Constrained cryptographic keys

A host device, comprising:

• a communication interface for communicating with other devices;
• a storage device for storing a shared secret key and key derivation function, wherein the shared secret key and key derivation function are both known to a client device and used as part of symmetric key cryptography;
• and
• a processing circuit coupled to the communication interface and the storage device, the processing circuit configured to
• generate a proxy key based on the key derivation function, one or more operating constraints, and the shared secret key, where the one or more operating constraints restrict operation of the client device relative to the proxy device, and
• send the proxy key to a proxy device, wherein the proxy device can use the proxy key to authenticate communications with the client device which can independently recreate the proxy key for verification.

A proxy generation device comprising:

• means for obtaining a shared secret key used for secure communications with a client device having the same shared secret key for implementing symmetric key cryptography;
• means for obtaining a key derivation function, wherein the key derivation function is also known to the client device;
• means for generating a proxy key based on the key derivation function, one or more operating constraints, and the shared secret key, where the one or more operating constraints restrict operation of the client device relative to the proxy device;
• and
• means for sending the proxy key to a proxy device, wherein the proxy device can use the proxy key to authenticate communications with the client device which can independently recreate the proxy key for verification.

A processor configured to generate a proxy key on a host device, comprising:

• a processing circuit configured to
• obtain a shared secret key used for secure communications with a client device having the same shared secret key used for symmetric key cryptography;
• obtain a key derivation function, wherein the key derivation function is related to a second key derivation function known to the client device;
• generate the proxy key based on the key derivation function, one or more operating constraints, and the shared secret key, where the one or more operating constraints restrict operation of the client device relative to the proxy device;
• and
• provide the proxy key to a proxy device, wherein the proxy device can use the proxy key to authenticate communications with the client device which can independently recreate the proxy key for verification.

A non-transitory machine-readable medium having one or more instructions for generating a proxy key at a host device, which when executed by a processor causes the processor to:

• obtain a shared secret key used for secure communications with a client device having the same shared secret key for implementing symmetric key cryptography;
• obtain a key derivation function, wherein the key derivation function is related to a second key derivation function known to the client device;
• generate the proxy key based on the key derivation function, one or more operating constraints on the proxy key, and the shared secret key, where the one or more operating constraints restrict operation of the client device relative to the proxy device;
• and
• provide the proxy key to a proxy device, wherein the proxy device can use the proxy key to authenticate communications with the client device which can independently recreate the proxy key for verification.

A method operational on a proxy device, comprising:

• obtaining a proxy key from a host device, wherein the proxy key is based on a secret key unknown to the proxy device and one or more operating constraints that restrict operation of a client device relative to the proxy device;
• storing the proxy key for use with the client device with which the host device has shared a key derivation function and a secret key for implementing symmetric key cryptography;
• authenticating a message with the proxy key;
• and
• sending the authenticated message to the client device to authenticate the proxy device to the client device which independently recreates and verifies the proxy key.

A proxy device comprising:

• a communication interface for communicating with a host device and a client device;
• a storage device;
• and
• a processing circuit coupled to the communication interface and the storage device, the processing circuit configured to
• obtain a proxy key from the host device, wherein the proxy key is based on a secret key unknown to the proxy device and one or more operating constraints that restrict operation of the client device relative to the proxy device,
• store the proxy key in the storage device for use with the client device, wherein the host device and client device share a key derivation function and a secret key for implementing symmetric key cryptography,
• authenticate a message using the proxy key, and
• send the authenticated message to the client device to authenticate the proxy device to the client device which independently recreates and verifies the proxy key.

A proxy device comprising:

• means for obtaining a proxy key from a host device, wherein the proxy key is based on a secret key unknown to the proxy device and one or more operating constraints that restrict operation of a client device relative to the proxy device;
• means for storing the proxy key for use with the client device with which the host device has shared a key derivation function and a secret key to implement symmetric key cryptography;
• means for authenticating a message with the proxy key;
• and
• means for sending the authenticated message to the client device to authenticate the proxy device to the client device which independently recreates and verifies the proxy key.

A method operational on a client device for authenticating a proxy device, comprising:

• obtaining a shared secret key known to both a host device and the client device to implement symmetric key cryptography;
• obtaining a key derivation function known to both the client device and the host device;
• obtaining one or more operating constraints that restrict operation of the client device relative to the proxy device;
• receiving an authenticated message at the client device from a proxy device;
• generating a local proxy key using the key derivation function, the one or more operating constraints, and the shared secret key;
• and
• authenticating the proxy device at the client device by using the local proxy key to verify the received authenticated message.

A client device, comprising:

• a communication interface for communicating with a proxy device;
• a storage device for storing a shared secret key and a key derivation function, wherein the shared secret key and key derivation function are both known to a host device to implement symmetric key cryptography;
• and
• a processing circuit coupled to the communication interface and the storage device, the processing circuit configured to
• obtain one or more operating constraints that restrict operation of the client device relative to the proxy device,
• receive a secure message from the proxy device,
• generate a local proxy key using the key derivation function, the one or more operating constraints, and the shared secret key, and
• authenticate the proxy device by using the local proxy key to verify the received secure message.

A client device, comprising:

• means for obtaining a shared secret key that can be used by a host device to authenticate communications with the client device having the same shared secret key by implementing symmetric key cryptography;
• means for obtaining a key derivation function known to both the host device and client device;
• means for obtaining one or more operating constraints that restrict operation of the client device relative to the proxy device;
• means for receiving an authenticated message at the client device from a proxy device;
• means for generating a local proxy key using the key derivation function, the one or more operating constraints, and the shared secret key;
• and
• means for authenticating the proxy device by using the local proxy key to verify the received authenticated message.

The client device of 51 further comprising:

• means for obtaining one or more constraints;
• means for generating the local proxy key using the one or more constraints;
• and
• means for restricting operations that can be performed by the proxy device according to the one or more constraints.

A processor configured to authenticate a proxy device on a client device, comprising:

• a processing circuit configured to
• obtain a shared secret key that can be used by a host device to authenticate communications with the client device having the same shared secret key by implementing symmetric key cryptography;
• obtain a key derivation function known to both the client device and host device;
• obtain one or more operating constraints that restrict operation of the client device relative to the proxy device;
• receive an authenticated message at the client device from the proxy device;
• generate a local proxy key using the key derivation function, the one or more operating constraints, and the shared secret key;
• and
• authenticate the proxy device at the client device by using the local proxy key to verify the received authenticated message.

A non-transitory machine-readable medium having one or more instructions for authenticating a proxy device at a client device, which when executed by a processor causes the processor to:

• obtain a shared secret key that can be used by a host device to authenticate communications with the client device having the same shared secret key;
• obtain a key derivation function known to both the client device and host device;
• obtain one or more operating constraints that restrict operation of the client device relative to the proxy device;
• receive an authenticated message at the client device from the proxy device;
• generate a local proxy key using the key derivation function, the one or more operating constraints, and the shared secret key;
• and
• authenticate the proxy device at the client device by using the local proxy key to verify the received authenticated message.