Patent Application
20200374112
The present application relates to the field of cryptography, and more particularly to secure provisioning of data to a client device, and related devices, methods and computer programs.
Data may need to be provisioned to mobile and wearable devices during device manufacturing. Such data may include various asset data, including but not limited to: device key pairs, other cryptographic key material, digital certificates, security policies, device identifiers and credentials. Device key pairs are typically required e.g. to enable various security services offered by the mobile/wearable device. Additionally/alternatively, such data may include executable code, e.g. a Trusted Application (TA). The provisioned data is typically protected in some manner by the mobile/wearable device's secure hardware.
As an example, during device manufacturing at the factory, a device key pair may be generated and its public key certified by enrolling a device certificate for it. Both the device key pair and the device certificate may be placed in a secure location in the device to enable the usage of the private key to be tightly controlled. Typically, the device key pair can be used only for predefined use cases when the device is with an end-user. These use cases include e.g. device attestation in which the device can sign an attestation to prove that a certain parameters are valid for the device. Another example is key attestation where a key pair is generated by a secure environment in the device, and the device key pair is then used to attest that the key pair in question is really generated in and protected by the secure environment of the device.
However, provisioning of data (such as device keys or device key pairs and the like) in a client device during device manufacturing can have security issues, such as how to encrypt the data to be provisioned so that only the target client device is able to decrypt the data.
This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the detailed description. This summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.
It is an object of the disclosure to provide improved secure provisioning of data to a client device. The foregoing and other objects are achieved by the features of the independent claims. Further implementation forms are apparent from the dependent claims, the description and the figures.
According to a first aspect, a secure server device is provided. The secure server device comprises an interface configured to obtain a public key of a provisioning asymmetric cryptographic key pair, the provisioning asymmetric cryptographic key pair having been generated based on a first symmetric cryptographic key of a client device class identifier. The secure server device further comprises a processor configured to utilize the obtained public key of the provisioning asymmetric cryptographic key pair in generation of a second symmetric cryptographic key, and utilize the generated second symmetric cryptographic key in encryption of data to be provisioned to one or more client devices associated with the class identifier. The interface is further configured to send the encrypted data to be provisioned to one or more of the client devices associated with the class identifier. The embodiment allows a non-trusted manufacturing facility equipped with the secure server device to establish a secure data provisioning channel from the secure server device to trusted hardware in client devices, thereby avoiding security issues associated with provisioning of data in the client device during device manufacturing.
In a further implementation form of the first aspect, the processor is further configured to generate an ephemeral asymmetric cryptographic key pair, and to generate the second symmetric cryptographic key based on the obtained public key of the provisioning asymmetric cryptographic key pair and a private key of the generated ephemeral asymmetric cryptographic key pair using a predetermined key-agreement protocol, and the interface is further configured to send a public key of the generated ephemeral asymmetric cryptographic key pair to the one or more of the client devices associated with the class identifier. Using the private key of the ephemeral asymmetric cryptographic key pair together with the public key of the provisioning asymmetric cryptographic key pair allows a secure way of establishing a shared secret (i.e. the second symmetric cryptographic key) between the secure server device and the client device.
In a further implementation form of the first aspect, the data to be provisioned comprises at least one of cryptographic key material or executable code.
In a further implementation form of the first aspect, the provisioning asymmetric cryptographic key pair comprises an elliptic curve key pair or a Rivest-Shamir-Adleman key pair. Using the elliptic curve key pair or the Rivest-Shamir-Adleman key pair as the provisioning asymmetric cryptographic key pair allows further improvements in security for the generation of the second symmetric cryptographic key.
In a further implementation form of the first aspect, the predetermined key-agreement protocol comprises a Diffie-Hellman key-agreement protocol. Using a key-agreement protocol such as the Diffie-Hellman key-agreement protocol allows further improvements in security for the generation of the second symmetric cryptographic key.
In a further implementation form of the first aspect, the Diffie-Hellman key-agreement protocol comprises an elliptic curve Diffie-Hellman key-agreement protocol. Using the elliptic curve Diffie-Hellman key-agreement protocol allows further improvements in security for the generation of the second symmetric cryptographic key.
In a further implementation form of the first aspect, the secure server device further comprises a hardware security module. Using a hardware security module in the secure server device allows a secure and certified environment against physical and logical attacks.
According to a second aspect, a secure server device is provided. The secure server device comprises an interface configured to obtain a public key of a provisioning asymmetric cryptographic key pair, the provisioning asymmetric cryptographic key pair having been generated based on a first symmetric cryptographic key of a client device class identifier. The secure server device further comprises a processor configured to utilize the obtained public key of the provisioning asymmetric cryptographic key pair in generation of a second symmetric cryptographic key, randomly generate a third symmetric cryptographic key, encrypt data to be provisioned to one or more client devices associated with the class identifier with the randomly generated third symmetric cryptographic key, and utilize the generated second symmetric cryptographic key in encryption of the third symmetric cryptographic key. The interface is further configured to send the encrypted data to be provisioned and the encrypted third symmetric cryptographic key to one or more of the client devices associated with the class identifier. The embodiment allows a non-trusted manufacturing facility equipped with the secure server device to establish a secure data provisioning channel from the secure server device to trusted hardware in client devices, thereby avoiding security issues associated with provisioning of data in the client device during device manufacturing.
