Method of providing a signing key for digitally signing, verifying or encrypting data

0001The present invention relates to a method of providing a key, in particular for digitally signing, verifying or encrypting data to be exchanged between a first party and a second party, comprising the steps of transmitting an identification code, which is uniquely identifying said first party, from said first party to a gateway, verifying said identification code by said gateway by using an authentication server, and creating a signing key.

0002The present invention further relates to a mobile terminal and a gateway.

0003Prior art methods of providing signing keys for digitally signing data often rely on long-term signing keys which are not very secure since there is no possibility to dynamically alter said signing keys.

0004There are also methods which provide for dynamic creation/selection of signing keys, but these methods usually employ extra software and/or hardware such as personalized chip cards.

0005Furthermore, in many cases a contract with a trust center is required.

0006<patcit id="pcit0001" dnum="US20030237004A1"><text>US 2003/0237004 A1</text></patcit> discloses a method and apparatus for certificate validation, wherein virtual private network (VPN) clients possess a public key cryptographic key pair. A support for a respective public key infrastructure (PKI) is provided by an access gateway and an authentication server in a shared manner.

0007<patcit id="pcit0002" dnum="WO03096140A"><text>WO 03/096140</text></patcit> discloses a system, method and computer program for authorizing a mobile station to use a product, service, access or other rights provided by a service provider through the use of digital signatures. These digital signatures are based on a shared signing key, and can be verified using a signature verification service. This system, method and computer program will validate the identity of the mobile station being used utilizing long term keys stored in the mobile station and an authentication center.

0008Hence it is an object of the present invention to provide an improved method of providing a signing key as well as an improved mobile terminal and an improved gateway.

0009Concerning the method of providing a signing key, said object is achieved by the features of the characterizing part of claim 1.

0010Although in the further description the term "signing key" is used, it is to be understood that said signing key describes a digital key in general and that said signing key may be used for verifying or encrypting data, in particular transaction data as well as it may be used for signing. Therefore, the subject matter of the present invention is not limited to the possibility of signing data.

0011The steps of transmitting and verifying an identification code and creating a signing key are for example implemented in the authentication mechanisms of GSM (global system for mobile communications) communication systems, wherein e.g. an international mobile station identity (IMSI) is used as said identification code.

0012The GSM authentication mechanisms are, inter alia, based on so-called A3- and A8-algorithms the latter of which is also called "voice privacy algorithm" since it is used to encipher voice data exchanged between a mobile GSM terminal and a GSM base transceiver station (BTS).

0013Said A8-algorithm e.g. yields a 64-bit number also denoted as ciphering key Kc. According to the present invention, this ciphering key is provided to said first party which e.g. uses a mobile terminal such as a cellular phone or a PDA (personal digital assistent) or a portable personal computer with a wireless GSM interface, and which may need a signing key in order to authenticate a transaction with said second party. The first party can use the ciphering key Kc obtained by the A8-algorithm of the GSM system as such a signing key.

0014In order to be able to verify a digital signature of the first party so obtained, said second party is also provided with said ciphering key, or signing key, respectively.

0015By using a signing key, which is according to the present invention derived from a ciphering key of the GSM system, it is possible for the second party to verify the integrity of signed data and to authenticate the first party. The second party may e.g. be an online service provider offering goods and/or services via the Internet and the first party may e.g. be a customer of said second party.

0016In particular, according to the method of the present invention, there is no need for additional software or hardware or even a contract with a trust center because the inventive method is based on an existing authentication mechanism of the GSM standard, which improves flexibility.

0017According to an embodiment of the present invention, a further signing key is created which depends on said signing key but which is not identical with the ciphering key of the A8-algorithm.

0018To improve the inventive method's security and increase the available code space, it is possible to create said further signing key depending on further data which is common to said first party and an authentication server but which is not available to the public. Said further data may e.g. be derived from any form of subscription data of the first party such as an address, further personal data or the like.

0019The creation of the further signing key may e.g. be performed by using state-of-the-art signing algorithms for use with symmetric keys such as the message authentication code or keyed hashing for message authentication, cf. e.g. RFC 2104 (Internet requests for comments).

0020According to another advantageous embodiment of the present invention, a long-life signing key is provided, which may be used for a plurality of signing and authenticating transactions. In order to enable a reuse of such a long-life signing key, another variant of the inventive method provides a step of storing said long-life signing keys.

