Method and system for secure communication using hash-based message authentication codes

FIELD OF THE INVENTION

p-0002The present invention relates generally to computer security. More particularly, the present invention relates to a method and system for secure communication.

BACKGROUND OF THE INVENTION

p-0003With the increase in client-server communications, as well as the increase in the value of the data being communicated, there is a corresponding increase in the want and need for secure protocols for those communications. The ubiquity of mobile computing devices (more simply, “mobile devices”) and the functionality and data they access and store has increased this need. While there are existing secure data transport protocols, such as Secure Socket Layer (“SSL”) or Transport Layer Security (“TLS”), they are not suitable for all communications, data and environments. Additionally, they often require additional user authentication.

p-0004One-time passwords (“OTPs”) are gaining popularity as a secure method of user authentication, particularly for financial transactions. However, OTPs do not, by themselves, provide confidentiality of data.

p-0005One method of communicating securely is set out in Canadian Patent Application Number 2,590,989. The method set out therein is suitable for many scenarios, but the length of the passphrases used to derive the key for encrypt messages is relatively short. As a result, the encryption key can be less strong than desirable.

p-0006It is an object of this invention to provide a novel method and system for secure communication.

SUMMARY OF THE INVENTION

p-0007In accordance with an aspect of the invention, there is provided a method for secure communication, comprising:

p-0008generating a first hash-based message authentication code from a shared secret and a first counter value stored in storage of a computing device;

p-0009generating a second hash-based message authentication code from said shared secret and a second counter value;

p-0010deriving an encryption key from a first function of said first hash-based message authentication code and said second hash-based message authentication code;

p-0011encrypting a message using said encryption key; and

p-0012communicating said encrypted message via a network interface of said computing device.

p-0013The method can further include:

p-0014generating a one-time password using one of said first and second hash-based message authentication codes.

p-0015The method can further include:

p-0016communicating said one-time password to enable determination of one of said first and second counter values.

p-0017The first function can include at least a portion of a concatenation of said first and second hash-based message authentication codes.

p-0018The method can include:

p-0019combining said encryption key with an initialization vector for decrypting said message.

p-0020The encrypting can include:

p-0021generating an initialization vector as a second function of at least one of said first and second hash-based message authentication codes; and

p-0022encrypting said message using said encryption key concatenated with said initialization vector.

p-0023The generating can include setting the initialization vector as a portion of said second hash-based message authentication code.

p-0024The method can further include:

p-0025communicating an identifier for said shared secret and said counter with said encrypted message.

p-0026The method can further include:

p-0027receiving an encrypted response; and

p-0028decrypting said encrypted response using said encryption key.

p-0029In accordance with another aspect of the invention, there is provided a system for secure communication, comprising:

p-0030a computing device having a network interface for receiving a shared secret and a first counter value, a storage for storing said shared secret and said counter value, and a processor executing an encryption module, said encryption module generating a first hash-based message authentication code from said shared secret and said first counter value and a second hash-based message authentication code from said shared secret and a second counter value subsequent to said first counter value, said encryption module deriving an encryption key from a first function of said first hash-based message authentication code and said second hash-based message authentication code, and encrypting a message using said encryption key, said encryption module causing said network interface to communicate sent encrypted message.

p-0031The encryption module can generate a one-time password using one of the first and second hash-based message authentication codes.

p-0032The encryption module can indicate the one-time password via the network interface to enable determination of one of the first and second counter values.

p-0033The first function can include at least a portion of a concatenation of the first and second hash-based message authentication codes. The encryption module can combine the encryption key with an initialization vector for decrypting the message.

p-0034The encryption module can generate an initialization vector as a second function of at least one of the first and second hash-based message authentication codes, and encrypt the message using the encryption key concatenated with the initialization vector.

p-0035The encryption module can set the initialization vector as a portion of the second hash-based message authentication code.

p-0036The encryption module can communicate an identifier for the shared secret and the counter values with the encrypted message.

