Aerosol-generating device with encrypted data management

Abstract

An aerosol generating device comprises: a storage unit in which a secret value and a unique identification value are stored; a communication unit; and a controller configured to create usage data indicative of a usage of the aerosol-generating device, derive an encryption key from at least the stored secret value and optionally the unique identification value, encrypt the created usage data with the derived encryption key, and transmit the encrypted usage data to the aerosol-generating device. The encrypted usage data is stored in the storage unit, and the encrypted usage data and the unique identification value are transmitted to an external device via the communication unit.

Description

Technical Field

[0001] The present disclosure relates to an aerosol generating device, and in particular to an aerosol generating device for creating, storing and sending usage data, as well as a system comprising an aerosol generating device and a server, a method for operating the aerosol generating device, a method for sending data from the aerosol generating device to a server and a method for manufacturing an aerosol generating device. Background Art

[0002] Aerosol generating devices that generate an inhalable aerosol by heating a liquid or solid precursor material, such as an e-cigarette or risk reduction device, create and store usage data during operation. The usage data may relate to the functional operation and status of the device and consumer use of the device. Examples include aerosol generation, temperature, battery level, events and errors. Some of this data may be transmitted to a manufacturer server.

[0003] There are several reasons why the usage data thus created needs to be protected. First, data protection regulations may dictate measures to protect customer privacy. In addition, ensuring confidentiality of functional information protects the manufacturer from letting competitors know how a device works or how well it performs. It also avoids opening the manufacturer ecosystem to malicious or poor quality third-party services, which would diminish the customer experience. Furthermore, ensuring the integrity and authenticity of the data collected at the manufacturer's servers protects those servers from being contaminated by false or compromised information uploaded maliciously or accidentally.

[0004] Therefore, there is a need to protect the data stored in an aerosol generating device and ensure the confidentiality of the data records, both within the device and when transmitted externally. In addition, there is a need to protect the servers that collect data from the aerosol generating device from being contaminated by false or compromised information.

[0005] There are a variety of cryptographic algorithms known in the art for data encryption, decryption, and authentication. Many of these algorithms are at least one of computationally complex, unsuitable for implementation in embedded systems, or insecure. Summary of the invention

[0006] An object of the present invention is to provide an aerosol generating device and a corresponding method and system, which is capable of protecting its usage data without unduly increasing the complexity and manufacturing costs and without any usability restrictions.

[0007] This is achieved by the features of the independent claim. Preferred embodiments are the subject matter of the dependent claims.

[0008] A particular method of the invention is to provide each aerosol generating device with a unique identifier and a secret value, which are stored within the device. The device uses at least the secret value to derive an encryption key to encrypt its usage data. The encrypted usage data and unique identifier can be sent to a manufacturer server. The manufacturer server has access to a database that stores the secret value associated with the unique identifier. Thus, the manufacturer server can retrieve the secret value from the database and derive the encryption key to decrypt the encrypted usage data sent from the device.

[0009] According to a first aspect of the present invention, there is provided an aerosol generating device, comprising a storage unit in which a secret value and a unique identification value are stored. The aerosol generating device further comprises a communication unit and a controller. The controller is configured to create usage data indicating usage of the aerosol generating device, derive an encryption key from at least the stored secret value and optionally the unique identification value, encrypt the created usage data using the derived encryption key, store the encrypted usage data in the storage unit, and send the encrypted usage data and the unique identification value to an external device via the communication unit.

[0010] According to a second aspect of the present invention, there is provided a method for operating an aerosol generating device. The method comprises the following steps: storing a secret value and a unique identification value in a storage unit of the aerosol generating device; creating usage data indicating usage of the aerosol generating device; deriving an encryption key from at least the stored secret value and optionally the unique identification value; encrypting the created usage data using the derived encryption key; storing the encrypted usage data in the storage unit; and sending the encrypted usage data and the unique identification value to an external device via a communication unit.

[0011] By deriving the encryption key from a secret value stored in the aerosol generating device, there is no need to implement a complex protocol for exchanging keys between the aerosol generating device and an external device such as a manufacturer's server. Storing a unique identification value within the aerosol generating device and sending it to an external device together with the encrypted usage data allows the external device to derive an appropriate encryption key, even if different aerosol generating devices use different encryption keys to encrypt their usage data. Using different encryption keys for different aerosol generating devices ensures that the encrypted usage data of an aerosol generating device remains secure even if another aerosol generating device is damaged or its secret value is leaked.

[0012] The term "derive" is used herein to refer to obtaining or determining "A" (e.g., a cryptographic key) from "B" (e.g., a secret value). In one example, "A" is directly derived from "B", e.g., where "A" is equal to "B" or is at least a portion of "B". In another example, "A" is indirectly derived from "B", e.g., by performing an operation on "B" to obtain "A".

[0013] Preferably, the controller and / or the method are further adapted to derive an authentication key from at least the secret value and optionally the unique identification value, and to authenticate the stored usage data using the derived authentication key.

[0014] Providing the usage data with a (cryptographic) authentication code allows the usage data to be authenticated and intentional or accidental modification to be detected.By deriving the authentication key from a secret value stored in the aerosol generating device, no additional protocol is required for providing each aerosol generating device with a dedicated authentication key.

[0015] Preferably, the unique identification value comprises at least one of a product identifier, a platform identifier, a unique device identifier, and a manufacturing site identifier.

[0016] Providing product-related information instead of or in combination with a unique device identifier, such as a serial number, as a unique identification value enables the external device to easily understand which type of aerosol generating device it is communicating with.

[0017] Preferably, the secret value is a random value generated during a manufacturing stage of the aerosol generating device.

[0018] An advantage of using a random number as a secret value is that the secret value of an aerosol generating device cannot be derived from a (leaked) secret value of another aerosol generating device, thereby further strengthening the system against possible cryptographic attacks. Generating the secret value during the manufacturing stage of the aerosol generating device allows appropriate precautions to be taken in order to ensure the security of this sensitive information.

[0019] Preferably, the aerosol generating device further comprises a sensor for detecting an operating state of the aerosol generating device. Thus, the controller and / or the method may be adapted to create the usage data based on the detected operating state. Various types of sensors may be used, in particular sensors configured to detect an interaction of a user with the aerosol generating device, sensors configured to detect a puff performed by a user of the aerosol generating device, sensors configured to detect a voltage, current, resistance, charge, energy or temperature associated with an aerosol generating unit of the aerosol generating device, sensors for detecting a voltage, current, resistance, charge, energy or temperature associated with a power supply of the aerosol generating device, sensors for detecting a voltage, current, resistance, charge, energy or temperature associated with a charging device connected to the aerosol generating device, and / or sensors for detecting a type or amount of consumable material used by the aerosol generating unit.

[0020] Thus, different types of sensors allow for the detection of different kinds of usage information that may be relevant to the user and / or the manufacturer. For example, the usage data may include an indication of at least one of the following:

[0021] the start time, duration, end time, or type of user interaction,

[0022] the start time, duration or end time of a puff, or the number of puffs, performed by a user of the aerosol generating device,

[0023] a start time, a duration or an end time of a charging operation performed by the user by connecting the aerosol generating device to a charging device, or the number of charging operations,

[0024] a voltage, current, resistance, charge, energy or temperature associated with an aerosol generating unit of the aerosol generating device at the beginning of, during or at the end of a puff taken by a user of the aerosol generating device,

[0025] a voltage, current, resistance, charge, energy or temperature associated with a power source of the aerosol generating device at the beginning of, during or at the end of a puff taken by a user of the aerosol generating device,

[0026] a voltage, current, resistance, charge, energy or temperature associated with a power source of the aerosol generating device at the beginning of a charging operation, during said charging operation or at the end of said charging operation,

[0027] The type or amount of consumable material used by the aerosol generating unit.

[0028] Preferably, the controller and / or the method are adapted to store the encrypted usage data in a payload section of a data record. Each data record may include a header, a payload section and an authentication section. Furthermore, each header may include a first data field indicating the format of the data record and a second data field indicating the length of the data record.

[0029] Using a predefined data format to store and / or send the usage data allows defining a software interface between the aerosol generating device and the external device, so that the software on the aerosol generating device side and the external device side can be developed and maintained independently of each other. In addition, different types of aerosol generating devices can use the same data format, thereby improving the interoperability of different devices.

[0030] Preferably, each data record may also be associated with a record index. Thus, a record index may be used to manage a plurality of different data records stored within the aerosol generating device. The record index may also be used as (part of) a unique identifier (record unique identity, RUID) for each data record sent from the aerosol generating device to the external device.