0021Yet a further embodiment of the present invention is characterized by providing a plurality of signing keys, each of which is preferably valid for a single use only.

0022The advantages of providing a plurality of signing keys are obvious: only a single GSM authentication process is required which yields according to the present invention a plurality of signing keys and thus avoids further GSM authentications as long as there are signing keys left to use.

0023Said signing keys may be stored to a mobile terminal of the first party and to said gateway, from which they may be obtained by the second party later on. The storage of signing keys accelerates future signing processes and ensures the possibility of signing even if GSM functionality is (temporarily) not available which may be due to lacking network coverage.

0024Another advantageous embodiment of the present invention is characterized by providing an extra key or a plurality of extra keys which can be used to encipher said signing key(s). Said extra key(s) are transmitted and stored to a mobile terminal of the first party and to said gateway, which enables secure communication by means of enciphering said signing key(s) even if GSM functionality is not given.

0025By enciphering said signing key(s) with said extra key(s), it is possible to establish a secure transmission of signing keys between the mobile terminal of the first party and the gateway while using any kind of ad hoc network based on DECT (digital enhanced cordless telecommunications), bluetooth and IrDA systems instead of GSM communications.

0026According to a further advantageous embodiment of the present invention, said signing key is used for enciphering a communication between said first party and said second party which enables to also use ad hoc networks such as bluetooth for transmitting confidential signing data.

0027Another embodiment of the present invention proposes verifying a creditworthiness of said first party, which contributes to avoiding unnecessary GSM authentications. Said verification can e.g. be performed in said gateway before initiating a GSM authentication that is to be used for a future signing process. If the creditworthiness of said first party does e.g. not meet a predetermined critereon, no further transactions are permitted by said gateway. In particular, a GSM authentication for e.g. obtaining a signing key, is unnecessary.

0028A further very advantageous embodiment of the present invention is characterized by transmitting said signing key(s) and/or said extra key(s) via a short message service (SMS) of a mobile communications infrastructure and/or via another secure connection, to said first party and/or to said second party. By doing so, the risk of the signing key being intercepted by an unauthorized party is minimized. It is obvious that a multimedia message service (MMS) or the like can also be used for securely transmitting said signing key(s) and/or said extra key(s).

0029The object of the present invention is furthermore achieved by a mobile terminal and a gateway according to claims 12 to 14.

0030Further advantages and details of the invention are presented in the following detailed description with reference to the drawings, wherein <dl id="dl0001"><dt>Fig. 1a</dt><dd>depicts a first embodiment of the method according to the present invention,</dd><dt>Fig. 1b</dt><dd>depicts a second embodiment of the method according to the present invention,</dd><dt>Fig. 1c</dt><dd>depicts a third embodiment of the method according to the present invention, and</dd><dt>Fig. 2</dt><dd>depicts a fourth embodiment of the method according to the present invention.</dd></dl>

0031<figref idref="f0001">Fig. 1a</figref> shows a mobile terminal 1 of a first contracting party which contacts an online service provider OSP constituting a second contracting party.

0032As can be gathered from <figref idref="f0001">Fig. 1a</figref>, a connection between said mobile terminal 1 and said online service provider OSP is established firstly via a wireless access network 2, which may be an ad hoc network based on e.g. DECT, bluetooth or IrDA, and secondly via a personal computer PC, which in turn is connected to said online service provider via the Internet IP. The mobile terminal 1 and the personal computer PC are both equipped with a corresponding DECT, bluetooth or IrDA interface.

0033Instead of said personal computer PC any other type of access point such as e. g. a WLAN (Wireless Local Area Network) router or the like may be used.

0034Said first party desires to use an online service offered by said online service provider OSP and is thus required to authenticate itself to said online service provider OSP.

0035For this purpose, the online service provider OSP issues an authentication request M_01 to said mobile terminal 1 of said first party, which responds with an authentication response M_02 that comprises an identification code that is uniquely identifying said first party or its mobile terminal 1, respectively.

0036The identification code transmitted from the mobile terminal 1 to the online service provider OSP is a so-called international mobile subscriber identity (IMSI), which is stored to a SIM (subscriber identity module)-card that is comprised within the mobile terminal 1.

0037Said identification code is forwarded via message M_02a from said online service provider OSP to a customer care and billing system CCBS from which it is again forwarded to an authentication server AuC in form of a GSM standard authentication request M_03a.

