System and method of per-packet keying
View Patent ↗A method of per-packet keying for encrypting and decrypting data transferred between two or more parties, each party having knowledge of a shared key that allows a per-packet key to differ for each packet is provided. Avoiding the use of a static session key during encryption offers several advantages over existing encryption methods. For example, rejecting packets received with duplicate sequence numbers, or sequence numbers that are beyond a specified deviation range mitigates Replay Attacks.
1. A method of authenticating a client device to a remote lock device in preparation for per-packet keying, comprising:
generating, on a smart token of the client device, a first random number;
encrypting, on the client device, the first random number with a secret key to generate a first ciphertext;
transmitting, to the remote lock device, the first ciphertext and a serial number associated with the smart token in a first authentication packet via a network;
receiving, from the remote lock device, a second authentication packet comprising a second ciphertext via the network, wherein a second random number is encrypted with the secret key to generate the second ciphertext;
decrypting, on the client device, the received second ciphertext to yield the second random number; and
generating, on the client device, a session key using the first random number and the second random number,
whereby the client device employs the session key as a base session key to generate a per packet key, wherein a new per packet key is generated for each packet using the base session key and an offset value, wherein the offset is based on a random number that is incremented for each packet generated by:
generating a random number that is incremented for each packet starting with the number zero to form a sequence number;
encrypting the sequence number with the base session key to yield an initialization vector; and
concatenating the initialization vector with a two's complement of the initialization vector.
2. The method of claim 1 , wherein the secret key is pre-stored on the smart token.
3. The method of claim 1 , wherein the serial number uniquely identifies the smart token.
4. The method of claim 1 , further comprising the remote lock device using the serial number to access an enciphered version of the secret key.
5. The method of claim 4 , further comprising the remote lock device retrieving the enciphered version of the secret key from a lock database.
6. The method of claim 1 , wherein generating the session key further comprises concatenating the first random number and the second random number to generate a concatenated string.
7. The method of claim 6 , further comprising applying a hash function to the concatenated string.
8. The method of claim 1 , wherein the secret key is stored with the client device.
9. The method of claim 1 , wherein the secret key is unique to the client device.
10. A method of authenticating a client device to a remote lock device in preparation for per-packet keying, comprising the steps of:
receiving, from the client device, a first authentication packet comprising a serial number associated with a smart token coupled to the client device and a first ciphertext, wherein a first random number is encrypted with a secret key associated with the smart token to generate the first ciphertext;
retrieving, from a lock database, an enciphered version of the secret key associated with the smart token using the serial number;
decrypting, on the remote lock device, the enciphered version of the secret key to yield a plaintext version of the secret key;
decrypting, on the remote lock, the first ciphertext with the plaintext version of the secret key to yield the first random number;
generating, on the remote lock device, a second random number;
encrypting, on the remote lock device, the second random number with the plaintext version of the secret key to generate a second ciphertext;
transmitting, to the client device, the second ciphertext in a second authentication packet via a network; and
generating, on the remote lock device, a session key using the first random number and the second random number,
whereby the session key is used as a base session key to generate a per packet key, wherein a new per packet key is generated for each packet using the base session key and an offset value, wherein the offset is based on a random number that is incremented for each packet generated by:
generating a random number that is incremented for each packet starting with the number zero to form a sequence number;
encrypting the sequence number with the base session key to yield an initialization vector; and
concatenating the initialization vector with a two's complement of the initialization vector.
11. The method of claim 10 , wherein the secret key is pre-stored on the smart token.
12. The method of claim 10 , wherein the serial number uniquely identifies the smart token.
13. The method of claim 10 , wherein generating the session key further comprises concatenating the first random number and the second random number to generate a concatenated string.
14. The method of claim 10 , further comprising applying a hash function to the concatenated string.
15. The method of claim 10 , wherein the secret key is a unique secret key.
16. A system for authenticating devices in preparation for per-packet keying, comprising:
a smart-card enabled client computing device configured to:
generate a first random number on a smart token;
encrypt the first random number with a secret key to generate a first ciphertext;
transmit, to a remote lock device, the first ciphertext and a serial number associated with the smart token;
receive, from the remote lock device, a second ciphertext, wherein a second random number is encrypted with the secret key to generate the second ciphertext;
decrypt the second ciphertext to yield the second random number;
generate a session key using the first random number and the second random number; and
a data network for facilitating communication between the smart-card enabled client device and the remote device, whereby the client device uses the session key as a base session key to generate a per packet key, wherein a new per packet key is generated for each packet using the base session key and an offset value, wherein the offset is based on a random number that is incremented for each packet generated by:
generating a random number that is incremented for each packet starting with the number zero to form a sequence number;
encrypting the sequence number with the base session key to yield an initialization vector; and
concatenating the initialization vector with a two's complement of the initialization vector.
17. The system of claim 16 , wherein the secret key is pre-stored on the smart token.
18. The system of claim 16 , wherein the serial number uniquely identifies the smart token.
19. The system of claim 16 , wherein the session key is generated by concatenating the first random number and the second random number to generate a concatenated string.
20. The system of claim 19 , wherein a hash function is applied to the concatenated string.
21. The system of claim 16 , wherein the secret key is stored with the smart-card enabled client device.
22. The system of claim 16 , wherein the secret key is unique to the smart-card enabled client device.