In a further implementation form of the second aspect, the processor is further configured to generate an ephemeral asymmetric cryptographic key pair, and to generate the second symmetric cryptographic key based on the obtained public key of the provisioning asymmetric cryptographic key pair and a private key of the generated ephemeral asymmetric cryptographic key pair using a predetermined key-agreement protocol, and the interface is further configured to send a public key of the generated ephemeral asymmetric cryptographic key pair to the one or more of the client devices associated with the class identifier. Using the private key of the ephemeral asymmetric cryptographic key pair together with the public key of the provisioning asymmetric cryptographic key pair allows a secure way of establishing a shared secret (i.e. the second symmetric cryptographic key) between the secure server device and the client device.
In a further implementation form of the second aspect, the processor is further configured to utilize white-box cryptography in the encryption of the generated third symmetric cryptographic key. In other words, the embodiment can be applied together with existing protection methods, such as white-box encryption.
In a further implementation form of the second aspect, the data to be provisioned comprises at least one of cryptographic key material or executable code.
In a further implementation form of the second aspect, the provisioning asymmetric cryptographic key pair comprises an elliptic curve key pair or a Rivest-Shamir-Adleman key pair. Using the elliptic curve key pair or the Rivest-Shamir-Adleman key pair as the provisioning asymmetric cryptographic key pair allows further improvements in security for the generation of the second symmetric cryptographic key
In a further implementation form of the second aspect, the predetermined key-agreement protocol comprises a Diffie-Hellman key-agreement protocol. Using a key-agreement protocol such as the Diffie-Hellman key-agreement protocol allows further improvements in security for the generation of the second symmetric cryptographic key.
In a further implementation form of the second aspect, the Diffie-Hellman key-agreement protocol comprises an elliptic curve Diffie-Hellman key-agreement protocol. Using the elliptic curve Diffie-Hellman key-agreement protocol allows further improvements in security for the generation of the second symmetric cryptographic key.
In a further implementation form of the second aspect, the secure server device further comprises a hardware security module. Using a hardware security module in the secure server device allows a secure and certified environment against physical and logical attacks.
According to a third aspect, a client device is provided. The client device comprises a secure storage configured to store a first symmetric cryptographic key of a client device class identifier associated with the client device. The client device further comprises a transceiver configured to receive from a secure server device encrypted data to be provisioned to the client device. The client device further comprises a processor configured to obtain a private key of a provisioning asymmetric cryptographic key pair, the provisioning asymmetric cryptographic key pair having been generated at the client device based on the stored first symmetric cryptographic key, utilize the obtained private key of the provisioning asymmetric cryptographic key pair in generation of a second symmetric cryptographic key, and utilize the generated second symmetric cryptographic key in decryption of the encrypted data to be provisioned. The embodiment allows a secure data provisioning channel to be established between trusted hardware in the client device and a non-trusted manufacturing facility equipped with the secure server device, thereby avoiding security issues associated with provisioning of data in the client device during manufacturing of the client device.
In a further implementation form of the third aspect, the transceiver is further configured to receive from the secure server device a public key of an ephemeral asymmetric cryptographic key pair, and the processor is further configured to generate the second symmetric cryptographic key based on the private key of the generated provisioning asymmetric cryptographic key pair and the received public key of the ephemeral asymmetric cryptographic key pair using a predetermined key-agreement protocol. Using the public key of the ephemeral asymmetric cryptographic key pair together with the private key of the provisioning asymmetric cryptographic key pair allows a secure way of establishing a shared secret (i.e. the second symmetric cryptographic key) between the client device and the secure server device.
In a further implementation form of the third aspect, the client device further comprises a trusted execution environment configured to perform cryptographic operations. Use of trusted execution environment allows class secret and provisioning key derivation to be protected in the client devices.
According to a fourth aspect, a client device is provided. The client device comprises a secure storage configured to store a first symmetric cryptographic key of a client device class identifier associated with the client device. The client device further comprises a transceiver configured to receive from a secure server device encrypted data to be provisioned to the client device. The client device further comprises a processor configured to obtain a private key of a provisioning asymmetric cryptographic key pair, the provisioning asymmetric cryptographic key pair having been generated at the client device based on the stored first symmetric cryptographic key, utilize the obtained private key of the provisioning asymmetric cryptographic key pair in generation of a second symmetric cryptographic key, utilize the generated second symmetric cryptographic key in decryption of an encrypted third symmetric cryptographic key, and utilize the decrypted third symmetric cryptographic key in the decryption of the data to be provisioned, the encrypted third symmetric cryptographic key having been received from the secure server device by the transceiver. The embodiment allows a secure data provisioning channel to be established between trusted hardware in the client device and a non-trusted manufacturing facility equipped with the secure server device, thereby avoiding security issues associated with provisioning of data in the client device during manufacturing of the client device.
In a further implementation form of the fourth aspect, the transceiver is further configured to receive from the secure server device a public key of an ephemeral asymmetric cryptographic key pair, and the processor is further configured to generate the second symmetric cryptographic key based on the private key of the generated provisioning asymmetric cryptographic key pair and the received public key of the ephemeral asymmetric cryptographic key pair using a predetermined key-agreement protocol. Using the public key of the ephemeral asymmetric cryptographic key pair together with the private key of the provisioning asymmetric cryptographic key pair allows a secure way of establishing a shared secret (i.e. the second symmetric cryptographic key) between the client device and the secure server device.
