METHOD FOR IMPLEMENTING ENCRYPTED CLIENT-SERVER COMMUNICATION

• US 20170180126A1
• Filed: 12/16/2016
• Published: 06/22/2017
• Est. Priority Date: 12/17/2015
• Status: Active Grant

• Current Assignee: Volkswagen AG
• Original Assignee: Volkswagen AG
• Inventors: TSCHACHE, Alexander, WINKELVOS, Timo
• Granted Patent: US 10,511,439 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 2209/84 Vehicles
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0838 Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these network architectures or network communication protocols for key exchange in a packet data network H04L63/061
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/32 including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials

Abstract

A method for implementing an encrypted client-server communication, wherein the server includes an entry point, service systems behind the entry point, and a secure system. The method includes incorporating common cryptographic material into the client and into the secure system, deriving key material from the common cryptographic material in the client for an encrypted communication between the client and a service system, deriving key material from the common cryptographic material in the secure system for an encrypted communication between the client and a service system, and transferring the key material into the service system or retaining the key material in the secure system.

Claims

1. A method for implementing an encrypted client-server communication, wherein the server comprises an entry point, a plurality of service systems disposed behind the entry point, and a secure system, the method comprising:

incorporating common cryptographic material into the client and into the secure system;

deriving key material from the common cryptographic material in the client for an encrypted communication between the client and a service system;

deriving key material from the common cryptographic material in the secure system for an encrypted communication between the client and a service system; and

transferring the key material into the service system or retaining the key material in the secure system.

2. The method of claim 1, wherein the common cryptographic material is a symmetric key or an asymmetric key pair.

3. The method of claim 1, wherein the key material is applied in the client and in the service system or the secure system to data that are to be transmitted.

4. The method of claim 1, wherein the client and the entry point reciprocally authenticate one another via asymmetric keys.

5. The method of claim 1, wherein a further entry point for the client is provided in the client and the following operations are carried out for systems of the client provided behind the further entry point:

incorporating common cryptographic material into the systems of the client and into the secure system;

deriving key material from the common cryptographic material in the systems of the client for an encrypted communication between the respective system of the client and a service system.

6. A client-server system, wherein the server comprises an entry point, a plurality of service systems disposed behind the entry point, and a secure system, wherein common cryptographic material is provided in the client and in the secure system, that key material derived from the common cryptographic material is provided in the client for an encrypted communication between the client and a service system, and that key material derived from the common cryptographic material is provided in the service systems for an encrypted communication between the client and the respective service system.

7. The client-server system of claim 6, wherein the common cryptographic material is a symmetric key or an asymmetric encryption.

8. The client-server system of claim 6, wherein a further entry point for the client is provided in the client and that systems of the client are provided behind the further entry point, that common cryptographic material is provided in the systems of the client and in the secure system, and that key material derived from the common cryptographic material is provided in the systems of the client for an encrypted communication between the respective system and a service system.

9. The client-server system of claim 6, wherein the client is a vehicle and that the server is a backend of a manufacturer of the vehicle and/or of a service provider.

10. The client-server system of claim 8, wherein the systems of the client are control units.

11. The client-server system of claim 8, wherein the further entry point is an online control unit.