Communicating credentials between two operating systems

Abstract

To provide a method, a computer-readable medium, a memory device and a computer-implemented system for sending communicating credentials between two operating systems.SOLUTION: A method used to provide credentials for a provisioning operation includes: generating 202, by a first operating system (OS), a first transfer key; sending 212, from the first OS to a second OS, a random salt by using the first transfer key; generating 230, by the first OS, a second transfer key by using the random salt; and sending 232, from the first OS to the second OS, provisioning credentials by using the second transfer key.SELECTED DRAWING: Figure 2

Description

[Technical field]

[0001] The present disclosure relates to communication credentials between two operating systems (OS). [Background technology]

[0002] In some implementations, credentials may be communicated between two OSes, for example, during a provisioning operation, one OS may send provisioning credentials to the other OS. Summary of the Invention [Means for solving the problem]

[0003] The present invention provides, for example, the following items. (Item 1) generating, by a first operating system (OS), a first transport key; transmitting a random salt from the first OS to a second OS by using the first transport key; generating a second transport key by the first OS using the random salt; and sending provisioning credentials from the first OS to the second OS by using the second transport key; A method comprising: (Item 2) The method of any preceding claim, wherein the provisioning credentials comprise at least one of a private key of a certification authority (CA) or a certificate of the CA. (Item 3) receiving, by the first OS, a first response from the second OS, the first response comprising data; determining, by the first OS, that the data in the first response matches the random salt; The method according to any of the above items, further comprising: (Item 4) 13. A method according to any preceding claim, wherein the data comprises a bitmask, each bit of the bitmask indicating whether a corresponding byte comprises data or filler. (Item 5) 5. The method of claim 1, wherein the data comprises an indicator of one of consecutive order or reverse order. (Item 6) 2. The method of claim 1, wherein whether the data matches the random salt is determined by running a hashing function on the random salt to generate a hash result and determining whether the hash result matches the data. (Item 7) 2. The method according to claim 1, wherein the first OS and the second OS operate on the same device, and the first OS and the second OS perform a multi-transport layer security (mTLS) process. (Item 8) A computer-readable medium containing instructions that, when executed, cause an electronic device to perform an operation, the operation including: generating, by a first operating system (OS), a first transport key; transmitting a random salt from the first OS to a second OS by using the first transport key; generating a second transport key by the first OS using the random salt; and sending provisioning credentials from the first OS to the second OS by using the second transport key; 23. A computer readable medium comprising: (Item 9) 2. The computer-readable medium of claim 1, wherein the provisioning credentials comprise at least one of a private key of a certification authority (CA) or a certificate of the CA. (Item 10) The operation includes: receiving, by the first OS, a first response from the second OS, the first response comprising data; and determining, by the first OS, that the data in the first response matches the random salt; 20. The computer readable medium of any of the preceding claims, further comprising: (Item 11) 2. The computer-readable medium of claim 1, wherein the data comprises a bit mask, each bit of the bit mask indicating whether a corresponding byte comprises data or filler. (Item 12) 2. The computer-readable medium of claim 1, wherein the data comprises an indicator of one of a sequential order or a reverse order. (Item 13) A computer-readable medium according to any of the above items, wherein whether the data matches the random salt is determined by running a hashing function on the random salt to generate a hash result and determining whether the hash result matches the data. (Item 14) The computer-readable medium of any of the preceding items, wherein the first OS and the second OS operate on the same device, and the first OS and the second OS perform a multi-transport layer security (mTLS) process. (Item 15) 1. A computer implemented system, comprising: one or more computers; one or more computer memory devices interoperably coupled to the one or more computers and having a tangible, non-transitory, machine-readable medium storing one or more instructions; Equipped with The one or more instructions, when executed by the one or more computers, perform one or more operations, the operations including: generating, by a first operating system (OS), a first transport key; transmitting a random salt from the first OS to a second OS by using the first transport key; generating a second transport key by the first OS using the random salt; and sending provisioning credentials from the first OS to the second OS by using the second transport key; 13. A computer implemented system comprising: (Item 16) 2. The computer-implemented system of claim 1, wherein the provisioning credentials include at least one of a private key of a certification authority (CA) or a certificate of the CA. (Item 17) The operation includes: receiving, by the first OS, a first response from the second OS, the first response comprising data; and determining, by the first OS, that the data in the first response matches the random salt; 2. The computer-implemented system of claim 1, further comprising: (Item 18) 2. The computer-implemented system of claim 1, wherein the data comprises a bit mask, each bit of the bit mask indicating whether a corresponding byte comprises data or filler. (Item 19) A computer-implemented system according to any of the preceding items, wherein the data comprises an indicator indicating one of a sequential order or a reverse order. (Item 20) 2. The computer-implemented system of claim 1, wherein whether the data matches the random salt is determined by running a hashing function on the random salt to generate a hash result and determining whether the hash result matches the data. (Summary) The system, method, and software can be used to provide authentication information for a provisioning operation. In some aspects, the method includes generating a first transport key by a first operating system (OS), sending a random salt from the first OS to a second OS by using the first transport key, generating a second transport key by the first OS by using the random salt, and sending provisioning authentication information from the first OS to the second OS by using the second transport key. [Brief description of the drawings]

[0004] [Figure 1] FIG. 1 is a schematic diagram illustrating an example system for providing provisioning operations according to an implementation.

[0005] [Diagram 2] FIG. 2 illustrates an exemplary process of a provisioning operation according to an implementation.

