# US 2017/0257352 A1 · Improved installation of a terminal in a secure system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2017/0257352 A1
- Document ID: US20170257352A1
- Status: Published application
- Kind: A1
- Application number: 15/516,932
- Filed: 2015-10-08
- Published: 2017-09-07
- Earliest claimed: 2014-10-09
- Assignees: Kelisec AB
- Applicants: Kelisec AB
- Inventors: Elise Revell
- Web page: https://patentgrep.com/patent/US20170257352A1

## CPC

- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- H04L 9/0819: {Key transport or distribution, i.e. key establishment techniques where one party creates or otherwise obtains a secret value, and securely transfers it to the other(s) (network architectures or network communication protocols for key distribution in a packet data network H04L63/062)}
- H04L 9/0822: {using key encryption key}
- H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]}
- H04L 9/0869: {involving random numbers or seeds}
- H04L 9/3236: {using cryptographic hash functions}
- H04L 9/3273: {for mutual authentication (network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869)}
- H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)}
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W 12/0431: Key distribution or pre-distribution; Key agreement
- H04W 12/06: Authentication
- H04L 2463/081: applying self-generating credentials, e.g. instead of receiving credentials from an authority or from another peer, the credentials are generated at the entity itself
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

A system comprising a terminal and a server, wherein the terminal is installed in the system by the server being configured to: identify the terminal; generate key generation data, comprising at least one data seed; distribute the at least one seed to the terminal; generate key data and meta data based on said at least one seed and a function; store an identifier for the terminal along with the key data and the meta data for the terminal, wherein the terminal is arranged to receive the at least one seed from the server; generate key data and meta data based on said at least one seed and the same function; store the key data and the meta data, wherein the key data and the meta data stored in the terminal are the same as the key data and the meta data stored in the server.

## Claims

### Claim 1

A system (300) comprising a terminal (100) and a server (340), wherein the terminal (100) is installed in the system (300) by the server (340) being configured to:
identify the terminal (100);
generate key generation data, comprising at least one data seed;
distribute the at least one data seed to the terminal (100);
generate key data, to be used for generating a symmetric encryption key, and meta data, to be used for generating an authentication token, based on said at least one data seed and a function, such as a cryptographic hash function;
store an identifier for the terminal (100) along with the key data and the meta data for the terminal (100), wherein the terminal (100) is arranged to:
receive the at least one data seed from the server (340);
generate key data and meta data based on said at least one data seed and the same function;
store the key data and the meta data, wherein the key data and the meta data stored in the terminal (100) are the same as the key data and the meta data stored in the server (340).

### Claim 2 (depends on 1)

The system (300) according to claim 1, wherein said terminal (100) is configured to generate a symmetric encryption key based on the key data for the terminal as well as the key data for a second terminal (100b) to which a secure communication channel is to be established, such as a combination of the key data for the terminal and the key data for the second terminal.

### Claim 3 (depends on 1)

The system (300) according to claim 1, wherein said server (340) is configured to generate an identifier for the terminal (100), distribute the identifier to the terminal (100) and then receive the identifier from the terminal (100) and identify the terminal (100) based on this identifier.

### Claim 4 (depends on 1)

The system (300) according to claim 1, wherein the server (340) is configured to:
generate a random encryption key,
distribute the random encryption key to the terminal (100) and
encrypt the at least one data seed with the random encryption key, and wherein the terminal (100) is configured to
receive the random encryption key,
receive the encrypted at least one data seed from the server (340), and
decrypt the at least one data seed with the random encryption key.

### Claim 5 (depends on 1)

The system (300) according to claim 1, wherein the terminal (100) is configured to
generate an authentication token based on the meta data, and
send the authentication token to the server (340), and wherein the server (340) is configured to
receive the authentication token and
authenticate the authentication token by comparing it to the meta data stored for the terminal (100).

### Claim 6 (depends on 1)

The system (100, 300) according to claim 1, wherein the system (100, 300) is an apparatus (100) and the first terminal (100a) is an external device (245) to be installed in the apparatus (300) and the apparatus is configured to execute the server (340) or communicate with the server (340).

### Claim 7

A method for use in a system (300) comprising a terminal (100) and a server (340), said method being for installing the terminal (100) in the system (300), the method comprising:
the server (340) identifying the terminal (100);
the server (340) generating key generation data, comprising at least one data seed;
the server (340) distributing the at least one data seed to the terminal (100);
the server (340) generating key data, to be used for generating a symmetric encryption key, and meta data, to be used for generating an authentication token, based on said at least one data seed and a function, such as a cryptographic hash function;
the server (340) storing an identifier for the terminal (100) along with the key data and the meta data for the terminal (100),
the terminal (100) receiving the at least one data seed from the server (340);
the terminal (100) generating key data and meta data based on said at least one data seed and the same function;
the terminal (100) storing the key data and the meta data, wherein the key data and the meta data stored in the terminal (100) are the same as the key data and the meta data stored in the server (340).

### Claim 8 (depends on 7)

A computer readable storage medium (40) encoded with instructions (41) that, when executed on a processor, performs the method according to claim 7.