[0031] Preferably, each header further comprises a third data field indicating how many times the record index has been rolled over. In this way, each data record is uniquely identified even if the record index is only used internally by the aerosol generating device to manage data records and some old data records have been overwritten by the most recent data records.

[0032] Preferably, the controller and / or the method is adapted to employ a symmetric key algorithm to encrypt the created usage data. Preferably, AES is employed as the symmetric key algorithm.

[0033] Compared to asymmetric key based algorithms, symmetric key algorithms are significantly less complex both in terms of key generation / distribution and encryption / decryption. Among conventional symmetric key algorithms, AES is a mature algorithm that is particularly suitable for implementation in embedded systems.

[0034] Preferably, the controller and / or the method are adapted to derive an initialisation vector from the secret value and / or the unique identification value and to encrypt the created usage data by applying a block cipher in counter mode using the encryption key and the initialisation vector.

[0035] Applying a block cipher in counter mode is a secure method for applying a block cipher to variable length blocks of data and allows for low complexity implementation on both the encryption side and the decryption side. By deriving an initialization vector for the counter mode from a secret value and / or a unique identification value, no additional information needs to be stored and / or sent.

[0036] Preferably, the controller and / or the method are adapted to employ a hash-based key derivation function HKDF to derive the initialization vector from the secret value and / or the unique identification value. Specifically, the controller and / or the method may preferably be adapted to derive the initialization vector from the secret value and / or the unique identification value using a salt, the salt comprising at least one of a predefined value, a value of a record index associated with a data record containing the created usage data, a type of the data record, and at least a portion of a message authentication code MAC calculated for the created usage data.

[0037] HKDF provides a secure means of deriving key material of arbitrary length from input key material of finite length. Security is further improved by using a salt comprising a predefined value, in particular by using a salt comprising at least one of the value of a record index associated with a data record containing the created usage data, the type of the data record, and at least a portion of a message authentication code MAC calculated for the created usage data. In this way, different initialization vectors are used for different data records, thereby further strengthening the system's resistance to cryptanalysis by significantly reducing the amount of ciphertext encrypted with the same key. Ensuring that the initialization vector is derived or constructed from characteristics of the payload prevents the generation of duplicate initialization vectors in the event that an attack may successfully force the use of duplicate record indexes or unique record identifiers (RUIDs).

[0038] Preferably, the controller and / or the method are suitable for authenticating the created usage data by calculating a message authentication code MAC of the created usage data. Specifically, the controller and / or the method can be configured to calculate the MAC of the created usage data based on the created usage data and based on the first authentication key.

[0039] Computing a MAC of the created usage data (ie the plaintext usage data) allows the MAC to be used as an additional input to the key derivation function, thereby ensuring that different keys and / or initialization vectors are used for different usage data items.

[0040] Preferably, the controller and / or the method are adapted to authenticate the encrypted usage data by calculating a MAC of the encrypted usage data. In particular, the controller and / or the method may be adapted to calculate a MAC of the encrypted usage data based on the encrypted usage data and based on a second authentication key. The controller and / or the method may also be adapted to calculate a MAC of the encrypted usage data based on the encrypted usage data, based on the created MAC of the usage data and based on the second authentication key.

[0041] Computing the MAC of the encrypted usage data instead of or in addition to the MAC of the plaintext usage data further hardens the system against cryptanalysis, since tampered data records may be detected before decryption. In this way, cryptographic attacks based on manipulated ciphertext may be thwarted. Computing the MAC of the encrypted usage data not only from the encrypted usage data and the second authentication key, but also from the MAC of the created usage data further increases security against spoofing attacks by allowing the MAC of the created usage data to be authenticated as well.

[0042] Preferably, the controller and / or the method are adapted to derive the first authentication key and / or the second authentication key from the secret value and / or the unique identification value.

[0043] By deriving the authentication key from a secret value stored in the aerosol generating device, no additional protocol is required for providing each aerosol generating device with a dedicated authentication key.

[0044] Preferably, the controller and / or the method is adapted to calculate the MAC of the created usage data and / or the MAC of the encrypted usage data using a hash function. Furthermore, the controller and / or the method may be adapted to calculate the MAC of the created usage data and / or the MAC of the encrypted usage data by truncating the output of the hash function to a predefined number of bytes. Furthermore, the controller and / or the method may be adapted to store the MAC of the created usage data and / or the MAC of the encrypted usage data in the storage unit together with the encrypted usage data.

[0045] Using a limited number of bytes truncated from the output of the hash function, in particular two, three or four bytes, as a MAC of the created usage data and / or a MAC of the encrypted usage data provides an optimal compromise between the amount of additional storage capacity required to store the MAC and the level of security against tampering of the usage data that can be achieved.

[0046] Preferably, the controller and / or the method are adapted to employ a hash-based key derivation function HKDF to derive at least one of an encryption key for encrypting the created usage data, an initialization vector for encrypting the created usage data with a block cipher in counter mode, and an authentication key for authenticating the usage data from the secret value and / or the unique identification value. Specifically, at least a portion of the secret value and / or the unique identification value may be used as input key material for the key derivation function.

[0047] A hash-based key derivation function is a particularly effective means of deriving cryptographically secure keys from a limited amount of input key material. Inclusion of at least a portion of the secret value and / or the unique identification value into the process of deriving the encryption key, the initialization vector or the authentication key ensures that each aerosol generating device uses a different key to encrypt and / or authenticate its user data. Thus, the overall security of a system comprising multiple aerosol generating devices is significantly improved by reducing the amount of ciphertext encoded and / or authenticated with the same key.

[0048] Preferably, a salt is used together with at least a portion of the secret value and / or the unique identification value as input key material to the key derivation function.Furthermore, a fixed salt may be used to derive the encryption key and / or the authentication key.

[0049] The use of salts, random data used as an additional input to the hash function, further improves cryptographic security, in particular by hardening the system against attacks based on pre-computed hash chains.

[0050] Preferably, a predefined subset of the bit representation of the secret value can be used as input key material to the key derivation function together with the unique identification value and the salt. Furthermore, the predefined subset of the bit representation of the secret value used as input key material for deriving the encryption key and / or the authentication key is preferably different from the predefined subset of the bit representation of the secret value used as input key material for deriving the initialization vector.

[0051] Deriving the encryption key and the authentication key from different subsets of the bit representation of the secret value may further strengthen the system's resistance to cryptanalysis.

[0052] Preferably, at least a part of a message authentication code MAC calculated from the created usage data is used as a salt for deriving said initialization vector.

[0053] In this way, different salts are used to derive initialization vectors for different usage data items, effectively producing different keys for encrypting those usage data items.

[0054] Preferably, a first portion of output key material generated by said key derivation function is used as said encryption key, and a second portion of said output key material different from said first portion is used as said authentication key.

[0055] In this way, a single call to the key derivation function is sufficient to generate both the encryption key and the authentication key.

[0056] Preferably, the controller and / or the method are adapted to send the encrypted usage data together with an authentication code of the encrypted usage data to an external device via the communication unit.

[0057] In this way, the external device can verify the authentication code of the encrypted data in order to authenticate the transmitted usage data.

[0058] In the context of the present disclosure, the external device may be any device that can be communicatively coupled to the aerosol generating device, such as a charging station, a docking station, a mobile terminal, a personal computer, a host computer, and a server. In addition, the data communication between the aerosol generating device and the external device may be based on any suitable communication protocol and / or medium, including but not limited to data cable, near field communication, Bluetooth, BLE, WiFi, etc.

[0059] According to a third aspect of the present invention, there is provided an aerosol generating system, comprising an aerosol generating device according to the first aspect of the present invention, a database configured to store a unique identification value of each of a plurality of aerosol generating devices in association with a secret value of the aerosol generating device, and a server. The server is configured to receive encrypted usage data and the unique identification value of the aerosol generating device from the aerosol generating device, retrieve a secret value associated with the unique identification value from the database using the unique identification value, and decrypt the encrypted usage data using the retrieved secret value.

[0060] Providing a database storing unique identification values ​​for each of a plurality of aerosol generating devices in association with corresponding secret values ​​allows a server to retrieve the corresponding secret value using the unique identification value received from the aerosol generating device. Once the server is in possession of the secret value, encrypted data received from the aerosol generating device can be decrypted. In this way, a secure exchange can be established between the aerosol generating device and the server without establishing an encrypted secure channel, without including the secret value in any message exchanged between the server and the aerosol generating device, and without implementing complex algorithms for secure key exchange.

