Provisioning a shared secret to a portable electronic device and to a service entity

A method to be performed by a portable electronic device X, the method comprising:

• receiving at a communication interface of the portable electronic device X a broadcast message comprising a public key G of a service entity that provides a service Y;
• computing a shared secret AX as a function F of the public key G and of a private key bX of the portable electronic device X;
• computing a service-specific device identifier IDX, associated with the service Y, of the portable electronic device X by applying a first hash function to a concatenation of a service description value CY associated with the service Y and one or more identifiers of the portable electronic device X, wherein the identifiers comprise a device identifier PINX and a processor identifier PIDX;
• computing a value TX by applying an advanced encryption standard (AES) algorithm to the shared secret AX and to a combination of a model description value CX of the portable electronic device X and the service-specific device identifier IDX;
• computing a shared key SKX by applying a second hash function to the value TX;
• and
• establishing a trusted relationship between the portable electronic device X and the service entity using the service-specific device identifier IDX and the shared key SKX.

A method to be performed by a service entity providing a service Y, the method comprising:

• receiving at a communication interface of the service entity, from a manufacturing server, public keys {Bi} and corresponding service-specific device identifiers {IDi}, associated with the service Y, for one or more portable electronic devices {i}, each service-specific device identifier IDi having been computed by applying a first hash function to a concatenation of a service description value CY associated with the service Y and one or more identifiers of the portable electronic device i, wherein the identifiers comprise a device identifier PINi and a processor identifier PIDi;
• receiving at the communication interface of the service entity, from a particular portable electronic device X of the one or more portable electronic devices {i}, a registration request comprising a service-specific device identifier IDX of the particular portable electronic device X;
• and
• for each portable electronic device i:
• computing a shared secret Ai as a function F of a private key g, of the service entity, and of the public key Bi of the portable electronic device i;
• computing a value Ti by applying an advanced encryption standard (AES) algorithm to the shared secret Ai and to a combination of a model description value Cj of the portable electronic device i and the service-specific device identifier IDi;
• computing a shared key SKi by applying a second hash function to the value Ti;
• and
• establishing a trusted relationship between the service entity and the particular portable electronic device X using a shared key SKX corresponding to the service-specific device identifier IDX of the particular portable electronic device X.

A method to be performed by a service entity providing a service Y, the method comprising:

• receiving at a communication interface of the service entity, from a manufacturing server, service-specific device identifiers {IDi}, associated with the service Y, and corresponding shared keys {SKi} for one or more portable electronic devices {i}, each service-specific device identifier IDi having been computed by the manufacturing server by applying a first hash function to a concatenation of a service description value CY associated with the service Y and one or more identifiers of the portable electronic device i, wherein the identifiers comprise a device identifier PINi and a processor identifier PIDi, and each shared key SKi having been computed by the manufacturing server by:
• computing a shared secret Ai as a function F of a private key g, of the service entity, and of a public key Bi of the portable electronic device i;
• computing a value Ti by applying an advanced encryption standard (AES) algorithm to the shared secret Ai and to a combination of a model description value Cj of the portable electronic device i and the service-specific device identifier IDi;
• and computing the shared key SKi by applying a second hash function to the value Ti;
• receiving at the communication interface of the service entity, from a particular portable electronic device X of the one or more portable electronic devices {i}, a registration request comprising a service-specific device identifier IDX of the particular portable electronic device X;
• and
• establishing a trusted relationship between the service entity and the particular portable electronic device X using a shared key SKX that corresponds to the service-specific device identifier IDX of the particular portable electronic device X.

A manufacturing server comprising:

• a processor;
• a communication interface coupled to the processor;
• and
• a memory coupled to the processor, the memory storing code which, when executed by the processor, causes the processor to perform:
• broadcasting via the communication interface a message to one or more portable electronic devices {i}, the message including a public key G of a service entity that provides a service Y;
• and
• for each portable electronic device i:
• computing at the manufacturing server a shared secret Ai as a function F of a private key g corresponding to the public key G and of a public key Bi of the portable electronic device i;
• computing at the manufacturing server a service-specific device identifier IDi, associated with the service Y, of the portable electronic device i by applying a first hash function to a concatenation of a service description value CY associated with the service Y and one or more identifiers of the portable electronic device i, wherein the identifiers comprise a device identifier PINi and a processor identifier PIDi;
• computing at the manufacturing server a value Ti by applying an advanced encryption standard (AES) algorithm to the shared secret Ai and to a combination of a model description value Cj of the portable electronic device i and the service-specific device identifier IDi;
• computing at the manufacturing server a shared key SKi by applying a second hash function to the value Ti;
• and
• the manufacturing server providing the service-specific device identifier IDi and the shared key SKi to the service entity via the communication interface,
• wherein a trusted relationship is established between the service entity and the portable electronic device i using the service-specific device identifier IDi and the shared key SKi.

