Communications security systems and methods

Patent metadata

Field	Value
Publication number	US-10764059-B2
Application number	US-201615169245-A
Country	US
Kind code	B2
Filing date	May 31, 2016
Priority date	May 31, 2016
Publication date	Sep 1, 2020
Grant date	Sep 1, 2020

Abstract

Various examples are directed to systems and methods for communications security. For example, a computing device may generate a connection between the computing device and a client device. A first application executing at the computing device may send a first application session key to the client device via the connection. The first application may perform a cryptographic operation on a first message based at least in part on the first application session key to generate a first cryptographic result and send the first cryptographic result to the client device via the connection. The first application may receive a second cryptographic result from the client device via the connection and determine that the second cryptographic result was obtained with the first application session key.

First claim

What is claimed is:

1. A system for secure communication; comprising:
a computing device comprising at least one processor and a memory in communication with the at least one processor, comprising:
a connection circuit to generate a connection be the computing device and a client device;
a first application executing at the computing device to:
send a first application session key to the client device via the connection;
perform a cryptographic operation on a first message based at least in part on the first application session key to generate a first cryptographic result;
send the first cryptographic result to the client device via the connection;
receive a second message from the client device via the connection, the second message comprising a second cryptographic result;
determine that the second cryptographic result was obtained with the first application session key;
determine that the client device does not possess the first application session key; and
prompt a reset of the client device.

2. The system of claim 1 , wherein the first application is also to generate the first application session key.

3. The system of claim 1 , further comprising:
an operating system executing at the computing device to:
receive from the first application a request to store the first application session key; and
store the first application session key at a location of the memory associated with the first application.

4. The system of claim 1 , wherein the first application is also to:
randomly generate a first number;
send the first number to the client device via the connection;
receive a first value from the client device via the connection;
apply a hash function to the first number based at least in part on the first application session key to generate a second value; and
determine that the first value is equal to the second value.

5. The system of claim 4 , wherein the first application is also to:
receive a second number from the client device via the connection;
apply the hash function to the second number based at least in part on the first application session key to generate a third value;
send the third value to the client device via the connection; and
receive a success message from the client device via the connection, wherein the success message indicates that the client device verified the third value.

6. The system of claim 1 , wherein the first application is also to:
generate a second application session key;
send the second application session key to the client device;
randomly generate a first number;
send the first number to the client device;
receive a first value from the client device;
apply a hash function to the first number based at least in part on the first application session key to generate a second value;
determine that the second value is not equal to the first value; and
prompt a reset of the client device.

7. The system of claim 1 , further comprising a second application executing at the computing device, the second application to:
send a third message to the client device, wherein the third message requests data from the client device; and
receive a rejection message from the client device.

8. The system of claim 1 , wherein the first message describes a first data type requested by the first application and the second message comprises first data of the first data type.

9. The system of claim 1 , further comprising the client device to:
receive a data request via the connection and from a second application executing at the computing device;
determine that the client device does not have a second application session key from the second application; and
deny the data request.

10. The system of claim 1 , further comprising the client device to:
receive a second application session key via the connection;
receive a number via the connection;
apply a hash function to the number based at least in part on the first application session key to generate a first value; and
send the first value to the computing device.

11. The system of claim 1 , wherein to perform the cryptographic operation on the first message is to encrypt the first message with the first application session key, and wherein to determine that the second cryptographic result was obtained with the first application session key is to decrypt the second cryptographic result with the first application session key to generate a second message.

12. The system of claim 1 , wherein to determine that the second cryptographic result was obtained with the first application session key is to:
apply a hash function to a second message received from the client device based at least in part on the first application session key to generate a third cryptographic result; and
determine that the third cryptographic result is equivalent to the second cryptographic result.

13. A method for secure communication, comprising:
generating a connection between a computing device and a client device;
sending, by a first application executing at a computing device, a first application session key to the client device via the connection;
performing, by the first application, a cryptographic operation on a first message based at least in part on the first application session key to generate a first cryptographic result;
sending, by the first application, the first cryptographic result to the client device via the connection;
receiving, by the first application; a second message from the client device via the connection, the second message comprising a second cryptographic result;
determining, by the first application, that the second cryptographic result was obtained with the first application session key;
determining, by the first application, that the client does not possess the first application session key; and
prompting a reset of the client device.

14. The method of claim 13 , wherein performing the cryptographic operation on the first message comprises encrypting the first message with the first application session key, and wherein determining that the second cryptographic result was obtained with the first application session key comprises decrypt the second cryptographic result with the first application session key to generate a second message.

15. The method of claim 13 , wherein determining that the second cryptographic result was obtained with the first application session key comprises:
applying a hash function to a second message received from the client device based at least in part on the first application session key to generate a third cryptographic result; and
determining that the third cryptographic result is equivalent to the second cryptographic result.

16. At least one non-transitory computer readable medium comprising instructions to perform:
generating a connection between a computing device and a client device;
sending, by a first application executing at a computing device, a first application session key to the client device via the connection;
performing, by the first application, a cryptographic operation on a first message based at least in part on the first application session key to generate a first cryptographic result;

sending, by the first application, the first cryptographic result to the client device via the connection;
receiving, by the first application; a second message from the client device via the connection, the second message comprising a second cryptographic result;
determining, by the first application, that the second cryptographic result was obtained with the first application session key
dete

Assignees

• Intel Corp

Inventors

• Hernacki Brian J
• Naropanth Sumanth
• Gopalaiah Chandra Prakash

Classifications

• H04W12/0471

  Key exchange · CPC title

• H04W12/041

  Key generation or derivation · CPC title

• H04W12/033

  of the user plane, e.g. user's traffic · CPC title

• H04W12/03

  Protecting confidentiality, e.g. by encryption · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title