p-0037The encryption module can receive an encrypted response to the communication of the encrypted message, and decrypt the encrypted response using the encryption key.

p-0038In accordance with a further aspect of the invention, there is provided a method for secure communication, comprising:

p-0039generating a first hash-based message authentication code from a shared secret and a first counter value stored in storage of a computing device;

p-0040generating a second hash-based message authentication code from said shared secret and a second counter value;

p-0041deriving an encryption key from at least said first hash-based message authentication code;

p-0042generating an initialization vector from at least said second hash-based message authentication code;

p-0043encrypting a message using said encryption key and said initialization vector; and

p-0044communicating said encrypted message via a network interface of said computing device.

p-0045The method can include generating a one-time password using one of the first and second hash-based message authentication codes. Further, the method can include communicating the one-time password to enable determination of one of the first and second counter values.

p-0046The deriving can include concatenating at least a portion of the first and second hash-based message authentication codes.

p-0047The generating of the initialization vector can include concatenating at least a portion of the first and second hash-based message authentication codes.

BRIEF DESCRIPTION OF THE DRAWINGS

p-0048An embodiment will now be described, by way of example only, with reference to the attached Figures, wherein:

p-0049<figref idrefs="DRAWINGS">FIG. 1</figref> shows a high-level architecture of a system for recovering a security credential in accordance with an embodiment of the invention and its operating environment;

p-0050<figref idrefs="DRAWINGS">FIG. 2</figref> shows a schematic diagram of the server of <figref idrefs="DRAWINGS">FIG. 1</figref>;

p-0051<figref idrefs="DRAWINGS">FIG. 3</figref> shows a schematic diagram of the mobile device of <figref idrefs="DRAWINGS">FIG. 1</figref>;

p-0052<figref idrefs="DRAWINGS">FIG. 4</figref> shows the method of setting up the mobile device for use with the system of <figref idrefs="DRAWINGS">FIG. 1</figref>; and

p-0053<figref idrefs="DRAWINGS">FIGS. 5A and 5B</figref> show the general method for secure communication using the system of <figref idrefs="DRAWINGS">FIG. 1</figref>.

DETAILED DESCRIPTION OF THE EMBODIMENT

p-0054The invention provides a system and method for secure communication between two computing devices. Two hash-based message authentication codes (“HMACs”) are generated using a shared key and two counter values. A key for encrypting communications between two computing devices is then derived as a function of the two HMACs. As the amount of source data provided by the two HMACs is relatively large, the encryption key and an initialization vector to which it is concatenated can be made fairly strong. Further, an OTP generated using one of the two HMACs enables authentication of the initiating party's identity and synchronization of the counter values between the two communicating computing devices. By deriving an encryption key for encrypting communications between the computing devices using a relatively-long passphrase, the encryption key can be stronger and communications encrypted using the encryption key are less vulnerable to various types of cryptographic attacks. Further, as the encryption key is derived from an OTP, it can be dynamic, thereby making its use suitable in a variety of systems and methods.

p-0055<figref idrefs="DRAWINGS">FIG. 1</figref> is a high-level architectural diagram of a system for secure communication and its operating environment in accordance with an embodiment of the invention. In this embodiment, the two computing devices that communicate securely are a mobile device and a server. The mobile device accesses data and/or functionality available through the server via secure communications, with both requests and responses being encrypted.

p-0056As shown in <figref idrefs="DRAWINGS">FIG. 1</figref>, the system includes a server <b>20</b> that generates shared secrets and encryption and decryption keys, and stores the decryption keys in a key database. While only one server <b>20</b> is shown, it will be appreciated by those skilled in the art that the functionality/service provided by the server <b>20</b> in the described embodiment can be provided by two or more server computers. Where there is more than one server, the servers can be in communication with one another over a local area network, or can be distributed remotely and in communication with each other via one or more communication networks. The server <b>20</b> is in communication with a large, public network, such as the Internet <b>24</b>.

