Secure shared key sharing systems and methods

Patent metadata

Field	Value
Publication number	US-9331989-B2
Application number	US-201414507526-A
Country	US
Kind code	B2
Filing date	Oct 6, 2014
Priority date	Oct 6, 2014
Publication date	May 3, 2016
Grant date	May 3, 2016

Abstract

Systems and methods used to securely communicate a shared key to devices. One embodiment describes a method to securely communicate a shared key to a first device and a second device that includes receiving, using the first device, a shared key and unique identifier pairing associated with the first device from a key generator; receiving, using a trusted third party, the shared key and unique identifier pairing from the key generator; generating, using the first device, a signature using the unique identifier and the shared key; transmitting, using the first device, the signature and the unique identifier to the trusted third party; verifying, using the trusted third party, the unique identifier based on the signature; determining, using the trusted third party, the shared key when the unique identifier is verified; and transmitting, using the trusted third party, the shared key to the second device to enable the first device and the second device to communicate securely by encoding and decoding communicated data using the shared key.

First claim

What is claimed is:

1. A method to securely communicate a shared key to a first device comprising a boot device and a second device comprising a central processor configured to be communicatively coupled via a data bus, comprising:
receiving, using the first device, a shared key and unique identifier pairing associated with the first device from a key generator;
receiving, using a trusted third party, the shared key and unique identifier pairing from the key generator;
generating, using the first device, a signature using the unique identifier and the shared key;
transmitting, using the first device, the signature and the unique identifier to the trusted third party, wherein the trusted third party is communicatively coupled to the central processor via a network;
verifying, using the trusted third party, the unique identifier based on the signature;
determining, using the trusted third party, the shared key when the unique identifier is verified; and
transmitting, using the trusted third party, the shared key to the second device to enable the first device and the second device to communicate securely by encoding and decoding communicated data using the shared key comprising:
signing, using the boot device, startup routine instructions stored in the boot device by encoding the startup routine instructions using the shared key;
transmitting, using the boot device, the signed startup routine instructions to the central processor;
verifying, using the central processor, the signed startup routine instructions by decoding the signed startup routine instructions using the shared key; and
executing, using the central processor, the startup routine instructions to initialize a computing system.

2. The method of claim 1 , wherein transmitting the signature and the unique identifier comprises transmitting the signature and the unique identifier in response to a request received from the trusted third party or the second device.

3. The method of claim 2 , wherein the request comprises a nonce and generating the signature comprises performing a cryptographic hash on the unique identifier using the shared key and the nonce.

4. The method of claim 2 , comprising transmitting when the trusted third party or the second device determines that:
the first device and the second device are communicatively coupled a first time;
the second device is powered on;
the second device does not know the shared key; or any combination thereof.

5. A tangible, non-transitory, computer readable medium configured to store instructions executable by a processor, wherein the instructions comprise instructions to:
store, using a trusted third party, a shared key and unique identifier pairing associated with a first device comprising a boot device;
verify, using the trusted third party, identity of the first device based at least in part on a signed unique identifier received from the first device using the shared key, wherein the signed unique identifier comprises the unique identifier and a signature generated by the first device using the unique identifier and the shared key;
determine, using the trusted third party, the shared key based at least in part on the unique identifier when the identity of the first device is verified, wherein the trusted third party is configured to store a plurality of unique identifier and shared key pairings associated with different devices;
transmit, using the trusted third party, the shared key to a second device comprising a central processor configured to be communicatively coupled to the boot device via a data bus and to the trusted third party via a network to enable the first device and the second device to communicate securely by encoding and decoding communicated data using the shared key, wherein enabling the first device and the second device to communicate securely comprises enabling:
the second device to sign startup routine instructions stored in the second device by encoding the startup routine instructions using the shared key;
the second device to transmit the signed startup routine instructions to the first device;
the first device to verify the signed startup routine instructions by decoding the signed startup routine instructions using the shared key; and
the first device to execute the startup routine instructions to initialize a computing system.

6. The computer readable medium of claim 5 , comprising instructions to:
generate, using the trusted third party, a nonce; and
send, using the trusted third party, a request to the first device requesting the signed unique identifier, wherein the request comprises the nonce to enable the first device to generate the signature by performing a first cryptographic hash operation on the unique identifier using the shared key and the nonce.

7. The computer readable medium of claim 6 , wherein the instructions to verify the identity of the first device comprises instructions to compare the signature to an output of a second cryptographic hash operation performed by the trusted third party using the unique identifier, the shared key, and the nonce.

8. The computer readable medium of claim 5 , wherein the instructions to transmit the shared key to the second device comprise instructions to encrypt the shared key using a public key infrastructure encryption technique.

9. The computer readable medium of claim 5 , wherein the instructions to determine the shared key comprise instructions to match the unique identifier with one of the plurality of pairings.

10. A method to manufacture a first device comprising a boot device, comprising:
generating, using a key generator, a unique identifier that uniquely identifies the first device;
generating, using the key generator, a shared key that is configured to be used by the first device to encode transmitted data and decode received data;
storing, using the key generator, the unique identifier and the shared key in the first device; and
transmitting, using the key generator, the unique identifier and the shared key from the key generator to a trusted third party to enable the trusted third party to:
store the unique identifier and the shared key as a pairing; and
transmit the shared key to a second device comprising a central processor communicatively coupled to the first device via a data bus and the trusted third party via a network to enable the first device and the second device to communicate securely by encoding and decoding data using the shared key, wherein enabling the first device and the second device to communicate securely comprises enabling:
the second device to sign startup routine instructions stored in the second device by encoding the startup routine instructions using the shared key,
the second device to transmit the signed startup routine instructions to the first device:
the first device to verify the signed startup routine instructions by decoding the signed startup routine instructions using the shared key; and
the first device to execute the startup routine instructions to initialize a computing system.

11. The method of claim 10 , wherein transmitting the unique identifier and the shared key to the trusted third party comprises encrypting the unique identifier and the shared key using a public key infrastructure encryption technique and transmitting the encrypted unique identifier and shared key over the network.

12. The method of claim 10 , wherein generating the unique identifier comprises generating a media access control address.

13. The method of claim 10 , wherein generating the shared key comprises generating a symmetric key.

14. The method of claim 10 , wherein stori

Assignees

• Micron Technology Inc

Inventors

• Dover Lance Walker

Classifications

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04L9/0825

  using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates · CPC title

• G06F21/575 Primary

  Secure boot · CPC title

• H04L9/0844

  with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys · CPC title

• H04L9/0822

  using key encryption key · CPC title