A portable electronic device X comprising:

• a processor;
• a communication interface coupled to the processor through which a broadcast message is received, the broadcast message comprising a public key G of a service entity that provides a service Y;
• and
• a memory coupled to the processor, the memory storing code which, when executed by the processor, causes the processor to perform:
• computing a shared secret AX as a function F of the public key G and of a private key bX of the portable electronic device X;
• computing a service-specific device identifier IDX, associated with the service Y, of the portable electronic device X by applying a first hash function to a concatenation of a service description value CY associated with the service Y and one or more identifiers of the portable electronic device X, wherein the identifiers comprise a device identifier PINX and a processor identifier PIDX;
• computing a value TX by applying an advanced encryption standard (AES) algorithm to the shared secret AX and to a combination of a model description value CX of the portable electronic device X and the service-specific device identifier IDX;
• computing a shared key SKX by applying a second hash function to the value TX;
• and
• establishing a trusted relationship between the portable electronic device X and the service entity using the service-specific device identifier IDX and the shared key SKX.

A service entity providing a service Y, the service entity comprising:

• a processor;
• a communication interface coupled to the processor, through which the service entity receives, from a manufacturing server, public keys {Bi} and corresponding service-specific device identifiers {IDi}, associated with the service Y, for one or more portable electronic devices {i}, each service-specific device identifier IDi having been computed by applying a first hash function to a concatenation of a service description value CY associated with the service Y and one or more identifiers of the portable electronic device i, wherein the identifiers comprise a device identifier PINi and a processor identifier PIDi, and through which the service entity receives, from a particular portable electronic device X of the one or more portable electronic devices {i}, a registration request comprising a service-specific device identifier IDX of the particular portable electronic device X;
• and
• a memory coupled to the processor, the memory storing code which, when executed by the processor, causes the processor to perform, for each portable electronic device i:
• computing a shared secret Ai as a function F of a private key g, of the service entity, and of the public key Bi of the portable electronic device i;
• computing a value Ti by applying an advanced encryption standard (AES) algorithm to the shared secret Ai and to a combination of a model description value Cj of the portable electronic device i and the service-specific device identifier IDi;
• and
• computing a shared key SKi by applying a second hash function to the value Ti;
• and
• establishing a trusted relationship between the service entity and the particular portable electronic device X using a shared key SKX corresponding to the service-specific device identifier IDX of the particular portable electronic device X.

A service entity providing a service Y, the service entity comprising:

• a processor;
• a communication interface coupled to the processor, through which the service entity receives, from a manufacturing server, service-specific device identifiers {IDi}, associated with the service Y, and corresponding shared keys {SKi} for one or more portable electronic devices {i}, each service-specific device identifier IDi having been computed by the manufacturing server by applying a first hash function to a concatenation of a service description value CY associated with the service Y and one or more identifiers of the portable electronic device i, wherein the identifiers comprise a device identifier PINi and a processor identifier PIDi, and each key SKi having been computed by the manufacturing server by:
• computing a shared secret Ai as a function F of a private key g, of the service entity, and of a public key Bi of the portable electronic device i;
• computing a value Ti by applying an advanced encryption standard (AES) algorithm to the shared secret Ai and to a combination of a model description value Cj of the portable electronic device i and the service-specific device identifier IDi;
• and computing the shared key SKi by applying a second hash function to the value Ti, and through which the service entity receives, from a particular portable electronic device X of the one or more portable electronic devices {i}, a registration request comprising a service-specific device identifier IDX of the particular portable electronic device X;
• and
• a memory coupled to the processor, the memory storing code which, when executed by the processor, causes the processor to perform:
• establishing a trusted relationship between the service entity and the particular portable electronic device X using a shared key SKX that corresponds to the service-specific device identifier IDX of the particular portable electronic device X.