p-0057A mobile device <b>28</b> is also in communication with the Internet <b>24</b> via a cellular communications tower <b>32</b>. In particular, the mobile device <b>28</b> communicates via cellular communications with the cellular communications tower <b>32</b> that, in turn, is in communication with the Internet <b>24</b> via a number of intermediate servers operated by one or more cellular communications carriers (not shown).

p-0058<figref idrefs="DRAWINGS">FIG. 2</figref> shows a number of physical and logical components of the server <b>20</b>, including a central processing unit (“CPU”) <b>40</b>, random access memory (“RAM”) <b>44</b>, an input/output (“I/O”) interface <b>48</b>, a network interface <b>52</b>, non-volatile storage <b>56</b>, and a local bus <b>60</b> enabling the CPU <b>40</b> to communicate with the other components. The CPU <b>40</b> executes an operating system and programs that provide the desired functionality. RAM <b>44</b> provides relatively responsive volatile storage to the CPU <b>40</b>. The I/O interface <b>48</b> allows for input to be received from one or more devices, such as a keyboard, a mouse, etc., and outputs information such as to a display and/or speakers. The network interface <b>52</b> permits communication with other systems for sending and receiving communications to the mobile device <b>28</b>. Non-volatile storage <b>56</b> stores the operating system and applications. A key database <b>64</b> is maintained by the server <b>20</b> in the non-volatile storage and stores user account information, mobile device information and decryption keys associated with user accounts. The server <b>20</b> includes a Web interface for enabling users to register with the server <b>20</b>. Further, the server <b>20</b> includes various installation versions of one or more applications for installation on the mobile device <b>28</b>. The versions enable installation of the application on various types of mobile device with varying versions of operating systems.

p-0059Referring to <figref idrefs="DRAWINGS">FIG. 3</figref>, a number of components of the mobile device <b>28</b> are shown. The mobile device <b>28</b> is a typical mobile phone having basic functions. The mobile device <b>28</b> has an input interface <b>68</b> for receiving input from a user, a display <b>72</b> is provided for presenting information visually to the user, and a speaker <b>76</b> for playing audio notifications or other audio output, including voice output, to the user. The mobile device <b>28</b> also includes storage <b>80</b> for storing an operating system that controls the main functionality of the mobile device <b>28</b>, along with a number of applications that are run on the mobile device <b>28</b>, and data. A processor <b>84</b> executes the operating system and applications. A SIM card <b>88</b> provides additional memory for storing applications and data, and has a microprocessor for executing them. Additionally, the SIM card <b>88</b> has a unique hardware identification code that permits identification of the mobile device <b>28</b>. When installed, the SIM card <b>88</b> forms part of the mobile device <b>28</b>. Other types of mobile devices can have encrypted device memory in place of the SIM card <b>88</b> that offers the equivalent functionality. A communications interface <b>92</b> permits communications with a cellular network for voice and data. The communications interface <b>92</b> also enables communications via other wireless and wired channels, such as Bluetooth and universal serial bus (“USB”).

p-0060The mobile device <b>28</b> executes software, referred to herein as a client application, that includes an encryption module for securing communications with the server <b>20</b>. In particular, in this embodiment, the client application, when executed, enables secure exchange of data via Global System for Mobile (“GSM”) Short Message Service (“SMS”) with the server <b>20</b>. The client application is separate from the native application on the mobile device <b>28</b> for transmitting SMS messages. The client application is stored in the storage <b>80</b> of the mobile device <b>28</b> and executed by the processor <b>84</b> when activated by the user (such as by selecting and activating an associated icon in the user interface of the mobile device <b>28</b>), and its encryption module encrypts communications sent to the server and decrypts communications sent by the server <b>20</b>. As used herein with respect to this embodiment, the term “client” refers to the mobile device <b>28</b> that executes the client application.

