Key Configuration Method, System, and Apparatus

Patent metadata

Field	Value
Publication number	US-2016269176-A1
Application number	US-201615143204-A
Country	US
Kind code	A1
Filing date	Apr 29, 2016
Priority date	Oct 30, 2013
Publication date	Sep 15, 2016
Grant date	—

Abstract

A key configuration method includes acquiring, by a configuration device, a public key of a second device, and sending the public key of the second device to a first device, generating, by the first device, a first shared key, and sending information for obtaining the first shared key to the second device using the public key of the second device, or generating, by the first device, a first shared key using the public key of the second device, and sending information for obtaining the first shared key to the second device, and generating, by the second device, the first shared key using a private key of the second device and the information for obtaining the first shared key, where the first shared key is used for a secure connection between the first device and the second device.

First claim

What is claimed is:

1 . A key configuration method, comprising:
receiving, by a first device, a public key of a second device that is sent by a configuration device after the configuration device acquires the public key of the second device; generating, by the first device, a first shared key according to a key exchange algorithm using the public key of the second device and a private key of the first device; and sending a public key of the first device to the second device such that the second device generates the first shared key according to the key exchange algorithm using a private key of the second device and the public key of the first device, wherein the key exchange algorithm is pre-agreed by the first device and the second device, and wherein the first shared key is used for a secure connection between the first device and the second device.

2 . The method according to claim 1 , wherein the first shared key that is used for the secure connection between the first device and the second device comprises directly using the first shared key for the secure connection between the first device and the second device.

3 . The method according to claim 1 , wherein the first shared key that is used for the secure connection between the first device and the second device comprises a derivation key that is used for the secure connection between the first device and the second device, wherein the derivation key is generated by the first device and the second device using a pre-agreed key derivation algorithm on the first shared key.

4 . The method according to claim 2 , wherein the key exchange algorithm is a Diffie-Hellman (D-H) algorithm.

5 . The method according to claim 1 , wherein pre-agreeing, by the first device and the second device, the key exchange algorithm comprises:
pre-configuring, in the first device and the second device, a parameter used by the key exchange algorithm; or sending, by the configuration device, the parameter used by the key exchange algorithm to the first device and the second device.

6 . The method according to claim 1 , wherein receiving, by the first device, the public key of the second device that is sent by the configuration device after the configuration device acquires the public key of the second device comprises:
establishing, by the first device, a secure connection to the configuration device in order to generate a second shared key; and receiving, by the first device, an encryption result that is sent by the configuration device after the configuration device acquires the public key of the second device, wherein the encryption result is obtained after the configuration device encrypts the public key of the second device using the second shared key, and wherein the method further comprises decrypting, by the first device, the received encryption result using the second shared key, to obtain the public key of the second device.

7 . The method according to claim 6 , wherein establishing, by the first device, the secure connection to the configuration device in order to generate the second shared key comprises:
securely establishing, by the first device, a WiFi protected setup (WPS) interaction manner with the configuration device by means of WiFi to share a credential; and setting the credential as the second shared key.

8 . The method according to claim 6 , wherein establishing, by the first device, the secure connection to the configuration device in order to generate the second shared key comprises:
receiving, by the first device, a public key of the configuration device that is sent by the configuration device; and generating, by the first device, the second shared key according to the pre-agreed key exchange algorithm using the public key of the configuration device and the private key of the first device such that the configuration device generates, after acquiring the public key of the first device, the second shared key according to the pre-agreed key exchange algorithm using the public key of the first device and a private key of the configuration device.

9 . The method according to claim 1 , wherein after obtaining, by the first device, the public key of the second device, the method further comprises generating, by the first device, a new public key and a new private key, wherein the public key of the first device that is sent by the first device to the second device is the new public key, wherein the public key of the first device that is used by the second device to generate the first shared key is the new public key, and wherein the private key of the first device that is used by the first device to generate the first shared key is the new private key.

10 . The method according to claim 1 , wherein the first device is an enrollee and the second device is a registrar.

11 . The method according to claim 1 , wherein the first device is a client, and the second device is a group owner (GO).

12 . The method according to claim 1 , wherein the first device is a wireless terminal and the second device is an access point.

13 . The method according to claim 1 , wherein the first device is a central node and the second device is a sensor node.

14 . The method according to claim 1 , wherein the configuration device acquires information from the first device or the second device by scanning a two-dimensional code, using a universal serial bus (USB), or by means of near field communication.

15 . The method according to claim 1 , further comprising:
generating, by the first device, a verification value using the public key of the second device; sending, by the first device, the verification value to the second device; verifying, by the second device, the received verification value using the public key of the second device; and generating the first shared key when the verification succeed.

16 . A key configuration method, comprising:
providing, by a second device, a public key of the second device for a configuration device such that the configuration device sends the public key of the second device to a first device; receiving, by the second device, a public key of the first device that is sent by the first device after the first device generates a first shared key according to a key exchange algorithm using the public key of the second device and a private key of the first device; and generating, by the second device, the first shared key according to the key exchange algorithm using a private key of the second device and the public key of the first device, wherein the key exchange algorithm is pre-agreed by the first device and the second device, and wherein the first shared key is used for a secure connection between the first device and the second device.

17 . The method according to claim 16 , wherein the configuration device acquires information from the second device or the first device using a two-dimensional code or a universal serial bus (USB), or by means of near field communication.

18 . The method according to claim 16 , further comprising:
receiving, by the second device, a verification value that is generated by the first device using the public key of the second device; verifying, by the second device, the received verification value using the public key of the second device; and performing, by the second device, the step of generating the first shared key when the verification succeed.

19 . A key configuration apparatus, disposed in a first device, comprising:
a memory; and a processor coupled to the memory and confi

Assignees

• Huawei Device Co Ltd

Inventors

• Pang Gaokun
• Ding Zhiming

Classifications

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L9/083 Primary

  involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04L9/0841 Primary

  involving Diffie-Hellman or related key agreement protocols · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title