Network device configured for cryptographically protected communication supporting multiple execution environments
AssigneeRobert Bosch GmbH
InventorAndreas Bartelt
Life of this patent
Estimating the term…
Abstract
A first network device configured for cryptographically protected communication with a second network device. The cryptographically protected communication comprising at least a handshake protocol, a cryptographic protection of bulk data protocol, and a resumption protocol. A session handling system obtains from the handshake protocol a first bulk cryptographic protection key and a resumption key. The first cryptographic protection key is forwarded to the host system but not the resumption key.
Claims19
A first network device configured for cryptographically protected communication with a second network device, the cryptographically protected communication including at least a handshake protocol, a cryptographic protection of bulk data protocol, and a resumption protocol, the first network device being configured to arrange multiple separate execution environments in the first network device, the multiple separate execution environments including a host system execution environment executing a host system and a session handling system execution environment executing a session handling system;
- wherein:
- during the handshake protocol, the session handling system is configured to obtain a cryptographic response depending on a long-term secret, the cryptographic response being sent to the second network device as part of the handshake protocol to establish a secure session between the first network device and the second network device, the session handling system obtaining from the handshake protocol a first bulk cryptographic protection key and a resumption key, the first cryptographic protection key being forwarded to the host system,
- during the cryptographic protection of bulk data protocol, the host system is configured to cryptographically protect bulk data sent to or received from the second network device in the secure session with a bulk cryptographic protection key received from the session handling system,
- during the resumption protocol, the session handling system is configured to obtain a cryptographic response from the resumption key, the cryptographic response being sent to the second network device as part of the resumption protocol to re-establish a secure session between the first network device and the second network device, the session handling system obtaining from the resumption protocol a second bulk cryptographic protection key, the second cryptographic protection key being forwarded to the host system for use in bulk cryptographic protection.
A method for cryptographically protected communication between a first network device and a second network device, the cryptographically protected communication comprising at least a handshake protocol, a cryptographic protection of bulk data protocol, and a resumption protocol, the method comprising the following steps:
- arranging multiple separate execution environments in the first network device, the multiple separate execution environments including a host system execution environment executing a host system and a session handling system execution environment executing a session handling system;
- during the handshake protocol, obtaining by the session handling system a cryptographic response depending on the long-term secret, the cryptographic response being sent to the second network device as part of the handshake protocol to establish a secure session between the first network device and the second network device, the session handling system obtaining from the handshake protocol a first bulk cryptographic protection key and a resumption key;
- forwarding the first cryptographic protection key to the host system;
- during the cryptographic protection of bulk data protocol, protecting by the host system, cryptographically bulk data sent to and/or received from the second network device in the secure session with a bulk cryptographic protection key received from the session handling system;
- during the resumption protocol, obtaining, by the session handling system, a cryptographic response from the resumption key, the cryptographic response being sent to the second network device as part of the resumption protocol to re-establish a secure session between the first network device and the second network device, the session handling system obtaining from the resumption protocol a second bulk cryptographic protection key;
- forwarding the second cryptographic protection key to the host system for use in bulk cryptographic protection.
A non-transitory computer readable medium on which are stored data representing instructions for cryptographically protected communication between a first network device and a second network device, the cryptographically protected communication comprising at least a handshake protocol, a cryptographic protection of bulk data protocol, and a resumption protocol, the instructions, when executed by a processor system, causing the processor system to perform the following steps:
- arranging multiple separate execution environments in the first network device, the multiple separate execution environments including a host system execution environment executing a host system and a session handling system execution environment executing a session handling system;
- during the handshake protocol, obtaining by the session handling system a cryptographic response depending on the long-term secret, the cryptographic response being sent to the second network device as part of the handshake protocol to establish a secure session between the first network device and the second network device, the session handling system obtaining from the handshake protocol a first bulk cryptographic protection key and a resumption key;
- forwarding the first cryptographic protection key to the host system;
- during the cryptographic protection of bulk data protocol, protecting by the host system, cryptographically bulk data sent to and/or received from the second network device in the secure session with a bulk cryptographic protection key received from the session handling system;
- during the resumption protocol, obtaining, by the session handling system, a cryptographic response from the resumption key, the cryptographic response being sent to the second network device as part of the resumption protocol to re-establish a secure session between the first network device and the second network device, the session handling system obtaining from the resumption protocol a second bulk cryptographic protection key;
- forwarding the second cryptographic protection key to the host system for use in bulk cryptographic protection.
Dependencies are inferred from the claim text.