Method and system for exchanging cryptographic keys with an unauthenticated device

1. A method, implemented on a machine having at least one processor, storage, and a communication platform connected to a network for exchanging a key with a device, the method comprising:

receiving a message from the device;

generating a secret value;

creating a cryptographic key based on the message and the secret value;

generating a visual code based on the secret value, wherein the visual code includes first information and second information; and

providing, for display, the visual code which is to be captured by the device, wherein the device is to calculate a test value based on the first information and determine whether the device is securely connected based on the test value.

2. The method of claim 1 , wherein the message is received over an insecure channel on the network.

3. The method of claim 1 , wherein the visual code is a one-dimensional barcode or two-dimensional barcode and is to be scanned by the device with a camera.

4. The method of claim 1 , wherein the test value is calculated by at least the following:

generating a key value based on the first information;

calculating a parameter based on a key derivation function and the key value; and

calculating the test value based on the parameter and a pseudorandom function.

5. The method of claim 1 , wherein whether the device is securely connected is determined by at least the following:

extracting a check value from the second information;

comparing the test value with the check value to generate a comparison result; and

determining whether the device is securely connected based on the comparison result.

6. The method of claim 1 , further comprising:

obtaining an indication regarding whether the device is securely connected from a user who has access to the device.

7. The method of claim 1 , further comprising:

receiving a coded value from the device over an insecure channel on the network, wherein the coded value is calculated by the device based on a first check value included in the second information;

determining whether the message is verified based on the message and the coded value;

transmitting third information to the device over an insecure channel on the network, when the message is verified; and

dropping the message when the message is not verified.

8. The method of claim 7 , wherein whether the device is securely connected is determined by at least the following:

extracting a second check value from the third information;

comparing the test value with the second check value to generate a comparison result; and

determining whether the device is securely connected based on the comparison result.

9. A system, having at least one processor, storage, and a communication platform connected to a network for exchanging a key with a device, the system comprising:

a communication unit configured for receiving a message from the device;

a secret value generator configured for generating a secret value;

a key value generator configured for creating a cryptographic key based on the message and the secret value;

a visual code generator configured for generating a visual code based on the secret value, wherein the visual code includes first information and second information; and

an input/output unit configured for providing, for display, the visual code which is to be captured by the device, wherein the device is to calculate a test value based on the first information and determine whether the device is securely connected based on the test value.

10. The system of claim 9 , wherein the message is received over an insecure channel on the network.

11. The system of claim 9 , wherein the visual code is a one-dimensional barcode or two-dimensional barcode and is to be scanned by the device with a camera.

12. The system of claim 9 , wherein the test value is calculated by at least one of the following:

generating a key value based on the first information;

calculating a parameter based on a key derivation function and the key value; and

calculating the test value based on the parameter and a pseudorandom function.

13. The system of claim 9 , wherein whether the device is securely connected is determined by at least the following:

an information extractor configured for extracting a check value from the second information; and

a comparison unit configured for:

comparing the test value with the check value to generate a comparison result; and

determining whether the device is securely connected based on the comparison result.

14. The system of claim 9 , wherein the input/output unit is further configured for:

obtaining an indication regarding whether the device is securely connected from a user who has access to the device.

15. The system of claim 9 , further comprising a message verification unit, wherein:

the communication unit is further configured for receiving a coded value from the device over an insecure channel on the network, wherein the coded value is calculated by the device based on a check value included in the second information;

the message verification unit is configured for determining whether the message is verified based on the message and the coded value;

the communication unit is further configured for transmitting third information to the device over an insecure channel on the network, when the message is verified; and

the message verification unit is further configured for dropping the message when the message is not verified.

16. The system of claim 15 , wherein whether the device is securely connected is determined by at least the following:

an information extractor configured for extracting a second check value from the third information; and

a comparison unit configured for:

comparing the test value with the second check value to generate a comparison result; and

determining whether the device is securely connected based on the comparison result.

17. A machine-readable tangible and non-transitory medium having instructions for exchanging a key with a device, wherein the instructions, when read by the machine, causes the machine to perform the following:

receiving a message from the device;

generating a secret value;

creating a cryptographic key based on the message and the secret value;

generating a visual code based on the secret value, wherein the visual code includes first information and second information; and

providing, for display, the visual code which is to be captured by the device, wherein the device is to calculate a test value based on the first information and determine whether the device is securely connected based on the test value.

18. The machine-readable tangible and non-transitory medium of claim 17 , wherein the visual code is a one-dimensional barcode or two-dimensional barcode and is to be scanned by the device with a camera.

19. The machine-readable tangible and non-transitory medium of claim 17 , wherein the instructions, when read by the machine, causes the machine to further perform the following:

obtaining an indication regarding whether the device is securely connected from a user who has access to the device.

20. The machine-readable tangible and non-transitory medium of claim 17 , wherein the instructions, when read by the machine, causes the machine to further perform the following:

receiving a coded value from the device over an insecure channel on the network, wherein the coded value is calculated by the device based on a first check value included in the second information;

determining whether the message is verified based on the message and the coded value;

transmitting third information to the device over an insecure channel on the network, when the message is verified; and

dropping the message when the message is not verified.