Symmetric key distribution framework for the internet

• US 8,532,303 B2
• Filed: 12/14/2007
• Issued: 09/10/2013
• Est. Priority Date: 12/14/2007
• Status: Expired due to Fees

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Sunder, Divya Naidu Kolar, Dewan, Prashant, Long, Men
• Primary Examiner(s): Dada, Beemnet
• Assistant Examiner(s): GYORFI, THOMAS A
• Application Number:
  US11/957,184
• Publication Number:
  US 20090154708A1
• Time in Patent Office: 2,097 Days
• Field of Search: 380277-281
• US Class Current: 380/279
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]

Abstract

A method, device, and system are disclosed. In one embodiment the method includes receiving measured health information from a client on a key distribution server. Once the measured health information is received the server is capable of validating the measured health information to see if it is authentic. The server is also capable of sending a session key to the client when the measured health information is validated. When the client receives the session key, the client is capable of initiating an encrypted and authenticated connection with an application server in the domain using the session key.

Claims

1. A method, comprising:

a security measurement hardware device, integrated in a client, requesting a required client health policy from an application server;

a network interface controller, integrated in the application server, sending/storing the required client health policy and an address of a key distribution server to the security measurement hardware device;

the security measurement hardware device performing a health check of the client using the required client health policy received from the network interface controller, the health check creating health information describing the health of the client;

the security measurement hardware device sending the health information to a key distribution server;

the key distribution server validating the client'"'"'s health through the received health information;

the key distribution server providing the client with a session key for secure interaction with the application server when the client'"'"'s health has been validated;

the key distribution server providing the network interface controller a master key corresponding to the session key, wherein the master key is one of a plurality of unique master keys, each unique master key being provided for each particular session key;

the client sending a request to interact with the application server using the session key; and

the network interface controller allowing the client to interact with the application server after verifying the client'"'"'s session key with the corresponding master key.

2. The method of claim 1, further comprising:

resolver logic, integrated in the application server, determining the required client health policy of the application server; and

the resolver logic sending the required client health policy to the network interface controller to be stored.

3. A system, comprising:

a client, including a security measurement hardware device to;

request a required client health policy from an application server, the application server comprising a network interface controller;

perform a health check of the client using the required client health, the health check creating health information describing the health of the client; and

send the health information to a key distribution server; and

wherein the client to send a request to interact with the application server using a session key; and

the key distribution server to;

validate the client'"'"'s health through the received health information;

provide the client with the session key for secure interaction with the application server when the health of the client has been validated; and

provide the network interface controller of the application server with a master key corresponding to the session key, wherein the master key is one of a plurality of unique master keys, each unique master key being provided for each particular session key; and

the network interface controller of the application server to;

send the required client health policy and an address of a key distribution server to the security measurement hardware device;

verify the session key with the corresponding master key; and

allow the client to interact with the application server after verifying the session key.

4. The system of claim 3, wherein the application server further includes:

resolver logic to determine the required client health policy of the application server; and

send the required client health policy to the network interface controller to be stored.