US 9,425,968 B2Granted

System and method for updating an encryption key across a network

AssigneeLandis+Gyr Innovations, Inc.

InventorsMichael Demeter, Stephen Chasko

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and methods are provided for generating subsequent encryption keys by a client device as one of a plurality of client devices across a network. Each client device is provided with the same key generation information and the same key setup information from an authentication server. Each client device maintains and stores its own key generation information and key setup information. Using its own information, each client device generates subsequent encryption keys that are common or the same across devices. These subsequent encryption keys are generated and maintained the same across devices without any further instruction or information from the authentication server or any other client device. Additionally, client devices can recover the current encryption key by synchronizing information with another client device.

Claims15

Dependent claims

A method for generating encryption keys by a client device, wherein the client device is one of a plurality of client devices in a network and each client device is provided with key generation information comprising computer-executable instructions for a derivation method and a derivation index adjustment, comprising:

establishing a secure channel between an authentication server and the client device;
receiving from the authentication server via the secure channel key setup information comprising a derivation key, a derivation index, an initial expiration period, and an expiration interval;
in response to the client device receiving the key setup information, generating an initial encryption key using the derivation method, the derivation key, and the derivation index, wherein the client device uses the initial encryption key to encrypt a first message to at least one of the plurality of client devices across the network and to decrypt a second message from one of the plurality of client devices across the network prior to expiration of the initial expiration period;
in response to the client device determining that the initial expiration period has expired:
generating a current derivation index by adjusting the derivation index previously received from the authentication server by the derivation index adjustment;
generating a current expiration period based on the initial expiration period and the expiration interval previously received from the authentication server;
and
generating a subsequent encryption key using the derivation method, the derivation key previously received from the authentication server, and the current derivation index, wherein the subsequent encryption key is valid until the current expiration period expires;
and
in response to the client device determining that the current expiration period has expired:
adjusting the current derivation index by the derivation index adjustment;
updating the current expiration period by the expiration interval previously received from the authentication server;
and
generating a next subsequent encryption key using the derivation method, the derivation key previously received from the authentication server, and the current
derivation index, wherein the next subsequent encryption key is valid until the current expiration period expires.

12 more elements

A method for recovering a current encryption key by a first client device from a second client device, the first client device storing a first current encryption key, a first key information comprising a first current derivation index, a first derivation key, a first derivation method, a first derivation index adjustment, a first current expiration period, and an expiration interval, the second client device storing a second current encryption key, comprising:

receiving an encrypted message by the first client device, the encrypted message sent by the second client device, wherein the message is encrypted using the second current encryption key;
in response to determining by the first client device that the first current encryption key fails to verify the message received from the second client device, generating a trial encryption key using the first derivation method, the first derivation key, and the first current derivation index incremented by the first derivation index adjustment;
in response to determining by the first client device that the trial encryption key successfully verifies the message received from the second client device, replacing the first current encryption key with the trial encryption key, adjusting the first current derivation index by incrementing it by the first derivation index adjustment, and adjusting the first current expiration period by the expiration interval;
in response to determining by the first client device that the trial encryption key fails to verify the message received from the second client device, generating a second trial encryption key using the first derivation method, the first derivation key, and the first current derivation index decremented by the first derivation index adjustment;
and
in response to determining by the first client device that the second trial encryption key successfully verifies the message received from the second client device, the first client device sends a message to the second client device encrypted using the first current encryption key.

3 more elements

A client device comprising:

a processor unit that includes a processor and processor unit memory, wherein the processor unit memory includes computer-executable instructions for initialization of the client device and key generation information comprising a derivation method and a derivation index adjustment;
and
wherein the processor is operable to execute computer-executable instructions from the processor unit memory to:
receive a communication through a secure channel on a network, the communication containing key setup information from an authentication server, the key setup information comprising a derivation key, a derivation index, an initial expiration period, and an expiration interval;
in response to receiving key setup information generate an initial encryption key using the derivation method, the derivation key, and the derivation index, wherein the initial encryption key used to encrypt a first message to at least one of a plurality of client devices across the network and to decrypt a second message from one of the plurality of client devices across the network prior to expiration of the initial expiration period;
in response to determining that the initial expiration period has expired:
generate a current derivation index by adjusting the derivation index previously received from the authentication server by the derivation index adjustment;
generate a current expiration period based on the initial expiration period and the expiration interval previously received from the authentication server;
and
generate a subsequent encryption key using the derivation method, the derivation key previously received from the authentication server, and the current derivation index, wherein the subsequent encryption key valid until the current expiration period expires;
and
in response to determining that the current expiration period has expired:
adjust the current derivation index by the derivation index adjustment;
update the current expiration period by the expiration interval previously received from the authentication server;
and
generate a next subsequent encryption key using the derivation method, the derivation key previously received from the authentication server, and the current derivation index, wherein the next subsequent encryption key valid until the current expiration period expires.

13 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/289,246Filed 28 May 2014 · us provisional application
Priority: 15 Nov 2013
Published: US 2015/0143108 A121 May 2015
Granted: 23 Aug 2016
Term ends: Not estimatedThe source records don’t support an estimate.

Classification9 codes

H04L 9/3268
Involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements: using…
H04L 9/0891
Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords: revocation or update of secret…
H04L 63/0435
Wherein the data content is protected, e.g. by encrypting or encapsulating the payload: wherein the sending and receiving network entities apply…
H04L 63/06
Network architectures or network communication protocols for network security: for supporting key management in a packet data network