[0006] [Diagram 3] FIG. 3 illustrates an exemplary encoding scheme according to an implementation.

[0007] [Figure 4] FIG. 4 is a flow chart illustrating an exemplary method of a provisioning operation according to an implementation.

[0008] [Diagram 5] 5 illustrates a high level architectural block diagram of a computer according to an implementation. Like reference numbers and designations in the various drawings refer to like elements. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] (Detailed Description) In some cases, two operating systems (OSs) may run on the same device. The device may be a standalone device or a module in a system. In a provisioning operation, the primary OS may trigger a provisioning operation on the secondary OS. The primary OS may configure a device-specific Certificate Authority (CA) for the device and send the CA certificate and CA key to the secondary OS. In some implementations, the provisioning process may be performed during the manufacturing stage, and both OSs store the provisioning credentials when the device is manufactured. However, in some cases, these provisioning credentials may be deleted in an initialization process, e.g., a factory reset operation. Therefore, a runtime provisioning operation may be used to regenerate and populate the provisioning credentials in both OSs to ensure that both OSs can communicate with each other using mutual transport layer security (mTLS).

[0010] In some cases, to provide a shared secret, e.g., provisioning credentials, to the secondary OS in a secure manner, the primary OS can generate a first transport key and a random salt. The primary OS can send the random salt wrapped by the first transport key to the secondary OS. The secondary OS can obtain the random salt using an unwrap operation. The secondary OS can send the random salt back to the first OS to confirm receipt of the random salt. In some cases, the secondary OS sends the size of the random salt back to the secondary OS to acknowledge receipt. In some cases, the secondary OS performs a hash operation on the random salt and sends the hashed random salt back to the first OS. Both the primary OS and the secondary OS can generate a second transport key using the random salt and communicate the provisioning credentials by using the second transport key. In some cases, an encoding algorithm can be used to protect the transmission of the random salt between the primary OS and the secondary OS. These approaches improve the security of the provisioning operation. Figures 1-5 and related descriptions provide additional details of these implementations.

[0011] 1 is a schematic diagram illustrating an example communication system 100 that provides provisioning operations according to an implementation. At a high level, the example communication system 100 includes a vehicle 120 that is communicatively coupled to a client device 122. The vehicle 120 is also communicatively coupled to a server 130 over a network 140.

[0012] Vehicle 120 may include motor vehicles (e.g., automobiles, cars, trucks, buses, motorcycles, etc.), aircraft (e.g., airplanes, unmanned aerial vehicles, unmanned aerial systems, drones, helicopters, etc.), spacecraft (e.g., space planes, space shuttles, space capsules, space stations, satellites, etc.), watercraft (ships, boats, hovercraft, submarines, etc.), rail vehicles (trains, trams, etc.), and other types of vehicles including any combination of any of the foregoing, whether currently existing or future. In the illustrated example, vehicle 120 includes one or more sensors 102, vehicle component controllers 104, vehicle systems processor 106, communication subsystem 116, user interface 118, memory 114, and operation devices 150, which are connected to bus 110.

[0013] In some cases, a vehicle can include one or more sensors. The one or more sensors can generate inputs that reflect the surroundings or environment inside the vehicle, such as video or audio inputs. Exemplary sensors can include cameras, microphones, lasers, radar, ultrasonic, light detection and ranging (LIDAR), or any other sensor.

[0014] The vehicle 120 includes one or more sensors 102 that detect or measure information for the vehicle 120. Exemplary sensors 102 can include sensors that capture environmental information outside the vehicle 120, such as cameras, microphones, lasers, radar, ultrasonic, light detection and ranging (LIDAR), and the like. These sensors can provide environmental input to an automated processing platform operating on the vehicle 120 to make automated decisions. Exemplary sensors 102 also include devices that capture information inside the vehicle 120, such as monitors for components such as the engine, battery, fuel, electrical system, cooling system, and the like. These sensors can provide operational status and alerts to an automated processing platform operating on the vehicle 120. Exemplary sensors 102 can also include automated sensors that can detect sound levels inside the vehicle 120. The automated sensors can determine noise levels inside the vehicle 120 or provide input to other signal processors that determine noise levels.

[0015] The vehicle 120 includes a vehicle component controller 104. Although illustrated as a vehicle component controller 104 in FIG. 1, the vehicle 120 may include two or more vehicle component controllers 104. The vehicle component controller 104 represents a controller that controls the operation of components on the vehicle 120. Exemplary components may include an engine, an accelerator, brakes, a radiator, a battery, a steering wheel, a transmission system, a cooling system, an electrical system, an entertainment system, and other components of the vehicle 120. For example, the vehicle component controller 104 may control a speaker system of the vehicle 120, including controlling volume, balance, fade, and optionally other settings for audio output inside the vehicle 120. The vehicle component controller 104 may automatically operate each component according to inputs from the vehicle system processor 106 or a combination thereof. In some implementations, the vehicle component controller 104 may include a data processing device.

[0016] The vehicle systems processor 106 may include one or more processing components (alternatively referred to as a "processor" or "central processing unit (CPU)") configured to execute instructions related to one or more processes, steps, or actions for an autonomous processing platform operating on the vehicle 120. Generally, the vehicle systems processor 106 executes instructions and manipulates data to perform operations of the autonomous processing platform. The vehicle systems processor 106 may receive inputs from sensors 102 and generate commands to the vehicle component controllers 104. In some cases, the vehicle systems processor 106 may perform autonomous operations. In some cases, the vehicle systems processor 106 may include data processing equipment.

