IMPROVED INSTALLATION OF A TERMINAL IN A SECURE SYSTEM

• US 20170257352A1
• Filed: 10/08/2015
• Published: 09/07/2017
• Est. Priority Date: 10/09/2014
• Status: Active Application

• Current Assignee: Kelisec AB
• Original Assignee: Kelisec AB
• Inventors: Revell, Elise
• Granted Patent: US 10,291,596 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 2463/081 applying self-generating credentials, e.g. instead of receiving credentials from an authority or from another peer, the credentials are generated at the entity itself cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 9/0819 Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) network architectures or network communication protocols for key distribution in a packet data network H04L63/062
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0869 involving random numbers or seeds
• CPC Class Codes: H04L 9/3236 using cryptographic hash functions
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication

Abstract

A system comprising a terminal and a server, wherein the terminal is installed in the system by the server being configured to: identify the terminal; generate key generation data, comprising at least one data seed; distribute the at least one seed to the terminal; generate key data and meta data based on said at least one seed and a function; store an identifier for the terminal along with the key data and the meta data for the terminal, wherein the terminal is arranged to receive the at least one seed from the server; generate key data and meta data based on said at least one seed and the same function; store the key data and the meta data, wherein the key data and the meta data stored in the terminal are the same as the key data and the meta data stored in the server.

Claims

1. A system (300) comprising a terminal (100) and a server (340), wherein the terminal (100) is installed in the system (300) by the server (340) being configured to:

identify the terminal (100);

generate key generation data, comprising at least one data seed;

distribute the at least one data seed to the terminal (100);

generate key data, to be used for generating a symmetric encryption key, and meta data, to be used for generating an authentication token, based on said at least one data seed and a function, such as a cryptographic hash function;

store an identifier for the terminal (100) along with the key data and the meta data for the terminal (100), wherein the terminal (100) is arranged to;

receive the at least one data seed from the server (340);

generate key data and meta data based on said at least one data seed and the same function;

store the key data and the meta data, wherein the key data and the meta data stored in the terminal (100) are the same as the key data and the meta data stored in the server (340).

2. The system (300) according to claim 1, wherein said terminal (100) is configured to generate a symmetric encryption key based on the key data for the terminal as well as the key data for a second terminal (100b) to which a secure communication channel is to be established, such as a combination of the key data for the terminal and the key data for the second terminal.

3. The system (300) according to claim 1, wherein said server (340) is configured to generate an identifier for the terminal (100), distribute the identifier to the terminal (100) and then receive the identifier from the terminal (100) and identify the terminal (100) based on this identifier.

4. The system (300) according to claim 1, wherein the server (340) is configured to:

generate a random encryption key,

distribute the random encryption key to the terminal (100) and

encrypt the at least one data seed with the random encryption key, and wherein the terminal (100) is configured to

receive the random encryption key,

receive the encrypted at least one data seed from the server (340), and

decrypt the at least one data seed with the random encryption key.

5. The system (300) according to claim 1, wherein the terminal (100) is configured to

generate an authentication token based on the meta data, and

send the authentication token to the server (340), and wherein the server (340) is configured to

receive the authentication token and

authenticate the authentication token by comparing it to the meta data stored for the terminal (100).

6. The system (100, 300) according to claim 1, wherein the system (100, 300) is an apparatus (100) and the first terminal (100a) is an external device (245) to be installed in the apparatus (300) and the apparatus is configured to execute the server (340) or communicate with the server (340).

7. A method for use in a system (300) comprising a terminal (100) and a server (340), said method being for installing the terminal (100) in the system (300), the method comprising:

the server (340) identifying the terminal (100);

the server (340) generating key generation data, comprising at least one data seed;

the server (340) distributing the at least one data seed to the terminal (100);

the server (340) generating key data, to be used for generating a symmetric encryption key, and meta data, to be used for generating an authentication token, based on said at least one data seed and a function, such as a cryptographic hash function;

the server (340) storing an identifier for the terminal (100) along with the key data and the meta data for the terminal (100),

the terminal (100) receiving the at least one data seed from the server (340);

the terminal (100) generating key data and meta data based on said at least one data seed and the same function;

the terminal (100) storing the key data and the meta data, wherein the key data and the meta data stored in the terminal (100) are the same as the key data and the meta data stored in the server (340).

8. A computer readable storage medium (40) encoded with instructions (41) that, when executed on a processor, performs the method according to claim 7.