[0061] According to a fourth aspect of the present invention, there is provided a method for manufacturing an aerosol generating device according to the first aspect of the present invention. The method comprises the following steps: generating a secret value and a unique identification value; writing the secret value and the unique identification value into a storage unit of the aerosol generating device; and storing the secret value in association with the unique identification value in a database for each of a plurality of aerosol generating devices.

[0062] By providing each aerosol generating device with a secret value and a unique identification value, the aerosol generating device can encrypt its usage data using a device-specific key. At the same time, the aerosol generating device can identify itself in a communication session with a server by means of the unique identification value. Storing the unique identification value of each of a plurality of aerosol generating devices in association with the corresponding secret value in a database allows the server to retrieve the corresponding secret value using the unique identification value received from the aerosol generating device and to decrypt the usage data using the retrieved secret value. In this way, secure exchanges can be performed between the aerosol generating device and the server without establishing an encrypted secure channel, without including the secret value in any message exchanged between the server and the aerosol generating device, and without implementing complex algorithms for secure key exchange.

[0063] Preferably, the unique identification value comprises at least one of a product identifier, a platform identifier, a unique device identifier, and a manufacturing site identifier.

[0064] Providing product-related information instead of or in combination with a unique device identifier, such as a serial number, as a unique identification value enables the server to easily understand which type of aerosol generating device it is communicating with.

[0065] Preferably, the secret value is a random number generated by the aerosol generating device during a manufacturing stage.

[0066] An advantage of using a random number as a secret value is that the secret value of an aerosol generating device cannot be derived from a (leaked) secret value of another aerosol generating device, thereby further strengthening the system against possible cryptographic attacks. Generating the secret value during the manufacturing stage of the aerosol generating device allows appropriate precautions to be taken in order to ensure the security of this sensitive information.

[0067] The method may further comprise the step of sending the generated random number from the aerosol generating device (preferably in encrypted form) to a host computer.The host computer may then be responsible for storing the secret value in the database in association with the unique identification value.

[0068] According to a fifth aspect of the present invention, there is provided a method for sending usage data from an aerosol generating device to a host. A secret value and a unique identification value are stored in the aerosol generating device. The method comprises the following steps: receiving the unique identification value from the aerosol generating device at the host, retrieving the secret value of the aerosol generating device from a database, wherein the secret value of each of a plurality of aerosol generating devices is stored in the database in association with the corresponding unique identification value. The method further comprises the following steps: deriving an encryption key at the host from at least the retrieved secret value and optionally the received unique identification value. The method further comprises the following steps: receiving encrypted usage data from the aerosol generating device at the host, and decrypting the received encrypted usage data using the encryption key.

[0069] By only sending the unique identification value from the aerosol generating device to the host and retrieving the secret value of the aerosol generating device from the database, secure data exchange can be performed between the aerosol generating device and the host without establishing an encrypted secure channel, without including the secret value in any message exchanged between the host and the aerosol generating device, and without implementing complex algorithms for secure key exchange.

[0070] Preferably, the method further comprises the steps of: deriving an authentication key at the host from at least the retrieved secret value and optionally the unique identification value; receiving a first message authentication code MAC from the aerosol generating device together with the encrypted usage data at the host; calculating a second MAC based on the decrypted usage data and the derived authentication key; and comparing the first MAC and the second MAC.

[0071] Computing a second MAC at the host based on the decrypted usage data and comparing this MAC to the first MAC received along with the encrypted usage data allows the host to authenticate the received usage data, detect unintentional modifications to the received usage data, and thwart spoofing attacks by malicious devices.

[0072] Preferably, the method further comprises the step of deriving an initialization vector, wherein the received encrypted usage data is decrypted by applying a block cipher in counter mode using the encryption key and the initialization vector. In addition, the initialization vector can preferably be derived from the unique identification value, the secret value and the first MAC.

[0073] In this way, the encrypted usage data can be decrypted even if the aerosol generating device applies a block cipher in counter mode, which is a secure method for applying a block cipher to data blocks of variable length and allows a low complexity implementation on both the encoder and decoder side.

[0074] Preferably, the encrypted usage data is included in a payload section of a data record having a unique record identifier.In this case, the initialisation vector may preferably be derived from the unique identification value, the secret value, the first MAC and the unique record identifier.

[0075] In this way, the unique record identifier may be used to request a specific piece of usage information from the aerosol generating device and / or to further increase data security by effectively using different keys for different data records.

[0076] According to a sixth aspect of the present invention, there is provided a host computer having a processing unit and a memory, wherein the memory stores computer-readable instructions, and wherein the computer-readable instructions, when executed by the processing unit, are suitable for executing all steps of the method according to the fifth aspect of the present invention.

[0077] The invention is defined in the claims. However, a non-exhaustive list of non-limiting examples is provided below. Any one or more features of these examples may be combined with any one or more features of another example, embodiment or aspect described herein.

[0078] Example Ex1: An aerosol generating device, comprising: a storage unit, in which a secret value and a unique identification value are stored; a communication unit; and a controller, wherein the controller is configured to: create usage data indicating the usage of the aerosol generating device, derive an encryption key from at least the stored secret value and optionally the unique identification value, encrypt the created usage data using the derived encryption key, store the encrypted usage data in the storage unit, and send the encrypted usage data and optionally the unique identification value to an external device via the communication unit.

[0079] Example Ex2: An aerosol generating device according to Ex1, wherein the controller is further configured to derive an authentication key from at least the secret value and optionally the unique identification value, and to authenticate the stored usage data using the derived authentication key.

[0080] Example Ex3: An aerosol generating device according to any of the preceding examples, wherein the unique identification value comprises at least one of a product identifier, a platform identifier, a unique device identifier, and a manufacturing site identifier.

[0081] Example Ex4: An aerosol generating device according to any of the preceding examples, wherein the secret value is a random value generated during the manufacturing stage of the aerosol generating device.

[0082] Example Ex5: An aerosol generating device according to any of the preceding examples, comprising a sensor for detecting an operating state of the aerosol generating device.

[0083] Example Ex6: An aerosol generating device according to the previous example, wherein the controller is configured to create the usage data based on the detected operating state.

[0084] Example Ex7: An aerosol generating device according to the previous example, wherein the sensor includes one of the following: a sensor configured to detect interaction of a user with the aerosol generating device, a sensor configured to detect a puff performed by a user of the aerosol generating device, a sensor configured to detect a voltage, current, resistance, charge, energy or temperature associated with an aerosol generating unit of the aerosol generating device, a sensor for detecting a voltage, current, resistance, charge, energy or temperature associated with a power supply of the aerosol generating device, a sensor for detecting a voltage, current, resistance, charge, energy or temperature associated with a charging device connected to the aerosol generating device, and a sensor for detecting the type or amount of consumable material used by the aerosol generating unit.

[0085] Example Ex8: An aerosol generating device according to any of the preceding examples, wherein the usage data includes an indication of at least one of the following: a start time, duration, end time or type of user interaction; a start time, duration or end time of a puff performed by a user of the aerosol generating device, or the number of puffs; a start time, duration or end time of a charging operation performed by the user by connecting the aerosol generating device to a charging device, or the number of charging operations; a voltage, current, resistance, charge, energy or temperature associated with an aerosol generating unit of the aerosol generating device at the start of, during or at the end of a puff performed by the user of the aerosol generating device; a voltage, current, resistance, charge, energy or temperature associated with a power source of the aerosol generating device at the start of, during or at the end of a puff performed by the user of the aerosol generating device; a voltage, current, resistance, charge, energy or temperature associated with a power source of the aerosol generating device at the start of, during or at the end of a charging operation; a type or amount of consumable material used by the aerosol generating unit.

[0086] Example Ex9: An aerosol generating device according to any of the preceding examples, wherein the controller is configured to store encrypted usage data in a payload section of the data record.

[0087] Example Ex10: An aerosol generating device according to the previous example, wherein each data record includes a header, the payload section and an authentication section.

[0088] Example Ex11: An aerosol generating device according to the previous example, wherein each header includes a first data field indicating the format of the data record and a second data field indicating the length of the data record.

[0089] Example Ex12: An aerosol generating device according to the previous example, wherein each data record is associated with a record index.

[0090] Example Ex13: An aerosol generating device according to the previous example, wherein each header further includes a third data field, the third data field indicating how many times the record index has rolled over.

[0091] Example Ex14: An aerosol generating device according to any of the preceding examples, wherein the controller is configured to use a symmetric key algorithm to encrypt the created usage data.

[0092] Example Ex15: An aerosol generating device according to the previous example, wherein AES is used as the symmetric key algorithm.

