knowledge of the master secret and is configured to obtain the shared secret from the home carrier.
2. The method as in claim 1 , wherein the contextual information further comprises topological information.
3. The method as in claim 1 , wherein the contextual information further comprises time-based information.
4. The method as in claim 1 , wherein the contextual information further comprises transactional information.
5. The method as in claim 1 , further comprising receiving the contextual information from another communication entity.
6. The method as in claim 1 , further comprising cryptographically communicating with the communication entity using the shared secret as key material.
7. A method for intermediating a trust relationship with at least two communication entities, comprising:
receiving, by a home carrier from a first communication entity, a request for an authorization of a second communication entity having requested to receive a service from the first communication entity as part of a communication session, wherein the second communication entity is a subscriber of the home carrier;
generating, by the home carrier, a shared secret from contextual information and a master secret shared only with the second communication entity, wherein the contextual information is derived from at least one circumstance corresponding to the communication session, and the second communication entity is configured to independently generate the shared secret of the home carrier; and
providing, by the home carrier, authentication information and the shared secret to the first communication entity, wherein the first communication entity has no knowledge of the master secret and is configured to establish a secure communication with the second communication entity to provide the requested service based on the authentication information and the shared secret.
8. The method as in claim 7 , wherein the contextual information further comprises topological information.
9. The method as in claim 7 , wherein the contextual information further comprises time-based information.
10. The method as in claim 7 , wherein the contextual information further comprises transactional information.
11. The method as in claim 7 , further comprising receiving the contextual information from one of the first communication entity or the second communication entity.
12. The method as in claim 7 , further comprising providing the shared secret in the authentication information to the first communication entity.
13. An apparatus for establishing a trust relationship with a communication entity, comprising:
hardware processor circuitry, comprising:
means for sending a request to receive a service from a communication entity as part of a communication session;
means for generating a shared secret from contextual information and a master secret shared only with a home carrier, wherein the apparatus is a subscriber of the home carrier, the contextual information is derived from at least one circumstance corresponding to the communication session, and the home carrier is configured to independently generate the shared secret of the apparatus;
and means for establishing a secure communication with the communication entity to obtain the requested service based on the shared secret, wherein the communication entity has no knowledge of the master secret and is configured to obtain the shared secret from the home carrier.
14. The apparatus as in claim 13 , wherein the contextual information further comprises topological information.
15. The apparatus as in claim 13 , wherein the contextual information further comprises time-based information.
16. The apparatus as in claim 13 , wherein the contextual information further comprises transactional information.
17. The apparatus as in claim 13 , further comprising means for receiving the contextual information from another communication entity.
18. The apparatus as in claim 13 , further comprising means for cryptographically communicating with the communication entity using the shared secret as key material.
19. An apparatus for intermediating a trust relationship with at least two communication entities, comprising:
hardware processor circuitry, comprising:
means for receiving, from a first communication entity, a request for an authorization of a second communication entity having requested to receive a service from the first communication entity as part of a communication session, wherein the second communication entity is a subscriber of the apparatus;
means for generating a shared secret from contextual information and a master secret shared only with the second communication entity, wherein the contextual information is derived from at least one circumstance corresponding to the communication session, and the second communication entity is configured to independently generate the shared secret of the apparatus; and
means for providing authentication information and the shared secret to the first communication entity, wherein the first communication entity has no knowledge of the master secret and is configured to establish a secure communication with the second communication entity to provide the requested service based on the authentication information and the shared secret.
20. The apparatus as in claim 19 , wherein the contextual information further comprises topological information.
21. The apparatus as in claim 19 , wherein the contextual information further comprises time-based information.
22. The apparatus as in claim 19 , wherein the contextual information further comprises transactional information.
23. The apparatus as in claim 19 , further comprising means for receiving the contextual information from one of the first communication entity or the second communication entity.
24. The apparatus as in claim 19 , further comprising means for providing the shared secret in the authentication information to the first communication entity.
25. An apparatus for establishing a trust relationship with a communication entity, comprising:
a memory unit including computer-readable instructions for:
sending a request to receive a service from a communication entity as part of a communication session,
generating a shared secret from contextual information and a master secret shared only with a home carrier, wherein the apparatus is a subscriber of the home carrier, the contextual information is derived from at least one circumstance corresponding to the communication session, and the home carrier is configured to independently generate the shared secret of the apparatus, and
establishing a secure communication with the communication entity to obtain the requested service based on the shared secret, wherein the communication entity has no knowledge of the master secret and is configured to obtain the shared secret from the home carrier; and
a processor circuit coupled to the memory unit for processing the computer-readable instructions.