In a further implementation form of the fourth aspect, the processor is further configured to utilize white-box cryptography in the decryption of the received encrypted third symmetric cryptographic key. In other words, the embodiment can be applied together with existing protection methods, such as white-box encryption.
In a further implementation form of the fourth aspect, the client device further comprises a trusted execution environment configured to perform cryptographic operations. Use of trusted execution environment allows class secret and provisioning key derivation to be protected in the client devices.
According to a fifth aspect, a processor used in a secure server device comprising an interface coupled to the processor is provided. The processor is configured to cause the interface to obtain a public key of a provisioning asymmetric cryptographic key pair, the provisioning asymmetric cryptographic key pair having been generated based on a first symmetric cryptographic key of a client device class identifier. The processor is further configured to utilize the obtained public key of the provisioning asymmetric cryptographic key pair in generation of a second symmetric cryptographic key, and utilize the generated second symmetric cryptographic key in encryption of data to be provisioned to one or more client devices associated with the class identifier. The processor is further configured to cause the interface to send the encrypted data to be provisioned to one or more of the client devices associated with the class identifier.
According to a sixth aspect, a processor used in a secure server device comprising an interface coupled to the processor is provided. The processor is configured to cause the interface to obtain a public key of a provisioning asymmetric cryptographic key pair, the provisioning asymmetric cryptographic key pair having been generated based on a first symmetric cryptographic key of a client device class identifier. The processor is further configured to utilize the obtained public key of the provisioning asymmetric cryptographic key pair in generation of a second symmetric cryptographic key, randomly generate a third symmetric cryptographic key, encrypt data to be provisioned to one or more client devices associated with the class identifier with the randomly generated third symmetric cryptographic key, and utilize the generated second symmetric cryptographic key in encryption of the third symmetric cryptographic key. The processor is further configured to cause the interface to send the encrypted data to be provisioned and the encrypted third symmetric cryptographic key to one or more of the client devices associated with the class identifier.
According to a seventh aspect, a processor used in a client device comprising a transceiver coupled to the processor is provided. The processor is configured to cause the transceiver to receive from a secure server device encrypted data to be provisioned to the client device. The processor is further configured to obtain a private key of a provisioning asymmetric cryptographic key pair, the provisioning asymmetric cryptographic key pair having been generated at the client device based on a first symmetric cryptographic key of a client device class identifier associated with the client device, the first symmetric cryptographic key stored in a secure storage of the client device. The processor is further configured to utilize the obtained private key of the provisioning asymmetric cryptographic key pair in generation of a second symmetric cryptographic key. The processor is further configured to utilize the generated second symmetric cryptographic key in decryption of the encrypted data to be provisioned.
According to an eighth aspect, a processor used in a client device comprising a transceiver coupled to the processor is provided. The processor is configured to cause the transceiver to receive from a secure server device encrypted data to be provisioned to the client device. The processor is further configured to obtain a private key of a provisioning asymmetric cryptographic key pair, the provisioning asymmetric cryptographic key pair having been generated at the client device based on a first symmetric cryptographic key of a client device class identifier associated with the client device, the first symmetric cryptographic key stored in a secure storage of the client device. The processor is further configured to utilize the obtained private key of the provisioning asymmetric cryptographic key pair in generation of a second symmetric cryptographic key. The processor is further configured to utilize the generated second symmetric cryptographic key in decryption of an encrypted third symmetric cryptographic key, and utilize the decrypted third symmetric cryptographic key in the decryption of the data to be provisioned, the encrypted third symmetric cryptographic key having been received from the secure server device by the transceiver.
According to a ninth aspect, a method is provided. The method comprises obtaining, by a secure server device, a public key of a provisioning asymmetric cryptographic key pair, the provisioning asymmetric cryptographic key pair having been generated based on a first symmetric cryptographic key of a client device class identifier. The method further comprises utilizing, by the secure server device, the obtained public key of the provisioning asymmetric cryptographic key pair in generation of a second symmetric cryptographic key. The method further comprises utilizing, by the secure server device, the generated second symmetric cryptographic key in encryption of data to be provisioned to one or more client devices associated with the class identifier. The method further comprises sending the encrypted data to be provisioned from the secure server device to one or more of the client devices associated with the class identifier.
In a further implementation form of the ninth aspect, the method further comprises generating an ephemeral asymmetric cryptographic key pair by the secure server device. The second symmetric cryptographic key is generated based on the obtained public key of the provisioning asymmetric cryptographic key pair and a private key of the generated ephemeral asymmetric cryptographic key pair using a predetermined key-agreement protocol. The method further comprises sending, by the secure server device, a public key of the generated ephemeral asymmetric cryptographic key pair to the one or more of the client devices associated with the class identifier.
In a further implementation form of the ninth aspect, the data to be provisioned comprises at least one of cryptographic key material or executable code.
In a further implementation form of the ninth aspect, the provisioning asymmetric cryptographic key pair comprises an elliptic curve key pair or a Rivest-Shamir-Adleman key pair.
In a further implementation form of the ninth aspect, the predetermined key-agreement protocol comprises a Diffie-Hellman key-agreement protocol.
In a further implementation form of the ninth aspect, the Diffie-Hellman key-agreement protocol comprises an elliptic curve Diffie-Hellman key-agreement protocol.
In a further implementation form of the ninth aspect, the secure server device further comprises a hardware security module.