[0017] The communication subsystem 116 can be configured to provide wireless or wired communication for data or control information of the vehicle 120. For example, the communication subsystem 116 can support transmissions via wireless local area network (WLAN or WiFi), near field communication (NFC), infrared (IR), radio frequency identification (RFID), Bluetooth (BT), universal serial bus (USB) or any other short-range communication protocol. The communication subsystem 116 can also support Global System for Mobile communication (GSM), Interim Standard 95 (IS-95), Universal Mobile Telecommunications System (UMTS), CDMA2000 (Code Division Multiple Access), Evolved Universal Mobile Telecommunications System (E-UMTS), Long Term Evaluation (LTE), LTE-Advanced, 5G or any other radio access technology. The communication subsystem 116 can include, for example, one or more antennas, receivers, transmitters, local oscillators, mixers, and digital signal processing (DSP) units. In some implementations, the communications subsystem 116 may support multiple-input multiple-output (MIMO) transmission. In some implementations, the receiver in the communications subsystem 116 may be an advanced receiver or a baseline receiver.

[0018] The user interface 118 may include, for example, any one or more of the following: a display or touch screen display (e.g., a liquid crystal display (LCD), light emitting diode (LED), organic light emitting diode (OLED), or microelectromechanical system (MEMS) display), a keyboard or keypad, a trackball, a speaker, or a microphone. The user interface 118 may also include an I / O interface, for example, a universal serial bus (USB) interface.

[0019] The memory 114 can be a computer-readable storage medium. Exemplary memories 114 include volatile and non-volatile memory, magnetic media, optical media, random access memory (RAM), read-only memory (ROM), removable media, and others. The memory 114 can store an operating system (OS) and various other computer-executable software programs of the vehicle 120 for performing one or more of the processes, steps, and actions described above.

[0020] The operation device 150 represents an application, a set of applications, software, a software module, hardware, or any combination thereof that can be configured to perform one or more specific operations of the vehicle 120. In some implementations, the operation device 150 can be a module that controls the infotainment operations of the vehicle 120. For example, the operation device 150 can interact with the sensors 102 to obtain data and present it on the user interface 118, and the operation device 150 can also receive user input from the user interface 118 and control a speaker to output video or music.

[0021] In some implementations, a first OS 152 and a second OS 154 can operate on the operation device 150. The first OS 152 can also be referred to as a primary OS. The first OS 152 can be configured to interact with control components of the vehicle 120 related to the driving operation of the vehicle 120, such as some of the sensors 102 (e.g., LIDAR), the vehicle system processor 106, the vehicle component controller 104, which are involved in the autonomous processing platform. The second OS 154 can also be referred to as a secondary OS. The second OS 154 can be configured to interact with the user interface 118, the communication subsystem 116, and external devices such as the client device 122 and the server 130. In one example, the first OS 152 can be an OS embodied in real time. The second OS 154 can be ANDROID or IOS. In some implementations, the first OS 152 does not have access to components outside the vehicle 120, whereas the second OS 154 can interact with devices outside the vehicle 120 through the communications subsystem 116.

[0022] In one exemplary operation, for example, turning on the vehicle 120 by an engine start operation can trigger a power-up of the operation device 150. When the operation device 150 is powered up, the first OS 152 is started first and starts a runtime operation. The first OS 152 then starts the startup of the second OS 154. The first OS 152 can check whether a provisioning operation is required. A provisioning operation may be required because a provisioning operation has not been performed before or a re-provisioning operation is required. The first OS 152 establishes a mutual transport layer security (mTLS) relationship with the second OS 154 by communicating a shared secret. In some implementations, the first OS 152 can initiate the provisioning process by sending a runtime-generated random salt to the second OS 154 that is wrapped with a first transport key. The random salt can be used to generate a second transport key that is used to transmit provisioning authentication information. FIGS. 2-4 and related descriptions provide additional details of these implementations. In some implementations, a module or application within first OS 152 may be configured to perform some or all of these provisioning operations.

[0023] As shown, bus 110 provides a communication interface to components of an autonomous processing platform operating on vehicle 120. In some cases, bus 110 can be implemented using a Controller Area Network (CAN) bus.

[0024] The client device 122 represents an application, a set of applications, software, a software module, hardware, or any other combination thereof that interacts with the vehicle 120. For example, the client device 122 can interact with the operation device 150 for infotainment operations. The client device 122 can be an electronic device that can include, but is not limited to, any of the following: an endpoint, a computing device, a mobile device, a mobile electronic device, a user device, a mobile station, a subscriber station, a portable electronic device, a mobile communication device, a wireless modem, a wireless terminal, or other electronic devices. Exemplary endpoints can include a mobile device, an Internet of Things (IoT) device, an Enterprise of Things (EoT) device, a cellular phone, a personal digital assistant (PDA), a smartphone, a laptop, a tablet, a personal computer (PC), a pager, a portable computer, a portable gaming device, a wearable electronic device, a health / medical / fitness device, a camera, or other mobile communication device having components for communicating voice or data over a wireless or wired communication network. The electronic device can also be a peripheral such as a headset, a remote controller, or a display. The electronic device can connect to the vehicle 120 using a short-range communication technology. The short-range communication technology can be wireless, such as BT, NFC, WLAN. The short-range communication technology can also be wired, such as USB.

