Secure one-way authentication communication system

[0002] This application is a continuation of International Application No. PCT/CA99/00053, filed Feb. 1, 1999, the content of which is incorporated herein by reference.

[0003] This invention relates to a protocol for the secure verification of correspondents in a data communication system and in particular to the verification of at least one of the correspondents having limited computing power.

[0004] Traditionally, a mechanical turnstile system was used to restrict the entry of persons into or out of a pre-determined area. In order to gain entry, the user is required to pay a fee, the fee being in the form of cash, tokens, fee cards or other payment medium. These mechanical turnstiles however allow entry without being able to identify the persons entering or leaving. In order to monitor users, an operator is required.

[0005] In order to alleviate this problem electronic card entry and exit systems were devised. In these types of systems, a user is issued with an identification card beforehand which is then inserted into a card reader and upon positive verification will allow entry via a locked door or similar barrier thus obviating the need for an operator. A disadvantage of this system is that for a large number of users, a database has to be maintained listing each of the users, particularly if each user has a unique identification then the verification system is required to scroll through each of the records to find a matching identity. Secondly, this system is also inconvenient if there are a large number of users entering a particular location at a given time such as a public transit way, the insertion and withdrawal of cards from a card reader is apt to cause bottlenecks at the entrance way.

[0006] Transit systems have been devised in which users are provided with a pre-programmed smart card. In this system, the turnstile or a terminal is able to monitor the smart card remotely thus the user simply walks past the turnstile without having to physically insert the card in a slot. The card is generally activated by the presence of a electromagnetic field generated by the terminal, the card then transmits an appropriate identification back to the terminal which verifies the card identification and allows entry of the user. These cards generally have limited computing power and are not able to perform complex computations. It is also desirable to authenticate these cards to prevent duplication or fraudulent entry. Because the cards have limited computing power, it is necessary to implement a authentication protocol that minimizes the computation performed by the card and furthermore is able to provide verification of the card by the terminal in a very short period of time, generally less than one second.

[0007] This invention seeks to provide a solution to the problem of card verification between a terminal and a card where the card device has limited computing power.

[0008] According to one aspect of this invention there is provided a method of authenticating at least one of a pair of correspondents T and C in an information exchange session, and wherein one of the correspondents T includes a secret key t and the other correspondent C has a public key C and a shared secret value t_Cderived from said public key C and said secret key t the method comprising the steps of:

[0009] the first correspondent C transmitting to the second correspondent T said public key C;

[0010] the second correspondent T generating a challenge value χ and transmitting said challenge value χ to said first correspondent C;

[0011] said second correspondent T generating a session shared secret value ss by combing said private key t with said public key C of said first correspondent C;

[0012] said second correspondent T generating a response test value k_tby combining said session shared secret ss with said challenge χ, in a mathematical function 𝑓₁;

[0013] said first correspondent C generating a response value k_cby combining said shared secret t_Cwith said challenge value χ in said mathematical function 𝑓₁and sending said response value k_cto said second correspondent T; and

[0014] said second correspondent T comparing said response test value k_tto said challenge response value k_cto verify said first correspondent C.

[0015] A further aspect of this invention provides for said public key C being included in a certificate Cert_C, whereby the second correspondent verifies the certificate on C and the identity of the first correspondent C before generating the challenge χ.

[0016] In accordance with a further aspect of this invention the mathematical function 𝑓₁is a one way function.

[0017] Embodiments of the present invention will now be described by way of example only with reference to the accompanying drawings in which:

[0018] FIG. 1 is a schematic representation of a communication system; and

[0019] FIG. 2 is a flow chart showing a verification protocol according to the present invention.

[0020] In the following description like numerals referred to like elements. Referring to FIG. 1, a transit control system is shown generally by numeral 10. In the system, a user 12 carries an identification card 14. A terminal including a card reader is provided for remote monitoring of card carrying users 12. The terminal 16 communicates with cards in a given area of proximity via, for example, electromagnetic means 18. These systems are readily available and will not be discussed further.

[0021] In the context of the present data communication system, the card and terminal are designated a pair of first and second correspondents C and T respectively. Depending upon the reading mechanism employed, the card generally is powered when brought in proximity to the magnetic field generated by the terminal 18. The card 14 contains a low power processing unit which is at least capable of performing simple calculations. In a typical data communication session, the card assembles a data string, which when assembled is transmitted to the terminal.

