Hardware cryptographic authentication

• US 9,917,821 B2
• Filed: 12/29/2015
• Issued: 03/13/2018
• Est. Priority Date: 12/29/2015
• Status: Active Grant

• Current Assignee: Itron, Inc.
• Original Assignee: Itron, Inc.
• Inventors: Gillmore, Matthew Keith, Otting, James Marcus
• Primary Examiner(s): ZAIDI, SYED A
• Application Number:
  US14/983,274
• Publication Number:
  US 20170187699A1
• Time in Patent Office: 805 Days
• Field of Search: 713171
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/067 using one-time keys cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 12/06 Authentication

Abstract

An example method of establishing an authenticated session between two communicating devices includes establishing, by a first processor of a first device, a secure connection with a second device over the network using a communications protocol; receiving, by the first processor, an identity authentication request from the second device; passing, by the first processor, the identity authentication request to a second processor located on an authentication chip of the first device; generating, by the second processor using one or more authentication code functions stored on the authentication chip, one or more authentication codes using a unique serial number of the first device and an authentication key, both stored on the authentication chip; providing, by the second processor, the one or more generated authentication codes to the first processor; and sending, by the first processor, a response to the second device that includes the one or more generated authentication codes.

Claims

1. A device capable of communications with one or more other devices via a communications network, the device comprising:

a first processor;

a communication system for two-way communications with the one or more other devices on the network, the communication system communicably connected with the first processor; and

an authentication chip communicatively connectable with the first processor and the communication system, the authentication chip having;

a second processor; and

a memory communicably connected to the second processor for storing

a unique serial number for the device,

a key, wherein the key is to be written once and never read by the first processor, and

one or more authentication code functions,

wherein the first processor is configured to, after a secure data transport session is established between the device and an other device of the one or more devices that attempts to communicate with the device over the network, receive an authentication request from the other device and pass the authentication request to the second processor; and

wherein the second processor is configured to, in response to the authentication request,

execute one or more of the authentication code functions to generate one or more authentication codes using the unique serial number of the device and the key; and

provide the one or more generated authentication codes to the first processor to be provided in a response to the other device over the network.

2. The device of claim 1, wherein the authentication request includes a challenge, and the one or more generated authentication codes include a challenge response.

3. The device of claim 1, wherein the second processor is further configured to:

generate a challenge for the other device to request authentication of an identity of the other device;

provide the generated challenge to the first processor;

receive a challenge response from the first processor, the challenge response received by the first processor from the other device; and

process the challenge response using the one or more authentication code functions and the key,

wherein authentication is successful if the challenge response is correct and is determined to have used a key in accordance with the key of the authentication chip.

4. The device of claim 1, wherein the authentication chip is embodied in a hardware dongle.

5. The device of claim 1, wherein the key is initially blank and subsequently written to the authentication chip by a user.

6. The device of claim 1, wherein the one or more authentication codes further include sub-device identification to indicate different applications or different users that share the device.

7. The device of claim 6, wherein a different communication session is established with the other device for each application or user of the device having a different sub-device identification.

8. A method of establishing a secure and authenticated connection between two devices in communication via a network, the method comprising:

establishing, by a first processor of a first device, a secure connection with a second device over the network using a communications protocol;

receiving, by the first processor, an identity authentication request from the second device;

passing, by the first processor, the identity authentication request to a second processor located on an authentication chip of the first device;

generating, by the second processor using one or more authentication code functions stored on the authentication chip, one or more authentication codes using a unique serial number of the first device and an authentication key, the unique serial number and the authentication key both stored on the authentication chip;

providing, by the second processor, the one or more generated authentication codes to the first processor; and

sending, by the first processor, a response to the second device that includes the one or more generated authentication codes.

9. The method of claim 8, wherein the identity authentication request includes a challenge, and the one or more generated authentication codes include a challenge response.