A non-transitory computer readable medium storing instructions which, when executed by a processor of a manufacturing server, cause the processor to perform:

• broadcasting a message to one or more portable electronic devices {i}, the message including a public key G of a service entity that provides a service Y;
• and
• for each portable electronic device i:
• computing a shared secret Ai as a function F of a private key g corresponding to the public key G and of a public key Bi of the portable electronic device i;
• computing a service-specific device identifier IDi, associated with the service Y, of the portable electronic device i by applying a first hash function to a concatenation of a service description value CY associated with the service Y and one or more identifiers of the portable electronic device i, wherein the identifiers comprise a device identifier PINi and a processor identifier PIDi;
• computing a value Ti by applying an advanced encryption standard (AES) algorithm to the shared secret Ai and to a combination of a model description value Cj of the portable electronic device i and the service-specific device identifier IDi;
• computing a shared key SKi by applying a second hash function to the value Ti;
• and
• providing the service-specific device identifier IDi and the shared key SKi to the service entity,
• wherein a trusted relationship is established between the service entity and the portable electronic device i using the service-specific device identifier IDi and the shared key SKi.

A non-transitory computer readable medium storing instructions which, when executed by a processor of a portable electronic device X, cause the processor to perform:

• receiving a broadcast message comprising a public key G of a service entity that provides a service Y;
• computing a shared secret AX as a function F of the public key G and of a private key bX of the portable electronic device X;
• computing a service-specific device identifier IDX, associated with the service Y, of the portable electronic device X by applying a first hash function to a concatenation of a service description value CY associated with the service Y and one or more identifiers of the portable electronic device X, wherein the identifiers comprise a device identifier PINX and a processor identifier PIDX;
• computing a value TX by applying an advanced encryption standard (AES) algorithm to the shared secret AX and to a combination of a model description value CX of the portable electronic device X and the service-specific device identifier IDX;
• computing a shared key SKX by applying a second hash function to the value TX;
• and
• establishing a trusted relationship between the portable electronic device X and the service entity using the service-specific device identifier IDX and the shared key SKX.

A non-transitory computer readable medium storing instructions which, when executed by a processor of a service entity providing a service Y, cause the processor to perform:

• receiving, from a manufacturing server, public keys {Bi} and corresponding service-specific device identifiers {IDi}, associated with the service Y, for one or more portable electronic devices {i}, each service-specific device identifier IDi having been computed by applying a first hash function to a concatenation of a service description value CY associated with the service Y and one or more identifiers of the portable electronic device i, wherein the identifiers comprise a device identifier PINi and a processor identifier PIDi;
• receiving, from a particular portable electronic device X of the one or more portable electronic devices {i}, a registration request comprising a service-specific device identifier IDX of the particular portable electronic device X;
• and
• for each portable electronic device i:
• computing a shared secret Ai as a function F of a private key g, of the service entity, and of the public key Bi of the portable electronic device i;
• computing a value Ti by applying an advanced encryption standard (AES) algorithm to the shared secret Ai and to a combination of a model description value Cj of the portable electronic device i and the service-specific device identifier IDi;
• and
• computing a shared key SKi by applying a second hash function to the value Ti;
• and
• establishing a trusted relationship between the service entity and the particular portable electronic device X using a shared key SKX corresponding to the service-specific device identifier IDX of the particular portable electronic device X.

A non-transitory computer readable medium storing instructions which, when executed by a processor of a service entity providing a service Y, cause the processor to perform:

• receiving, from a manufacturing server, service-specific device identifiers {IDi}, associated with the service Y, and corresponding shared keys {SKi} for one or more portable electronic devices {i}, each service-specific device identifier IDi having been computed by the manufacturing server by applying a first hash function to a concatenation of a service description value CY associated with the service Y and one or more identifiers of the portable electronic device i, wherein the identifiers comprise a device identifier PINi and a processor identifier PIDi, and each key SKi having been computed by the manufacturing server by:
• computing a shared secret Ai as a function F of a private key g, of the service entity, and of a public key Bi of the portable electronic device i;
• computing a value Ti by applying an advanced encryption standard (AES) algorithm to the shared secret Ai and to a combination of a model description value Cj of the portable electronic device i and the service-specific device identifier IDi;
• and
• computing the shared key SKi by applying a second hash function to the value Ti;
• receiving, from a particular portable electronic device X of the one or more portable electronic devices {i}, a registration request comprising a service-specific device identifier IDX of the particular portable electronic device X;
• and
• establishing a trusted relationship between the service entity and the particular portable electronic device X using a shared key SKX that corresponds to the service-specific device identifier IDX of the particular portable electronic device X.