[0093] Example Ex16: An aerosol generating device according to any of the preceding examples, wherein the controller is also configured to derive an initialization vector from the secret value and / or the unique identification value, and to encrypt the created usage data by applying a block cipher in a counter mode using the encryption key and the initialization vector.

[0094] Example Ex17: An aerosol generating device according to the previous example, wherein the controller is configured to use a hash-based key derivation function HKDF to derive the initialization vector from the secret value and / or the unique identification value.

[0095] Example Ex18: An aerosol generating device according to the previous example, wherein the controller is configured to derive the initialization vector from the secret value and / or the unique identification value using a salt, the salt comprising a predefined value, the value of a record index associated with a data record containing the created usage data, the type of the data record, and at least one of at least a portion of a message authentication code MAC calculated based on the created usage data.

[0096] Example Ex19: An aerosol generating device according to any of the preceding examples, wherein the controller is further configured to authenticate the created usage data by calculating a message authentication code MAC of the created usage data.

[0097] Example Ex20: An aerosol generating device according to the previous example, wherein the controller is further configured to calculate a MAC of the created usage data based on the created usage data and based on the first authentication key.

[0098] Example Ex21: An aerosol generating device according to any of the preceding examples, wherein the controller is further configured to authenticate the encrypted usage data by calculating a MAC of the encrypted usage data.

[0099] Example Ex22: An aerosol generating device according to the previous example, wherein the controller is further configured to calculate a MAC of the encrypted usage data based on the encrypted usage data and based on a second authentication key.

[0100] Example Ex23: An aerosol generating device according to the previous example, wherein the controller is further configured to calculate the MAC of the encrypted usage data based on the encrypted usage data, based on the created MAC of the usage data and based on the second authentication key.

[0101] Example Ex24: An aerosol generating device according to any one of Examples Ex20-Ex23, wherein the controller is further configured to derive the first authentication key and / or the second authentication key from the secret value and / or the unique identification value.

[0102] Example Ex25: An aerosol generating device according to any one of Examples Ex19-Ex24, wherein the controller is further configured to use a hash function to calculate a MAC of the created usage data and / or a MAC of the encrypted usage data.

[0103] Example Ex26: An aerosol generating device according to the previous example, wherein the controller is further configured to calculate a MAC of the created usage data and / or a MAC of the encrypted usage data by truncating the output of the hash function to a predefined number of bytes.

[0104] Example Ex27: An aerosol generating device according to any one of Examples E19-Ex26, wherein the controller is further configured to store the created MAC of the usage data and / or the MAC of the encrypted usage data together with the encrypted usage data in the storage unit.

[0105] Example Ex28: An aerosol generating device according to any of the preceding examples, wherein the controller is further configured to employ a hash-based key derivation function HKDF to derive from the secret value and / or the unique identification value at least one of an encryption key for encrypting the created usage data, an initialization vector for encrypting the created usage data in a counter mode using a block cipher, and an authentication key for authenticating the usage data.

[0106] Example Ex29: An aerosol generating device according to the previous example, wherein at least a part of the secret value and / or the unique identification value is used as input key material of the key derivation function.

[0107] Example Ex30: An aerosol generating device according to the previous example, wherein the salt is used together with at least a part of the secret value and / or the unique identification value as an input key material for the key derivation function.

[0108] Example Ex31: An aerosol generating device according to Examples Ex28-Ex30, wherein a predefined subset of the bit representation of the secret value is used together with the unique identification value and the salt as input key material for the key derivation function.

[0109] Example Ex32: An aerosol generating device according to the previous example, wherein a predefined subset of bit representations of secret values ​​used as input key material for deriving the encryption key and / or the authentication key is different from a predefined subset of bit representations of secret values ​​used as input key material for deriving the initialization vector.

[0110] Example Ex33: An aerosol generating device according to any one of Examples Ex28-Ex32, wherein a fixed salt is used to derive the encryption key and / or the authentication key.

[0111] Example Ex34: An aerosol generating device according to any one of Examples Ex28-Ex33, wherein at least a portion of a message authentication code MAC calculated based on the created usage data is used as a salt for deriving the initialization vector.

[0112] Example Ex35: An aerosol generating device according to any one of Examples Ex28-Ex34, wherein a first part of the output key material generated by the key derivation function is used as the encryption key, and a second part of the output key material different from the first part is used as the authentication key.

[0113] Example Ex36: An aerosol generating device according to any of the preceding examples, wherein the controller is further configured to send encrypted usage data together with an authentication code of the encrypted usage data via the communication unit.

[0114] Example Ex37: An aerosol generating device according to any of the preceding examples, wherein the external device is any one of a charging station, a docking station, a mobile terminal, a personal computer, a host computer and a server.

[0115] Example Ex38: An aerosol generating device according to any of the preceding examples, wherein the encrypted usage data is sent via any of a data cable, near field communication, Bluetooth, BLE and WiFi.

[0116] Example Ex39: An aerosol generating system, comprising: an aerosol generating device according to any one of Examples Ex1 to Ex38; a database, the database being configured to store a unique identification value of the aerosol generating device in association with a secret value of each of a plurality of aerosol generating devices; and a server, the server being configured to receive encrypted usage data and the unique identification value of the aerosol generating device from the aerosol generating device, retrieve a secret value associated with the unique identification value from the database using the unique identification value, and decrypt the encrypted usage data using the retrieved secret value.

[0117] Example Ex40: A method for operating an aerosol generating device, the method comprising the following steps: storing a secret value and a unique identification value in a storage unit of the aerosol generating device; creating usage data indicating the usage of the aerosol generating device; deriving an encryption key from at least the stored secret value; encrypting the created usage data with the derived encryption key; storing the encrypted usage data in the storage unit; and sending the encrypted usage data and, optionally, the unique identification value to an external device via a communication unit.

[0118] Example Ex41: The method according to Ex40 also includes the following steps: deriving an authentication key from at least the secret value and optionally the unique identification value; and authenticating the stored usage data using the derived authentication key.

[0119] Example Ex42: A method according to any of the preceding examples, wherein the unique identification value includes at least one of a product identifier, a platform identifier, a unique device identifier, and a manufacturing site identifier.

[0120] Example Ex43: The method according to any of the preceding examples further includes generating a random value as the secret value during a manufacturing stage of the aerosol generating device.

[0121] Example Ex44: The method according to any of the preceding examples includes a step of detecting the operating status of the aerosol generating device.

[0122] Example Ex45: An aerosol generating device according to the previous example, wherein the usage data is created based on the detected operating status.

[0123] Example Ex46: A method according to the previous example, wherein detecting the operating state includes at least one of the following: detecting user interaction with the aerosol generating device; detecting a puff performed by a user of the aerosol generating device; detecting a voltage, current, resistance, charge, energy or temperature associated with an aerosol generating unit of the aerosol generating device; detecting a voltage, current, resistance, charge, energy or temperature associated with a power supply of the aerosol generating device; detecting a voltage, current, resistance, charge, energy or temperature associated with a charging device connected to the aerosol generating device; and detecting the type or amount of consumable material used by the aerosol generating unit.

[0124] Example Ex47: A method according to any of the preceding examples, wherein the usage data includes an indication of at least one of the following: a start time, duration, end time or type of user interaction; a start time, duration or end time of a puff performed by a user of the aerosol generating device, or the number of puffs; a start time, duration or end time of a charging operation performed by the user by connecting the aerosol generating device to a charging device, or the number of charging operations; a voltage, current, resistance, charge, energy or temperature associated with an aerosol generating unit of the aerosol generating device at the start of, during or at the end of a puff performed by the user of the aerosol generating device; a voltage, current, resistance, charge, energy or temperature associated with a power source of the aerosol generating device at the start of, during or at the end of a puff performed by the user of the aerosol generating device; a voltage, current, resistance, charge, energy or temperature associated with a power source of the aerosol generating device at the start of, during or at the end of a charging operation; and a type or amount of consumable material used by the aerosol generating unit.

[0125] Example Ex48: A method according to any of the preceding examples, wherein the encrypted usage data is stored in a payload section of the data record.

[0126] Example Ex49: A method according to the previous example, wherein each data record includes a header, the payload segment and an authentication segment.

[0127] Example Ex50: A method according to the previous example, wherein each header includes a first data field indicating the format of the data record and a second data field indicating the length of the data record.

[0128] Example Ex51: A method according to the previous example, wherein each data record is associated with a record index.

[0129] Example Ex52: A method according to the previous example, wherein each header also includes a third data field, wherein the third data field indicates how many times the record index has rolled over.