According to a tenth aspect, a computer program is provided. The computer program comprises program code configured to perform the method according to the ninth aspect, when the computer program is executed on a computing device.
According to an eleventh aspect, a method is provided. The method comprises obtaining, by a secure server device, a public key of a provisioning asymmetric cryptographic key pair, the provisioning asymmetric cryptographic key pair having been generated based on a first symmetric cryptographic key of a client device class identifier. The method further comprises utilizing, by the secure server device, the obtained public key of the provisioning asymmetric cryptographic key pair in generation of a second symmetric cryptographic key. The method further comprises randomly generating a third symmetric cryptographic key by the secure server device. The method further comprises encrypting, by the secure server device, data to be provisioned to one or more client devices associated with the class identifier with the randomly generated third symmetric cryptographic key. The method further comprises utilizing, by the secure server device, the generated second symmetric cryptographic key in encryption of the third symmetric cryptographic key. The method further comprises sending the encrypted data to be provisioned and the encrypted third symmetric cryptographic key from the secure server device to one or more of the client devices associated with the class identifier.
In a further implementation form of the eleventh aspect, the method further comprises generating an ephemeral asymmetric cryptographic key pair by the secure server device. The second symmetric cryptographic key is generated based on the obtained public key of the provisioning asymmetric cryptographic key pair and a private key of the generated ephemeral asymmetric cryptographic key pair using a predetermined key-agreement protocol. The method further comprises sending, by the secure server device, a public key of the generated ephemeral asymmetric cryptographic key pair to the one or more of the client devices associated with the class identifier.
In a further implementation form of the eleventh aspect, the method further comprises utilizing, by the secure server device, white-box cryptography in the encryption of the generated third symmetric cryptographic key.
In a further implementation form of the eleventh aspect, the data to be provisioned comprises at least one of cryptographic key material or executable code.
In a further implementation form of the eleventh aspect, the provisioning asymmetric cryptographic key pair comprises an elliptic curve key pair or a Rivest-Shamir-Adleman key pair.
In a further implementation form of the eleventh aspect, the predetermined key-agreement protocol comprises a Diffie-Hellman key-agreement protocol.
In a further implementation form of the eleventh aspect, the Diffie-Hellman key-agreement protocol comprises an elliptic curve Diffie-Hellman key-agreement protocol.
In a further implementation form of the eleventh aspect, the secure server device further comprises a hardware security module.
According to a twelfth aspect, a computer program is provided. The computer program comprises program code configured to perform the method according to the eleventh aspect, when the computer program is executed on a computing device.
According to a thirteenth aspect, a method is provided. The method comprises receiving, at a client device from a secure server device, encrypted data to be provisioned to the client device. The method further comprises obtaining, by the client device, a private key of a provisioning asymmetric cryptographic key pair, the provisioning asymmetric cryptographic key pair having been generated by the client device based on a first symmetric cryptographic key of a client device class identifier associated with the client device, the first symmetric cryptographic key stored at a secure storage of the client device. The method further comprises utilizing, by the client device, the obtained private key of the provisioning asymmetric cryptographic key pair in generation of a second symmetric cryptographic key. The method further comprises utilizing, by the client device, the generated second symmetric cryptographic key in decryption of the encrypted data to be provisioned.
In a further implementation form of the thirteenth aspect, the method further comprises receiving a public key of an ephemeral asymmetric cryptographic key pair at the client device from the secure server device. The method further comprises generating, by the client device, the second symmetric cryptographic key based on the private key of the generated provisioning asymmetric cryptographic key pair and the received public key of the ephemeral asymmetric cryptographic key pair using a predetermined key-agreement protocol.
In a further implementation form of the thirteenth aspect, the client device further comprises a trusted execution environment for performing cryptographic operations.
According to a fourteenth aspect, a computer program is provided. The computer program comprises program code configured to perform the method according to the thirteenth aspect, when the computer program is executed on a computing device.
According to a fifteenth aspect, a method is provided. The method comprises receiving, at a client device from a secure server device, encrypted data to be provisioned to the client device. The method further comprises obtaining, by the client device, a private key of a provisioning asymmetric cryptographic key pair, the provisioning asymmetric cryptographic key pair having been generated by the client device based on a first symmetric cryptographic key of a client device class identifier associated with the client device, the first symmetric cryptographic key stored at a secure storage of the client device. The method further comprises utilizing, by the client device, the obtained private key of the provisioning asymmetric cryptographic key pair in generation of a second symmetric cryptographic key. The method further comprises utilizing, by the client device, the generated second symmetric cryptographic key in decryption of an encrypted third symmetric cryptographic key, the encrypted third symmetric cryptographic key having been received at the client device from the secure server device. The method further comprises utilizing the decrypted third symmetric cryptographic key in the decryption of the data to be provisioned.
In a further implementation form of the fifteenth aspect, the method further comprises receiving a public key of an ephemeral asymmetric cryptographic key pair at the client device from the secure server device. The method further comprises generating, by the client device, the second symmetric cryptographic key based on the private key of the generated provisioning asymmetric cryptographic key pair and the received public key of the ephemeral asymmetric cryptographic key pair using a predetermined key-agreement protocol.
In a further implementation form of the fifteenth aspect, the method further comprises utilizing, by the client device, white-box cryptography in the decryption of the received encrypted third symmetric cryptographic key.
In a further implementation form of the fifteenth aspect, the client device further comprises a trusted execution environment for performing cryptographic operations.
