Systems and methods for generating symmetric cryptographic keys

Patent metadata

Field	Value
Publication number	US-10291403-B2
Application number	US-201816030550-A
Country	US
Kind code	B2
Filing date	Jul 9, 2018
Priority date	Jul 7, 2017
Publication date	May 14, 2019
Grant date	May 14, 2019

Abstract

A system for generating symmetric cryptographic keys for communications between hosts. Hosts use associated devices to generate secret keys. Each key is generated based on a static seed and a dynamic seed. The dynamic seed is created from sensor data or auxiliary data. The secret key allows host machines to encrypt, or decrypt, plaintext messages sent to, or received from, other host machines.

First claim

What is claimed is:

1. A system for generating symmetric cryptographic keys and for decrypting messages, the system comprising:
a first host machine; and
a first device in communication with the first host machine, the first device configured to
receive a message from the first host machine indicating an intent to communicate with a second host machine,
generate a secret key based on a static seed and a dynamic seed, the dynamic seed created from sensor data or auxiliary data,
encrypt an identifier for the first host machine, or the first device, using the static seed, to generate an encrypted identifier message, and
transmit the encrypted identifier message and the secret key to the first host machine, the first host machine configured to encrypt a plaintext message using the secret key and transmit the encrypted identifier message and the encrypted plaintext message to the second host machine,

a second device in communication with the second host machine, the second device configured to
receive an encrypted identifier message from the second host machine, the encrypted identifier message transmitted by the first host machine to the second host machine,
decrypt the encrypted identifier message using the static seed used by the first host machine,
derive the secret key using the static seed and a dynamic seed, the dynamic seed created from sensor data or the auxiliary data obtained by the decryption of the encrypted identifier message, and
transmit the secret key to the second host machine, the second host machine configured to decrypt the plaintext message encrypted by the first host machine using the secret key.

2. The system of claim 1 , wherein the auxiliary data is configured to allow a variable number of data elements and a variable range of values for each data element, and the combination of the number of data elements and range of data values produce a variable range of entropy for the auxiliary data.

3. The system of claim 1 , wherein the dynamic seed is based on a combination of auxiliary data and sensor data only available to the first device generating the secret key and the secret key is used by the first host machine to encrypt and decrypt data stored on the first host machine.

4. The system of claim 1 , wherein the first device is removably coupled to the first host machine.

5. The system of claim 1 wherein the first device is further configured to generate a message authentication code of an identifier for the first host machine, or its associated device, using the secret key, and include this message authentication code in its encrypted identifier message.

6. The system of claim 1 wherein the first host machine is configured to send the first device auxiliary data used to generate the dynamic seed.

7. The system of claim 1 , wherein the second device is removably coupled to the second host machine.

8. The system of claim 1 , wherein the static seed is identified by decrypting the encrypted identifier message with a plurality of static seeds to produce a message matching the form of a decrypted identifier message.

9. The system of claim 1 , wherein the second device is further configured to
receive an encrypted identifier message encrypted by the system of claim 5 ,
decrypt the encrypted identifier message using the static seed used by the first host machine,
identify a plurality of dynamic seeds using a plurality of values for sensor data or using a plurality of values for sensor data combined with the auxiliary data obtained by the decryption of the encrypted identifier message, and
identify a correct dynamic seed from the plurality of dynamic seeds that, when input with the static seed to a key generation function, produces a key that generates a message authentication code that matches the message authentication code included in the encrypted identifier message.

Assignees

• Ligatti Jay
• Cetin Cagri
• Engram Shamaria
• Goldgof Dmitry
• Univ South Florida

Inventors

• Ligatti Jay
• Cetin Cagri
• Engram Shamaria
• Goldgof Dmitry

Classifications

• H04L9/0869 Primary

  involving random numbers or seeds · CPC title

• H04L9/0866

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title

• H04L9/0827

  involving distinctive intermediate devices or communication paths (network architectures or network communication protocols using different networks H04L63/18) · CPC title

• H04L63/0435

  wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06) · CPC title

• H04L9/3242 Primary

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title