# US 2014/0195807 A1 · System, device, and method of provisioning cryptographic data to electronic devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0195807 A1 - Document ID: US20140195807A1 - Status: Published application - Kind: A1 - Application number: 14/187,275 - Filed: 2014-02-23 - Published: 2014-07-10 - Earliest claimed: 2009-11-16 - Assignees: ARM Technologies Israel Ltd. - Inventors: Hagai BAR-EL; Alexander KLIMOV; Asaf SHEN - Web page: https://patentgrep.com/patent/US20140195807A1 ## CPC - H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]} - H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]} - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract System, device, and method of provisioning cryptographic assets to devices. A method includes: (a) generating a delegation message at a first provisioning server; the delegation message indicating provisioning rights that are delegated by the first provisioning server to a second provisioning server with regard to subsequent provisioning of cryptographic assets to an electronic device; wherein generating the delegation message comprises at least one of: (A) inserting into the delegation message an association key unknown to the first provisioning server, encrypted using a public key of the electronic device; (B) inserting into the delegation message a public key of the second provisioning server; enabling the electronic device to locally generate the association key unknown to the first provisioning server; (b) delivering the delegation message to the electronic device; (c) at the second provisioning server, based on the delegation message, provisioning cryptographic assets to the electronic device, using the association key. ## Claims ### Claim 1 A method of cryptographic material provisioning (CMP), the method comprising: (a) generating a delegation message at a first provisioning server, wherein the delegation message indicates provisioning rights that are delegated by the first provisioning server to a second provisioning server with regard to subsequent provisioning of cryptographic assets to an electronic device, wherein generating the delegation message comprises at least one of: (A) inserting into the delegation message an association key unknown to the first provisioning server, encrypted using a public key of said electronic device, wherein said public key of said electronic device is usable to encrypt data for subsequent decrypting by said electronic device using said private encryption key of said electronic device; (B) inserting into the delegation message a public key of the second provisioning server; enabling the electronic device to locally generate said association key unknown to the first provisioning server; wherein the association key is retrievable by the second provisioning server based on the public key of the second provisioning server; (b) delivering the delegation message from the first provisioning server to the electronic device; (c) at the second provisioning server, and based on said delegation message, provisioning one or more cryptographic assets to the electronic device, using said association key. ### Claim 2 (depends on 1) The method of claim 1, wherein the first provisioning server, by listening to all communications among the first provisioning server, the second provisioning server, the electronic device, and an authorization server, cannot decipher the contents of one or more cryptographic assets that are provisioned by the second provisioning server to the electronic device, even though said first provisioning server delegated to said second provisioning server one or more provisioning rights to subsequently provision one or more of said cryptographic assets. ### Claim 3 (depends on 1) The method of claim 1, wherein the first provisioning server, which introduced the second provisioning server to the electronic device for purposes of subsequent provisioning of cryptographic assets, cannot decipher data exchanged between the second provisioning server and the electronic device, even though the second provisioning server and the electronic device did not have any shared secrets and did not have any cryptographic key data usable for secure communication between the second provisioning server and the electronic device prior to said introduction by said first provisioning server. ### Claim 4 (depends on 1) The method of claim 1, comprising: delegating from the first provisioning sever to the second provisioning server, a right to securely send a cryptographic asset from the second provisioning server to the electronic device, wherein the first provisioning server cannot decipher any cryptographic asset that is sent from the second provisioning server to the electronic device. ### Claim 5 (depends on 1) The method of claim 1, wherein generating the delegation message comprises: inserting into the delegation message a public key of the second provisioning server, to enable execution of an identification protocol for subsequent personalized provisioning of a cryptographic asset to said electronic device. ### Claim 6 (depends on 1) The method of claim 1, wherein generating the delegation message comprises: inserting into the delegation message an association key to be used with the second provisioning server, to enable subsequent execution of provisioning of a cryptographic asset to one or more electronic devices using said association key. ### Claim 7 (depends on 1) The method of claim 1, wherein delivering the delegation message to the electronic device is performed via a one-pass one-way communication from the first provisioning server to said electronic device. ### Claim 8 (depends on 1) The method of claim 1, comprising, prior to performing step (a): securely delivering from the second provisioning server to the first provisioning server, via a secure communication channel, (A) a public encryption key of the second provisioning server, and (B) a class-wide association key encrypted with a key that allows the association key to be decrypted by said electronic device. ### Claim 9 (depends on 1) The method of claim 1, comprising: provisioning from the first provisioning server to the electronic device, via a one-pass one-way provisioning protocol, at least: (i) the public encryption key of the second provisioning server, (ii) the server certificate of the second provisioning server, digitally signed by an authorization server; (iii) an indication of which cryptographic assets the second provisioning server is authorized to subsequently provision to the electronic device. ### Claim 10 (depends on 1) The method of claim 1, wherein generating the delegation message comprises: inserting into the delegation message one or more flags indicating to the electronic device whether the second provisioning server is authorized to provision: (X) only personalized cryptographic assets, or (Y) only class-wide cryptographic assets for a class of multiple electronic device, or (Z) both personalized and class-wide cryptographic assets. ### Claim 11 (depends on 1) The method of claim 1, comprising: prior to provisioning a particular cryptographic asset from the second provisioning server to the electronic device, performing: acquiring by the second provisioning server an authorization ticket, from an authorization server, indicating that the second provisioning server is authorized to provision the particular cryptographic asset to said electronic device. ### Claim 12 (depends on 11) The method of claim 11, wherein said acquiring of the authorization ticket is triggered by a flag, indicating that authorization is required for each provisioning event performed by the second provisioning server, the flag located in a server certificate issued by said authorization server to the second provisioning server. ### Claim 13 (depends on 11) The method of claim 11, wherein the acquiring comprises: at the second provisioning server, contacting the authorization server to present to the authorization server (A) a server certificate of the second provisioning server, and (B) a hash of the particular cryptographic asset intended to be provisioned by the second provisioning server to the electronic device. ### Claim 14 (depends on 13) The method of claim 13, wherein the acquiring further comprises: receiving at the second provisioning server, from said authorization server, said authorization ticket which comprises a digital signature by the authorization server on the hash of the particular cryptographic asset intended to be provisioned by the second provisioning server to the electronic device; wherein said digital signature enables said electronic device to verify by the electronic device prior to storing said particular cryptographic asset. ### Claim 15 (depends on 1) The method of claim 1, wherein provisioning the cryptographic asset to the electronic device is performed via a one-pass one-way communication from the second provisioning server to said electronic device. ### Claim 16 A system for cryptographic material provisioning (CMP), the system comprising: a first provisioning server to generate a delegation message, wherein the delegation message indicates provisioning rights that are delegated by the first provisioning server to a second provisioning server with regard to subsequent provisioning of cryptographic assets to an electronic device, wherein the first provisioning server is to generate the delegation message by performing at least one of: (A) inserting into the delegation message an association key unknown to the first provisioning server, encrypted using a public key of said electronic device, wherein said public key of said electronic device is usable to encrypt data for subsequent decrypting by said electronic device using said private encryption key of said electronic device; (B) inserting into the delegation message a public key of the second provisioning server; enabling the electronic device to locally generate said association key unknown to the first provisioning server; wherein the association key is retrievable by the second provisioning server based on the public key of the second provisioning server; wherein the first provisioning server is to cause delivery of the delegation message from the first provisioning server to the electronic device; wherein the second provisioning server is to provision, and based on said delegation message, one or more cryptographic assets to the electronic device, using said association key.