[0130] Example Ex53: A method according to any of the preceding examples, wherein the created usage data is encrypted using a symmetric key algorithm.

[0131] Example Ex54: A method according to the previous example, wherein AES is used as the symmetric key algorithm.

[0132] Example Ex55: The method according to any of the preceding examples further includes the following steps: deriving an initialization vector from the secret value and / or the unique identification value; and encrypting the created usage data by applying a block cipher in counter mode using the encryption key and the initialization vector.

[0133] Example Ex56: A method according to the previous example, wherein the initialization vector is derived from the secret value and / or the unique identification value using a hash-based key derivation function HKDF.

[0134] Example Ex57: A method according to the previous example, wherein the initialization vector is derived from the secret value and / or the unique identification value using a salt, the salt comprising at least one of a predefined value, the value of a record index associated with a data record containing the created usage data, the type of the data record, and at least a portion of a message authentication code MAC calculated based on the created usage data.

[0135] Example Ex58: According to the method described in any one of the previous examples, it also includes the following steps: authenticating the created usage data by calculating the message authentication code MAC of the created usage data.

[0136] Example Ex59: A method according to the previous example, wherein a MAC of the created usage data is calculated based on the created usage data and a first authentication key.

[0137] Example Ex60: The method according to any one of the previous examples also includes a step of authenticating the encrypted usage data by calculating the MAC of the encrypted usage data.

[0138] Example Ex61: A method according to the previous example, wherein the MAC of the encrypted usage data is calculated based on the encrypted usage data and based on a second authentication key.

[0139] Example Ex62: The method described in the previous example also includes the following steps: based on the encrypted usage data, calculating the MAC of the encrypted usage data based on the created usage data and based on the second authentication key.

[0140] Example Ex63: The method according to any one of Examples Ex59-Ex62 also includes a step of deriving the first authentication key and / or the second authentication key from the secret value and / or the unique identification value.

[0141] Example Ex64: A method according to any one of Examples Ex58-Ex63, wherein a hash function is used to calculate the MAC of the created usage data and / or the MAC of the encrypted usage data.

[0142] Example Ex65: A method according to the previous example, wherein the MAC of the created usage data and / or the MAC of the encrypted usage data is calculated by truncating the output of the hash function to a predefined number of bytes.

[0143] Example Ex66: The method according to any one of Examples Ex58-Ex65 further includes the following steps: storing the created MAC of the usage data and / or the MAC of the encrypted usage data together with the encrypted usage data.

[0144] Example Ex67: The method according to any one of the preceding examples further includes the following steps: using a hash-based key derivation function HKDF to derive at least one of an encryption key for encrypting the created usage data, an initialization vector for encrypting the created usage data in a counter mode using a block cipher, and an authentication key for authenticating the usage data from the secret value and / or the unique identification value.

[0145] Example Ex68: A method according to the previous example, wherein at least a portion of the secret value and / or the unique identification value is used as input key material for the key derivation function.

[0146] Example Ex69: A method according to the previous example, wherein the salt is used together with at least a portion of the secret value and / or the unique identification value as input key material for the key derivation function.

[0147] Example Ex70: A method according to Example Ex67, wherein a predefined subset of the bit representation of the secret value is used together with the unique identification value and the salt as input key material for the key derivation function.

[0148] Example Ex71: A method according to the previous example, wherein a predefined subset of bit representations of a secret value used as input key material for deriving the encryption key and / or the authentication key is different from a predefined subset of bit representations of a secret value used as input key material for deriving the initialization vector.

[0149] Example Ex72: A method according to any one of Examples Ex67-Ex71, wherein a fixed salt is used to derive the encryption key and / or the authentication key.

[0150] Example Ex73: A method according to any one of Examples Ex67-Ex72, wherein at least a portion of a message authentication code MAC calculated based on the created usage data is used as a salt for deriving the initialization vector.

[0151] Example Ex74: A method according to any one of Examples Ex67-Ex73, wherein a first part of the output key material generated by the key derivation function is used as the encryption key, and a second part of the output key material different from the first part is used as the authentication key.

[0152] Example Ex75: A method according to any of the preceding examples, wherein the encrypted usage data is sent together with an authentication code of the encrypted usage data.

[0153] Example Ex76: A method according to any of the preceding examples, wherein the external device is any one of a charging station, a docking station, a mobile terminal, a personal computer, a host computer, and a server.

[0154] Example Ex77: A method according to any of the preceding examples, wherein the encrypted usage data is sent via any one of a data cable, near field communication, Bluetooth, BLE and WiFi.

[0155] Example Ex78: A method for manufacturing an aerosol generating device according to any of the preceding examples, the method comprising: generating a secret value and a unique identification value; writing the secret value and the unique identification value into a storage unit of the aerosol generating device; and for each of a plurality of aerosol generating devices, storing the secret value in association with the unique identification value in a database.

[0156] Example Ex79: A method according to the previous example, wherein the unique identification value includes at least one of a product identifier, a platform identifier, a unique device identifier, and a manufacturing site identifier.

[0157] Example Ex80: A method according to example Ex78 or Ex79, wherein the secret value is a random number generated by the aerosol generating device during a manufacturing stage.

[0158] Example Ex81: The method according to the previous example also includes sending the generated random number from the aerosol generating device to a host computer.

[0159] Example Ex82: A method according to the previous example, wherein the generated random number is sent from the aerosol generating device to the host computer in encrypted form.

[0160] Example Ex83: A method for sending usage data from an aerosol generating device to a host, wherein a secret value and a unique identification value are stored in the aerosol generating device, the method comprising the following steps: receiving the unique identification value from the aerosol generating device at the host; retrieving the secret value of the aerosol generating device from a database, wherein the secret value of each of a plurality of aerosol generating devices is stored in association with the corresponding unique identification value; deriving an encryption key at the host from at least the retrieved secret value and optionally the received unique identification value; receiving encrypted usage data from the aerosol generating device at the host; and decrypting the received encrypted usage data using the encryption key.

[0161] Example Ex84: The method according to the previous example also includes: deriving an authentication key at the host from at least the retrieved secret value and optionally the unique identification value; receiving a first message authentication code MAC from the aerosol generating device together with the encrypted usage data at the host; calculating a second MAC based on the decrypted usage data and the derived authentication key; and comparing the first MAC and the second MAC.

[0162] Example Ex85: The method according to the previous example also includes deriving an initialization vector, wherein the received encrypted usage data is decrypted by applying a block cipher in a counter mode using the encryption key and the initialization vector.

[0163] Example Ex86: A method according to the previous example, wherein the initialization vector is derived from the unique identification value, the secret value and the first MAC.

[0164] Example Ex87: A method according to the previous example, wherein the encrypted usage data is included in a payload segment of a data record having a unique record identifier.

[0165] Example Ex88: A method according to the previous example, wherein the initialization vector is derived from the unique identification value, the secret value, the first MAC and the unique record identifier.

[0166] Example Ex89: A host computer having a processing unit and a memory, wherein the memory stores computer-readable instructions, which are suitable for performing all steps of the method described in any one of Examples Ex83-Ex88 when executed by the processing unit. BRIEF DESCRIPTION OF THE DRAWINGS

[0167] Examples will now be further described with reference to the accompanying drawings, in which:

[0168] Figure 1 shows a block diagram of an aerosol generating device according to an embodiment;

[0169] Figure 2 shows a block diagram of a system including an aerosol generating device and a server according to an embodiment;

[0170] Figure 3 A schematic diagram showing a data structure according to an embodiment;

[0171] Figure 4 shows a diagram illustrating a data flow in a method for encrypting usage data according to an embodiment;

[0172] Figure 5 shows a diagram illustrating a data flow in a method for calculating a MAC according to an embodiment;

[0173] Figure 6 shows a diagram illustrating the data flow in a method for deriving encryption and authentication keys according to an embodiment;

[0174] Figure 7 shows a diagram illustrating a data flow in a method for deriving an initial vector according to an embodiment;

[0175] Figure 8 A flow chart of a method for encrypting usage data according to an embodiment is shown;

[0176] Fig. 9 A flow chart showing a method for sending and decrypting usage data according to an embodiment is shown;

[0177] Fig.10 A flowchart showing a manufacturing method according to an embodiment; and

[0178] Fig.11 A flow chart of a manufacturing method according to another embodiment is shown. DETAILED DESCRIPTION

[0179] Figure 1 A block diagram of an aerosol generating device (100) according to an embodiment of the present invention is shown. The aerosol generating device (100) may include an aerosol generating unit (110), a sensor (120), a communication unit sensor (130), a storage unit (140), a communication unit (150) and a power supply (160).

