Method and system for exchanging cryptographic keys with an unauthenticated device
The present teaching relates to exchanging a key with a device. In one example, a secret value is generated. A message is transmitted to the device. The message includes information related to the secret value based on which the device is to create a cryptographic key. A visual code displayed on the device is captured. The visual code includes a first piece of information and a second piece of information. A key value is generated based on the first piece of information and the secret value. A test value is calculated based on the key value. It is determined whether the device is securely connected based on the test value.
1. A method, implemented on a machine having at least one processor, storage, and a communication platform connected to a network for exchanging a key with a device, the method comprising:
generating a visual code including first information and second information;
providing, for display, the visual code to be captured by the device;
receiving a coded value from the device, wherein the coded value is calculated by the device based on the second information;
determining whether a message received from the device is verified based on the coded value;
transmitting, in response to the message being verified, third information to the device; and
dropping the message in response to the message being unverified.
2. The method of claim 1 , wherein the message is received over an insecure channel on the network.
3. The method of claim 1 , wherein the visual code is a one-dimensional barcode or two-dimensional barcode and is to be scanned by the device with a camera.
4. The method of claim 1 , wherein the device is configured to calculate a test value based on the first information and determine whether the device is securely connected based on the test value.
5. The method of claim 4 , further comprising:
determining whether the device is securely connected by:
comparing the test value with a check value included in the third information to generate a comparison result; and
determining whether the device is securely connected based on the comparison result.
6. The method of claim 1 , further comprising:
obtaining an indication regarding whether the device is securely connected from a user who has access to the device.
7. A machine-readable tangible and non-transitory medium having instructions for exchanging a key with a device, wherein the instructions, when read by the machine, causes the machine to perform the following:
generating a visual code including first information and second information;
providing, for display, the visual code to be captured by the device;
receiving a coded value from the device, wherein the coded value is calculated by the device based on the second information;
determining whether a message received from the device is verified based on the coded value;
transmitting, in response to the message being verified, third information to the device; and
dropping the message in response to the message being unverified.
8. The machine-readable tangible and non-transitory medium of claim 7 , wherein the message is received over an insecure channel on the network.
9. The machine-readable tangible and non-transitory medium of claim 7 , wherein the visual code is a one-dimensional barcode or two-dimensional barcode and is to be scanned by the device with a camera.
10. The machine-readable tangible and non-transitory medium of claim 7 , wherein the device is configured to calculate a test value based on the first information and determine whether the device is securely connected based on the test value.
11. The machine-readable tangible and non-transitory medium of claim 10 , further comprising:
determining whether the device is securely connected by:
comparing the test value with a check value included in the third information to generate a comparison result; and
determining whether the device is securely connected based on the comparison result.
12. The machine-readable tangible and non-transitory medium of claim 7 , further comprising:
obtaining an indication regarding whether the device is securely connected from a user who has access to the device.
13. A system, having at least one processor, storage, and a communication platform connected to a network for exchanging a key with a device, the system comprising:
a visual code generator implemented by the at least one processor and configured for generating a visual code including first information and second information;
an input/output unit implemented by the at least one processor and configured for providing, for display, the visual code to be captured by the device;
a communication unit implemented by the at least one processor and configured for receiving a coded value from the device, wherein the coded value is calculated by the device based on the second information;
a message verification unit implemented by the at least one processor and configured for determining whether a message received from the device is verified based on the coded value;
wherein the communication unit is further configured for
transmitting, in response to the message being verified, third information to the device; and
dropping the message in response to the message being unverified.
14. The system of claim 13 , wherein the message is received over an insecure channel on the network.
15. The system of claim 13 , wherein the visual code is a one-dimensional barcode or two-dimensional barcode and is to be scanned by the device with a camera.
16. The system of claim 13 , wherein the device is configured to calculate a test value based on the first information and determine whether the device is securely connected based on the test value.
17. The system of claim 13 , further comprising:
a comparison unit implemented by the at least one processor and configured for:
comparing the test value with a check value included in the third information to generate a comparison result to determine whether the device is securely connected; and
determining whether the device is securely connected based on the comparison result.
18. The system of claim 13 , wherein the input/output unit is further configured for obtaining an indication regarding whether the device is securely connected from a user who has access to the device.