# US 10,313,314 B1 · Cryptographic system for secure command and control of remotely controlled devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,313,314 B1
- Document ID: US10313314B1
- Status: Granted
- Kind: B1
- Application number: 15/834,508
- Filed: 2017-12-07
- Granted: 2019-06-04
- Earliest claimed: 2015-03-17
- Assignees: The Charles Stark Draper Laboratory, Inc.
- Applicants: The Charles Stark Draper Laboratory, Inc.
- Inventors: William W. Weinstein; James M. Zagami; Joshua B. Weader
- Web page: https://patentgrep.com/patent/US10313314B1

## CPC

- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- B29C 44/3461: {Making or treating expandable particles}
- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- H04L 63/045: {wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)}
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)}
- H04L 63/123: {received data contents, e.g. message integrity}
- H04W 12/069: using certificates or pre-shared keys
- H04W 12/106: Packet or message integrity
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- B29C: SHAPING OR JOINING OF PLASTICS; SHAPING OF MATERIAL IN A PLASTIC STATE, NOT OTHERWISE PROVIDED FOR; AFTER-TREATMENT OF THE SHAPED PRODUCTS, e.g. REPAIRING (making preforms B29B11/00; making laminated products by combining previously unconnected layers which become one product whose layers will remain together B32B37/00 - B32B41/00)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A system and method operate on a first electronic device and a second electronic device. The first device has a control system and a cryptographic communications module. The second device has a key generator, a user interface, and a cryptographic communications module. The second device generates a single-mission cryptographic key that is securely programmed into the first device, and the first device is deployed to a remote location. The user interface receives a command for controlling the first device. The second device encrypts the command according to the cryptographic key, and transmits the encrypted command to the first device. The first device authenticates the command, decrypts it, and passes the decrypted command to the control system. The first device may be actively guided ordnance, and the second device may be a control element for controlling the actively guided ordnance. The key may be automatically obfuscated upon mission completion or termination.

## Claims

### Claim 1

A control element (CE) for managing encryption keys and secure communications for a mission for a remotely controlled device (RCD), wherein the remotely controlled device is stored unkeyed and is keyed at the time of deployment, the CE comprising:
a scanner; and
a cryptographic module configured to, at the time of deployment of the RCD (a) obtain indicia from the remotely controlled device using the scanner; (b) obtain an RCD public key associated with the remotely controlled device based on the indicia; (c) generate a first operational keyset including a first single-mission encryption key for the remotely controlled device; (d) encrypt at least a portion of the first operational keyset using the RCD public key to form an encrypted first operational keyset; (e) transmit the encrypted first operational keyset to the remotely controlled device over a key load interface; (f) generate a second operational keyset including a second single-mission encryption key for the remotely controlled device; (g) encrypt at least a portion of the second operational keyset using a forward observer (FO) public key associated with the FO and transmit such encrypted second operational keyset to the FO; and (h) encrypt at least a portion of the second operational keyset using the RCD public key associated with the RCD and transmit such encrypted second operational keyset to the RCD; (i) encrypt a first command for the remotely controlled device using a CE in-use encryption key derived from the first single-mission encryption key; and (j) transmit the encrypted first command to the remotely controlled device along with an authentication tag over a first wireless communication link,
wherein the RCD is an actively guided ordnance (AGO).

### Claim 2 (depends on 1)

A control element according to claim 1, wherein the indicia includes at least one of an identifier of the RCD or the public key associated with the RCD.

### Claim 3 (depends on 1)

A control element according to claim 1, wherein the scanner includes at least one of:
an optical reader for reading the indicia from an outer surface of the RCD; or
a near-field reader for reading the indicia from a near-field readable device of the RCD.

### Claim 4 (depends on 1)

A control element according to claim 1, wherein the control element is configured to change the CE in-use key every N messages between the CE and the RCD, where N is greater than or equal to one.

### Claim 5 (depends on 1)

A control element according to claim 1, wherein the control element is further configured to digitally sign the encrypted first operational keyset transmitted to the remotely controlled device over the key load interface.

### Claim 6 (depends on 1)

A control element according to claim 1, wherein the cryptographic module comprises:
at least one first microprocessor configured to encrypt data using a single-mission cryptographic key;
a second microprocessor, configured to transmit and receive encrypted data using a public data communications medium;
and a third microprocessor, coupled to the at least one first microprocessor and to the second microprocessor, the third microprocessor configured (a) to determine whether encrypted data received from the at least one first microprocessor are correctly encrypted, and if so, to provide these data to the second microprocessor for transmission, and (b) to determine whether a command received from the second microprocessor is authentic, and if so, to decrypt the received command using the single-mission cryptographic key.