[0025] Server 130 represents an application, a set of applications, software, a software module, hardware, or any combination thereof that may be configured to manage the operation of vehicle 120. In some implementations, server 130 may interact with operations device 150 for security or infotainment operations.

[0026] The exemplary communication system 100 includes a network 140. The network 140 represents an application, a set of applications, software, a software module, hardware, or a combination thereof that can be configured to transmit data between the server 130 and the vehicle 120 in the communication system 100. The network 140 includes a wireless network, a wired network, or a combination thereof. For example, the network 140 can include one or more of a radio access network (RAN), a core network (CN), and an external network. The RAN can comprise one or more radio access technologies. In some implementations, the radio access technology can be Global System for Mobile communication (GSM), Interim Standard 95 (IS-95), Universal Mobile Telecommunications System (UMTS), CDMA2000 (Code Division Multiple Access), Evolved Universal Mobile Telecommunications System (E-UMTS), Long Term Evaluation (LTE), LTE-Advanced, 5G, or any other radio access technology. In some examples, the core network can be an Evolved Packet Core (EPC).

[0027] 1 are shown as including various component parts, portions, or modules that implement various features and functionality, these elements may instead include multiple sub-modules, third party services, components, libraries, etc., as desired. Additionally, the features and functionality of the various components may be combined into fewer components, as desired.

[0028] Additionally, although the processes and methods in this disclosure are described using vehicle 120 in FIG. 1 as an example, these processes and methods can also be used in other non-vehicle devices, where two OSs run on the same device and communicate secrets shared in the provisioning process. Additionally, the processes and methods can be used between two OSs on different devices to communicate secrets shared in the provisioning process.

[0029] Figure 2 is a flow diagram illustrating an example process 200 of a provisioning operation according to an implementation. The process 200 can be implemented by one or more entities shown in Figure 1 or any other system or module that provides provisioning operations. For example, the process 200 can be implemented by the first OS 152 and the first OS 154 illustrated in Figure 2. The example process 200 shown in Figure 2 can be implemented using additional operations, fewer operations, or different operations, which can be performed in the order shown or in a different order.

[0030] The exemplary process 200 begins at step 202, where a provisioning process is triggered. In some implementations, the process 200 can be triggered by the start of the first OS 152. When the first OS 152 starts, the first OS 152 can check the provisioning storage to determine if some or all of the provisioning credentials are stored. As described later in step 232, the provisioning credentials can include an entity key, a CA key, an entity certificate or a CA certificate, or any combination thereof. In some implementations, these provisioning credentials are stored in a specific storage such that they are accessible to the second OS 154. If the provisioning credentials are stored, the first OS 152 then checks whether these provisioning credentials are valid. The first OS 152 can determine whether these provisioning credentials are valid by attempting a cryptographic operation using the provisioning credentials. Examples of cryptographic operations include encryption or decryption operations. The encryption or decryption operations can be based on the Advanced Encryption Standard (AES). If the cryptographic operation is successfully set up and proceeds to the next step, then the provisioning credentials are valid.

[0031] If the provisioning credentials are not stored or are not valid, the first OS 152 proceeds to step 210 and begins the provisioning process.

[0032] In some implementations, the second OS 154 can determine if a provisioning process is required by checking whether provisioning credentials are available. In some implementations, the provisioning credentials are stored in a keystore that is accessible to the second OS 154. The second OS 154 can check the keystore to determine if provisioning credentials are available. If the provisioning credentials are available, the second OS 154 can continue to operate. If the provisioning credentials are not available, the second OS 154 will wait to receive the provisioning credentials.

[0033] In the illustrated example, the provisioning process is initiated by the first OS 152. Alternatively, or in combination, the second OS 154 can also initiate the provisioning process. For example, if the second OS 154 determines that no provisioning credentials exist, the second OS 154 can send a provisioning request to the first OS 152, triggering step 210.

[0034] In step 210, the first OS 152 generates a first transport key. In some implementations, the first transport key can be generated based on a passphrase and a first salt. The passphrase is a secret shared between the first OS 152 and the second OS 154. An example of a passphrase can be a password. The first salt is a fixed value that is accessible to both the first OS 152 and the second OS 154. An example of a first salt value can be a random or pseudorandom value. In some cases, the first salt can be generated by a manufacturer of the device that runs the first OS 152 and the second OS 154. The first salt can be stored on the device that both the first OS 152 and the second OS 154 can access. In some cases, the first salt can be the same for multiple devices manufactured by the same manufacturer.

[0035] The first transport key can be generated by using a key derivation function or key generation API with the passphrase and the first salt as input. Examples of key derivation functions or key generation APIs include the OpenSSL API or the EnVeloPe Key Derivation Function (EVP KDF).

[0036] In some cases, the first transfer key can be further processed by using a hash function. For example, the Secure Hash Algorithm 256-bit (SHA256 algorithm) can be applied on the first transfer key to expand the first transfer key to 256 bits. Other hash functions can also be used.

[0037] The first OS 152 also generates a random salt in step 210. The random salt can be generated by using a pseudo-random number generator. The random salt is generated at run-time when the process 200 is performed, and therefore, unlike the first salt previously described, the random salt is different for each device and different for each time the provisioning process is performed.

[0038] At 212, the first OS 152 sends the random salt that has been wrapped with the first transport key to the second OS 154. The first OS 152 performs the wrapping operation by using the first transport key to generate ciphertext from the random salt input, which is then sent to the second OS 154.