10. The method of claim 8, further comprising:

generating, by the second processor, a challenge for the second device, to request authentication of an identity of the second device;

providing the generated challenge to the first processor;

receive, by the first processor, a challenge response from the second device;

provide, by the first processor, the challenge response to the second processor; and

process, by the second processor, the challenge response using the one or more authentication code functions and the authentication key,

wherein authentication of the identity of the second device is successful if the challenge response is correct and is determined to have used a key in accordance with the authentication key of the authentication chip.

11. The method of claim 8, wherein the one or more authentication codes further include sub-device identification to indicate different applications or different users that share the first device.

12. The method of claim 11, wherein a different communication session is established with the second device for each application or user of the first device having a different sub-device identification.

13. At least one non-transitory computer-readable medium having computer program logic stored thereon, the computer program logic including instructions to cause processors of a first device to:

establish, by a first processor, a secure connection with a second device over a network using a communications protocol;

receive, by the first processor, an identity authentication request from the second device;

pass, by the first processor, the identity authentication request to a second processor located on an authentication chip of the first device;

generate, by the second processor using one or more authentication code functions stored on the authentication chip, one or more authentication codes using a unique serial number of the first device and an authentication key, the unique serial number and the authentication key both stored on the authentication chip;

provide, by the second processor, the one or more generated authentication codes to the first processor; and

send, by the first processor, a response to the second device that includes the one or more generated authentication codes.

14. The at least one computer readable medium of claim 13, wherein the identity authentication request includes a challenge, and the one or more generated authentication codes include a challenge response.

15. The at least one computer readable medium of claim 13, wherein the instructions further include instructions to cause the processors to:

generate, by the second processor, a challenge for the second device, to request authentication of an identity of the second device;

provide the generated challenge to the first processor;

receive, by the first processor, a challenge response from the second device;

provide, by the first processor, the challenge response to the second processor; and

process, by the second processor, the challenge response using the one or more authentication code functions and the authentication key,

wherein authentication of the identity of the second device is successful if the challenge response is correct and is determined to have used a key in accordance with the authentication key of the authentication chip.

16. The at least one computer readable medium of claim 13, wherein the one or more authentication codes further include sub-device identification to indicate different applications or different users that share the first device.

17. The at least one computer readable medium of claim 15, wherein a different communication session is established with the second device for each application or user of the first device having a different sub-device identification.

18. An authentication chip of a device capable of communications with other devices on a network, the authentication chip comprising:

an authentication processor; and

a memory communicably connected to the authentication processor for storing

a unique serial number for the device,

a key, wherein the key is to be written once and never read by a main processor of the device, and

one or more authentication code functions,

wherein the authentication processor is configured to;

receive an authentication request from a main processor of the device, the authentication request received by the main processor from an other device on the network after a secure data transport session was established between the device and the other device;

execute the one or more authentication code functions to generate one or more authentication codes, in response to the authentication request, using the unique serial number and the key; and

provide the one or more generated authentication codes to the main processor to be provided in a response to the other device over the network.

19. The authentication chip of claim 18, wherein the authentication request includes a challenge, and the one or more generated authentication codes include a challenge response.

20. The authentication chip of claim 18, wherein the authentication processor is further configured to:

generate a challenge for the other device to request authentication of an identity of the other device;

provide the generated challenge to the main processor;

receive a challenge response from the main processor, the challenge response received by the main processor from the other device; and

process the challenge response using the one or more authentication code functions and the key,

wherein authentication is successful if the challenge response is correct and is determined to have used a key in accordance with the key of the authentication chip.

21. The authentication chip of claim 18, wherein the authentication chip is embodied in a hardware dongle.

22. The authentication chip of claim 18, wherein the key is initially blank and subsequently written to the authentication chip by a user.

23. The authentication chip of claim 18, wherein the one or more authentication codes further include sub-device identification to indicate different applications or different users that share the device.

24. The authentication chip of claim 23, wherein a different communication session is established with the other device for each application or user of the device having a different sub-device identification.