Installation of a terminal in a secure system
A system comprising a terminal and a server, wherein the terminal is installed in the system by the server being configured to: identify the terminal; generate key generation data, comprising at least one data seed; distribute the at least one seed to the terminal; generate key data and meta data based on said at least one seed and a function; store an identifier for the terminal along with the key data and the meta data for the terminal, wherein the terminal is arranged to receive the at least one seed from the server; generate key data and meta data based on said at least one seed and the same function; store the key data and the meta data, wherein the key data and the meta data stored in the terminal are the same as the key data and the meta data stored in the server.
1. A system comprising a terminal and a server, wherein the terminal is installed in the system by the server, the server being configured to:
identify the terminal,
generate key generation data, comprising at least one data seed,
distribute the at least one data seed to the terminal,
generate key data, to be used for generating a symmetric encryption key, and meta data, to be used for generating an authentication token, based on said at least one data seed and a function for generating numbers, and
store an identifier for the terminal along with the key data and the meta data for the terminal,
wherein the terminal is arranged to:
receive the at least one data seed from the server;
generate key data and meta data based on said at least one data seed and the same function for generating numbers,
store the key data and the meta data, wherein the key data and the meta data stored in the terminal are the same as the key data and the meta data stored in the server, and
mutate any one of (i) the key data, (ii) the meta data, (iii) the symmetric encryption key or (iv) any combination of (i), (ii) and (iii).
2. The system according to claim 1 , wherein said terminal is configured to generate a symmetric encryption key based on the key data for the terminal and the key data for a second terminal to which a secure communication channel is to be established.
3. The system according to claim 1 , wherein said server ( 340 ) is configured to generate an identifier for the terminal ( 100 ), distribute the identifier to the terminal and then receive the identifier from the terminal and identify the terminal based on the identifier.
4. The system according to claim 1 , wherein the server is configured to:
generate a random encryption key,
distribute the random encryption key to the terminal, and
encrypt the at least one data seed with the random encryption key; and wherein the terminal is configured to:
receive the random encryption key,
receive the encrypted at least one data seed from the server, and
decrypt the at least one data seed with the random encryption key.
5. The system according to claim 1 , wherein the terminal is configured to
generate an authentication token based on the meta data, and
send the authentication token to the server, and wherein the server is configured to:
receive the authentication token and
authenticate the authentication token by comparing it to the meta data stored for the terminal.
6. The system according to claim 1 , wherein the system is an apparatus and the terminal is an external device to be installed in the apparatus and the apparatus is configured to execute the server or communicate with the server.
7. A method for use in a system comprising a terminal and a server, said method being for installing the terminal in the system, the method comprising:
the server identifying the terminal;
the server generating key generation data, comprising at least one data seed;
the server distributing the at least one data seed to the terminal;
the server generating key data, to be used for generating a symmetric encryption key, and meta data, to be used for generating an authentication token, based on said at least one data seed and a function for generating numbers;
the server storing an identifier for the terminal along with the key data and the meta data for the terminal;
the terminal receiving the at least one data seed from the server;
the terminal generating key data and meta data based on said at least one data seed and the same function for generating numbers;
the terminal storing the key data and the meta data, wherein the key data and the meta data stored in the terminal are the same as the key data and the meta data stored in the server; and
the terminal mutating any one of (i) the key data, (ii) the meta data, (iii) the symmetric encryption key or (iv) any combination of (i), (ii) and (iii).
8. A computer readable storage medium encoded with instructions that, when executed by a processor, performs the method according to claim 7 .
9. The system according to claim 1 , wherein the meta data is mutated at a predetermined time.
10. The system according to claim 9 , wherein the predetermined time is once a day.
11. The system according to claim 1 , wherein the key data is mutated at a session setup.
12. The system according to claim 1 , wherein the key data is mutated upon a prompt from the terminal during a session.
13. The system according to claim 1 , wherein the symmetric encryption key is mutated at a session setup.
14. The system according to claim 1 , wherein the symmetric encryption key is mutated upon a prompt from the terminal during a session.
15. The system according to claim 1 , the terminal further configured to setup a new session, wherein the terminal mutates any one of (i) the key data, (ii) the meta data, (iii) the symmetric encryption key or (iv) any combination of (i), (ii) and (iii) during a setup of a new session setup.
16. The system according to claim 1 , wherein the terminal adds a symmetric encryption key version to a communication package.
17. The system according to claim 16 , wherein the terminal sets the symmetric encryption key version to an initialization value at server setup.
18. The system according to claim 16 , wherein the terminal sets the symmetric encryption key version to an initialization value at server setup and the symmetric encryption key is mutated if the symmetric encryption key version is changed from the initialization value.
19. The system according to claim 1 , wherein the mutation of the symmetric encryption key is based on a cryptographic hash function using a current symmetric encryption key as input.
20. The method according to claim 7 , the terminal generating a symmetric encryption key based on the key data for the terminal and the key data for a second terminal to which a secure communication channel is to be established.
21. The method according to claim 7 , the server generating an identifier for the terminal, distributing the identifier to the terminal, receiving the identifier from the terminal, and identifying the terminal based on the identifier.
22. The method according to claim 7 , wherein the function for generating numbers is a cryptographic hash function.
23. The method according to claim 7 ,
the terminal:
generating an authentication token based on the meta data, and
sending the authentication token to the server; and
the server:
receiving the authentication token, and
authenticating the authentication token by comparing it to the meta data stored for the terminal.