[0039] In some cases, data communication between the first OS 152 and the second OS 154 can be implemented by using a memory transfer protocol such as Hypervisor Abstraction (HAB). Alternatively, or in combination, data communication between the first OS 152 and the second OS 154 can be implemented by other standardized communication protocols, such as Transmission Control Protocol (TCP) or proprietary communication protocols.

[0040] At 220, the second OS 154 receives the wrapped random salt and performs an unwrapping function to obtain the random salt. As previously described, the second OS 154 has access to the same passphrase and first salt that the first OS 152 used to generate the first transport key. Therefore, the second OS 154 can also use the passphrase and first salt to generate the first transport key, and can use the first transport key to unwrap the received wrapped random salt to obtain the random salt.

[0041] At 222, the second OS 154 sends a first response to the first OS 152. The first response includes the decrypted random salt from step 220. By sending the decrypted random salt back to the first OS 152, the second OS 154 indicates to the first OS 152 that the random salt was successfully received and decrypted. Alternatively, or in addition, the second OS 154 can send the size of the random salt to the first OS 152 to acknowledge receipt of the random salt.

[0042] In some implementations, before transmitting the random salt at 222, the second OS 154 can process the random salt by using a hash function. For example, the Secure Hash Algorithm 256-bit (SHA256) algorithm can be applied on the random salt to expand the random salt to 256 bits. Other hash functions can also be used. Transmitting a hashed random salt can improve the security of the information being transmitted.

[0043] In some cases, to further improve the security of the transmission between first OS 152 and second OS 154, an encoding scheme can be applied to the data being transmitted in step 212, step 222, or both. Figure 3 is a diagram illustrating an example encoding scheme 300 according to an implementation.

[0044] As shown in FIG. 1, input data 310 is encoded to generate encoded data 320. The encoded data is organized into one or more block groups. Each block group, e.g., block group 330, includes a 0th block 332. The 0th block 332 is a bit mask that indicates whether each of the remaining blocks in block group 330 is a data block or a filler block. In the illustrated example, the bit mask includes 8 bits, with the first, third, fourth and sixth bits set to "1", indicating that the corresponding blocks, i.e., blocks 1, 3, 4 and 6, are data blocks. The remainder of the blocks are filler blocks. The input data 310 can fill the data blocks in order, starting with block 1, then continuing with blocks 3, 4 and 6, which skips the filler blocks. The filler blocks can be filled with "1", "0" or randomly generated bits. If additional data is present in the input data 310 after filling the data blocks in the block group 330, a second block group may be included. The second block group also starts with a bit mask block to indicate whether each of the blocks remaining in the second block group is a data block or a filler block. This process may be repeated until all of the input data 310 is included in the encoded data 320. In the illustrated example, each bit mask has 8 bits, each block group has 9 blocks (8 blocks corresponding to each bit in the bit mask plus the bit mask block), and each block may be a byte. The size of the blocks and the size of the block group may also be other numbers.

[0045] In some cases, the bitmasks may be generated by using a random function. The bitmasks in each block group may be the same or different.

[0046] In some implementations, the encoded data 320 may also include an indicator 322. The indicator 322 may indicate a sequence order. For example, a bit in the indicator 322 may be set to "0" to indicate normal order and to "1" to indicate reverse order. Alternatively, the indicator 322 may be a byte that is set to "0" to indicate normal order and set to "255" to indicate reverse order. In some implementations, the normal order may indicate that data is filled from the first data block to the last data block in each block group, whereas the reverse order may indicate that data is filled from the last data block to the first data block in each block group. Alternatively or in addition, the normal order may indicate that data is filled from the first block group to the last block group, whereas the reverse order may indicate that data is filled from the last block group to the first block group. Alternatively or additionally, normal order can indicate that the indicator bits in the bit mask are consecutive, with the first bit corresponding to the first block after the bit mask, while reverse order can indicate that the indicator bits in the bit mask are in reverse order, with the first bit mask corresponding to the last block in the block group. Alternatively or additionally, normal order can indicate that the indicator bits in the bit mask are set to "1" to represent data blocks and "0" to represent filler blocks, while reverse order can indicate that the indicator bits in the bit mask are set to "0" to represent data blocks and "1" to represent filler blocks. In some cases, the indicator 322 can include multiple bits to indicate different kinds of ordering as described previously. For example, one bit can indicate ordering within a block group, another bit can indicate ordering between block groups, and one or two bits can indicate the ordering of the bit mask as described previously.In some implementations, the indicator 322 or each bit in the indicator 322 may be randomly generated.

[0047] The encoding scheme in FIG. 3 can be used in step 212, and the wrapped random salt is encoded by using the encoding scheme. A data length indicator can also be transmitted in step 212 to indicate the size of the input data before encoding. The second OS 154 will first decrypt the data to obtain the wrapped random salt according to the indicator 322 and the first block 332 in each block group. The second OS 154 then further decrypts the wrapped random salt by unwrapping with the first transport key to obtain the random salt.

[0048] Alternatively, or in addition, the encoded scheme in Figure 3 can be used in step 222 to transmit the first response including the random salt. A data length indicator can also be transmitted in step 222 to indicate the size of the input data before encoding.