26. The apparatus as in claim 25 , wherein the contextual information further comprises topological information.
27. The apparatus as in claim 25 , wherein the contextual information further comprises time-based information.
28. The apparatus as in claim 25 , wherein the contextual information further comprises transactional information.
29. The apparatus as in claim 25 , wherein the memory unit further comprises computer-readable instructions for receiving the contextual information from another communication entity.
30. The apparatus as in claim 25 , wherein the memory unit further comprises computer-readable instructions for cryptographical communication with the communication entity using the shared secret.
31. An apparatus for intermediating a trust relationship with at least two communication entities, comprising:
a memory unit including computer-readable instructions for:
receiving, from a first communication entity, a request for an authorization of a second communication entity having requested to receive a service from the first communication entity as part of a communication session, wherein the second communication entity is a subscriber of the apparatus,
generating a shared secret from contextual information and a master secret shared only with the second communication entity, wherein the contextual information is derived from at least one circumstance corresponding to the communication session, and the second communication entity is configured to independently generate the shared secret of the apparatus, and
providing authentication information and the shared secret to the first communication entity, wherein the first communication entity has no knowledge of the master secret and is configured to establish a secure communication with the second communication entity to provide the requested service based on the authentication information and the shared secret; and
a processor circuit coupled to the memory unit for processing the computer-readable instructions.
32. The apparatus as in claim 31 , wherein the contextual information further comprises topological information.
33. The apparatus as in claim 31 , wherein the contextual information further comprises time-based information.
34. The apparatus as in claim 31 , wherein the contextual information further comprises transactional information.
35. The apparatus as in claim 31 , wherein the memory unit further comprises computer-readable instructions for receiving the contextual information from one of the first communication entity or the second communication entity.
36. The apparatus as in claim 31 , wherein the memory unit further comprises computer-readable instructions for providing the shared secret in the authentication information to the first communication entity.
37. A non-transitory computer-readable medium storing computer-readable instructions for:
sending, from a mobile device, a request to receive a service from a communication entity as part of a communication session;
generating, by the mobile device, a shared secret from contextual information and a master secret shared only with a home carrier, wherein the mobile device is a subscriber of the home carrier, the contextual information is derived from at least one circumstance corresponding to the communication session, and the home carrier is configured to independently generate the shared secret of the mobile device; and
establishing, by the mobile device, a secure communication with the communication entity to obtain the requested service based on the shared secret, wherein the communication entity has no knowledge of the master secret and is configured to obtain the shared secret from the home carrier.
38. The computer-readable medium as in claim 37 , wherein the contextual information further comprises at least one of topological information, time-based information, or transactional information.
39. A non-transitory computer-readable medium storing computer-readable instructions for:
receiving, by a home carrier from a first communication entity, a request for an authorization of a second communication entity having requested to receive a service from the first communication entity as part of a communication session, wherein the second communication entity is a subscriber of the home carrier;
generating, by the home carrier, a shared secret from contextual information and a master secret shared only with the second communication entity, wherein the contextual information is derived from at least one circumstance corresponding to the communication session, and the second communication entity is configured to independently generate the shared secret of the home carrier; and
providing, by the home carrier, authentication information and the shared secret to the first communication entity, wherein the first communication entity has no knowledge of the master secret and is configured to establish a secure communication with the second communication entity to provide the requested service based on the authentication information and the shared secret.
40. The computer-readable medium as in claim 39 , wherein the contextual information further comprises at least one of topological information, time-based information, or transactional information.
41. The method as in claim 1 , further comprising:
receiving an authenticity challenge message from the communication entity;
generating a first response based on the shared secret; and
transmitting the first response to the communication entity, wherein the communication entity is configured to also generate a second response based on the shared secret to compare with the first response for granting the requested service.
42. The method as in claim 7 , wherein the first communication entity and the second communication entity are configured to exchange authenticity challenge data, comprising:
the first communication entity generating an authenticity challenge message based on the received authentication information and the shared secret for the second communication entity;
the second communication entity generating a first response based on the shared secret in response to the authenticity challenge message; and
the first communication entity generating a second response based on the shared secret to compare with the first response for granting the requested service.