[go: up one dir, main page]

WO2003001733A1 - Cryptage en cascade selectionne pour communication et transactions - Google Patents

Cryptage en cascade selectionne pour communication et transactions Download PDF

Info

Publication number
WO2003001733A1
WO2003001733A1 PCT/ZA2002/000076 ZA0200076W WO03001733A1 WO 2003001733 A1 WO2003001733 A1 WO 2003001733A1 ZA 0200076 W ZA0200076 W ZA 0200076W WO 03001733 A1 WO03001733 A1 WO 03001733A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
encryption
application
security
parties
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/ZA2002/000076
Other languages
English (en)
Inventor
Valentin Kisimov
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Individual
Original Assignee
Individual
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Individual filed Critical Individual
Publication of WO2003001733A1 publication Critical patent/WO2003001733A1/fr
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0478—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/045—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption

Definitions

  • This invention relates to security systems for digital communications and transactions particularly, though not exclusively for financial transactions conducted over a public network, such as the Internet.
  • Digital financial transactions are known, such as ordering and paying for products over the Internet, paying suppliers using credit or debit cards, transferring money between accounts, etc.
  • Security protocols such as SSL, are implemented in certain transactions, such as banking transactions over the Internet, but these protocols are of a relatively low level.
  • In other transactions notably credit card payments, no special security measures are used and there is no authentication of the card and a transaction other than a check through the credit card issuer's "hot file". These checks are limited, because further checks on account balances, authorisation of payment, etc. are non-trivial i.e. involve considerable time/computational power.
  • smart devices can be used for increasing security and authentication for transactions over public networks.
  • the term “smart devices” means smart cards, SIM cards or other secure integrated circuits - chips in pervasive computing devices and like that include a processor, nonvolatile memory (e.g. Rom, EEPROM, mini-disk), optional volatile memory (RAM), and an operating system, that can store and process data.
  • Smart devices while being capable of being used for more functions and on a wider scale, ace currently used to a limited extend for identification, authorisation and storing information.
  • Security algorithms provide security protocols, where the security protocol is an established communication with a dialog between the communicating parties, using one or more security algorithm.
  • the major security algorithms are symmetrical or asymmetrical.
  • a symmetrical encryption algorithm such as 3DES and Blowfish, uses the same encryption key for sender and receiver of a message.
  • An asymmetrical encryption algorithm e.g. RSA, uses public and private keys where for each security operation the sender and receiver use different keys.
  • RSA e.g. RSA
  • This invention seeks to provide a security method, using cascaded encryption from unbreakable algorithms, applicable selectively, depending of the content of the message, the content of its data portions and the defined business rules established for the message portions and/or for the entire message.
  • One aspect of the invention provides a method for creating suitable high security protocols for transmission of messages between two parties communicating over a public network, such as the Internet, using a base communication protocol, including the steps of:
  • the base communication protocol may be any accepted communication protocol, such as TCP/IP, though preferable it is a secure protocol, such as SSL or another accepted security protocol, which provides a first low level of security.
  • the conditions for implementation of different encryption algorithms on the message portions may be selected from any desired criteria, such as value of money coded in a message portion, importance of the data concerned with the message, nature of the transaction concerned with the message and the like. Examples are: message concerned stock and bond trades, account payments and inter account transfers; message portions as card/account/PLN numbers, passwords and so on. For instance, in a stock trade instruction the stock symbol of shares may be encrypted with one application level security algorithm, while the prices and number of shares may be encrypted with another application level security algorithm.
  • the method may also apply selected further cascaded encryption levels to the message when other predetermined conditions have been fulfilled.
  • the applied cascaded application encryption algorithms define a chain of application level security algorithms, used in the security protocol.
  • the encryption mechanism of the base communication protocol if any, can be accepted as zero level of the cascading encryption.
  • the other application level encryption algorithms add additional levels in the cascaded encryption.
  • the preferred minimum level of application cascading is at least two - zero level and first level, including at least one application level cascading encryption.
  • the first cascaded application level security in the security protocol may use symmetrical or asymmetrical algorithms as desired.
  • the use of symmetrical encryption algorithms is preferred based on their relatively quicker performance.
  • asymmetrical algorithms are able to add higher level of security features, such as non-repudiation, digital signature etc.
  • at least when there are three application cascading security levels, one of them is symmetrical and another is asymmetrical.
  • the application level encryption is based on the concatenation of selected portions of two numbers, one of which is generated by one of the parties and the other is generated by the other of the parties to a communication.
  • the keys for the selected cascading protocols differ from one another, if same types of security algorithms are used in the cascaded path of algorithms.
  • the application level encryptions are performed using keys and functions allocated only in a smart device and in the communication partner - the secure server, without executing any security application encryption algorithms outside of these processors.
  • Figure 1 shows a system for achieving cascaded application encryption
  • Figure 2 shows a sub-system of the system of Figure 1 for creation an application level encryption symmetrical key.
  • Figures 1 and 2 illustrate a system for cascading transaction encryption that can be a few levels deep.
  • FIG. 1 shows an application architecture 10 comprising a base communication protocol 12, e.g. SSL, a first level application symmetrical transaction encryption 14 (e.g. 3DES), a second level asymmetrical encryption 16, a third application level symmetrical encryption 17, and plain data 18 that is to be encrypted and transmitted.
  • the level of security of the SSL encryption can be very low, but is sufficient to prevent causal observation of the content of transmitted messages.
  • Figure 2 illustrates an application structure 20 for creating a symmetrical key 32 for application level symmetrical encryption for data transmitted between a smart device - smart card 22 and a secure bank server 24.
  • the key 32 is created by: generating a random number RandNumbl in the smart card 22; generating another random number RandNumb2 in the bank server 24; defining the parts 26 and 28 of, respectively, RandNumbl and RandNumb2 to be concatenated; concatenating different parts of the random numbers 26 and 28; and generating a symmetrical key 32 that will be used as symmetrical application level encryption.
  • the parts of the random numbers participating in the concatenation vary in each concatenation process, depending of the transaction history between the sender and receiver or depending of some algorithm for dynamic concatenation.
  • the dynamics of the concatenation process adds another dependency and increases the level of security.
  • the concatenated values are dependent on: content of the previous transmitted message; rules in the smart card and in the bank server determining the specific smart card behaviour; historical and current conditions for initiation of the transaction; dependencies between the current and previous transactions; and so on.
  • the cascading transaction encryption is an encryption mechanism, the cascading depth of which depends of the value represented by the data to be transmitted and the type of the data.
  • the level of depth is selected for each data item in a message in accordance with the value of the item and the triggered condition for cascading encryption for that item.
  • the first application level cascading encryption in figure 1 (used over the zero level cascaded encryption provided by the base communication protocol) is a symmetrical encryption, such as 3DES or Blowfish, has a key that is different than the used in the base communication protocol and this key is created by concatenation of two random numbers as set out above.
  • the cascaded encryption level uses supporting encryption operations provided inside the customer's smart card and inside the bank server.
  • the second level application cascading encryption in figure 1 can be asymmetrical encryption, such as RSA, or a symmetrical encryption, executed inside the customer's smart card and inside the bank server.
  • the third level of application cascading encryption in figure 1 can be also symmetrical or asymmetrical encryption and it is executed inside the customer's smart card and inside the bank server.
  • a data item determined to warrant four levels of cascaded encryption can be encrypted by 3DES algorithm on a zero level - base communication protocol, after that by Blowfish algorithm on a first level, after that by RSA algorithm on a second level and after that 3DES algorithm on a third level.
  • the order of cascading the encryption algorithms is not predefined, but is preferably symmetrical, then asymmetrical, then symmetrical, or vice versa.
  • the depth of the cascading is not predefined.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