[0049] Returning to FIG. 2, in step 230, the first OS 152 receives the first response and determines whether the data in the first response matches the random salt. If the first response is encoded using the encoding scheme in FIG. 3, the first OS 152 uses the indicator 322 and the 0th block 332 in each block group to obtain the data in the first response. In some cases, the data in the first response can be a hashed random salt, as previously described. In some cases, the first OS 152 can also perform hashing using the same hashing function on the random salt and compare the hashing result with the data in the first response. If the hashing result matches the data in the first response, then the first OS 152 can conclude that the second OS 154 successfully obtained the random salt sent in step 212. Alternatively, the data in the first response can include a random salt without a hashing operation. In this case, the first OS 152 can compare the data with the random salt to determine if the second OS 154 successfully obtained the random salt.

[0050] If the match is not successful, the first OS 152 may return to step 210, generate another random salt, and repeat steps 212 through 222.

[0051] If the match is successful, then both the first OS 152 and the second OS 154 can use this random salt to generate a second transport key. In some implementations, the second transport key can be generated by using a key derivation function or key generation API with the passphrase (used in step 210 to generate the first transport key) and the random salt as input. Examples of key derivation functions or key generation APIs include the OpenSSL API or EVP KDF. The second transport key can be used to wrap provisioning credentials for transmission by the first OS 152.

[0052] The first OS 152 may generate the provisioning credentials in response to finding a successful match in step 230. Alternatively, or in combination, some or all of the provisioning credentials may be generated before the successful match in step 230, e.g., during step 210 or after step 212.

[0053] The provisioning credentials may include one or more of the following: a device CA private key, a device CA public key, a device CA certificate, an entity private key, an entity public key, an entity certificate, a key encryption key used to wrap the private key, and other authentication information.

[0054] In step 232, the first OS 152 sends the provisioning credential to the second OS 154. The provisioning credential has been wrapped with a second transport key. The first OS 152 performs a wrapping operation by using the second transport key to generate a ciphertext from the provisioning credential, which is then sent to the second OS 154. The second OS 154 obtains the provisioning credential by using an unwrapping operation to unwrap the received ciphertext with the second transport key.

[0055] In some cases, the type of provisioning credential generated and transmitted depends on the particular security operations involved in the provisioning process. In one implementation, the device CA is provisioned by the first OS 152. The first OS 152 can send the CA private key and CA certificate to the second OS 154 in one transmission or in separate transmissions. The second OS 154 can instantiate and use the CA based on the received CA private key and CA certificate to generate an entity certificate for an entity, e.g., the operating device 150. In some cases, each endpoint of the connection can be referred to as an entity.

[0056] In other implementations, an entity key pair can be created in the first OS 152 and the second OS 154. In this case, the first OS 152 sends an entity certificate to the second OS 154. In yet other implementations, the third-party CA certificate is transmitted between the first OS 152 and the second OS 154, or vice versa, depending on which OS has access to the Internet and which does not.

[0057] 4 is a flow chart illustrating an example method 400 of a provisioning operation according to an implementation. The method 400 may be implemented by one or more entities shown in FIG. 1 or any other system or module that provides provisioning operations. For example, the method 400 may be implemented by the operations device 150 illustrated in FIG. 1. The example method 400 shown in FIG. 4 may be implemented using additional, fewer, or different operations, which may be performed in the order shown or in a different order.

[0058] At 402, the first OS generates a first transport key. In some cases, the first OS generates the first transport key by deriving the first transport key from the passphrase and a first salt value. At 404, the first OS sends a random salt to the second OS by using the first transport key. At 406, the first OS generates a second transport key by using the random salt. In some cases, the first OS generates a second transport key from the passphrase and the random salt. At 408, the first OS sends provisioning credentials to the second OS by using the second transport key.

[0059] FIG. 5 illustrates a high-level architecture block diagram of a computer 500 according to an implementation. The computer 500 can be implemented as an operation device 150, a client device 122, a server 130, or any combination thereof. The computer 500 can also be used to implement the operations described in FIGS. 1-4. The illustrated diagrams are only possible implementations of the described subject matter and are not intended to limit the present disclosure to a single described implementation. Those skilled in the art will appreciate the fact that the described components can be connected, combined and / or used in alternative ways consistent with the present disclosure.

[0060] In some cases, the processing algorithms of the code package establishment can be implemented in executable computing code, for example, C / C++ executable code. In some cases, the computer 500 can include a standalone Linux system that runs batch applications. In some cases, the computer 500 can include a mobile or personal computer.

[0061] Computer 500 may comprise a computer that includes input devices such as a keypad, keyboard, touch screen, microphone, voice recognition device, or other device capable of receiving user information, and / or output devices that communicate information related to the operation of the computer or GUI, including digital data, visual and / or audio information.

[0062] The computer 500 may act as a client, a network component, a server, a database or other persistence, and / or any other component. In some implementations, one or more components of the computer 500 may be configured to operate within a cloud computing based environment.

[0063] At a high level, the computer 500 is an electronic computing device operable to receive, transmit, process, store or manage data. According to some implementations, the computer 500 may also include or be communicatively coupled to an application server, an e-mail server, a web server, a caching server, a streaming data server, a business intelligence (BI) server, and / or other servers.

[0064] Computer 500 can collect data from a web browser or client application, such as an installed plug-in, of network events or mobile application usage events across network 110. In addition, data can be collected by computer 500 from internal users (e.g., from a command console or by other suitable access methods), external or third parties, other automated applications, and any other suitable entities, individuals, systems, or components.