According to a sixteenth aspect, a computer program is provided. The computer program comprises program code configured to perform the method according to the fifteenth aspect, when the computer program is executed on a computing device.
Many of the attendant features will be more readily appreciated as they become better understood by reference to the following detailed description considered in connection with the accompanying drawings.
In the following, example embodiments are described in more detail with reference to the attached figures and drawings, in which:
In the following, identical reference signs refer to identical or at least functionally equivalent features.
In the following description, reference is made to the accompanying drawings, which form part of the disclosure, and in which are shown, by way of illustration, specific aspects in which the present disclosure may be placed. It is understood that other aspects may be utilized and structural or logical changes may be made without departing from the scope of the present disclosure. The following detailed description, therefore, is not to be taken in a limiting sense, as the scope of the present disclosure is defined be the appended claims.
For instance, it is understood that a disclosure in connection with a described method may also hold true for a corresponding device or system configured to perform the method and vice versa. For example, if a specific method step is described, a corresponding device may include a unit to perform the described method step, even if such unit is not explicitly described or illustrated in the figures. On the other hand, for example, if a specific apparatus is described based on functional units, a corresponding method may include a step performing the described functionality, even if such step is not explicitly described or illustrated in the figures. Further, it is understood that the features of the various example aspects described herein may be combined with each other, unless specifically noted otherwise.
Asymmetric cryptography (also known as public key cryptography) refers to a cryptographic technique that involves a pair of keys linked with each other, i.e. a public key and a private key. The public key may be distributed widely, whereas the private key is only known by its owner. Any person can encrypt a message using the public key of the owner (i.e. receiver of the message), but such an encrypted message can only be decrypted with the receiver's private key. Furthermore, the public key can used for authentication, i.e. to verify by anyone that the owner of the corresponding private key sent the message.
Symmetric cryptography refers to a cryptographic technique that involves the use of the same cryptographic key for both encryption of plaintext and decryption of ciphertext. In other words, the cryptographic key of the symmetric cryptography represents a shared secret between two or more parties.
As described in more detail below, the secure server devices 100a, 100b will be utilized in provisioning data to the client devices 110a, 110b during device manufacturing. Such data may include various asset data, including but not limited to: device keys or device key pairs, other cryptographic key material, digital certificates, security policies, device identifiers and credentials. These device keys/key pairs are typically required e.g. to enable various security services offered by the mobile/wearable device. Additionally/alternatively, data to be provisioned may include executable code, e.g. a Trusted Application (TA). These device keys/key pairs (or other data to be provisioned) may be generated using e.g. a cryptographic programming interface, such as that provided by a hardware security module 103a, 103b.
In the following, example embodiments of secure server devices 100a and 100b and client devices 110a and 110b are described based on
The secure server device 100a may comprise e.g. a manufacturing server that is used in manufacturing client devices, such as mobile devices and/or wearable devices. In other words, the secure server device 100a may be deployed at a manufacturing line for client devices. Here, the term “secure” refers to a trusted server device 100a comprising an element or unit that allows secure handling of sensitive or private data. The secure server device 100a may be implemented e.g. by the inclusion of the hardware security module 103a. Typically, the term “hardware security module” refers to a physical computing device that safeguards and manages digital keys and provides cryptoprocessing. Such a module may provide a secure and certified environment against physical and logical attacks and may comprise e.g. a plug-in card or an external device that attaches directly to the secure server device 100a.
Herein, each client device belongs to a class of client devices. For example, client devices with the same hardware specifications may share the same class. However, in some embodiments it is possible for hardware with different specifications to also have the same class identifier. A client device class is uniquely identified by an associated client device class identifier. Furthermore, each client device class identifier is assigned its own class key (K). The class key K is a symmetric cryptographic key that is the same for all the hardware with the same class identifier. In other words, the class key is a secret cryptographic key shared by all the hardware with the same class manufactured by the hardware vendor. The class key K is typically written into a secure memory area of the client device (such as the secure storage 113a, 113b of
The interface 101a is configured to obtain (e.g. retrieve or receive) a public key of a provisioning asymmetric cryptographic key pair (PKP). The provisioning asymmetric cryptographic key pair PKP comprises a private key (dp) and the public key (Qp).
The provisioning asymmetric cryptographic key pair PKP may have been derived from the class key K using a suitable method. For example, in an embodiment, the class key K may be used to derive an elliptic curve (EC) key pair. In another embodiment, the class key K may be used to derive a Rivest-Shamir-Adleman (RSA) key pair. In other words, the provisioning asymmetric cryptographic key pair may comprise e.g. an elliptic curve key pair or a Rivest-Shamir-Adleman key pair.
The derivation of the provisioning asymmetric cryptographic key pair PKP can be done e.g. by the chip manufacturer (e.g. the server 120), or by the client device manufacturer (e.g. the secure server device 100a). The derivation or generation of the provisioning asymmetric cryptographic key pair will be described in more detail in connection with
The processor 102a may optionally be configured to generate an ephemeral asymmetric cryptographic key pair. The ephemeral asymmetric cryptographic key pair comprises a private key (de) and a public key (Qe). The processor 102a may include e.g. one or more of various processing devices, such as a coprocessor, a microprocessor, a controller, a digital signal processor (DSP), a processing circuitry with or without an accompanying DSP, or various other processing devices including integrated circuits such as, for example, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a microcontroller unit (MCU), a hardware accelerator, a special-purpose computer chip, or the like.
