Reoccurring keying system

Patent metadata

Field	Value
Publication number	US-10587593-B2
Application number	US-201815911330-A
Country	US
Kind code	B2
Filing date	Mar 5, 2018
Priority date	Aug 30, 2011
Publication date	Mar 10, 2020
Grant date	Mar 10, 2020

Abstract

Methods, systems, and apparatuses are described for secure communications. One of a plurality of keys with respective key types may be used to establish a secure communication between computing devices. Verification of an establishment of the secure communication may be sent to a trusted computing device.

First claim

The invention claimed is:

1. A first computing device comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the first computing device to:
send, to a second computing device, a first request to establish a secure communication between the first computing device and the second computing device;
receive, from the second computing device, a response to the first request;
send, to a trusted computing device and based on the response to the first request, a second request to establish the secure communication between the first computing device and the second computing device;
receive, from the trusted computing device:
an indication of a plurality of keys; and
an indication of a type of key usage for each of the plurality of keys, wherein each of the plurality of keys has a different type of key usage;

process, a first key of the plurality of keys and a type of key usage for the first key, to establish the secure communication between the first computing device and the second computing device; and
send, to the trusted computing device, verification of an establishment of the secure communication based on the first key and the type of key usage of the first key.

2. The first computing device of claim 1 , wherein the first key is usage-specific and device pair-specific.

3. The first computing device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the first computing device to:
send to the trusted computing device a request for verification that the first key is valid; and
process, the first key of the plurality of keys and the type of key usage for the first key, to establish the secure communication in response to receiving a confirmation that the first key is valid.

4. The first computing device of claim 3 , wherein the request for verification comprises an indication of the first computing device, the second computing device, and the type of key usage of the first key.

5. The first computing device of claim 3 , wherein the request for verification comprises an indication of a last known datum:
received by the first computing device;
from the trusted computing device; and
for a pairing of the first computing device and the second computing device.

6. The first computing device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the first computing device to:
process an instruction received from the trusted computing device to change the type of key usage of the first key.

7. The first computing device of claim 1 , wherein the instructions, when executed by the one or more processors, cause the first computing device to:
when the first key is no longer valid, process a received indication of a replacement key to establish a second secure communication between the first computing device and the second computing device.

8. A trusted computing device comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the trusted computing device to:
process a received first request to establish a secure communication between a first computing device and a second computing device;
send to the first computing device:
an indication of a plurality of keys; and
an indication of a type of key usage for each of the plurality of keys, wherein each of the plurality of keys has a different type of key usage; and

process a verification, received from the first computing device, of an establishment of the secure communication between the first computing device and the second computing device based on a first key of the plurality of keys and a type of key usage of the first key.

9. The trusted computing device of claim 8 , wherein the first key of the plurality of keys is assigned to a group of three or more devices for one or more secure communications, wherein the first computing device and the second computing device are in the group.

10. The trusted computing device of claim 8 , wherein the instructions, when executed by the one or more processors, cause the trusted computing device to:
send, to the first computing device, an instruction to change the type of key usage of the first key.

11. The trusted computing device of claim 8 , wherein the instructions, when executed by the one or more processors, cause the trusted computing device to send, to the first computing device, the indication of the plurality of keys and the indication of the type of key usage for each of the plurality of keys, in response to receiving, from the first computing device, a request to verify that one or more of the plurality of keys is valid.

12. The trusted computing device of claim 8 , wherein the instructions, when executed by the one or more processors, cause the trusted computing device to:
process a request, received from the first computing device, to verify that the first key of the plurality of keys is valid.

13. The trusted computing device of claim 12 , wherein:
the request to verify comprises an indication of the first computing device and the second computing device; and
the instructions, when executed by the one or more processors, cause the trusted computing device to:
process the indication of the first computing device and the second computing device to verify that the first key is valid; and
in response to verifying that the first key is valid, send, to the first computing device, a confirmation that the first key is valid.

14. The trusted computing device of claim 12 , wherein:
the request to verify comprises an indication of a selected type of key usage; and
the instructions, when executed by the one or more processors, cause the trusted computing device to:
process the indication of the selected type of key usage to verify that the first key is valid; and
in response to verifying that the first key is valid, send, to the first computing device, a confirmation that the first key is valid.

15. A system comprising:
a first computing device;
a second computing device; and
a trusted computing device;
wherein the first computing device comprises:
one or more first processors; and
first memory storing instructions that, when executed by the one or more first processors, cause the first computing device to:
send, to the second computing device, a first request to establish a secure communication between the first computing device and the second computing device;
send, to the trusted computing device, and based on a received response to the first request, a second request to establish the secure communication between the first computing device and the second computing device;
process a first key of a plurality of keys received from the trusted computing device, and a type of key usage for the first key, to establish the secure communication between the first computing device and the second computing device; and
send, to the trusted computing device, verification of an establishment of the secure communication based on the first key and the type of key usage of the first key;

wherein the second computing device comprises:
one or more second processors; and
second memory storing instructions that, when executed by the one or more second processors, cause the second computing device to:
send, to the first computing device, the response to the first request; and

wherein the trusted computing device comprises:
one or more third processors; and
third memory storing instructions that, when executed by the one or more third processors, cause the trusted computing

Assignees

• Comcast Cable Comm Llc

Inventors

• Davoust Nancy
• Fahrny James
• Taylor Kevin

Classifications

• H04L63/10

  for controlling access to devices or network resources · CPC title

• H04L63/062 Primary

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title