FIELD OF THE INVENTION

The invention relates to generating key inside a device, and more particularly to a system and a method for generating secure key inside a device employing a seed pusher.

BACKGROUND

Generally, a key is used to encrypt or decrypt a data, and is generated inside a device. Generating such key is initiated using a seed, which is a number or a vector that is used in generating key pseudo-randomly. Hence the choice of a good random seed or a high entropy seed having higher degree of randomness is crucial to generate a secure key.

Typically in the present practices, the device accesses the high entropy seed from the Hardware Security Module (HSM) through the communication bus that are secured. This requires an additional hardware component, namely the HSM to be deployed into the device. Owing to the additional cost, and to the constraints in accommodating such additional hardware component into the legacy devices, there is a need for a solution that eliminates the need for additional hardware component in the devices. Also, the validity and authenticity of the device requesting for the seed during the initial participation of the device poses a threat, as to the malicious device may request for such seed from the HSM. This compromises on the security by which the key is generated by the device.

The invention is aimed at providing a solution that eliminates the need for additional hardware component inside the device(s) to access the high entropy seed, and to generate a secure key.

OBJECTS OF THE INVENTION

It is an object of the invention to provide a system for generating secure key, in which additional hardware component in the device for accessing the seed is eliminated.

It is also an object of the invention to provide a system for generating secure key, having a seed pusher to provide high entropy seed required for generating key securely by the device. Another object of the invention is to provide a system for generating secure key, in which the device and the seed pusher are authenticated and certified, to establish secure communication channel and of its participation thereof to generate secure key.

Yet another object of the invention is to provide a method for generating secure key by the system of the invention.

SUMMARY OF THE INVENTION

Accordingly the invention provides a system for generating a secure key. The system of the invention comprises one or more devices that coordinate with the engineering tool correspondingly. The system has at least one seed pusher for providing a seed to the device in order to generate a secure key.

Accordingly the invention also provides a method for generating a secure key by the system of the invention. The method of the invention comprises the steps of checking the validity and / or the authenticity of at least one device requesting the other seed and of the engineering tool, obtaining the certificate of enrollment for the device. The method also comprises establishing secure communication channel between the device and seed pusher, and providing the seed to the device by the said seed pusher for generating a secure key by the device.

BRIEF DESCRIPTION OF THE DRAWINGS

With reference to the accompanying drawings in which:

Fig. 1 shows a system for generating secure key in accordance with the invention; and

Fig. 2 illustrates the transaction between the device and the seed pusher in accordance with the invention.

DETAILED DESCRIPTION

The invention is hereinafter described with reference to Figs. 1 and 2 through a non-exhaustive exemplary embodiment.

In Figs. 1 and 2, the system for generating secure key and the transaction between the device and the seed pusher of the system, in accordance with the invention are shown. The system (100) for for generating secure key has atleast one device (101) that requires a first key, referred hereinafter as other key to obtain certificate of enrollment, in order to establish itself as a trusted device. The device (101) requests for a seed (110), hereinafter referred to as other seed, to the engineering tool (102).

The engineering tool (102) performs the function of engineering, commissioning or the like as required. The engineering tool (102) upon the request for other seed from the device (101) checks the validity or the authenticity (111) of the device (101) by verifying the credentials of the device (101) in its database or the like. Upon successful verification, and finding the device (101) to be a valid and an authenticated device, the engineering tool (102) provides the other seed (112) to the device (101) for generating the other key to obtain certificate of enrollment, and also the information regarding the seed pusher (103) such as IP address etc, through a secure communication channel. By this, the challenge of authenticating a device during the initial stages in the absence of a certificate of enrollment in respect of the device is addressed. The engineering tool (102) also offloads the task of seed management (113) to seed pusher (103), which resides as a part of the engineering tool (102) or external to it.

The device (101) based on the information received from the engineering tool (102) about the seed pusher (103), identifies the corresponding seed pusher (103) and requests for a seed (210) to the identified seed pusher (103). The seed pusher (103) makes a request (211) to the device (101) for the certificate of enrollment of the device (101). The device (101) provides its certificate of enrollment (212) to the seed pusher (103), where the certificate of enrollment of the device (101) is verified (213) by the seed pusher (103). Also, the device (101) makes a similar request (214) to the seed pusher (103) for the certificate of enrollment of the seed pusher (103). The seed pusher (103) provides its certificate of enrollment (215) to the device (101) only if the certificate of enrollment of the device (101) is found valid through its verification (213). Similarly, the device (101) also verifies (216) the certificate of enrollment of the seed pusher (103). Upon successful verification (216) of the certificate of enrollment of the seed pusher (103) by the device (101), the device (101) and the seed pusher (103) establishes (217) a secure communication channel. The secure communication channel is based on protocol such as Secure Sockets Layer (SSL) or Transport Layer Security (TLS) or the like. The seed pusher then generates a seed (218) and provides the generated seed over the secure communication channel (219) to the device (101). The seed and the other seed referred hereinabove have high degree of randomness rendering them to be a high entropy seed. The seed provided to the device (101) through step (219) is utilized for generating the key to encrypt and / or decrypt data or for future certificate enrollment. (101).

The invention therefore provides a system with which a high entropy seed can be provided to generate a highly randomized key that is secure, in an environment or application having resource constraints. Besides this, the need for an additional hardware component in a device to access or obtain the seed is eliminated. By this, the invention provides a suitable solution through deployment of a seed pusher, wherein the existing devices in an environment such as substation etc., does not require an additional hardware component as required currently, to have a high entropy seed to generate a highly randomized key. Since the system is performing based on the certificate of enrolment of each of the participating components like the device, engineering tool, seed pusher etc., the trust between each of these components is built therefore eliminating the risk in relation to the compromise of the security or of its breach. Thus, the invention holistically provides a secure system and workflow to generate a high entropy seed with which a highly randomized key is generated.

Only certain features of the invention have been specifically illustrated and described herein, and many modifications and changes will occur to those skilled in the art. The invention is not restricted by the preferred embodiment described herein in the description. It is to be noted that the invention is explained by way of exemplary embodiment and is neither exhaustive nor limiting. Certain aspects of the invention that not been elaborated herein in the description are well understood by one skilled in the art. Also, the terms relating to singular form used herein in the description also include its plurality and vice versa, wherever applicable. Any relevant modification or variation, which is not described specifically in the specification are in fact to be construed of being well within the scope of the invention. The appended claims are intended to cover all such modifications and changes which fall within the spirit of the invention.

Thus, it will be appreciated by those skilled in the art that the present invention can be embodied in other specific forms without departing from the spirit or essential characteristics thereof. The presently disclosed embodiments are therefore considered in all respects to be illustrative and not restricted. The scope of the invention is indicated by the appended claims rather than the foregoing description and all changes that come within the meaning and range and equivalence thereof are intended to be embraced therein.