[0065] Each of the components of the computer 500 can communicate using a system bus 512. In some implementations, any and / or all of the components of the computer 500, both hardware and / or software, can interface with each other and / or with the interface 502 via the system bus 512 using an application programming interface (API) 508 and / or a service layer 510. The API 508 can include specifications for routines, data structures, and object classes. The API 508 can be either computer language independent or dependent and can refer to a complete interface, a single function, or a set of APIs. The service layer 510 provides software services to the computer 500. The functionality of the computer 500 can be accessible to all service consumers using this service layer. Software services such as those provided by the service layer 510 provide reusable, defined business functionality through defined interfaces. For example, the interface can be software written in JAVA, C++, or other suitable language, providing data in Extensible Markup Language (XML) format or other suitable format. While depicted as integrated components of computer 500, alternative implementations may depict API 508 and / or services layer 510 as stand-alone components in conjunction with other components of computer 500. Additionally, any or all parts of API 508 and / or services layer 510 may be implemented as child modules or sub-modules of other software modules, enterprise applications, or hardware modules without departing from the scope of the present disclosure.

[0066] The computer 500 includes an interface 502. Although illustrated in FIG. 5 as a single interface 502, two or more interfaces 502 may be used according to the particular needs, desires or particular implementation of the computer 500. The interface 502 is used by the computer 500 to communicate with other systems in a distributed environment connected to a network (whether or not shown). In general, the interface 502 comprises logic encoded in software and / or hardware in a suitable combination and operable to communicate with a network. More specifically, the interface 502 may comprise software supporting one or more communication protocols related to the communication, such that the hardware or hardware of the interface is operable to communicate physical signals within and outside the computer 500.

[0067] Computer 500 includes at least one processor 504. Although illustrated in FIG. 5 as a single processor 504, two or more processors may be used according to the particular needs, desires, or particular implementation of the computer. Generally, processor 504 executes instructions and manipulates data to perform the operations of computer 500. Specifically, processor 504 performs the functionality disclosed in FIGS. 1-4.

[0068] The computer 500 also includes a memory 514 that maintains data for the computer 500. Although illustrated in Figure 5 as a single memory 514, two or more memories may be used according to the particular needs, desires or particular implementation of the computer 500. While the memory 514 is illustrated as an integrated component of the computer 500, in alternative implementations the memory 514 may be external to the computer 500.

[0069] Application 506 is an algorithmic software engine providing functionality according to the particular needs, desires, or particular implementation of computer 500, particularly with respect to functionality required for anomaly detection. Although illustrated as a single application 506, application 506 may be implemented as multiple applications 506 on computer 500. Additionally, while illustrated as integrated into computer 500, in alternative implementations application 506 may be external to computer 500.

[0070] There may be any number of computers 500 associated with the network or external to the network and communicating through the network. Additionally, the present disclosure contemplates that many users may use one computer 500, or one user may use multiple computers 500.

[0071] The described implementations of the subject matter may include one or more features either alone or in combination.

[0072] For example, in a first implementation, a method includes generating a first transport key by a first operating system (OS), sending a random salt from the first OS to a second OS by using the first transport key, generating a second transport key by the first OS by using the random salt, and sending provisioning credentials from the first OS to the second OS by using the second transport key.

[0073] Each of the above and other described implementations can optionally include one or more of the following features.

[0074] The first feature may be combined with any of the following features, wherein the provisioning credential comprises at least one of a private key of a certification authority (CA) or a certificate of the CA.

[0075] A second feature may be combined with any of the previous or following features and further includes receiving, by the first OS, a first response from the second OS, the first response comprising data, and determining, by the first OS, that the data in the first response matches a random salt.

[0076] A third feature, which may be combined with any of the previous or following features, is that the data comprises a bitmask, each bit of the bitmask indicating whether a corresponding byte comprises data or filler.

[0077] A fourth feature, which may be combined with any of the previous or following features, comprises an indicator that the data is in one of consecutive order or reverse order.

[0078] A fifth feature, which may be combined with any of the previous or following features, wherein whether the data matches the random salt is determined by running a hashing function on the random salt to produce a hash result and determining whether the hash result matches the data.

[0079] A sixth feature may be combined with any of the previous features, where the first OS and the second OS operate on the same device, and the first OS and the second OS perform a multi-transport layer security (mTLS) process.

[0080] In a second implementation, a computer-readable medium contains instructions that, when executed, cause an electronic device to perform operations including generating a first transport key by a first operating system (OS), sending a random salt from the first OS to a second OS by using the first transport key, generating a second transport key by the first OS by using the random salt, and sending provisioning credentials from the first OS to the second OS by using the second transport key.

[0081] Each of the above and other described implementations can optionally include one or more of the following features.

[0082] The first feature may be combined with any of the following features, wherein the provisioning credentials comprise at least one of a private key of a certification authority (CA) or a certificate of the CA.

[0083] A second feature may be combined with any of the previous or following features, and the operations further include receiving, by the first OS, a first response from the second OS, the first response comprising data, and determining, by the first OS, that the data in the first response matches the random salt.

[0084] A third feature, which may be combined with any of the previous or following features, is that the data comprises a bitmask, each bit of the bitmask indicating whether a corresponding byte comprises data or filler.

[0085] A fourth feature, which may be combined with any of the previous or following features, comprises an indicator that the data is in one of consecutive order or reverse order.