p-0061<figref idrefs="DRAWINGS">FIG. 4</figref> shows the general method <b>100</b> of setting up the mobile device <b>28</b> for use with the server <b>20</b>. In order to use the system, the user of the mobile device <b>28</b> registers with the server <b>20</b> via a Web page, either on the mobile device <b>28</b> or elsewhere (step <b>110</b>). The Web page is part of a registration and administration interface for the security credential recovery service that is Web-based. During registration, the user provides his name, a login name and password, and the telephone number associated with the mobile device <b>28</b> with which he wishes to securely communicate with the server. In addition, the user is asked to accept an end-user license agreement (“EULA”) and privacy policy before access to the server via the mobile device is provided. Once registration is complete, the server <b>20</b> sends a short message service (“SMS”) message to the mobile device <b>28</b> that includes a link for downloading an application (step <b>120</b>). The SMS message is sent to the mobile device <b>28</b> via the telephone number provided by the user at step <b>110</b>. Upon receipt of the SMS message and activation of the link, the mobile device <b>28</b> downloads the application, after which it is installed on the mobile device <b>28</b> (step <b>130</b>). The server <b>20</b> receives the download request, determines the type of mobile device in order to deliver an appropriate version of the application to the mobile device <b>28</b>.

p-0062Once the application is installed on the mobile device <b>28</b> and started up for the first time, the user is prompted for his login name and password (step <b>140</b>). The application transmits the user's login name and password securely to the server <b>20</b> and, once approved, the server <b>20</b> generates a shared secret, K_SHARED, a shared authentication key, K_MAC, and an initial counter value, C₀, for the mobile device <b>28</b> (step <b>150</b>). The shared secret is generated using a strong random number generator. The server <b>20</b> generates a token ID, “TID”, for these security elements and stores it, the shared secret, the shared authentication key and the initial counter value in the key database, together with the other user information.

p-0063The server <b>20</b> then transmits the shared secret, the shared authentication key, the counter value and the token ID to the mobile device <b>28</b> (step <b>160</b>). Upon receipt of the shared secret, the shared authentication key, the counter value and the token ID, the application executing on the mobile device <b>28</b> initializes the encryption module and provides the shared secret, the shared authentication module, the counter value and the token ID to the encryption module (step <b>170</b>). At this point, the application is ready to communicate securely with the server to access the functionality and/or data available thereon.

p-0064During regular operation, the user starts up the application and enters in his login name and password. Upon receiving a request from the user to access functionality and/or data available through the server <b>20</b>, the application calls upon the encryption module to encrypt the request being sent to the server <b>20</b> and to decrypt the response sent by the server <b>20</b>.

p-0065<figref idrefs="DRAWINGS">FIGS. 5A and 5B</figref> illustrate the method for secure communication using the system shown in <figref idrefs="DRAWINGS">FIG. 1</figref> generally at <b>200</b>. The method begins with the encryption module generating S_n, a 20-byte HMAC, and a corresponding OTP_n(step <b>210</b>). In particular, where n is an incremental variable, and C_nis the n^thvalue of the counter C. The counter C is initialized by the server <b>20</b> at a random value, C₀, and incremented by one each time a new HMAC is required. The particular HMAC function employed in the embodiment is the HMAC-SHA-1 algorithm, as set out in IETF RFC 2104, although other HMAC functions will occur to those skilled in the art.

p-0066After generating S_n, the encryption module generates S_n+1, another 20-byte HMAC, and a corresponding OTP₊₁(step <b>220</b>). In particular,

p-0067<br /><i>S</i>_n+1=HMAC(<i>K</i>_SHARED,<i>C</i>_n+1),

p-0068where C₊₁=C_n+1. Again, the HMAC-SHA-1 algorithm is employed to generate the HMAC, S_n.

