Back to results
US 11,601,409 B2Granted
Establishing a secure communication session with an external security processor
AssigneeComcast Cable Communications, LLC
InventorsJames W. Fahmy, Pete Kuykendall, Nancy Davoust
Life of this patent
Estimating the term…
Abstract
A security system is disclosed in which a secure communication session is established between an external security processor and an interface device. After insertion of the external security processor into the interface device, an authorization server provides authorization to the external security processor and the interface device based on, for example, identification information for each device. A derived key may be generated using a common device security key, and a seed value stored at the interface device. The derived key may then be used for multiple communication sessions between the interface device and the external security processor.
Claims17
A method comprising:
- after insertion of an external security processor device into an interface device, obtaining first identification information from the external security processor device and second identification information from the interface device;
- sending the first identification information and the second identification information to a server of a service provider;
- receiving, based on the first identification information and the second identification information, authorization from the server of the service provider;
- establishing, based on the authorization, a secure session between the external security processor device and the interface device, wherein establishing the secure session comprises creating a session key;
- retrieving a device security key via the interface device;
- encrypting the device security key using a first seed value to derive a first derived key;
- encrypting the first derived key with the session key;
- storing the encrypted first derived key in a first storage area of the interface device;
- sending the encrypted first derived key to the external security processor device;
- after a compromise of the first derived key, re-encrypting the device security key using a second seed value to derive a second derived key;
- and
- storing the second derived key in a second storage area of the interface device.
9 more elements
A method comprising:
- after insertion of an external security processor device into a video interface device, obtaining first identification information from the external security processor device and second identification information from the video interface device;
- sending the first identification information and the second identification information to a server of a service provider;
- receiving, based on the first identification information and the second identification information, authorization from the server of the service provider;
- and
- performing, by a computing device and to derive a first derived key, a first encryption using:
- a device security key stored in a first memory storage area of the computing device;
- and
- a first seed value;
- storing the first derived key in a second memory storage area of the computing device;
- establishing, based on the authorization, a secure communication session between the computing device and an external security processor;
- using the secure communication session to send the first derived key to the external security processor;
- performing, after a compromise of the first derived key, a second encryption using the device security key;
- deriving, using a second seed value comprising a combination of an address of the computing device and a second random number, a second derived key;
- and
- storing the second derived key in the second memory storage area of the computing device.
12 more elements
A method comprising:
- after insertion of an external security processor device into an interface device of a plurality of different devices, obtaining first identification information from the external security processor device and second identification information from the interface device;
- sending the first identification information and the second identification information to a server of a service provider;
- receiving, based on the first identification information and the second identification information, authorization from the server of the service provider;
- encrypting, by a processor, using a first seed value, and to create a first derived key for the interface device, a device security key stored in a first memory storage area of a computing device of the interface device, wherein the device security key is common to the plurality of different devices;
- using the first derived key for multiple communication sessions via the interface device;
- determining that a compromise of the first derived key has occurred;
- determining a subset of the plurality of different devices affected by the compromise;
- and
- receiving, via the processor, an instruction to perform, based on a second seed, and to derive a second derived key for the interface device, a second encryption of the device security key, wherein the second encryption of the device security key produces a second derived key for the subset of the plurality of different devices, and the second derived key is different from the first derived key.
6 more elements
Dependencies are inferred from the claim text.