The processor 102a is further configured to establish a shared secret, i.e. a provisioning session key (PSK) between the secure server device 100a and the client device 110a. In other words, the processor 102a is further configured to utilize the obtained public key Qp of the provisioning asymmetric cryptographic key pair in the generation of a second symmetric cryptographic key (i.e. provisioning session key PSK).
For example, when the ephemeral asymmetric cryptographic key pair has been generated, this may be implemented so that the processor 102a generates the second symmetric cryptographic key PSK based on the obtained public key Qp of the provisioning asymmetric cryptographic key pair and the private key de of the generated ephemeral asymmetric cryptographic key pair, e.g. by using a predetermined key-agreement protocol. The key-agreement protocol may comprise a Diffie-Hellman key-agreement protocol, such as an elliptic curve Diffie-Hellman (ECDH) key-agreement protocol. In other words, the ephemeral key pair may be used together with the provisioning key pair PKP to agree on a shared secret PSK using e.g. a Diffie-Hellman key agreement, such as the ECDH.
The processor 102a is further configured to utilize the generated second symmetric cryptographic key PSK in encryption of the data to be provisioned to the client device 110a. For example, the processor 102a may utilize the generated second symmetric cryptographic key PSK to securely wrap the data to be provisioned. After the encryption, the interface 101a is further configured to send the encrypted data to be provisioned to the client device 110a. When the ephemeral asymmetric cryptographic key pair has been generated, the interface 101a may optionally be configured to also send the public key Qe of the generated ephemeral asymmetric cryptographic key pair to the client device 110a.
However, in contrast to the embodiment of
Further in contrast to the embodiment of
Further in contrast to the embodiment of
Further in contrast to the embodiment of
Otherwise, the elements, features and parameters (such as the various cryptographic keys, identifiers, and data to be provisioned) of the secure server device 100a and the secure server device 100b are identical or at least functionally equivalent so their descriptions are not repeated here in detail.
The client device 110a may be any of various types of mobile and/or wearable devices used directly by an end user entity and capable of communication in a wireless network, such as user equipment (UE). Such devices include but are not limited to smartphones, tablet computers, smart watches, lap top computers, Internet-of-Things (IoT) devices etc.
Furthermore, the client device 110a may comprise secure hardware, such as a trusted execution environment (TEE) 114a for performing cryptographic operations, such as encryption and/or decryption related operations. Typically, the trusted execution environment refers to a secure area in a processor (such as the processor 112a), or a processor (such as the processor 112a) executing in a secure mode, or the like. It may be used e.g. to guarantee that code and data loaded inside are isolated from other applications and protected with respect to confidentiality and integrity. The trusted execution environment 114a may be integrated with the secure storage 113a, i.e. only the TEE may be allowed to access the secure storage 113a containing device secrets.
The secure storage 113a is configured to store the first symmetric cryptographic key (i.e. class key K described above in more detail) of the client device class identifier associated with the client device 110a.
It is to be noted that the various cryptographic keys, identifiers, and data to be provisioned used by the client device 110a are identical or at least functionally equivalent to those used by the secure server device 100a so their descriptions are not repeated here in detail.
The transceiver 111a is configured to receive from the secure server device 100a the encrypted data to be provisioned to the client device 110a.
The processor 112a is configured to obtain the private key dp of the provisioning asymmetric cryptographic key pair PKP. The provisioning asymmetric cryptographic key pair PKP is generated or has been previously generated at the client device 110a based on the first symmetric cryptographic key K stored in the secure storage 113a. If the data provisioning has been done before for the client device 110a, then the provisioning asymmetric cryptographic key pair PKP has been generated during this first provisioning. In an example, the client device 110a may store the generated provisioning asymmetric cryptographic key pair PKP e.g. to the secure storage 113a at the first data provisioning, and the during the following data provisionings the generated provisioning asymmetric cryptographic key pair PKP may be obtained from the secure storage 113a. In other words, the generation of the provisioning asymmetric cryptographic key pair PKP may be performed only once per client device 110a.
The processor 112a is further configured to utilize the obtained private key dp of the provisioning asymmetric cryptographic key pair PKP in generation of the second symmetric cryptographic key PSK. For example, this may be implemented so that the transceiver 111a receives the public key Qe of the ephemeral asymmetric cryptographic key pair from the secure server device 100a, and the processor 112a generates the second symmetric cryptographic key PSK based on the private key dp of the generated provisioning asymmetric cryptographic key pair PKP and the received public key Qe of the ephemeral asymmetric cryptographic key pair using a predetermined key-agreement protocol. As before, the key-agreement protocol may comprise the Diffie-Hellman key-agreement protocol, such as the elliptic curve Diffie-Hellman (ECDH) key-agreement protocol.
The processor 112a is further configured to utilize the generated second symmetric cryptographic key PSK in decryption of the encrypted data to be provisioned that was received from the secure server device 100a.
In contrast to the embodiment of
Further in contrast to the embodiment of
Otherwise, the elements, features and parameters (such as the various cryptographic keys, identifiers, and data to be provisioned) of the client device 110a and the client device 110b are identical or at least functionally equivalent so their descriptions are not repeated here in detail.