0038Due to its position in the transmission configuration depicted in <figref idref="f0001">Fig. 1a</figref>, said customer care and billing system CCBS can also be understood as a gateway which manages e.g. contacting said authentication server AuC.

0039Said authentication server AuC may e.g. be comprised in a home location register (HLR) of a network operator a mobile network of which the first party is subscribed to. The authentication server AuC is connected to said customer care and billing system CCBS via a signalling system SSN7.

0040Upon receiving the GSM standard authentication request M_03a from said customer care and billing system CCBS, said authentication server AuC performs a GSM standard authentication, step 111a of <figref idref="f0001">Fig. 1a</figref>, which involves generating a so-called triplet comprising <ul id="ul0001" list-style="dash"><li>a random number,</li><li>a signed response, and</li><li>a ciphering key,</li></ul> which is sent back to said customer care and billing system CCBS by means of message M_03b.

0041The random number of said triplet is forwarded to the mobile terminal 1 by means of message M_03c, which in step 111b continues the GSM standard authentication based on the known A3- and A8-algorithms of the GSM standard (cf. ETSI-GSM Technical Specification GSM 03.20, Version 3.3.2). This yields a so-called challenge response, i.e. the random number digitally signed with the same ciphering key used as in the authentication server AuC. Said challenge response is returned to said customer care and billing system CCBS via message M_03d.

0042In step 111c, said signed response from the authentication server AuC and said challenge response from said mobile terminal 1 are tested for identity within said customer care and billing system CCBS. If they are identical, the first party using said mobile terminal 1 has successfully authenticated itself to the customer care and billing system CCBS.

0043A positive authentication result M_02b is thereupon transmitted to the online service provider OSP which requests a signing key from the customer care and billing system CCBS via the message M_04, which also contains the international mobile subscriber identity (IMSI) of said mobile terminal 1.

0044Said signing key may be the ciphering key of the above mentioned triplet. In this case, creating a signing key is not necessary. Otherwise, a signing key is generated in step 120 of <figref idref="f0001">Fig. 1a</figref> and is provided to both the online service provider OSP and the mobile terminal 1, which is denoted by the arrows 130 in <figref idref="f0001">Fig. 1a</figref>.

0045Providing 130 said signing key is performed via a secure connection, which in case of the transmission to said online service provider may be a secured session over the Internet IP. Regarding the transmission to said mobile terminal 1, a secure wireless transmission is performed by using a short message service (SMS) of a GSM network.

0046Additionally, said signing key may itself be enciphered for the transmission to said mobile terminal 1 by using a suitable key which can be comprised of secret data that is only shared by said customer care and billing system CCBS and said first party 1, so as to increase transmission security of said signing key.

0047Now both the online service provider OSP and the first party with its mobile terminal 1, possess a signing key which can be used to digitally sign data.

0048For instance, the first party can exchange any unsigned/unciphered contracting parameters 135 such as a price or something else with the second party, i.e. the online service provider OSP, and additionally, both of them digitally sign said parameters. Then the first party also transmits said signed parameters to the second party, which simply compares its own signed parameters with the signed parameters received from the first party. If both sets of signed parameters are identical, integrity of parameters as well as the identity of said first party is ensured, and a transaction such as a contract or a payment 140 and the like may be performed.

0049Thus by using existing GSM authentication measures according to the messages M_03a, M_03b, M_03c, M_03d, it is possible to provide signing keys to the first and second party without extra hardware or software and especially without any contract to an (external) trust center.

0050<figref idref="f0002">Fig. 1b</figref> shows a second embodiment of the present invention, which assumes a positive GSM authentication result according to step 111c of <figref idref="f0001">Fig. 1a</figref> and does not show the messages M_03a, M_03b, M_03c, M_03d which are part of the GSM standard authentication process described above.

0051After successful completion of the GSM authentication, cf. to message M_02b of <figref idref="f0001">Fig. 1a</figref>, the online service provider OSP requests a signing key from the customer care and billing system CCBS via the message M_04 (<figref idref="f0002">Fig. 1b</figref>, <figref idref="f0001">1a)</figref>, which also contains the international mobile subscriber identity (IMSI) of the mobile terminal 1, the latter one having been received by the online service provider OSP in the above described manner.

