Secure shared key sharing systems and methods

Patent metadata

Field	Value
Publication number	US-9686248-B2
Application number	US-201615141489-A
Country	US
Kind code	B2
Filing date	Apr 28, 2016
Priority date	Oct 6, 2014
Publication date	Jun 20, 2017
Grant date	Jun 20, 2017

Abstract

Systems and methods used to securely communicate a shared key to devices. One embodiment describes a method to securely communicate a shared key to a first device and a second device that includes receiving, using the first device, a shared key and unique identifier pairing associated with the first device from a key generator; receiving, using a trusted third party, the shared key and unique identifier pairing from the key generator; generating, using the first device, a signature using the unique identifier and the shared key; transmitting, using the first device, the signature and the unique identifier to the trusted third party; verifying, using the trusted third party, the unique identifier based on the signature; determining, using the trusted third party, the shared key when the unique identifier is verified; and transmitting, using the trusted third party, the shared key to the second device to enable the first device and the second device to communicate securely by encoding and decoding communicated data using the shared key.

First claim

What is claimed is:

1. A computing device configured to be communicatively coupled to a third party server via a network, comprising:
a boot device configured to:
store a unique identifier, a shared key, and startup routine instructions;
generate a signature based at least in part on the unique identifier and the shared key;
communicate the signature and the unique identifier to the third party server to enable the third party server to verify identity of the boot device and retrieve the shared key when the identity of the boot device is verified; and
generate encoded data by encoding the startup routine instructions based at least in part on the shared key; and

a central processing unit communicatively coupled to the boot device via a data bus, wherein the central processing unit is configured to:
receive the encoded data from the boot device via the data bus;
receive the shared key from the third party server via the network when the identity of the boot device is verified by the third party server;
determine the startup routine instructions by decoding the encoded data based at least in part on the shared key; and
execute the startup routine instructions to initialize the computing device.

2. The computing device of claim 1 , wherein:
the boot device is configured to generate the signature by performing a first cryptographic hash on the unique identifier based at least in part on the shared key; and
the third party server is configured to:
retrieve the shared key based at least in part on the unique identifier received from the boot device;
perform a second cryptographic hash on the unique identifier based at least in part on the shared key; and
verify identify of the boot device when a first result of the first cryptographic hash and a second result of the second cryptographic hash match.

3. The computing device of claim 1 , wherein:
the boot device is configured to generate the encoded data by performing a first cryptographic hash on the startup routine instructions based at least in part on the shared key, wherein the encoded data comprises the startup routine instructions and a first result of the first cryptographic hash; and
the central processing unit is configured to:
determine the startup routine instructions by performing a second cryptographic hash on at least a portion of the encoded data based at least in part on the shared key; and
execute the startup routine instructions to initialize the computing device when a second result of the second cryptographic hash matches the first result of the first cryptographic hash.

4. The computing device of claim 1 , wherein:
the boot device comprises non-volatile memory configured to store the startup routine instructions, the unique identifier, and the shared key; and
the non-volatile memory comprises read only memory (ROM), flash memory, ferroelectric RAM (F-RAM), a hard disk, a floppy disk, magnetic tape, an optical disc, or any combination thereof.

5. The computing device of claim 1 , comprising a communication interface configured to communicatively couple the computing device to the network;
wherein the network comprises a personal area network, a local area network, a wide area network, or any combination thereof.

6. The computing device of claim 1 , wherein:
the boot device comprises a boot block configured to store the startup routine instructions; and
the boot block is not accessible by the central processing unit.

7. The computing device of claim 1 , wherein the central processing unit is configured to:
determine the startup routine instructions upon the computing device powering on; and
execute the startup routine instructions to perform error-detection on data stored in a memory component of the computing device.

8. The computing device of claim 1 , wherein:
the shared key comprises a cryptographic key, a symmetric key, or a private key; and
the unique identifier comprises a media access control address that identifies the boot device.

9. The computing device of claim 1 , wherein the computing device comprises a computer, a pager, a cellular phone, a personal organizer, or a control circuit.

10. A computing system configured to facilitate secure communication between two or more of a plurality of electronic devices, comprising:
a third party server communicatively coupled to one or more of the plurality of electronic devices via a network, wherein the third party server is configured to:
store a first pairing configured to associate a first shared key and a first unique identifier, wherein first shared key is configured to be used by a first electronic device of the plurality of electronic devices to encode first transmitted data and the first unique identifier is configured to indicate identity of the first electronic device;
receive a first signature and the first unique identifier from one of the plurality of electronic devices;
determine a second signature based at least in part on the first unique identifier and the first shared key;
determine that the first signature was generated by the first electronic device when the first signature and the second signature match; and
communicate the first shared key to a second electronic device of the plurality of electronic devices when the first signature was generated by the first electronic device to enable the second electronic device to:
determine instructions by decoding the first transmitted data received from the first electronic device using the first shared key; and
execute the instructions to perform an operation in the second electronic device.

11. The computing system of claim 10 , wherein:
the first electronic device is communicatively coupled to the second electronic device via a data bus and the first electronic device is configured to:
store the instructions; and
generate the first transmitted data by performing a first cryptographic hash on the instructions based at least in part on the first shared key, wherein the first transmitted data comprises the instructions and a first result of the first cryptographic hash; and

the second electronic device is configured to:
determine the instructions by performing a second cryptographic hash on at least a portion of the first transmitted data based at least in part on the shared key; and
execute the instructions to initialize operation of the second electronic device when a second result of the second cryptographic hash matches the first result of the first cryptographic hash.

12. The computing system of claim 10 , wherein the third party server is configured to, when the first signature and the second signature do not match:
indicate an attempted intrusion into the computing system;
block subsequent attempts to retrieve the first shared key; or
both.

13. The computing system of claim 10 , wherein the third party server is configured to store a second pairing configured to associate a second shared key and a second unique identifier, wherein the second shared key is configured to be used by a third electronic device of the plurality of electronic devices to encode second transmitted data and the second unique identifier is configured to indicate identity of the third electronic device.

14. The computing system of claim 10 , wherein the third party server is configured to communicate the first shared key to the second electronic device by implementing a public key infrastructure technique.

15. A communication network configured to communicatively couple a plurality of electronic devices, comprising:
a first communication channel configured to communicatively couple a fir

Assignees

• Micron Technology Inc

Inventors

• Dover Lance Walker

Classifications

• H04L9/3247

  involving digital signatures · CPC title

• H04L9/321

  involving a third party or a trusted authority · CPC title

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• G06F21/575 Primary

  Secure boot · CPC title

• H04L63/061 Primary

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title