In an embodiment, the elements, features and parameters (such as the various cryptographic keys, identifiers, and data to be provisioned) of the secure server device 100 are identical or at least functionally equivalent to those of the secure server device 100a, and the elements, features and parameters of the client devices 1101-110n are identical or at least functionally equivalent to those of the client devices 110a. In another embodiment, the elements, features and parameters of the secure server device 100 are identical or at least functionally equivalent to those of the secure server device 100b, and the elements, features and parameters of the client devices 1101-110n are identical or at least functionally equivalent to those of the client device 110b. Accordingly, their descriptions are not repeated here in detail.
As shown in
Stages 220 and 230 involve secure transfer of assets/data to be provisioned from the secure server device 100 to the client devices 1101-110n. Stages 220 and 230 need to be done once per client device.
The derivation of the PKP can be done e.g. by a chip manufacturer, or by a client device manufacturer using a single client device 1130 belonging to the specific class. In the former case, the chip manufacturer derives the PKP in a secure environment (e.g. server 120) in which the class key K is available. In the latter case, the client device manufacturer may load a special trusted PKP-generation application to a single client device 1130. This trusted application has access to the class key K and derives the PKP in this client device 1130. In both cases, the key derivation needs to be done only once per device class. The public key part the PKP is securely transferred (operation 212 or 221) to a trusted server (i.e. secure server device 100) that makes use of it accordingly.
The PKP is then used to wrap/encrypt (operation 222) an asset in the trusted server 100, the wrapped/encrypted asset is transferred (operations 231i to 231n) to the client devices 1101-110n, and the client devices 1101-110n unwrap/decrypt the asset with the PKP. In addition to transferring the wrapped/encrypted asset, also additional security parameters may need to be transferred, including the public key Qe of the ephemeral key pair, potential initialization vectors (IVs) used during wrapping/encrypting the assets, and/or plain data (such as a device certificate chain).
The method 300a comprises obtaining, by a secure server device, a public key of a provisioning asymmetric cryptographic key pair PKP, the provisioning asymmetric cryptographic key pair PKP having been generated based on a first symmetric cryptographic key K of a client device class identifier, step 301a.
The method 300a further comprises generating an ephemeral asymmetric cryptographic key pair by the secure server device, step 302a.
The method 300a further comprises generating a second symmetric cryptographic key PSK based on the obtained public key Qp of the provisioning asymmetric cryptographic key pair and a private key de of the generated ephemeral asymmetric cryptographic key pair using a predetermined key-agreement protocol, step 303a.
The method 300a further comprises utilizing, by the secure server device, the generated second symmetric cryptographic key in encryption of data to be provisioned to one or more client devices associated with the class identifier, step 304a.
The method 300a further comprises sending the encrypted data to be provisioned and the public key Qe of the generated ephemeral asymmetric cryptographic key pair from the secure server device to one or more of the client devices associated with the class identifier, step 305a.
The method 300a may be performed by the secure server device 100a. Further features of the method 300a directly result from the functionalities of the secure server device 100a. The method 300a can be performed by a computer program.
The method 310a comprises receiving, at the client device from the secure server device, the public key Qe of the ephemeral asymmetric cryptographic key pair and the encrypted data to be provisioned to the client device, step 311a.
The method 310a further comprises obtaining, by the client device, the private key dp of the provisioning asymmetric cryptographic key pair, step 312a. The provisioning asymmetric cryptographic key pair has been generated by the client device based on the first symmetric cryptographic key (class key K) of the client device class identifier associated with the client device, which first symmetric cryptographic key is stored at the secure storage of the client device.
The method 310a further comprises generating, by the client device, the second symmetric cryptographic key PSK based on the private key dp of the generated provisioning asymmetric cryptographic key pair and the received public key Qe of the ephemeral asymmetric cryptographic key pair using a predetermined key-agreement protocol, step 313a.
The method 310a further comprises utilizing, by the client device, the generated second symmetric cryptographic key PSK in decryption of the encrypted data to be provisioned, step 314a.
The method 310a may be performed by the client device 110a. Further features of the method 310a directly result from the functionalities of the client device 110a. The method 310a can be performed by a computer program.
The method 300b comprises obtaining, by a secure server device, a public key of a provisioning asymmetric cryptographic key pair PKP, the provisioning asymmetric cryptographic key pair PKP having been generated based on a first symmetric cryptographic key K of a client device class identifier, step 301b.
The method 300b further comprises generating an ephemeral asymmetric cryptographic key pair by the secure server device, step 302b.
The method 300b further comprises generating a second symmetric cryptographic key PSK based on the obtained public key Qp of the provisioning asymmetric cryptographic key pair and a private key de of the generated ephemeral asymmetric cryptographic key pair using a predetermined key-agreement protocol, step 303b.
The method 300b further comprises obtaining (generating or retrieving) data to be provisioned (private device key Kpriv) to one or more client devices associated with the class identifier, step 304b.
The method 300b further comprises randomly generating a third symmetric cryptographic key KEK by the secure server device, step 305b.
The method 300b further comprises encrypting, by the secure server device, the data to be provisioned with the randomly generated third symmetric cryptographic key KEK, step 306b.
The method 300b further comprises utilizing, by the secure server device, the generated second symmetric cryptographic key PSK in encryption of the third symmetric cryptographic key (KEK), thus obtaining the encrypted third symmetric cryptographic key (PEK), step 307b1.
Optionally, the method 300b further comprises utilizing, by the secure server device, white-box cryptography in the encryption of the generated third symmetric cryptographic key, step 307b2.