[0180] The aerosol generating unit (110) is a unit for generating an aerosol from a precursor material (consumable material) for inhalation by a user of the aerosol generating device. For example, the aerosol generating unit (110) may include a vaporizer or a heating element. The precursor material may be provided in liquid or solid form. The aerosol generating unit (110) is powered by electrical energy provided by a power source (160) and controlled by a controller (130).

[0181] The sensor (120) delivers data that can be used to control the operation of the aerosol generating device. For example, the sensor can be configured to detect user interaction with the aerosol generating device, such as pressing a button, opening or closing a container of a precursor material, performing a gesture by moving the device in a particular manner, etc. The sensor can also be configured to detect a puff performed by a user of the aerosol generating device. In another example, the sensor can be configured to detect a voltage, current, resistance, charge, energy, or temperature associated with the operation of the aerosol generating unit (110). The sensor can also be configured to detect a voltage, current, resistance, charge, energy, or temperature associated with a power source (160) of the aerosol generating device and / or a charging device connected to the aerosol generating device. In another example, the sensor can be configured to detect the type or amount of consumable material used by the aerosol generating unit (110).

[0182] The controller (130) is responsible for controlling the overall operation of the aerosol generating device, in particular operating the aerosol generating unit (110) (possibly based on data delivered by the sensor (120)), creating, encrypting and storing usage data in the storage unit (140), receiving and sending data via the communication unit (150), monitoring and / or controlling the charging of the power source (160), etc. The controller (130) may be a microprocessor, a microcontroller or a combination of more than one microprocessor and / or microcontroller. The controller (130) may also be equipped with a storage device for storing computer program instructions and / or a memory for storing data related to the execution of the computer program.

[0183] A storage unit (140) is connected to the controller (130) and has stored therein a unique identifier (142) and a secret value (144) which can be used by the controller to encrypt usage data. The storage unit (140) is also adapted to store encrypted usage data created by the controller (130). The storage unit may be volatile or non-volatile. For example, a flash memory is provided as the storage unit. The storage unit may be an integral part of the microcontroller or a component external to the controller. The storage unit may include more than one physically or logically separate storage sections or components for storing different data items. For example, the unique identifier (142), the secret value (144) and the encrypted usage data (144) may be stored in different sections or components of the storage unit (140). The secret value may be stored in a section or component that is specifically protected from unauthorized access.

[0184] The unique identifier (142) is a piece of data that is unique to each aerosol generating device, such as a unique device identity. For example, each aerosol generating device may be provided with a unique serial number, which is stored as a unique identifier in the storage unit (140). In addition to or instead of the serial number, the unique identifier may also include information indicating at least one of a product identifier, a platform identifier, and a manufacturing site. The unique identifier may also be provided as a unique manufacturing information block (or manufacturing facility ID) MIB, i.e., as a data block including information related to the manufacturing process, such as product ID, platform ID, unique ID (or serialized device unit ID), and manufacturing site.

[0185] The secret value (144) is a value used by the controller to derive an encryption key for encrypting usage data. The secret value is secret in that it is generally neither known to the user or any other unauthorized person nor (easily) derived from the aerosol generating device or the data transmitted. The secret value is also not included in any data transmission during normal operation. The secret value may be stored in a particularly secure portion of the storage unit (140) that is not accessible to any external device.

[0186] The secret value is also stored in association with the corresponding unique identifier in a database accessible to the manufacturer's server. In this way, the server can use the unique identifier in a lookup operation to obtain the secret value for a particular aerosol generating device in order to derive an encryption key for encrypting usage data for the device. Using the encryption key so derived, the server can decrypt encrypted usage data sent from this particular device.

[0187] The secret value may be large enough to prevent brute force attacks on the encrypted data. For example, the secret value may include 8, 16, 32, 64, 128, or 256 bytes of data. Other sizes of the secret value may also be used, including sizes that are powers of two or other than powers of two.

[0188] For example, a random number or pseudo-random number generated during the manufacturing process may be used as the secret value. The secret value may be generated by the aerosol generating device during the manufacturing process and preferably sent in encrypted form to a host computer which is responsible for storing the secret value in a database in association with the unique identifier for later reference by the manufacturer server. The secret value may also be generated by the host computer and sent to the storage unit (140) or written directly into the storage unit during a certain stage of the manufacturing process.

[0189] The encrypted usage data (146) is usage data created by the controller and stored in encrypted form in the storage unit (140). The usage data indicates usage of the aerosol generating device and may be data generated by the device in response to a particular event. Examples include data generated due to device errors, aerosol generation, or battery charging. For example, the usage data may include an indication of at least one of a start time, duration, end time, and type of interaction performed by a user with the aerosol generating device, such as pressing a button, opening or closing a container of precursor material, performing a gesture by moving the device in a particular manner, etc. The usage data may also include an indication of at least one of a start time, duration, and end time of a puff performed by a user of the aerosol generating device, or a number of puffs. The usage data may also include an indication of at least one of a start time, duration, and end time of a charging operation performed by a user by connecting the aerosol generating device to a charging device, or a number of charging operations.

[0190] The usage data may also relate to the operational state or health state of the aerosol generating device (100). For example, the usage data may also include an indication of at least one of a voltage, current, resistance, charge, energy and temperature associated with an aerosol generating unit (110) of the aerosol generating device. The usage data may also include an indication of at least one of a voltage, current, resistance, charge, energy or temperature associated with a power supply (160) of the aerosol generating device. Each of these indications may be conditioned on a particular event, such as the start of, during or end of a puff performed by a user of the aerosol generating device. At least some of these indications may also be conditioned on the start, duration or end of a heating operation performed by the aerosol generating unit (110) and / or on the start of, during or end of a charging operation. The usage data may also indicate the type or amount of consumable material used by the aerosol generating unit.

[0191] The communication unit (150) is configured for establishing a communication link to an external device, and in particular for sending the encrypted usage data (146) to a manufacturer server. The communication link may be based on any wired or wireless communication technology, including but not limited to a serial communication link, a universal serial bus (USB), an optical communication port, near field communication (NFC), Bluetooth, Bluetooth low energy (BLE), wireless communication, WiFi according to any of the IEEE 802.11x standards, mobile communication, etc. The communication with the manufacturer server may be direct or indirect, for example via an intermediate device such as a mobile phone, a cradle or a docking station. The communication with the manufacturer server may also involve more than one communication protocol, for example a Bluetooth connection between the aerosol generating device and the mobile phone and a mobile communication between the mobile phone and an Internet access point.

[0192] The power source (160) supplies power to all components of the aerosol generating device. The power source may be a rechargeable battery, such as a lithium ion battery or a lithium polymer battery. Other power sources may also be used.

[0193] Figure 2 A block diagram of a system including an aerosol generating device (100) and a server (200) according to an embodiment of the present invention is shown. The aerosol generating device (100) and the server (200) are connected via a communication link for sending encrypted usage data. The server (200) has access to a database (300) that stores a secret value for each of a plurality of aerosol generating devices in association with a corresponding unique identifier. The aerosol generating device can also be connected to a cradle (190) or a docking station that operates as a charging device (190) for charging a power source (160). The communication link between the aerosol generating device (100) and the server (200) can also be formed indirectly with the cradle (190) or a mobile phone operating as an intermediary (not shown).

[0194] Figure 3 A schematic diagram of a data structure according to an embodiment of the present invention is shown. Usage data can be stored and sent in the form of data records, where each data record relates to a specific event, such as user interaction, charging operation, temperature, battery level, error message, etc. Each data record may include a header, a payload section, and an authentication section (message authentication code, MAC). The header may specify the format of the data record, the length of the data record, and the index. The format may indicate which data is provided at which location within the payload section. Different formats may be predefined for different events. The length may indicate the total length of the data record or the length of the payload section.

[0195] The index or the index together with other elements of the header (particularly the length, data type and data format) can form a unique identifier (record unique identity, RUID) for the corresponding data record. The record index can be unique based on a combination of an increasing number or a small increasing number that can be repeated and a "rollover" value indicating the number of times the smaller number overflowed. The index is not necessarily stored and / or sent with the payload and can be implicitly known from the request for a particular data record or the position of the data record in an array or list of data records. Therefore, instead of an index value, a rollover value can be stored and / or sent, which indicates how many times the index has rolled over a predefined maximum index value.

[0196] The payload may contain actual usage data, i.e. information related to the corresponding event, as described above in conjunction with Figure 1 The payload can be encrypted. A MAC can be a cryptographic signature or authentication code for authentication purposes. The process of data encryption, authentication, and key derivation is explained below.

