Shared symmetric key encryption

Patent metadata

Field	Value
Publication number	US-10027683-B2
Application number	US-201514811673-A
Country	US
Kind code	B2
Filing date	Jul 28, 2015
Priority date	Jul 28, 2015
Publication date	Jul 17, 2018
Grant date	Jul 17, 2018

Abstract

A method for encrypting a message is described in which a public key and a private key are generated. The public key is encrypted using a shared symmetric key shared with an agent. The private key is encrypted using a private symmetric key. The encrypted public key is sent to the agent and decrypted by the agent with the shared symmetric key. A message encrypted with the shared symmetric key is received from the agent, and is decrypted using the shared symmetric key.

First claim

The invention claimed is:

1. A method of a system comprising a processor, comprising:
encrypting a public key using a shared symmetric key shared with an agent, to form an encrypted public key;
encrypting a private key using a private symmetric key to form an encrypted private key;
sending the encrypted public key to the agent over a network;
receiving, from the agent over the network, a first message encrypted with the shared symmetric key, the first message comprising a request to run an operation at a computing device using the agent;
decrypting the first message using the shared symmetric key; and
sending an encrypted second message to the agent over the network, the encrypted second message encrypted with the private key produced by decrypting the encrypted private key, the encrypted second message authorizing the operation at the computing device.

2. The method of claim 1 , wherein the private symmetric key is hardcoded in a server that receives the first message and sends the encrypted second message.

3. The method of claim 1 , wherein the shared symmetric key is hardcoded in the agent.

4. The method of claim 1 , comprising signing, by the system, the public key with a message authentication code generated using the shared symmetric key.

5. The method of claim 1 , further comprising generating the public key and the private key in response to a first installation of an application, the method further comprising:
generating a new public key and a new private key in response to a second installation of the application.

6. The method of claim 1 , wherein the authorizing of the operation at the computing device is in response to decryption of the encrypted second message using the public key produced by the agent by decrypting the encrypted public key received by the agent from the system over the network.

7. The method of claim 1 , wherein the encrypted second message includes a license that enables a functionality of an application at the computing device.

8. The method of claim 1 , further comprising:
sending, by the system over the network to the agent, a communication request message;
receiving, by the system over the network from the agent, an acknowledgment of the communication request message;
in response to determining that the acknowledgment was not received within a specified time duration of the communication request message, releasing, by the system, the license.

9. The method of claim 1 , wherein the public key and the private key are part of an asymmetric key pair.

10. A server, comprising:
a processor;
a non-transitory storage medium storing instructions executable on the processor to:
generate an asymmetric key pair;
encrypt a private key of the asymmetric key pair using a hardcoded private symmetric key;
encrypt a public key of the asymmetric key pair using a shared symmetric key;
send the encrypted public key over a network to a computing device that comprises the shared symmetric key hardcoded on the computing device;
receive, from the computing device over the network, a first message encrypted with the shared symmetric key, the first message comprising a request to run an operation at the computing device;
decrypt the first message using the shared symmetric key; and
send an encrypted second message to the computing device over the network, the encrypted second message encrypted with the private key produced by decrypting the encrypted private key with the hardcoded private symmetric key, the encrypted second message authorizing the operation at the computing device.

11. The server of claim 10 , wherein the first message comprises a request timestamp indicating when the first message was created, and the instructions are executable on the processor to:
in response to determining that the first message is valid, send to the computing device the second message that includes a response timestamp.

12. The server of claim 10 , wherein the instructions are executable on the processor to sign the encrypted public key with a message authentication code generated using the shared symmetric key.

13. The server of claim 10 , wherein the asymmetric key pair is a first asymmetric key pair that is generated upon a first installation of an application, wherein the instructions are executable on the processor to generate a new asymmetric key pair upon a second installation of the application.

14. The server of claim 10 , wherein the instructions are executable on the processor to:
send a communication request message to the computing device; and
if a communication acknowledgement message responsive to the communication request message is not received from the computing device within a communication timeframe, release a license under which the computing device is operating.

15. The server of claim 10 , wherein the encrypted second message includes a license that enables a functionality of an application at the computing device.

16. The server of claim 10 , wherein the instructions are executable on the processor to:
send, over the network to the computing device, a communication request message;
receive, over the network from the computing device, an acknowledgment of the communication request message;
in response to determining that the acknowledgment was not received within a specified time duration of the communication request message, release the license.

Assignees

• Hewlett Packard Development Co
• Entit Software Llc

Inventors

• Bruce Spencer
• Kozorovitzky Boris
• Levi Doron

Classifications

• H04L63/045

  wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14) · CPC title

• H04L2463/062

  applying encryption of the keys · CPC title

• H04L63/126 Primary

  the source of the received data · CPC title

• H04L9/3297

  involving time stamps, e.g. generation of time stamps · CPC title

• H04L9/0822

  using key encryption key · CPC title