Optionally, the method 300b further comprises creating a certificate signing request (CSR), step 308b.
The method 300b further comprises sending the encrypted data to be provisioned and the encrypted third symmetric cryptographic key from the secure server device to one or more of the client devices associated with the class identifier, step 309b.
The method 300b may be performed by the secure server device 100b. Further features of the method 300b directly result from the functionalities of the secure server device 100b. The method 300b can be performed by a computer program.
The method 310b comprises receiving, at the client device from the secure server device, the public key Qe of the ephemeral asymmetric cryptographic key pair, the encrypted third symmetric cryptographic key (PEK), and the encrypted data to be provisioned to the client device, step 311b.
The method 310b further comprises obtaining, by the client device, the private key dp of the provisioning asymmetric cryptographic key pair, step 312b. The provisioning asymmetric cryptographic key pair has been generated by the client device based on the first symmetric cryptographic key (class key K) of the client device class identifier associated with the client device, which first symmetric cryptographic key is stored at the secure storage of the client device.
The method 310b further comprises generating, by the client device, the second symmetric cryptographic key PSK based on the private key dp of the generated provisioning asymmetric cryptographic key pair and the received public key Qe of the ephemeral asymmetric cryptographic key pair using a predetermined key-agreement protocol, step 313b.
The method 310b further comprises utilizing, by the client device, the generated second symmetric cryptographic key PSK (and optionally white-box cryptography) in decryption of an encrypted third symmetric cryptographic key (PEK) to obtain the decrypted third symmetric cryptographic key (KEK), step 314b.
The method 310b further comprises utilizing the decrypted third symmetric cryptographic key (KEK) in the decryption of the data to be provisioned, step 315b.
The method 310b may be performed by the client device 110b. Further features of the method 310b directly result from the functionalities of the client device 110b. The method 310b can be performed by a computer program.
In other words, the process of
After decrypting the data to be provisioned (e.g. the private device key), the client device may store the data to be provisioned and optionally the device certificate (chain) into a secure location and limit it use as appropriate.
The disclosure allows a non-trusted manufacturing facility equipped with the secure server device to establish a secure data provisioning channel from the secure server device to trusted hardware in client devices, thereby avoiding security issues associated with provisioning of data in the client device during device manufacturing, such as how to encrypt the data to be provisioned so that only the target client device is able to decrypt the data, and how to authenticate the target client device.
In the disclosure, the class key K is used to generate a provisioning key pair (PKP), where the private key part is only known by the client device, and the public key part is transferred to the secure server device. The PKP is then used e.g. with Elliptic Curve Diffie-Hellman (ECDH) method to derive a provisioning shared secret (PSK), which can be used to secure the transfer of the data to be provisioned from the secure server device to the client device. Since only the client device has access to the private key part of the PKP, only it can obtain the asset in plain text. This process also implicitly authenticates the client device as the secure server device knows that the corresponding private key is only available in authenticated client devices.
Furthermore, a single public key per device class needs to be derived and/or obtained, which will be imported to the secure server device. Furthermore, the disclosure is readily deployable since chip manufacturers typically pre-program class secrets in their chips. Furthermore, key derivation can be diversified to allow multiple provisioning keys for multiple use cases. Furthermore, even if one provisioning session key is compromised, it does not allow access to any other device keys.
The functionality described herein can be performed, at least in part, by one or more computer program product components such as software components. According to an embodiment, the client devices 110a, 110b and/or secure server devices 100a, 100b comprise a processor configured by the program code when executed to execute the embodiments of the operations and functionality described. Alternatively, or in addition, the functionality described herein can be performed, at least in part, by one or more hardware logic components. For example, and without limitation, illustrative types of hardware logic components that can be used include Field-programmable Gate Arrays (FPGAs), Program-specific Integrated Circuits (ASICs), Program-specific Standard Products (ASSPs), System-on-a-chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), and Graphics Processing Units (GPUs).
Any range or device value given herein may be extended or altered without losing the effect sought. Also any embodiment may be combined with another embodiment unless explicitly disallowed.
Although the subject matter has been described in language specific to structural features and/or acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as examples of implementing the claims and other equivalent features and acts are intended to be within the scope of the claims.
It will be understood that the benefits and advantages described above may relate to one embodiment or may relate to several embodiments. The embodiments are not limited to those that solve any or all of the stated problems or those that have any or all of the stated benefits and advantages. It will further be understood that reference to ‘an’ item may refer to one or more of those items.
The steps of the methods described herein may be carried out in any suitable order, or simultaneously where appropriate. Additionally, individual blocks may be deleted from any of the methods without departing from the spirit and scope of the subject matter described herein. Aspects of any of the embodiments described above may be combined with aspects of any of the other embodiments described to form further embodiments without losing the effect sought.
The term ‘comprising’ is used herein to mean including the method, blocks or elements identified, but that such blocks or elements do not comprise an exclusive list and a method or apparatus may contain additional blocks or elements.
It will be understood that the above description is given by way of example only and that various modifications may be made by those skilled in the art. The above specification, examples and data provide a complete description of the structure and use of exemplary embodiments. Although various embodiments have been described above with a certain degree of particularity, or with reference to one or more individual embodiments, those skilled in the art could make numerous alterations to the disclosed embodiments without departing from the spirit or scope of this specification.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/EP2017/081203 | 12/1/2017 | WO | 00 |
