Secure key distribution with general purpose mobile device

• US 8,688,987 B2
• Filed: 07/30/2012
• Issued: 04/01/2014
• Est. Priority Date: 07/30/2012
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Kirk, James Christopher, Olive, Michael L., Toth, Louis T.
• Primary Examiner(s): LEMMA, SAMSON B
• Application Number:
  US13/561,372
• Publication Number:
  US 20140032903A1
• Time in Patent Office: 610 Days
• Field of Search: 713/168, 713/171, 713182-183, 713/186, 380277-278, 380/282, 726/6
• US Class Current: 713/171
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

One embodiment is directed to a method for managing cryptographic information. The method includes initiating cryptographic information loading application on a general purpose mobile device (GPMD) and establishing a connection between the GPMD and a server that includes cryptographic information. Authentication input is received from a user of the GPMD. Data identifying the GPMD and the authentication input is sent from the GPMD to the server for authentication of the GPMD and the user. The GPMD also sends data identifying an electronic device into which cryptographic information is to be loaded. In response, the GPMD receives cryptographic information for the electronic device at the GPMD from the server. The GPMD then sends the cryptographic information from the GPMD to the electronic device for loading therein.

Claims

1. A method for managing cryptographic information, the method comprising:

initiating a cryptographic information loading application by one or more processing devices on a general purpose mobile device (GPMD);

establishing a connection between the GPMD and a server that includes cryptographic information;

receiving an authentication input from a user of the GPMD;

sending data identifying the GPMD and the authentication input from the GPMD to the server for authentication of the GPMD and the user;

sending data identifying an electronic device into which cryptographic information is to be loaded, wherein the electronic device is an avionic device;

receiving the cryptographic information for the electronic device at the GPMD from the server; and

sending the cryptographic information from the GPMD to the electronic device for loading therein.

2. The method of claim 1, wherein receiving an authentication input from a user includes receiving a password or biometric data.

3. The method of claim 1, wherein sending data identifying the GPMD includes sending one or more of a serial number and a SIM card number for the GPMD;

authenticating the GPMD based on the data identifying the GPMD.

4. The method of claim 3, wherein sending data identifying the GPMD includes sending a location of the GPMD from the GPMD to the server;

at the server, authenticating the GPMD based on comparing the location to an expected location.

5. The method of claim 1, wherein sending data identifying an electronic device includes sending an aircraft identifier of an aircraft with which the avionic device is associated.

6. The method of claim 5, comprising:

securing messages at the avionic device based on the cryptographic information; and

sending the secured messages over an avionic datalink.

7. The method of claim 1, wherein receiving the cryptographic information includes receiving a wrapped version of the cryptographic information via a first path, the method further comprising:

receiving an unwrapping code for the cryptographic information via a second path that is distinct from the first path.

8. The method of claim 7, comprising:

wherein the cryptographic information is received via one of browser of the GPMD or an email address associated with the GPMD; and

wherein the unwrapping code is received at the GPMD via one of email, text, or a voice channel.

9. A non-transitory computer readable medium comprising:

instructions that are configured to be executed on a general purpose mobile device (GPMD), the instructions, when executed by the GPMD, cause the GPMD to;

initiate cryptographic information loading application on a general purpose mobile device (GPMD);

establish a connection between the GPMD and a server that includes cryptographic information;

receive an authentication input from a user of the GPMD;

send data identifying the GPMD and the authentication input from the GPMD to the server for authentication of the GPMD;

send data identifying an electronic device into which cryptographic information is to be loaded, wherein the electronic device is an avionic device;

receive the cryptographic information for the electronic device at the GPMD from the server; and

send the cryptographic information from the GPMD to the electronic device for loading therein.

10. The computer readable medium of claim 9, wherein receiving an authentication input from a user includes receiving a password or biometric data.

11. The computer readable medium of claim 9, wherein send data identifying the GPMD includes send one or more of a serial number and a SIM card number for the GPMD.

12. The computer readable medium of claim 9, wherein send data identifying an electronic device includes send an aircraft identifier of an aircraft with which the avionic device is associated.

13. The computer readable medium of claim 9, wherein receiving the cryptographic information includes receiving a wrapped version of the cryptographic information, and wherein the instructions cause the GPMD to:

receive an unwrapping code for the cryptographic information from a user; and

unwrap the wrapped version of the cryptographic information based on the unwrapping code.

14. A system for cryptographic information distribution, the system comprising:

a key distribution server including cryptographic information and a list of authorized general purpose mobile devices (GPMDs); and

a GPMD having cryptographic information loading application installed thereon, wherein the key loading application is configured to;

receive an authentication input from a user;

send data identifying the GPMD and the authentication input to the key distribution server;

send data identifying an electronic device into which cryptographic information is to be loaded, wherein the electronic device is an avionic device;

receive the cryptographic information for the electronic device from the key management server; and

send the cryptographic information to the electronic device for loading therein.

15. The system of claim 14, wherein receive an input from a user includes receive a password or biometric data.

16. The system of claim 14, wherein send data identifying the GPMD includes send one or more of a serial number and a SIM card number for the GPMD;

and

wherein the key distribution server is configured to compare the data identifying the GPMD with the list of authorized GPMDs to authenticate the GPMD.

17. The system of claim 14, wherein send data identifying the electronic device includes send an aircraft identification number of an aircraft with which the avionic device is associated.

18. The system of claim 17, wherein the avionic device is configured to:

secure messages device based on the cryptographic information; and

send the secured messages over an avionic datalink.

19. The system of claim 14, wherein receive the cryptographic information includes receive a wrapped version of the cryptographic information via a first path, and wherein the instructions further cause the GPMD to:

receive an unwrapping code for the cryptographic information via a second path that is distinct from the first path.

20. The system of claim 19, wherein the key distribution server is configured to send the cryptographic information via one of browser of the GPMD or an email address associated with the GPMD;

and

send the unwrapping code to the GPMD via one of email, text, or a voice channel.