[0197] According to the present invention, a symmetric key algorithm is used to encrypt usage data stored in the payload of each data record. Since the payload length can vary and will generally exceed the block size of a conventional block cipher algorithm, a counter mode is applied in order to convert a conventional block cipher into a stream cipher. As is generally known in the art, the counter mode generates a key stream by encrypting successive values ​​of a counter. The ciphertext is then obtained by XORing the plaintext with the key stream. To ensure that a different key stream is used for each data record, the counter is concatenated with a random number or initialization vector that varies from data record to data record. Decryption is then performed by XORing the ciphertext with the same key stream again.

[0198] In a preferred embodiment, the Advanced Encryption Standard (AES) in counter mode (AES-CTR) is used to encrypt the usage data. Figure 4 The data flow for encrypting usage data according to the present embodiment is illustrated in FIG.

[0199] The AES-CTR algorithm receives usage data as input and delivers encrypted usage data as output.In addition to the encryption key (AES key), the encryption process may also require a counter and an initialization vector for counter mode.

[0200] According to another aspect of the invention, the authenticity of each usage data record is ensured by an authentication code (digital signature) or "digest". This signature is provided in the form of a message authentication code (MAC), which is calculated based on the header and / or payload of the data record. Any modification to the data record will (with overwhelming probability) produce a MAC that is different from the MAC of the original data record, so that tampered data can be easily detected (integrity check). In addition, the calculation of the MAC is based on a secret key (authentication key or MAC key), making it impossible for an attacker to predict the "correct" MAC for a given piece of data. In this way, the system is hardened against spoofing attacks that attempt to contaminate the manufacturer's servers with false or corrupted information (authenticity check).

[0201] In a preferred embodiment, a hash-based MAC (HMAC) is employed, i.e., a MAC calculated by applying a cryptographic hash algorithm, preferably the Secure Hash Algorithm 1 (SHA-1), to the data to be authenticated. The algorithm used to calculate a MAC based on SHA-1 is generally referred to as HMAC-SHA1. Other algorithms, including HMAC-SHA256, may also be used.

[0202] Figure 5 A diagram illustrating the data flow in a method for calculating a MAC according to an embodiment of the invention is shown.The HMAC-SHA1 algorithm receives as input the header and payload of a data record together with a MAC key and delivers a MAC as output.

[0203] Typically, the strength of an authentication code or "digest" depends on its length. For example, the HMAC-SHA1 algorithm delivers a MAC that is 160 bits (20 bytes) in length. However, in an aerosol generating device, a large number of short data records of only a few bytes each need to be authenticated. Therefore, it is not feasible to attach a 20-byte MAC to each record, especially considering the limited amount of storage capacity available in an aerosol generating device.

[0204] In order to reduce the overhead for storing and sending authenticated data records, and to increase the maximum number of data records that can be stored within the aerosol generating device, the MAC delivered by the HMAC algorithm may be truncated to a few bytes, for example to 2, 3 or 4 bytes. Such use of truncated authentication codes increases the number of collisions for maliciously crafted encrypted records. However, in this case, attempts to contaminate the manufacturer's server with false data should be detected due to impossible data or multiple data logs with false authentication codes.

[0205] Both the encryption key (AES key) and the message authentication key (MAC key) are derived from a secret value and a unique ID stored in the aerosol generating device. Therefore, different aerosol generating devices use different keys to encrypt and authenticate their data records. Therefore, even if a particular device is compromised so that its AES and / or MAC keys become known, other devices will not be affected.

[0206] The key derivation function (HKDF) based on the HMAC algorithm is used to derive both the AES key and the MAC key. The key derivation function (KDF) is a cryptographic algorithm that derives one or more secret keys from a secret value, and can be used to stretch a key into a longer key or obtain a key in a desired format. The HKDF algorithm uses an HMAC hash function (e.g., HMAC-SHA256) to extract a pseudo-random key (PRK) from an optional salt (acting as a key for the HMAC function) and any potentially weak input key material (IKM) (acting as data). It then generates output key material (OKM) of similar cryptographic strength of any desired length by repeatedly generating PRK key hash blocks, then appending them to the output key material, and finally truncating to the desired length.

[0207] The data flow for this process is Figure 6 The HKDF algorithm receives a secret value (a subset of bits) as input key material, receives a unique identifier (UID) as context, receives a constant value as salt, and delivers output key material (OKM). The mask (AES mask) is used to select (demultiplex) a subset of bits from the secret value as IKM. Different masks (IV masks) are used to select different subsets of bits from the secret value as IKM for deriving the initialization vector, as will be described below in conjunction with Figure 7 Both the AES key and the MAC key are obtained from the OKM by selecting the required number of consecutive bits (AES length, MAC length) from different positions within the OKM (AES offset, MAC offset).

[0208] An initialization vector for encrypting the usage data with AES-CTR is also derived from the secret value and the UID by means of a key derivation function similar to that used to derive the AES key and the MAC key. In order to further strengthen this method against cryptanalysis, the initialization vector is also made dependent on the current data record, in particular on the MAC of the (unencrypted) usage data stored in the payload section of the data record and / or a unique identifier (RUID) of the data record (e.g. an index or sequence number), and / or other properties of the payload to be encrypted. In this way, a different initialization vector can be used for each data record and / or each transmission without further increasing the size of the data record.

[0209] The data flow for this process is Figure 7 The HKDF algorithm receives (a subset of bits of) a secret value as input key material (IKM), receives a unique identifier (UID) as context, receives a combination of a (truncated) MAC, a record identifier and a constant value as a salt, and delivers an output key material (OKM). The combination of a (truncated) MAC, a record identifier and a constant value can be obtained, for example, by concatenating corresponding bit strings in a multiplexer (MUX). A mask (IV mask) is used to select (demultiplex) a subset of bits from the secret value as IKM. From the OKM, an initialization vector is obtained at a certain position (IV offset) with a required length (IV length).

[0210] When an encrypted data record has been sent from the aerosol generating device, Figure 7 All input information for the key derivation function shown in , including the MAC and the unique identifier, is also available at the manufacturer server. Therefore, the server can derive the same initialization vector and decrypt the received data record.

[0211] It is generally accepted that a MAC should be calculated for an encrypted message so that the authenticity can be checked before decryption begins (encrypt-then-MAC). However, in the present case, the advantage of being able to use the MAC as an additional input to the KDF to derive the initialization vector may outweigh the risk of applying the decryption algorithm to data that may have been tampered with. Therefore, it is preferable to calculate the MAC for the unencrypted data (MAC-then-encrypt), so that it can be used for the encryption process.

[0212] In another embodiment of the invention, a MAC may be calculated for the encrypted usage data in addition to or instead of the MAC of the unencrypted data (MAC-then-encrypt). To this end, a second authentication key may be derived from the unique device information in a manner similar to the (first) authentication key used to derive the MAC for calculating the unencrypted data. The second authentication key may then be used to calculate a MAC for the encrypted usage data by applying the HMAC algorithm to the encrypted usage data or to the MAC of the encrypted usage data and the unencrypted data. The MAC of the encrypted usage data is then sent together with the encrypted message.

[0213] On the server side, the integrity of the encrypted message can be checked by deriving a second authentication key in the same way as in the aerosol generating device, calculating a server-side MAC from the encrypted message, and comparing the server-side MAC with the MAC attached to the encrypted message. The decryption process is then started only if the two MACs are identical.

[0214] Figure 8 A flow chart of a method for encrypting usage data according to an embodiment of the present invention is shown.

[0215] In step S110, the encryption key K ENC and the message authentication key K MAC Is to use such as combining Figure 6 The key derivation process is derived from the unique device information. In step S120, the operating state of the aerosol generating device is detected, for example by means of a suitable sensor. Based on the detection result, usage data is created in step S130. Depending on the type of usage data created, a unique record ID is generated in step S140. The unique record ID may include information indicating the type, format, length and index of the data record. In step S150, the message authentication key K is used to generate a unique record ID. MAC , using a combination of Figure 5 The process described above is used to calculate a message authentication code, MAC, for the unique record ID and usage data. In step S160, using the combination of Figure 7 The process described derives a unique initialization vector IV from the unique device information, the unique record ID and the MAC. In step S170, the encryption key K is used ENC and initialization vector IV, using Figure 4 The process encrypts the data record. The encrypted data record is then stored in the aerosol generating device together with the MAC in step 180. The process then returns to step S120.

[0216] Fig. 9 A flow chart showing a method for sending usage data from an aerosol generating device to a host and decrypting the received data at the host according to an embodiment of the invention is shown.

