Use of static Diffie-Hellman key with IPSec for authentication

Abstract

Embodiments of the invention authenticate devices and establish secure connections between devices using static Diffie-Hellman key pairs. A first device obtains in a trusted manner a static DH public key of a second device prior to negotiation. The second device negotiates a secure connection to the first device using a shared secret created from the static DH public key, which serves as both a claim on the second device's identity and an encryption key. The static DH public key can be used to establish subsequent secure, authenticated communications sessions.

Description

CROSS-REFERENCE TO RELATED APPLICATION [0001] The present application claims the benefit of Abraham et al., U.S. Provisional Patent Application No. 60 / 534,795 entitled, “Configuring Network Settings Using Portable Media”, filed on Jan. 7, 2004, which is hereby incorporated by reference in its entirety.FIELD OF THE INVENTION [0002] This invention generally relates to the area of computer systems. More particularly, the present invention concerns methods for facilitating the use of a security protocol to protect network communications, and even more particularly to methods for negotiating security parameters and authenticating users interconnected to a network. BACKGROUND OF THE INVENTION [0003] Computer networks provide an efficient way to exchange information between two or more computers. Various types of computer networks are utilized including private networks, e.g., local area networks (LANs), and public networks, e.g., the Internet. Often, the information exchanged between comp...

AI Technical Summary

Benefits of technology

[0013] In still another embodiment, a system is provided for establishing a secure communications channel between networked devices comprising a first networked device generating a Diffie-Hellman (DH) key pair, a portable media device storing the DH key pair generated by the first networked device, a second networked device reading the DH key pair from the portab

Problems solved by technology

Often, the information exchanged between computers is of a sensitive or confidential nature.

Similarly, users routinely transmit sensitive and confidential business information over networks.

IP was designed to allow for an open exchange of information; however, standard IP was not designed to protect information from unauthorized access.

Accordingly, standard IP does not prevent an unauthorized user from receiving, viewing, and even modifying information transmitted over a network.

Standard IP lacks other features such as authentication of users and network devices.

Images