### Claim 7 (depends on 1)

A control element according to claim 1, wherein the control element is configured for controlling multiple remotely controlled devices simultaneously including, for each remotely controlled device, the cryptographic module is further configured to (a) obtain indicia from the remotely controlled device; (b) obtain an RCD public key associated with the remotely controlled device based on the indicia; (c) generate a first operational keyset including a first single-mission encryption key for the remotely controlled device; (d) encrypt at least a portion of the first operational keyset using the RCD public key to form an encrypted first operational keyset; (e) transmit the encrypted first operational keyset to the remotely controlled device over a key load interface; (f) encrypt a first command for the remotely controlled device using a CE in-use encryption key derived from the first single-mission encryption key; and (g) transmit the encrypted first command to the remotely controlled device along with an authentication tag over a wireless communication link.

### Claim 8 (depends on 1)

A control element according to claim 1, wherein the control element changes the CE in-use key at predetermined intervals so that only a limited number of commands from the CE to the RCD are encrypted using a given version of such in-use key.

### Claim 9 (depends on 1)

A control element according to claim 1, wherein the CE is further configured to (a) generate a third operational keyset including a third single-mission encryption key for the remotely controlled device; (b) encrypt at least a portion of the third operational keyset using the RCD public key to form an encrypted third operational keyset and transmit the encrypted third operational keyset to the remotely controlled device over the key load interface; (c) generate a fourth operational keyset including a fourth single-mission encryption key for the remotely controlled device; (d) encrypt at least a portion of the fourth operational keyset using the FO public key associated with the FO and transmit such encrypted fourth operational keyset to the FO; and (e) encrypt at least a portion of the fourth operational keyset using the RCD public key associated with the RCD and transmit such encrypted fourth operational keyset to the RCD.

### Claim 10

A method for managing encryption keys and secure communications by a control element (CE) for a mission for a remotely controlled device (RCD), wherein the remotely controlled device is an stored unkeyed and is keyed at the time of deployment, the method comprising:
at the time of deployment of the RCD:
(a) obtaining indicia from the remotely controlled device;
(b) obtaining an RCD public key associated with the remotely controlled device based on the indicia;
(c) generating a first operational keyset including a first single-mission encryption key for the remotely controlled device;
(d) encrypting at least a portion of the first operational keyset using the RCD public key to form an encrypted first operational keyset;
(e) transmitting the encrypted first operational keyset to the remotely controlled device over a key load interface;
(f) encrypting a first command for the remotely controlled device using a CE in-use encryption key derived from the first single-mission encryption key;
(g) transmitting the encrypted first command to the remotely controlled device along with an authentication tag over a first wireless communication link;
(h) generating a second operational keyset for a forward observer control element (FO), the second operational keyset including a second single-mission encryption key for the remotely controlled device;
(i) encrypting at least a portion of the second operational keyset using an FO public key associated with the FO and transmitting such encrypted second operational keyset to the FO; and
(j) encrypting at least a portion of the second operational keyset using the RCD public key associated with the RCD and transmitting such encrypted second operational keyset to the RCD,
wherein the RCD is an actively guided ordnance (AGO).

### Claim 11 (depends on 10)

A method according to claim 10, wherein the indicia includes at least one of an identifier of the RCD or the public key associated with the RCD.

### Claim 12 (depends on 10)

A method according to claim 10, wherein obtaining indicia from the remotely controlled device comprises at least one of:
reading the indicia from an outer surface of the RCD; or
reading the indicia from a near-field readable device of the RCD.

### Claim 13 (depends on 10)

A method according to claim 10, further comprising:
changing the CE in-use key every N messages between the CE and the RCD, where N is greater than or equal to one.

### Claim 14 (depends on 10)

A method according to claim 10, further comprising:
digitally signing the encrypted first operational keyset transmitted to the remotely controlled device over the key load interface.

### Claim 15 (depends on 10)

A method according to claim 10, wherein the control element is configured for controlling multiple remotely controlled devices simultaneously including, for each remotely controlled device, (a) obtaining indicia from the remotely controlled device; (b) obtaining an RCD public key associated with the remotely controlled device based on the indicia; (c) generating a first operational keyset including a first single-mission encryption key for the remotely controlled device; (d) encrypting at least a portion of the first operational keyset using the RCD public key to form an encrypted first operational keyset; (e) transmitting the encrypted first operational keyset to the remotely controlled device over a key load interface; (f) encrypting a first command for the remotely controlled device using a CE in-use encryption key derived from the first single-mission encryption key; and (g) transmitting the encrypted first command to the remotely controlled device along with an authentication tag over a wireless communication link.