La présente invention concerne un procédé permettant de créer des protocoles de haute sécurité pour la transmission de messages entre deux parties communiquant via un réseau public, la sécurité s'adaptant dynamiquement au contenu. Au-dessus du protocole de communication de base utilisé pour l'échange de messages, il est possible de constituer un cryptage en cascade des applications, avec différents niveaux de sécurité et différents algorithmes de cryptage en liaison avec la mise en cascade. On utilise pour cela, avec le protocole de communication de base, d'une part un codage d'application, et d'autre part une interface de programmation d'application. Les différentes parties du message peuvent être cryptées chacune d'une façon différente, les différents cryptages venant en cascade selon des règles établies. Ces règles se choisissent sur la base de tous les critères semblant appropriés, et notamment la valeur de la partie du message, l'importance des données concernées par le message, la nature de la transaction. Pour chaque partie du message, on choisit une profondeur de la mise en cascade de sécurité, dans le respect de règles régissant l'application du cryptage selon le niveau applicable à une partie particulière du message.
PCT/ZA2002/000076 2001-06-26 2002-05-16 Cryptage en cascade selectionne pour communication et transactions Ceased WO2003001733A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
ZA2001/5247 2001-06-26
ZA200105247 2001-06-26

Publications (1)

Publication Number Publication Date
WO2003001733A1 true WO2003001733A1 (fr) 2003-01-03

