Establishing a protected communication channel
AssigneeTrustonic Limited
InventorRichard Hayton
Life of this patent
Estimating the term…
Abstract
To establish a first protected communication channel between a device D and a first server S, a symmetric key KS is derived at the device D, based on a device identifying key KD and public key information dependent on a first server public key Spublic of the first server S. The symmetric key KS is derived in a corresponding way at a second server T. The symmetric key KS is transmitted from the second server T to the first server S on a second protected communication channel. Communication on the first protected communication channel between the device D and the first server S is protected using a communication key KC which is dependent on the symmetric key KS. This can enable a device D lacking support for asymmetric key cryptography to securely enter into communication with the first server S.
Claims12
A method for establishing a first protected communication channel between a device and a first server, the first server having a first server public key, and the device having a device identifying key shared with a second server different from the first server, the method comprising:
- deriving a symmetric key at the device, based on the device identifying key and public key information dependent on the first server public key;
- sending, by the device, a payload message to the first server on the first protected communication channel protected using a communication key which is dependent on the symmetric key;
- in response to the payload message, the first server sends a key generation request to the second server to trigger the second server to derive the symmetric key and transmit the symmetric key to the first server on a second protected communication channel;
- deriving the symmetric key at the second server, based on the device identifying key and the public key information;
- and
- transmitting the symmetric key from the second server to the first server using the second protected communication channel.
At least one non-transitory, computer-readable storage medium storing one or more computer programs, which when executed by one or more data processors in a device, a first server, and a second server different from the first server, cause the one or more data processors to establish a first protected communication channel between the device and the first server, where the first server has a first server public key and the device has a device identifying key shared with the second server by:
- deriving a symmetric key at the device, based on the device identifying key and public key information dependent on the first server public key;
- sending, by the device, a payload message to the first server on the first protected communication channel protected using a communication key which is dependent on the symmetric key;
- in response to the payload message, the first server sending a key generation request to the second server to trigger the second server to derive the symmetric key and transmit the symmetric key to the first server on a second protected communication channel;
- deriving the symmetric key at the second server, based on the device identifying key and the public key information;
- and
- transmitting the symmetric key from the second server to the first server using the second protected communication channel.
A system comprising:
- a device;
- a first server;
- and
- a second server different from the first server,
- each of the device, the first server, and the second server comprising:
- corresponding processing circuitry to perform data processing;
- and
- data storage,
- wherein each data storage stores one or more computer programs for controlling corresponding processing circuitry to establish a first protected communication channel between the device and the first server, the first server having a first server public key, and the device having a device identifying key shared with the second server by:
- deriving a symmetric key at the device, based on the device identifying key and public key information dependent on the first server public key;
- sending, by the device, a payload message to the first server on the first protected communication channel protected using a communication key which is dependent on the symmetric key;
- in response to the payload message, the first server sends a key generation request to the second server to trigger the second server to derive the symmetric key and transmit the symmetric key to the first server on a second protected communication channel;
- deriving the symmetric key at the second server, based on the device identifying key and the public key information;
- and
- transmitting the symmetric key from the second server to the first server using the second protected communication channel.
Dependencies are inferred from the claim text.