p-0069The encryption module then concatenates S_n+1with the first four bytes of S_nto derive the session encryption key, K_ENC (step <b>230</b>). As the HMAC S_n+1is 20 bytes in length, the resulting K_ENC is 24 bytes in length. The encryption module then establishes an initialization vector (“IV”) of the last eight bytes of the HMAC S_n(step <b>240</b>). The encryption module generates a message digest using the shared K_MAC, and concatenates the encryption key, K_ENC, with the initialization vector, IV, using this to encrypt data generated by the application (step <b>250</b>). The message data, C_DATA, in this case, takes the form of extensible mark-up language (“XML”). Those skilled in the art, however, will appreciate that the message data could also be in any of a number of other formats. A message digest is generated for C_DATA using K_MAC and appended to the data. The encryption module then encrypts C_DATA and the appended message digest using the derived session encryption key K_ENC and appended initialization vector IV (step <b>260</b>). Specifically, Triple Data Encryption Algorithm (referred to commonly as “Triple DES”) is used to encrypt C_DATA and the appended message digest using the 32-byte concatenated K_ENC and IV. Upon encrypting C_DATA and the appended message digest, the application executing on the mobile device sends the encrypted message data and message digest to the server <b>20</b> via the communications interface <b>92</b> of the mobile device <b>28</b> (step <b>270</b>). The application appends the token ID, TID, and OTP_n. The TID permits the server <b>20</b> to reference the corresponding shared secret, K_SHARED, stored in the key database <b>64</b>, and OTP_nenables synchronization of the counter values between the mobile device <b>28</b> and the server <b>20</b>.

p-0070Upon receipt of the communication, the server <b>20</b> verifies the TID, retrieves the corresponding shared secrets, K_SHARED and K_MAC, and the last known counter value, referred to as C_m(step <b>280</b>). Using the last known counter value, C_m, and the shared secrets, the server <b>20</b> proceeds to increment C_mby one and generate an HMAC using K_SHARED and the new counter value. Once the HMAC is generated, the server <b>20</b> then generates a corresponding OTP:

p-0071<br />OTP_m+1=Truncate(HMAC(<i>K</i>_SHARED,<i>C</i>_m+1))

p-0072If the resulting OTP_m+1matches OTP_nprovided in the communication from the mobile device <b>28</b>, then the counter value, C_n=C_m+1. If not, then the server <b>20</b> iteratively increments C_m+1and tests the successive counter values as noted above until C_nis found or a set number of tries to match the counter values has been attempted, after which the server <b>20</b> determines that the communication is invalid. If the communication is deemed invalid, the server <b>20</b> responds back to the mobile device <b>28</b> with an error message. Once C_nhas been discovered, the server <b>20</b> records the corresponding S_n=HMAC (K_SHARED, C_n).

p-0073The server <b>20</b> then determines the subsequent counter value, C_n+1, and uses it to generate the corresponding HMAC (step <b>290</b>):

p-0074<br /><i>S</i>_n+1=HMAC(<i>K</i>_SHARED,<i>C</i>_n+1)

p-0075The corresponding 24-byte encryption key, K_ENC, is then derived by the server <b>20</b> by concatenating S_n+1with the first four bytes of S_n(step <b>300</b>). The server <b>20</b> then generates the initialization value, IV, as the last eight bytes of S_n(step <b>310</b>). Using K_ENC concatenated with IV, the server <b>20</b> decrypts the encrypted C_DATA and appended message digest, and generates the message digest independently using the K_MAC corresponding to the TID in the communication from the mobile device <b>28</b> to verify the integrity of the message data (step <b>320</b>).

p-0076Once the message data, C_DATA, has been decrypted and verified, the server <b>20</b> processes the message data and generates a response in the form of message data, S_DATA (step <b>330</b>). Again, the data is in XML format, but could be in any of a number of other formats. The server <b>20</b> then generates a message digest for S_DATA using the retrieved K_MAC, appends the message digest to S_DATA, and encrypts S_DATA and the appended message digest using the concatenated K_ENC and IV (step <b>340</b>). The server <b>20</b> then communicates the encrypted response to the mobile device <b>28</b> (step <b>350</b>).