Family

ID=25589214

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/ZA2002/000076 Ceased WO2003001733A1 (fr) 2001-06-26 2002-05-16 Cryptage en cascade selectionne pour communication et transactions

Country Status (1)

Country Link
WO (1) WO2003001733A1 (fr)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120210438A1 (en) * 2011-02-15 2012-08-16 Guobiao Zhang Secure Three-Dimensional Mask-Programmed Read-Only Memory
US20150317255A1 (en) * 2011-02-15 2015-11-05 Chengdu Haicun Ip Technology Llc Secure Printed Memory
CN116566714A (zh) * 2023-05-29 2023-08-08 深圳感臻智能股份有限公司 一种智能家居间的数据传输方法及系统

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5933501A (en) * 1996-08-01 1999-08-03 Harris Corporation `Virtual` encryption scheme combining different encryption operators into compound-encryption mechanism
WO2000077972A1 (fr) * 1999-06-11 2000-12-21 General Instrument Corporation Cryptage/decryptage pouvant etre configures pour support de services multiples

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5933501A (en) * 1996-08-01 1999-08-03 Harris Corporation `Virtual` encryption scheme combining different encryption operators into compound-encryption mechanism
WO2000077972A1 (fr) * 1999-06-11 2000-12-21 General Instrument Corporation Cryptage/decryptage pouvant etre configures pour support de services multiples

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120210438A1 (en) * 2011-02-15 2012-08-16 Guobiao Zhang Secure Three-Dimensional Mask-Programmed Read-Only Memory
US20130311790A1 (en) * 2011-02-15 2013-11-21 Chengdu Haicun Ip Technology Llc Secure Three-Dimensional Mask-Programmed Read-Only Memory
US20150317255A1 (en) * 2011-02-15 2015-11-05 Chengdu Haicun Ip Technology Llc Secure Printed Memory
US20170024330A1 (en) * 2011-02-15 2017-01-26 Chengdu Haicun Ip Technology Llc Secure Printed Memory
CN116566714A (zh) * 2023-05-29 2023-08-08 深圳感臻智能股份有限公司 一种智能家居间的数据传输方法及系统

Similar Documents

Publication Publication Date Title
CN1307818C (zh) 一种用于电子交易的密码系统和方法
CA2678101C (fr) Dispositif et procede d'authentification
US5956699A (en) System for secured credit card transactions on the internet
US6328217B1 (en) Integrated circuit card with application history list
CA2256009C (fr) Systeme et procede de protection de communications par cryptographie
US6182900B1 (en) Network-supported chip card transaction method
WO2019005968A1 (fr) Création de compte sécurisé
US20050138364A1 (en) Digital certificate proxy
CN110458545A (zh) 电子交易处理方法、服务器、交易终端和系统
Ward EMV card payments–An update
EP1791292B1 (fr) Personnalisation d'un circuit électronique
EP1791291A1 (fr) Personnalisation d'une carte bancaire pour d'autres applications
WO2003001733A1 (fr) Cryptage en cascade selectionne pour communication et transactions
Urien et al. A breakthrough for prepaid payment: End to end token exchange and management using secure SSL channels created by EAP-TLS smart cards
EP4002256A1 (fr) Traitement sécurisé de transactions de paiement
US20040107353A1 (en) Cryptographic method of protecting an electronic chip against fraud
JP2002170063A (ja) 電子価値取引システムおよび方法、電子価値取引端末装置、電子価値取引センタ装置
WO2007055675A1 (fr) Systeme et procede de paiement argent liquide
EP3113408B1 (fr) Procédé et système destinés à l'authentification
WO1998032260A1 (fr) Systeme de tables destine a une messagerie protegee
Hanáček Security of electronic money
EP0811282B1 (fr) Systeme et procede de transaction electronique
EP4672116A1 (fr) Procede pour effectuer une transaction de monnaie numerique
EP3145116B1 (fr) Procédé et système de communication de terminal à un élément sécurisé
KR20250159504A (ko) 다중 해싱을 이용한 보안 알고리즘이 적용된 오프라인 블록체인 거래방법 및 이를 이용한 오프라인 블록체인 전자결제 시스템

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NO NZ OM PH PL PT RO RU SD SE SG SI SK SL TJ TM TN TR TT TZ UA UG US UZ VN YU ZA ZM ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): GH GM KE LS MW MZ SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
REG Reference to national code

Ref country code: DE

Ref legal event code: 8642

122 Ep: pct application non-entry in european phase
NENP Non-entry into the national phase

Ref country code: JP

WWW Wipo information: withdrawn in national office

Country of ref document: JP