Physics-based key generation

• US 10,015,148 B2
• Filed: 03/05/2015
• Issued: 07/03/2018
• Est. Priority Date: 02/13/2013
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Heffner, Kenneth H.
• Primary Examiner(s): Armouche, Hadi S
• Assistant Examiner(s): Zarrineh, Shahriar
• Application Number:
  US14/639,733
• Publication Number:
  US 20150180841A1
• Time in Patent Office: 1,216 Days
• Field of Search: 380 44
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/0872 using geo-location information, e.g. location data, time, relative position or proximity to other entities
• CPC Class Codes: H04L 9/12 Transmitting and receiving encryption devices synchronised or initially set up in a particular manner
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy

Abstract

In some examples, a controller is configured to generate a key based on a physics-based output of a component. The controller may, for example, use the key to authenticate communication between at least two nodes, to encrypt data, or to decrypt data, may be generated based on a physics-based output generated a component. The output generated by the component may vary over time, such that the controller is configured to generate a different key, depending on the time at which the output from the component used to generate the key was generated by the component. In some examples, the key is not stored in a memory, and is a discrete signal that only exists in real-time while the component is active and generating the detectable output.

Claims

1. A method comprising:

receiving a first output generated by a first component of a first node, wherein the first output is based on a physical configuration of the first component, and wherein outputs generated by the first component vary over time;

generating, with a controller of the first node, a first key based on the first output;

encrypting, with the controller, a first data set with the first key;

transmitting the encrypted first data set to a second node, the second node comprising a second component configured to generate an output that is based on a physical configuration of the second component, wherein a first clock of the first node and a second clock of the second node are synchronized such that the first and second nodes are configured to generate time-matched keys based on outputs of the first and second components, respectively;

receiving a second output generated by the first component of the first node, wherein the second output is based on the physical configuration of the first component and is different than the first output;

generating, with the controller of the first node, a second key based on the second output;

encrypting, with the controller, a second data set with the second key; and

transmitting the encrypted second data set to the second node.

2. The method of claim 1, further comprising:

generating, by a circuit of the first node, a waveform or particle from the first output of the first component; and

converting the waveform or particle into a discrete signal, wherein generating the first key based on the first output of the first component comprises generating the first key based on the discrete signal.

3. The method of claim 1, further comprising controlling a stimulus source to apply a stimulus to the first component to cause the first component to generate the first output.

4. The method of claim 1, wherein the first output generated by the first component is generated at a first time, wherein the second output generated by the first component of the first node is generated at a second time, the method further comprising:

receiving a third data set from the second node at a third time within a predetermined time window of the second time; and

decrypting, with the controller, the received second data set with the second key.

5. The method of claim 1, wherein the controller comprises a first controller, and the first output generated by the first component is generated by the first component at a first time, the method further comprising:

receiving, by the second node, the encrypted first data set from the first node;

receiving, by a second controller of the second node, a third output generated by the second component at a second time, the second time being within a predetermined time window of the first time;

generating, with the second controller, a third key based on the third output generated by the second component at the second time; and

decrypting, with the second controller, the received encrypted first data set with the third key.

6. The method of claim 1, wherein generating the first key comprises:

generating a value based on the first output generated by the first component;

transforming the value with a transformation algorithm that results in a unique value; and

generating the first key based on the unique value.

7. The method of claim 1, wherein the first and second nodes are configured to generate the time-matched keys based on respective outputs of the first and second components, generated within a second of each other over a period of a month.

8. The method of claim 1, wherein the first clock and the second clock are synchronized to be within a nanosecond of each other over a period of a day.

9. A system comprising:

a first node comprising;

a communication module;

a first circuit including a first component configured to generate a first output at a first time and generate a second output at a second time, the second output being different than the first output, wherein the first component is a physical structure, wherein the first and second outputs are based on a physical configuration of the first component, and wherein outputs generated by the first component vary over time;

a first clock; and

a controller configured to generate a first key based on the first output generated by the first component, encrypt a first data set with the first key, and transmit the encrypted first data set to a second node via the communication module, the second node comprising a second circuit including a second component configured to generate an output that is based on a physical configuration of the second component, wherein the first clock of the first node and a second clock of the second node are synchronized such that the first and second nodes are configured to generate time-matched keys based on outputs of the first and second components, respectively, and

wherein the controller is configured to generate a second key based on the second output, encrypt a second data set with the second key, and transmit the encrypted second data set to the second node.

10. The system of claim 9, further comprising a stimulus circuit configured to apply a first stimulus to the first component to cause the first component to generate the first output and a second stimulus different than the first stimulus to the first component to cause the first component to generate the second output.

11. The system of claim 9, wherein the controller is configured to receive a third data set from the second node and decrypt the third data set with the second key.

12. The system of claim 9, wherein the first component comprises a plurality of components, and wherein the controller is configured to select a first subset of components of the plurality of components, wherein the first subset of components is configured to generate the first output, and wherein the controller is configured to select a second subset of components of the plurality of components, wherein second subset of components is configured to generate the second output.

13. The system of claim 9, wherein the communication module comprises a first communication module, and the controller comprises a first controller, the system further comprising:

the second node comprising;

a second communication module;

the second clock;

the second component; and

a second controller configured to generate a third key based on the output generated by the second component at a third time, the third time being within a predetermined window of time of the first time, the second controller being further configured to receive the encrypted first data set from the first node via the second communication module and decrypt the encrypted first data set using the third key.

14. The system of claim 13, wherein the first and second nodes are configured to generate the time-matched keys based on respective outputs of the first and second components generated within a second of each other over a period of a month.

15. The system of claim 13, wherein the first clock and the second clock are synchronized to be within a nanosecond of each other over a period of a day.

16. The system of claim 9, wherein the controller is configured to generate the first key by at least generating a value based on the first output generated by the first component, transforming the value with a transformation algorithm that results in a unique value, and generating the first key based on the unique value.

17. A system comprising:

a first node comprising;

a communication module;

a first circuit comprising a first component configured to generate a first output at a first time and generate a second output at a second time, the second output being different than the first output, wherein the first component is a physical structure, wherein the first and second outputs are based on a physical configuration of the first component, and wherein outputs generated by the first component vary over time;

a first clock; and

a controller configured to generate a first key based on the first output generated by the first component, receive an encrypted first data set from a second node, and decrypt the received encrypted first data set with the first key, the second node comprising a second circuit including a second component configured to generate an output that is based on a physical configuration of the second component, wherein a first clock of the first node and a second clock of the second node are synchronized such that the first and second nodes are configured to generate time-matched keys based on outputs of the first and second components, respectively, and

wherein the controller is configured to generate a second key based on the second output, encrypt a second data set with the second key, and transmit the encrypted second data set to the second node via the communication module.

18. The system of claim 17, wherein the controller is configured to receive an encrypted third data set from the second node, and decrypt the encrypted third data set with the second key.

19. The system of claim 17, wherein the communication module comprises a first communication module, and the controller comprises a first controller, the system further comprising:

the second node comprising;

a second communication module;

the second clock;

the second component; and

a second controller configured to generate a third key based on a third output generated by the second component within a predetermined window of the first time, encrypt the data using the third key, and transmit, via the second communication module, the encrypted data to the first node.

20. The system of claim 19, wherein the first and second nodes are configured to generate the time-matched keys based on respective outputs of the first and second components generated within a second of each other over a period of a month.