System and method for authenticating devices

A device comprising a processing circuitry configured to:

• provide (a) a device identifier uniquely identifying the device, (b) current device root key information indicative of a currently used device root key out of a plurality of unique root keys assigned to the device and stored on the device, and (c) device root key usage information indicative of a number of usages of the currently used device root key;
• generate a derived key from the currently used device root key, using a derivation function designed to generate a different derivation for identical data for each execution;
• encrypt, using an encryption function using the derived key, a combination of:
• (a) the device identifier, (b) the current device root key information, and (c) the device root key usage information, giving rise to an authentication encryption;
• and
• send the authentication encryption and a timestamp indicative of a time of creation of the authentication encryption to a device authentication system, thereby enabling authentication of the device, wherein the device is authenticated by the device authentication system if:
• (a) the authentication encryption is valid and (b) the timestamp is within an allowed time window from an authentication attempt time;
• wherein each of the unique root keys has a predetermined maximal number of allowed usages for authentication and wherein upon reaching the maximal number of allowed usages for a given root key of the unique root keys, the given root key is not used for the authentication.

A method for authenticating devices, the method comprising:

• providing a plurality of validation encryptions including, for each given device of the devices, a plurality of encryptions of a combination of:
• (a) an identifier uniquely identifying the given device, (b) current Root Key (RK) information indicative of a currently used RK out of a plurality of unique RKs assigned to the given device and stored on the given device, and (c) usage information indicative of a number of usages of the currently used RK;
• wherein each given encryption of the validation encryptions is encrypted using an encryption function using a derived key generated from the respective currently used RK of the respective given device, and wherein the derived key is generated using a derivation function designed to generate a different derivation for identical data for each execution;
• obtaining an authentication encryption generated by an Authentication Requesting Device (ARD) for authenticating the ARD, wherein the authentication encryption is a result of encryption of a second combination of:
• (a) an ARD identifier uniquely identifying the ARD, (b) current ARD RK information indicative of a currently used ARD RK out of a plurality of unique ARD RKs assigned to the ARD and stored on the ARD, and (c) ARD usage information indicative of a number of usages of the currently used ARD RK;
• wherein the authentication encryption is encrypted using the encryption function using an ARD derived key generated from the currently used ARD RK, and wherein the ARD derived key is generated using the derivation function;
• obtaining, along with the authentication encryption, a timestamp indicative of a time of creation of the authentication encryption;
• and
• upon one of the validation encryptions matching the authentication encryption and the timestamp being within an allowed time window from an authentication attempt time, authenticating the ARD, and upon none of the validation encryptions matching the authentication encryption or the timestamp not being within the allowed time window, not authenticating the ARD.

A method comprising:

• providing (a) a device identifier uniquely identifying a device, (b) current device root key information indicative of a currently used device root key out of a plurality of unique root keys assigned to the device and stored on the device, and (c) device root key usage information indicative of a number of usages of the currently used device root key;
• generating a derived key from the currently used device root key, using a derivation function designed to generate a different derivation for identical data for each execution;
• encrypting, using an encryption function using the derived key, a combination of:
• (a) the device identifier, (b) the current device root key information, and (c) the device root key usage information, giving rise to an authentication encryption;
• and
• sending the authentication encryption and a timestamp indicative of a time of creation of the authentication encryption to a device authentication system, thereby enabling authentication of the device, wherein the device is authenticated by the device authentication system if:
• (a) the authentication encryption is valid and (b) the timestamp is within an allowed time window from an authentication attempt time;
• wherein each of the unique root keys has a predetermined maximal number of allowed usages for authentication and wherein upon reaching the maximal number of allowed usages for a given root key of the unique root keys, the given root key is not used for the authentication.

A non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code, executable by processing circuitry of a computer to perform a method for authenticating devices, the method comprising:

• providing a plurality of validation encryptions including, for each given device of the devices, a plurality of encryptions of a combination of:
• (a) an identifier uniquely identifying the given device, (b) current Root Key (RK) information indicative of a currently used RK out of a plurality of unique RKs assigned to the given device and stored on the given device, and (c) usage information indicative of a number of usages of the currently used RK;
• wherein each given encryption of the validation encryptions is encrypted using an encryption function using a derived key generated from the respective currently used RK of the respective given device, and wherein the derived key is generated using a derivation function designed to generate a different derivation for identical data for each execution;
• obtaining an authentication encryption generated by an Authentication Requesting Device (ARD) for authenticating the ARD, wherein the authentication encryption is a result of encryption of a second combination of:
• (a) an ARD identifier uniquely identifying the ARD, (b) current ARD RK information indicative of a currently used ARD RK out of a plurality of unique ARD RKs assigned to the ARD and stored on the ARD, and (c) ARD usage information indicative of a number of usages of the currently used ARD RK;
• wherein the authentication encryption is encrypted using the encryption function using an ARD derived key generated from the currently used ARD RK, and wherein the ARD derived key is generated using the derivation function;
• obtaining, along with the authentication encryption, a timestamp indicative of a time of creation of the authentication encryption;
• and
• upon one of the validation encryptions matching the authentication encryption and the timestamp being within an allowed time window from an authentication attempt time, authenticating the ARD, and upon none of the validation encryptions matching the authentication encryption or the timestamp not being within the allowed time window, not authenticating the ARD.

A non-transitory computer readable storage medium having computer readable program code embodied therewith, the computer readable program code, executable by processing circuitry of a computer to perform a method comprising:

• providing (a) a device identifier uniquely identifying a device, (b) current device root key information indicative of a currently used device root key out of a plurality of unique root keys assigned to the device and stored on the device, and (c) device root key usage information indicative of a number of usages of the currently used device root key;
• generating a derived key from the currently used device root key, using a derivation function designed to generate a different derivation for identical data for each execution;
• encrypting, using an encryption function using the derived key, a combination of:
• (a) the device identifier, (b) the current device root key information, and (c) the device root key usage information, giving rise to an authentication encryption;
• and
• sending the authentication encryption and a timestamp indicative of a time of creation of the authentication encryption to a device authentication system, thereby enabling authentication of the device, wherein the device is authenticated by the device authentication system if:
• (a) the authentication encryption is valid and (b) the timestamp is within an allowed time window from an authentication attempt time;
• wherein each of the unique root keys has a predetermined maximal number of allowed usages for authentication and wherein upon reaching the maximal number of allowed usages for a given root key of the unique root keys, the given root key is not used for the authentication.