0052By sending the mobile terminal's IMSI to said customer care and billing system CCBS, an appropriate, individual key generation for said mobile terminal 1 is enabled. Otherwise within said CCBS it would be not clear for which mobile terminal a key generation is to be initiated, which is critical since said signing keys are specific to the corresponding mobile terminal 1 or its IMSI or the like.

0053The customer care and billing system CCBS has a key generator 3 for creating a signing key based on input data such as the international mobile subscriber identity (IMSI) of the mobile terminal 1, a session specific random number that has already been exchanged during GSM standard authentication, cf. message M_03b of <figref idref="f0001">Fig. 1a</figref>, a ciphering key and/or other secret data shared only by the first party and the authentication server AuC. Said input data is provided by a database 4 and the input is symbolized in <figref idref="f0002">Fig. 1b</figref> by the arrows 4a.

0054The signing key is created within said key generator 3 and then returned to the online service provider OSP by message M_04a.

0055The same key generator 3 is located within said mobile terminal 1, in particular on a SIM (subscriber identity module)-card within the mobile terminal 1, and the aforementioned signing key is also generated within said mobile terminal 1, based on the same input 4a.

0056After creation of said signing key within said mobile terminal 1, a standardized signing algorithm such as a message authentication code MAC or a keyed hashing for message authentication HMAC (cf. RFC 2104, Internet requests for comments) is applied to document 5 and the document 5 is sent to the online service provider OSP together with the so signed document 5 via message M_05.

0057Upon receiving said message M_05, the online service provider OSP verifies the document 5 and the signed document by applying a standardized signing algorithm such as a message authentication code MAC or a keyed hashing for message authentication HMAC, to said document 5. It is evident that both said mobile terminal 1 and said online service provider OSP must use the same standardized signing algorithms MAC/HMAC.

0058If the signed version of document 5 created by the online service provider OSP is identical to the signed version of document 5 created by said mobile terminal 1, the identity of the mobile terminal 1 and the integrity of the document 5 is proofed.

0059A further embodiment of the present invention is shown in <figref idref="f0003">Fig. 1c</figref>. In contrast to <figref idref="f0002">Fig. 1b</figref>, an asymmetric signing process is employed. For this purpose, a public key generator 3a, which may e.g. be comprised within said customer care and billing system CCBS, is fed with input data 4a from a database 4 as already explained above to generate a public signing key sent to the online service provider OSP via message M_04a on request M_04.

0060The mobile terminal 1 comprises a private key generator 3b that generates a private signing key which is used by an asymmetric ciphering algorithm ac to create a signature which is sent to the online service provider OSP together with the document 5 by means of message M_05.

0061The online service provider OSP then verifies the identity of the mobile terminal 1 and the integrity of said document 5 by employing prior art asymmetric ciphering and deciphering algorithms in step 150.

0062<figref idref="f0004">Fig. 2</figref> shows a further embodiment of the method according to the present invention, in which a GSM standard authentication as already explained with reference to <figref idref="f0001">Fig. 1a</figref>, <figref idref="f0002">1b</figref>, <figref idref="f0003">1c</figref> is performed first.

0063After testing said signed response from the authentication server AuC and said challenge response from said mobile terminal 1 for identity within said customer care and billing system CCBS in step 111c, a plurality of signing keys is generated within said customer care and billing system CCBS and is provided to the mobile terminal 1 in step 130. The mobile terminal 1 stores said plurality of signing keys in step 135, and said signing keys are also stored to the customer care and billing system CCBS which is done in step 135a.

0064The storage of signing keys accelerates future signing processes and ensures the possibility of signing even if GSM functionality or any other communications channel that is usually used for securely transmitting signing keys particularly to said mobile terminal 1 is (temporarily) not available which may e.g. be due to lacking network coverage.

0065Yet a further variant of the present invention proposes to create at least one long-life token after a successful GSM standard authentication.

0066Both variants reduce a network load of the networks used for authentication, since a new authentication is only required if the long-life signing key has expired or each signing key of the plurality of signing keys has been used.

0067Furthermore, if a long-life signing key is still valid or if there are stored signing keys available in the mobile terminal 1, a user-transparent authentication can be performed, since accessing a stored signing key does not require user interaction. In this case, a mobile terminal comprising the stored signing keys should be password protected.

0068Said signing key(s) may generally be created/obtained by a ciphering key of the GSM standard authentication process. Additionally, secret data shared only by said first party and an authentication server AuC may be used to create a further signing key.

