Communicating a secret

• US 9,306,742 B1
• Filed: 02/05/2013
• Issued: 04/05/2016
• Est. Priority Date: 02/05/2013
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Folkmanis, Girts, Heninwolf, Paul
• Primary Examiner(s): Le, Chau
• Assistant Examiner(s): Chaudhry, Muhammad
• Application Number:
  US13/759,267
• Time in Patent Office: 1,155 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords

Abstract

A first portion of a cryptographic key can be conveyed through a secure channel to a device that can interact with a home network. After the first portion is received, a prompt can be sent by the recipient of the portion through a non-secure channel to the sender of the portion to send a second portion of the key. The cryptographic key can be constituted from the received portions and used by the device to secure communications with home network.

Claims

1. A computer-implemented method for providing a cryptographic key having a plurality of portions, comprising:

sending a first portion of the cryptographic key over a secure channel, from a first home automation device in a home automation network, to a second device distinct from the first device,

wherein the sending of the first portion of the cryptographic key from the first device to the second device comprises displaying the first portion to a user through a limited output display of the first device, to allow the user to enter the first portion into the second device through a keypad of the second device;

clearing the display after displaying the first portion of the cryptographic key;

receiving over a non-secure channel, by the first device from a third device different than the second device, a command to provide a second portion of the cryptographic key;

sending over the secure channel, from the first device to the second device, the second portion of the cryptographic key,

wherein the sending of the second portion from the first device to the second device comprises displaying the second portion to the user through the display, to allow the user to enter the second portion into the second device through the keypad; and

determining that all of the plurality of portions of the cryptographic key have been sent.

2. The method of claim 1, further comprising generating the cryptographic key.

3. A computer-implemented method for receiving a cryptographic key having a plurality of portions, comprising:

receiving, through a secure channel, a first portion of the cryptographic key from a first home automation device in a home automation network, wherein the receiving of the first portion comprises receiving the first portion at a second device, distinct from the first device, through a user-operated keypad of the second device after the first portion has been displayed to the user on a limited output display of the first device;

storing, by a computing device, the first portion of the cryptographic key in a computer-readable storage;

receiving a second portion of the cryptographic key at least partially through the secure channel,

wherein the receiving of the second portion comprises receiving the second portion through the keypad from the user, after the second portion has been displayed to the user;

combining the second portion of the cryptographic key with the first portion of the cryptographic key;

sending, by the computing device, over a non-secure channel, a command to display over the secure channel a third portion of the cryptographic key;

sending, over the non-secure channel, an indication that all of the cryptographic key has been received; and

sending over the non-secure channel a command to clear the display.

4. The method of claim 3, further comprising initializing a cryptographic key store to zero.

5. The method of claim 3, wherein the combining the second portion of the cryptographic key with the first portion of the cryptographic key comprises appending the second portion of the cryptographic key to the first portion of the cryptographic key.

6. A system comprising:

in a home automation device in a home automation network, a memory for storing a cryptographic key having a plurality of portions; and

a processor connected to the memory, the processor configured to;

send over a secure channel, to a first remote device distinct from the home automation device, a first portion of the cryptographic key,

wherein the sending of the first portion of the cryptographic key to the first remote device comprises displaying the first portion to a user through a limited output display of the home automation device, to allow the user to enter the first portion into a keypad of the first remote device;

clear the display after displaying the first portion of the cryptographic key;

receive, over a non-secure channel from a second remote device, a command to display a second portion of the cryptographic key;

send over the secure channel the second portion of the cryptographic key,

wherein the sending of the second portion comprises displaying the second portion to the user to allow the user to enter the second portion into the first remote device through the keypad; and

determine that all of the plurality of the portions of the cryptographic key have been displayed.

7. The system of claim 6, further comprising a display, the processor further configured to send the first portion of the cryptographic key by showing the first portion on the display.

8. A system, comprising:

in a remote device, a memory configured to store portions of a cryptographic key;

a processor connected to the memory, the processor configured to;

receive a first portion of the cryptographic key through a secure channel from a home automation device, distinct from the remote device, in a home automation network,

wherein the receiving of the first portion comprises receiving the first portion through a user-operated keypad of the remote device, after the first portion has been displayed to the user on a limited output display of the home automation device;

store the first portion of the cryptographic key;

receive a second portion of the cryptographic key through the secure channel, wherein the receiving of the second portion comprises receiving the second portion through the keypad from the user after the second portion has been displayed to the user;

combine the second portion of the cryptographic key with the first portion of the cryptographic key;

send over a non-secure channel a command to display over the secure channel a third portion of the cryptographic key;

determine that all of the plurality of portions of the cryptographic key have been received; and

send over the non-secure channel a command to clear the display.

9. The system of claim 8, the processor further configured to combine the second portion of the cryptographic key with the first portion of the cryptographic key by appending the second portion of the cryptographic key to the first portion of the cryptographic key.