p-0077Upon receipt of the response from the server <b>20</b>, the application on the mobile device <b>28</b> directs the encryption module to decrypt the message data and verify the integrity of the message data, S_DATA (step <b>360</b>). In particular, the encryption module decrypts the communication from the server <b>20</b> using the cached K_ENC concatenated with IV that it saved from when it generated the encrypted message data. The encryption module verifies the integrity of the message data, S_DATA, by independently generating the message digest and checking to ensure that it matches the message digest generated by the server <b>20</b>. Upon decryption and verification of S_DATA, it is outputted by the encryption module for use by the application executing on the mobile device <b>28</b>.

p-0078For each subsequent communication, the counter value is increased and a new session encryption key, K_ENC, is derived.

p-0079While the invention has been described with specificity to the use of SHA-1, those skilled in the art will appreciate that other types of hash-based message authentication codes can be employed. For example, SHA-256 or SHA-512 can be used in place of SHA-1.

p-0080The encryption key can be derived using other functions of two or more HMACs, such as PKCS#5 and other key derivation functions.

p-0081Other types of encryption can be used for encrypting the message apart from Triple DES. For example, Advanced Encryption Standard (“AES”) can be used without affecting the working of the invention.

p-0082Different functions of the first and second HMACs can be used to generate the encryption key and the initialization vector. In one embodiment, the encryption key is derived from a portion of one of the HMACs and the initialization vector is generated from a portion of the other HMAC. In another embodiment, both the encryption key and the initialization vector are generated using the two HMACs.

p-0083Where an initialization vector is employed, other functions for generating it will occur to those skilled in the art.

p-0084In some cases, it may not be necessary to transmit the token ID. For example, where hardware identifiers are accessible, the hardware identifier can be identified during provisioning of the application on the computing device and can be registered with the security elements stored in the key database. Upon receipt of a communication, the hardware identifier can be used to look up the requisite security elements for authenticating, verifying and/or decrypting the message.

p-0085The session key can be used for a single communication from one computing device to another. Alternatively, the session key can be used for multiple communications for a session or transaction. Further, where message data is too large to be transmitted in a single communication, such as an SMS message, the message data can be split and each portion can be encrypted using the same or separate encryption keys.

p-0086Other types of computing devices can be set up to work with the invention. For example, a mobile device can be paired via a hardwire connection to a personal computer for provisioning and can thereafter use the invention to carry out communications with the personal computer securely, such as for synchronizing data, etc.

p-0087While the invention was described with respect to an SMS client application executing on a mobile device, those skilled in the art will appreciate that a number of other types of software and/or hardware could be used. For example, a plug-in can be provided to adapt a native SMS client on a mobile device to conduct secure communications using the general method described above.

p-0088The software for enabling secure communications could be any computer-executable instructions for communicating securely with another computing device, and could be implemented in firmware, an operating system, an application, etc. The computer-executable instructions can reside in the storage of the computing device. Alternatively, the computer-readable instructions can reside in the storage of a subscriber identification module (“SIM”) card that, when inserted in a mobile phone, form part of that computing device. The computer-readable instructions can be made available via download or can be distributed on a computer-readable medium.

p-0089While the HMACs are described above as being generated using counters, other methods can be employed. For example, the HMACs can be generated using a moving factor that is based on time, for example.

p-0090The information in the communications can be outputted in a number of ways. For example, the information can saved in storage, displayed, printed or passed to an application for further processing.

p-0091The invention could be employed to secure communications for a variety of data types, such as, for example, email, MMS, instant messages, etc.

p-0092Those skilled in the art will appreciate that, in some cases, the lengths of the various elements used, such as the keys and the initialization vector, could be varied without significantly affecting the invention.

p-0093The above-described embodiments are intended to be examples of the present invention and alterations and modifications may be effected thereto, by those of skill in the art, without departing from the scope of the invention, which is defined solely by the claims appended hereto.