Patent ID: 9197422
Filing Date: 2015-11-24
Classification: H04L

Abstract:
1. A method for differential encryption to allow at least two devices to communicate securely using symmetric keys, the method comprising: for each device, generating at a sponsor facility, a large set of values using a physically unclonable function (PUF), the PUF based on physical properties related to manufacturing process variations of a device; securely storing the large set of values generated for a particular device within that device, the securely storing being done at the sponsor facility; securely storing a subset of the large set of values generated for each device at the sponsor facility, wherein a trusted sponsor device has access to the subset of values for each device, the subsets of values for the devices being a trust base for associations with the trusted sponsor device; generating a secure pair of channels including a first secure channel between the trusted sponsor device and a first device and a second secure channel between the trusted sponsor device and a second device, the secure pair of channels being located within the sponsor facility, the first secure channel generated based on a first symmetric key determined from the subset of values for the first device, the second secure channel generated based on a second symmetric key determined from the subset of values for the second device; introducing, by the sponsor device, the first device and the second device to each other by receiving a symmetric disposable key from the first device over the first secure channel and providing the disposable key to the second device over the second secure channel, the disposable key is encrypted by the first device using the first symmetric key and sent to the trusted sponsor device, decrypted by the trusted sponsor device using the first symmetric key, and encrypted by the trusted sponsor device using the second symmetric key and sent to the second device to be decrypted by the second device using the second symmetric key; configuring the first and second device to generate a temporary secure channel therebetween using the disposable key to encrypt communications therebetween and are configured to exchange a randomly-selected subset of the large set of values over the temporary secure channel, the subset of values comprising split keys used in generation of a larger set of symmetric connection keys for use in subsequent secure communications directly between the first and second devices; configuring the first and second device to use one or more key masks to create the symmetric connection keys from the exchanged split keys for secure communications directly therebetween, the symmetric connection keys being generated by mapping bits of two split keys to positions based on a key mask, and wherein the randomly-selected subset of values exchanged between the first and second devices becomes a trust base for an association between the first and second device.