[0022] At system set-up, i.e. when a card is issued to a user, an encryption scheme is chosen and appropriate system parameters are defined. In the following example an elliptic curve encryption scheme is used. The details of encryption schemes will not be discussed as they are well known in the art. However, if the elliptic curve encryption system is being utilized, then a public value C=cP, is computed where P is a generator point on the elliptic curve. The public value C is signed by a certifying authority (CA) to produce a certificate Cert_c, containing the public key C and identification of the card C and stored in the card 14. A shared secret t_C=tC is calculated where t is a secret key known to the terminal T. This shared secret t_Cis stored in the card within a secure boundary. Thus after the system set-up phase, the card contains a certificate Cert_Cand a shared secret t_C.

[0023] Referring now to FIG. 2, a protocol according to an embodiment of the present invention is shown generally by numeral 200. When the user 12 carrying the card 14 is in proximity to the terminal 18, the card detects the terminal 210 and sends its certificate Cert_cto the terminal T. Similarly when the terminal detects the card 214 it waits for a certificate Cert_c216. When the terminal receives the certificate, it verifies the certificate using the CA's public key 218. If the certificate is not verified, a rejection signal is generated which may be used to alert or signal an appropriate barrier or event. However if the certificate is verified the terminal extracts the public key C of the card from the certificate 220. The terminal then generates a challenge χ 222, which may be a large integer, or any suitable bit string. This challenge χ is then sent to the card 224. At the same time the terminal computes a shared secret ss=tC and computes a challenge response verification value k_T=𝑓₁(χ, ss), where 𝑓₁is a one-way function such as a secure hash function or one derived from the data encryption standard (DES). The card upon receipt of the challenge χ also computes its challenge response k_cby applying a one-way function 𝑓₁to the challenge value χ and the shared secret t_Cto calculate k_c=𝑓₁(χ, t_C). This challenge response value k_cis then sent back to the terminal 232 where it is verified 234 by the terminal comparing k_tto k_c. If these values are equal then the card is verified.

[0024] It may be seen thus that the purpose of the challenge χ is to know that the card has the shared secret t_C, otherwise the data communication system is open to replay attack, where an observer watches for the k_cand may send it back at a later time. Furthermore it may be seen from the system that the terminal does not have to maintain a record of secret keys for each card authorized in the system. The advantage of this may well be appreciated when for example the card is a public rail transit card identification and the terminal has to maintain records for each of approximately a few hundred thousand users. Thus the present invention avoids this disadvantage.

[0025] In a further embodiment, the card may at step 230 in producing the challenge response compute a value k_sig=𝑓₁(χ, t_c, m) where m is a message to be signed by the card. The card may then concatenate the challenge response k_sigwith the message and sends this to the terminal. In this instance, the card is both authenticated and a message generated by the card is signed.

[0026] In a still further embodiment, the card may be authenticated as well as send an encrypted message. In this instance, the card calculates its challenge response value k_enc=𝑓₁(χ, ss) and using this value as a key to calculate an encrypted value of a message m using for example a DES or DESX such that E=E_Kenc(m). In this instance the card is implicitly authenticated with the encrypted message. This may be useful for example when the card sends a P.I.N. back to the terminal.

[0027] In a further embodiment, the system rather than utilizing a single value of t, may use many values of t, i.e. t_ithus producing many shared secrets ss(t_i). In this instance, the card will send with its certificate the index i so that the terminal may extract the appropriate t_ito compute its shared secret as shown in step 226 FIG. 2.

[0028] In the above examples, the shared secret ss=t_Cwas for an elliptic curve implementation. For a finite field implementation, the shared secret may be calculated as ss=C^T. Furthermore a more generalized form of the shared secret is a function combining the values of the terminals private key t and the cards public key C using a cryptographic function 𝑓₁(t, C).

[0029] While the invention has been described in connection with the specific embodiment thereof, and in a specific use various modifications thereof will occur to those skilled in the art without departing from the spirit of the invention as set forth in the appended claims. In general, this invention has application to situations where authenticated access to goods and services are required or where entry is to be controlled.

[0030] The terms and expressions which have been employed in this specification are used as terms of description and not of limitations, there is no intention in the use of such terms and expressions to exclude any equivalence of the features shown and described or portions thereof, but it is recognized that various modifications are possible within the scope of the claims to the invention.