KEY PROVISIONING

• US 20200134212A1
• Filed: 10/31/2018
• Published: 04/30/2020
• Est. Priority Date: 10/31/2018
• Status: Active Grant

• Current Assignee: L3 Technologies, Inc. (L3Harris Technologies, Inc.)
• Original Assignee: L3 Technologies, Inc. (L3Harris Technologies, Inc.)
• Inventors: Hutchison, Jerry, Ditzman, Todd
• Granted Patent: US 11,093,627 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 9/30007 to perform operations on data operands
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/0662 with particular pseudorandom sequence generator
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes

Abstract

A device receives a first data item. The device stores the first data item in non-volatile memory. The device subsequently receives a second data item, where the second data item was previously generated from the first data item and a cryptographic key. The device performs a function such as, for example, an exclusive-or operation on the first data item and the second data item to generate the cryptographic key. The device uses the generated cryptographic key to encrypt data which may be transmitted over a wireless interface.

Claims

1. A device comprising executable instructions that when executed cause the device to perform operations comprising:

receiving, by a device, a first data item;

storing, by the device, the first data item in nonvolatile memory;

receiving, by the device, a second data item, the second data item generated by performing a splitting operation on a cryptographic key using the first data item;

generating, by the device, the cryptographic key by performing a combining operation on the first data item and the second data item;

storing, by the device, the cryptographic key in volatile memory; and

performing one or more of encryption or decryption of data, by the device, using the cryptographic key.

2. The device of claim 1, wherein the received first data item was generated from an irreversible function performed on a concatenation of an admin key and an identifier.

3. The device of claim 2, wherein the identifier is associated with the device.

4. The device of claim 2, wherein the identifier is associated with a group of devices.

5. The device of claim 4, wherein the admin key is associated with device.

6. The device of claim 2, wherein the irreversible function is a hash function

7. The device of claim 1, wherein the first data item is a random number.

8. The device of claim 1, wherein the second data item generated by performing a splitting operation on a cryptographic key using the first data item was generated by performing an exclusive or operation on the first data item and the cryptographic key.

9. The device of claim 1, wherein generating the cryptographic key by performing a combining operation on the first data item and the second data item comprises performing an exclusive or operation the first data item and the second data item.

10. The device of claim 1, wherein the device is a sonobuoy.

20. The method of claim 19, 1 wherein determining a first data item associated with a device comprises generating the first data item from an admin key and an identifier associated with the device.

11. A device comprising executable instruction that when executed cause the device to perform operations comprising:

receiving, by the device, a first data item;

receiving, by the device, a second data item;

generating, by the device, a cryptographic key from the first data item and the second data item, the cryptographic key being generated by the device without being received by the device over an interface.

12. The device of claim 11, wherein generating a cryptographic key from the first data item and the second data item comprises performing an exclusive or operation on the first data item and the second data item.

13. A system comprising executable instructions that when executed cause the system to perform operations comprising:

determining, by a system, a first data item associated with a device;

determining, by the system, a cryptographic key;

generating, by the system, a second data item by performing a splitting operation on the cryptographic key using the first data item; and

transmitting, by the system, the second data item to the device.

14. The system of claim 13, wherein the first data item associated with a device is associated with a plurality of devices.

15. The system of claim 13, wherein determining a first data item associated with a device comprises retrieving the first data item from a database based at least in part on an identifier associated with the first data item.

16. The system of claim 13, wherein determining a first data item associated with a device comprises generating the first data item from an admin key and an identifier associated with the device.

17. The system of claim 13, wherein determining a cryptographic key comprises determining a cryptographic key adapted for encrypting data for communication with the device.

18. The system of claim 13, wherein generating a second data item by performing a splitting operation on they cryptographic key using the first data item comprises performing an exclusive or operation on the first data item and the cryptographic key.

19. A method, comprising:

determining, by a system, a first data item associated with a device;

determining, by the system, a cryptographic key;

generating, by the system, a second data item by performing an exclusive or operation on the first data item and the cryptographic key; and

transmitting, by the system, the second data item to the first device.