Systems and methods for generating symmetric cryptographic keys

• US 10,291,403 B2
• Filed: 07/09/2018
• Issued: 05/14/2019
• Est. Priority Date: 07/07/2017
• Status: Active Grant

• Current Assignee: University of South Florida (State University System of Florida)
• Original Assignee: University of South Florida (State University System of Florida)
• Inventors: Ligatti, Jay, Cetin, Cagri, Engram, Shamaria, Goldgof, Dmitry
• Primary Examiner(s): Giddins, Nelson
• Application Number:
  US16/030,550
• Publication Number:
  US 20190013941A1
• Time in Patent Office: 309 Days
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0827 involving distinctive intermediate devices or communication paths network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/0872 using geo-location information, e.g. location data, time, relative position or proximity to other entities
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

A system for generating symmetric cryptographic keys for communications between hosts. Hosts use associated devices to generate secret keys. Each key is generated based on a static seed and a dynamic seed. The dynamic seed is created from sensor data or auxiliary data. The secret key allows host machines to encrypt, or decrypt, plaintext messages sent to, or received from, other host machines.

Claims

1. A system for generating symmetric cryptographic keys and for decrypting messages, the system comprising:

a first host machine; and

a first device in communication with the first host machine, the first device configured to

receive a message from the first host machine indicating an intent to communicate with a second host machine,

generate a secret key based on a static seed and a dynamic seed, the dynamic seed created from sensor data or auxiliary data,

encrypt an identifier for the first host machine, or the first device, using the static seed, to generate an encrypted identifier message, and

transmit the encrypted identifier message and the secret key to the first host machine, the first host machine configured to encrypt a plaintext message using the secret key and transmit the encrypted identifier message and the encrypted plaintext message to the second host machine,

a second device in communication with the second host machine, the second device configured to

receive an encrypted identifier message from the second host machine, the encrypted identifier message transmitted by the first host machine to the second host machine,

decrypt the encrypted identifier message using the static seed used by the first host machine,

derive the secret key using the static seed and a dynamic seed, the dynamic seed created from sensor data or the auxiliary data obtained by the decryption of the encrypted identifier message, and

transmit the secret key to the second host machine, the second host machine configured to decrypt the plaintext message encrypted by the first host machine using the secret key.

2. The system of claim 1, wherein the auxiliary data is configured to allow a variable number of data elements and a variable range of values for each data element, and the combination of the number of data elements and range of data values produce a variable range of entropy for the auxiliary data.

3. The system of claim 1, wherein the dynamic seed is based on a combination of auxiliary data and sensor data only available to the first device generating the secret key and the secret key is used by the first host machine to encrypt and decrypt data stored on the first host machine.

4. The system of claim 1, wherein the first device is removably coupled to the first host machine.

5. The system of claim 1 wherein the first device is further configured to generate a message authentication code of an identifier for the first host machine, or its associated device, using the secret key, and include this message authentication code in its encrypted identifier message.

6. The system of claim 1 wherein the first host machine is configured to send the first device auxiliary data used to generate the dynamic seed.

7. The system of claim 1, wherein the second device is removably coupled to the second host machine.

8. The system of claim 1, wherein the static seed is identified by decrypting the encrypted identifier message with a plurality of static seeds to produce a message matching the form of a decrypted identifier message.

9. The system of claim 1, wherein the second device is further configured to

receive an encrypted identifier message encrypted by the system of claim 5,

decrypt the encrypted identifier message using the static seed used by the first host machine,

identify a plurality of dynamic seeds using a plurality of values for sensor data or using a plurality of values for sensor data combined with the auxiliary data obtained by the decryption of the encrypted identifier message, and

identify a correct dynamic seed from the plurality of dynamic seeds that, when input with the static seed to a key generation function, produces a key that generates a message authentication code that matches the message authentication code included in the encrypted identifier message.