[0217] The process may be initiated by a host, which may be a manufacturer server, by sending a request to the aerosol generating device (S210). The aerosol generating device may respond to this request by sending its unique device ID, such as a manufacturing information block MIB (S215). On the other hand, in the context of this process, the secret information is neither part of this transmission nor part of any other transmission between the aerosol generating device and the host. Upon receiving the unique device ID, the host retrieves the corresponding secret value S from the database in step S220. DEV In step S225, the secret value may be stored in an encrypted form in the database, and the host may decrypt the encrypted secret value E(S DEV ). At this point, the host has complete unique device information, namely, the unique device ID and the secret value, and is therefore able to derive the encryption and message authentication keys used by the aerosol generating device to encrypt and authenticate usage data. Specifically, in step S230, the host utilizes the aerosol generating device to execute and combine the aerosol generating device with the aerosol generating device. Figure 6The same key derivation process as described above derives the encryption key K from the unique device information ENC and the message authentication key K MAC .

[0218] In step S235, the host may request data from the aerosol generating device. The request may include an indication of one or more data records (e.g., a unique record ID or at least a portion of a range of index values, etc.) to be sent by the aerosol generating device. The aerosol generating device may communicate with the corresponding MAC in encrypted form. data The requested data records are sent together to respond to this request (S240). The response may also include a unique record ID for each data record sent.

[0219] In step S245, the host uses the aerosol generating device and the combination of Figure 7 The same process described above is from unique device information, unique record ID and MAC DATA A unique initialization vector IV is derived. Then, in step S250, the initialization vector IV is combined with the encryption key K ENC are used together to decrypt the received data record and recover the data DATA contained therein host .

[0220] In step S255, the host records the unique ID and the recovered data DATA host Calculate the message authentication code MAC host If the message authentication code MAC thus calculated is found in step S260 host The message authentication code MAC received along with the encrypted data record data If they are the same, the record is considered valid. If they are not the same, the data record is invalid.

[0221] Fig.10 Flowchart showing a method of manufacturing an aerosol generating device according to an embodiment of the invention. The steps of this method may be performed at some stage of the assembly process of the aerosol generating device or at final testing of the assembled aerosol generating device, for example when the controller 130 is powered on for the first time.

[0222] In step S330, the aerosol generating device generates a unique secret value S by means of a random number generator, for example. DEV Then, the secret value S generated in this way is DEV It is stored in the storage unit 140 of the aerosol generating device as part of the unique device information (S340), encrypted (S350) and sent to the host computer to be stored in a database for future reference (S360).

[0223] Fig.11 A flowchart of a method for manufacturing an aerosol generating device according to another embodiment of the invention is shown. The steps of this method may be performed at a certain stage of the assembly process of the aerosol generating device or at the final test of the assembled aerosol generating device, for example when the controller 130 is powered on for the first time.

[0224] according to Fig.11 The process and Fig.10 The process of is different in that the host generates a unique device ID and sends it to the aerosol generating device in step S310 and S320. In step S310, the host generates a unique device ID and sends it to the aerosol generating device. The unique device ID may include a unique manufacturing information block MIB, i.e., a data block including information related to the manufacturing process (e.g., product ID, platform ID, unique ID and manufacturing site), as explained above.

[0225] In step S320, the aerosol generating device stores the received unique device ID in the storage unit 140. In step S330, the aerosol generating device generates a unique secret value S, for example, by means of a random number generator. DEV Then, the secret value S generated in this way is DEV The secret value S is stored in the storage unit 140 of the aerosol generating device together with the unique device ID (S340). In step S530, the secret value S DEV It is encrypted and sent to the host computer to be stored in a database in association with the unique device ID for later retrieval (S360).

[0226] Thus, embodiments of the present invention provide a technique for protecting usage data stored in an aerosol generating device both within the device and when sent to an external device (e.g., a manufacturer server). In addition, the manufacturer server that collects data from the aerosol generating device is protected from contamination with erroneous or corrupted information. Embodiments of the present invention can protect the storage and transmission of usage data in an aerosol generating device without the need for a public key infrastructure or overly complex algorithms for secure key exchange. Embodiments of the present invention also provide a high degree of data security, even in systems with a large number of aerosol generating devices and a large number of personal data records. Embodiments of the present invention are also particularly suitable for the limited computing power and storage capacity of aerosol generating devices.

Claims

1. An aerosol generating device, comprising A storage unit, wherein a secret value and a unique identification value are stored in the storage unit; Communication unit; as well as A controller configured to creating usage data indicative of usage of the aerosol generating device, deriving an encryption key from at least the stored secret value and optionally the unique identification value, The created usage data is encrypted using the derived encryption key, storing the encrypted usage data in the storage unit, and The encrypted usage data and the unique identification value are transmitted to an external device via the communication unit.

2. The aerosol generating device according to claim 1, wherein: The controller is further configured to derive an authentication key from at least the secret value and optionally the unique identification value, and to authenticate the stored usage data using the derived authentication key.

3. The aerosol generating device according to claim 1 or 2, wherein: The controller is configured to encrypt the created usage data using a symmetric key algorithm.

4. An aerosol generating device according to any one of the preceding claims, wherein: The controller is further configured to derive an initialization vector from the secret value and / or the unique identification value, and to encrypt the created usage data by applying a block cipher in a counter mode using the encryption key and the initialization vector.

5. An aerosol generating device according to any one of the preceding claims, wherein: The controller is further configured to authenticate the created usage data by calculating a message authentication code MAC of the created usage data.

6. An aerosol generating device according to any one of the preceding claims, wherein: The controller is further configured to authenticate the encrypted usage data by calculating a MAC of the encrypted usage data.

7. The aerosol generating device according to claim 5 or 6, wherein: The controller is further configured to calculate a MAC of the created usage data and / or a MAC of the encrypted usage data by truncating the output of the hash function to a predefined number of bytes.

8. The aerosol generating device according to any one of claims 5 to 7, wherein: The controller is further configured to store the created MAC of the usage data and / or the MAC of the encrypted usage data together with the encrypted usage data in the storage unit.

9. An aerosol generating device according to any one of the preceding claims, wherein: The controller is also configured to employ a hash-based key derivation function HKDF to derive at least one of an encryption key for encrypting the created usage data, an initialization vector for encrypting the created usage data using a block cipher in a counter mode, and an authentication key for authenticating the usage data from the secret value and / or the unique identification value.

10. The aerosol generating device according to claim 9, wherein: At least a portion of a message authentication code MAC calculated for the created usage data is used as a salt for deriving the initialization vector.

11. An aerosol generating system comprising: An aerosol generating device according to any one of claims 1 to 10; a database configured to store a unique identification value for each of a plurality of aerosol generating devices in association with a secret value for the aerosol generating device; as well as A server configured to receiving encrypted usage data and a unique identification value of the aerosol generating device from the aerosol generating device, using the unique identification value to retrieve from the database a secret value associated with the unique identification value, and Decrypt the encrypted usage data using the retrieved secret value.

12. A method for operating an aerosol generating device, the method comprising the steps of: storing a secret value and a unique identification value in a storage unit of the aerosol generating device; creating usage data indicative of usage of the aerosol generating device; deriving an encryption key from at least the stored secret value and optionally the unique identification value; encrypting the created usage data using the derived encryption key; storing the encrypted usage data in the storage unit; as well as The encrypted usage data and the unique identification value are transmitted to an external device via a communication unit.

13. A method for transmitting usage data from an aerosol generating device to a host, the aerosol generating device having stored therein a secret value and a unique identification value, the method comprising the steps of: receiving, at the host, the unique identification value from the aerosol generating device; retrieving a secret value for the aerosol generating device from a database having a secret value for each of a plurality of aerosol generating devices stored in association with a corresponding unique identification value; deriving, at the host, an encryption key from at least the retrieved secret value and optionally the received unique identification value; receiving, at the host, encrypted usage data from the aerosol generating device; as well as The received encrypted usage data is decrypted using the encryption key.

14. The method according to the preceding claim, further comprising deriving, at the host, an authentication key from at least the retrieved secret value and optionally the unique identification value; receiving at the host a first message authentication code MAC from the aerosol generating device together with encrypted usage data; calculating a second MAC based on the decrypted usage data and the derived authentication key; as well as The first MAC and the second MAC are compared.

15. The method according to the preceding claim, further comprising Export the initialization vector; in, The received encrypted usage data is decrypted by applying a block cipher in a counter mode using the encryption key and the initialization vector.

Images