0069Providing an extra key or a plurality of extra keys which can be used to encipher said signing key(s) is also possible with the method according to the present invention. Said extra key(s) are transmitted and stored to the mobile terminal 1 of the first party and to said gateway CCBS, which enables a secure transmission of said signing key(s) even if GSM functionality is not given.

0070By enciphering said signing key(s) with said extra key(s), it is possible to establish a secure transmission of signing keys between the mobile terminal 1 of the first party and the gateway CCBS while using any kind of ad hoc network based on DECT (digital enhanced cordless telecommunications), bluetooth and IrDA systems instead of GSM communications.

0071Generally, any type of transaction requiring user authentication or verification of transaction data can be improved by the present invention. Especially payment transactions can advantageously be simplified while at the same time increasing transaction security.

0072It is also possible to use the signing keys obtained by the method according to the present invention for accessing so-called single-sign-on services. Single-sign-on services provide for a centralized authentication process by means of a single authentication entity also known as "identity provider" which performs user authentication for a plurality of service providers which define a "circle of trust". After such an authentication, the identified user can contract with any service provider of said circle of trust without being asked to re-authenticate. Single-sign-on services are e.g. provided by a so-called Liberty Alliance Project (cf. website http://www.projectliberty.org/).

0073Generally, prior to initiating a GSM standard authentication (M_03a, ...., <figref idref="f0001">Fig. 1a</figref>) a creditworthiness of said first party can be checked by said customer care and billing system CCBS. This eliminates the need to perform said GSM standard authentication if the first party has a poor creditworthiness and thus reduces a network load.

0074In those cases, in which said signing key is transmitted from said customer care and billing system CCBS to said mobile terminal 1 via a short message (SMS), the customer care and billing system CCBS is not required to pass the corresponding short message to a short message service center (SMSC). Instead, the customer care and billing system CCBS can request an address, in particular the so-called MSC_ID, of a serving mobile switching center (MSC) of said GSM network, from a home location register (HLR) and transmit the short message to the mobile terminal 1 directly. This prevents delays that may be caused by a processing of said short message within said short message service center (SMSC).

0075The method according to the present invention furthermore provides an added value for network operators since they can offer secure and easy transactions to users for payments e.g. at supermarkets, authentication of bidders at online auctions and the like.

0076It is also possible to provide payment applications which are implemented within said mobile terminal 1 in addition to a regular firmware of said devices. Said payment applications can be used to control the above explained transaction processes and may have direct access to a GSM interface of said mobile terminal 1.

0077A further advantage of the present invention is the fact that users of a corresponding mobile terminal 1 can spontaneously make use of said authentication according to the present invention to take part in tombolas or auctions which are for instance presented to attract people to marketing events. A separate, i.e. non-electronic, verification of an identity of such people is not necessary because of the authentication according to the present invention. Informing bidders and/or winners of said tombola can as well be conducted by e.g. said customer care and billing system CCBS in a sophisticated way via short messages (SMS), phone calls or electronic mail.

0078As already stated above, the subject matter of the present invention is not limited to the possibility of signing data.

0079It is also possible to use said signing key for (digitally) verifying or encrypting data as well, which depends on a respective application and the type of transaction provided. For instance, said signing key may be used to sign and/or encrypt and/or verify contracts, price lists, orders, transaction numbers used for electronic banking and the like.

0080According to a further embodiment of the present invention, if said online service provider OSP and said customer care and billing system CCBS both are comprised within a circle of trust administered e. g. by the Liberty Alliance, said online service provider OSP may initiate an authentication by said customer care and billing system CCBS without requesting an IMSI from said first party, because in this case said customer care and billing system CCBS itself issues an authentication request (cf. M_01, <figref idref="f0001">Fig. 1a</figref>). In this case, the customer care and billing system CCBS plays the role of an identity provider (IDP), too.

0081To further improve security, the customer care and billing system may protect an identity of said first party by using existing parameters such as a temporary mobile station identity (TMSI) and/or a location area index (LAI), cf. <nplcit id="ncit0001" npl-type="b"><text>C. Lüders: Mobilfunksysteme, Vogel Verlag, Würzburg, 2001</text></nplcit>.

0082It is also possible to use separate anonymizing services that work independent of methods provided by communications networks.