[0086] A fifth feature, which may be combined with any of the previous or following features, wherein whether the data matches the random salt is determined by running a hashing function on the random salt to produce a hash result and determining whether the hash result matches the data.

[0087] A sixth feature may be combined with any of the previous features, where the first OS and the second OS operate on the same device, and the first OS and the second OS perform a multi-transport layer security (mTLS) process.

[0088] In a third implementation, a computer-implemented system includes one or more computers and one or more computer memory devices interoperably coupled to the one or more computers and having a tangible, non-transitory, machine-readable medium storing one or more instructions that, when executed by the one or more computers, perform one or more operations, including generating a first transport key by a first operating system (OS), sending a random salt from the first OS to a second OS by using the first transport key, generating a second transport key by the first OS by using the random salt, and sending provisioning credentials from the first OS to the second OS by using the second transport key.

[0089] These and other described implementations can optionally include one or more of the following features, respectively.

[0090] The first feature may be combined with any of the following features, wherein the provisioning credentials comprise at least one of a private key of a certification authority (CA) or a certificate of the CA.

[0091] A second feature may be combined with any of the previous or following features, and the operations further include receiving, by the first OS, a first response from the second OS, the first response comprising data, and determining, by the first OS, that the data in the first response matches the random salt.

[0092] A third feature, which may be combined with any of the previous or following features, is that the data comprises a bitmask, each bit of the bitmask indicating whether a corresponding byte comprises data or filler.

[0093] A fourth feature, which may be combined with any of the previous or following features, comprises an indicator that the data is in one of consecutive order or reverse order.

[0094] A fifth feature, which may be combined with any of the previous or following features, wherein whether the data matches the random salt is determined by running a hashing function on the random salt to produce a hash result and determining whether the hash result matches the data.

[0095] A sixth feature may be combined with any of the previous features, where the first OS and the second OS operate on the same device, and the first OS and the second OS perform a multi-transport layer security (mTLS) process.

[0096] Implementations of the subject matter and functional operations described herein can be implemented in digital electronic circuitry, in tangibly embodied computer software or firmware, in computer hardware including the structures disclosed herein and their structural equivalents, or in a combination of one or more of these. Software implementations of the subject matter described can be implemented as one or more computer programs, which are one or more modules of computer program instructions encoded on a tangible, non-transitory computer-readable medium for execution by a computer or computer-implemented system or for controlling the operation of a computer or computer-implemented system. Alternatively, or in addition, the program instructions can be encoded in / on an artificially generated propagated signal, e.g., a machine-generated electrical, optical, or electromagnetic signal that is generated to encode information for transmission to a receiving device for execution by a computer or computer-implemented system. The computer storage medium can be a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory device, or a combination of computer storage media. Configuring one or more computers means that one or more computers have hardware, firmware, or software (or a combination of hardware, firmware, or software) installed such that, when executed by the one or more computers, specific computing operations are performed. Computer storage media, however, are not propagating signals.

[0097] The terms "real-time," "real (first) time" (RFT), "near(ly) real-time" (NRT), "quasi real-time" or similar terms (as understood by those skilled in the art) refer to actions and responses that are close in time such that an individual perceives the actions and responses as occurring substantially simultaneously. For example, the time difference between an individual's action of accessing data followed by a response to the display of the data (or the start of the display) can be less than 1 millisecond (ms), less than 1 second (s), or less than 5 s. When the requested data does not need to be displayed (or started for display) instantly, it is displayed (or started for display) without any intentional delay, taking into account the limitations of the computing system described and the time required, for example, to gather, accurately measure, analyze, process, store, or transmit the data.

[0098] The terms "data processing device", "computer", "computing device" or "electronic computing device" (or equivalent terms understood by those skilled in the art) refer to data processing hardware and encompass all kinds of apparatus, devices and machines for processing data, including, as examples, programmable processors, computers or multiprocessors or computers. A computer can also be or further include special purpose logic circuitry, such as a central processing unit (CPU), a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC). In some implementations, a computer or computer implemented system or special purpose logic circuitry (or a combination of a computer or computer implemented system or special purpose logic circuitry) can be hardware or software based (or a combination of both hardware and software based). A computer can optionally include code that creates an execution environment for a computer program, such as a processor firmware, a protocol stack, a database management system, an operating system or code that constitutes a combination of the execution environment. This disclosure contemplates the use of a computer or computer implemented system having an operating system, such as LINUX®, UNIX®, WINDOWS®, MAC OS®, ANDROID® or IOS, or a combination of operating systems.

[0099] A computer program, which may also be referred to or described as a program, software, software application, unit, module, software module, script, code or other component, may be written in any form of programming language, including compiled or interpreted languages, or declarative or procedural languages, and it may be deployed in any form, including, for example, a stand-alone program, module, component or subroutine, for use in a computing environment. A computer program may, but need not, correspond to a file in a file system. A program may be stored in one or more scripts stored in portions of files that hold other programs or data, for example, in a markup language document, in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files that store one or more modules, subprograms or portions of code). A computer program may be deployed for execution on one computer or multiple computers, which may be located at one site or distributed across multiple sites and interconnected by a communication network.

[0100] While the portions of the programs illustrated in the various figures may be illustrated as individual components, such as units or modules that implement the described features and functionality using various objects, methods or other processes, the programs may instead include sub-units, sub-modules, third party services, components, libraries and other components, as appropriate. Conversely, the features and functionality of the various components may be combined into a single component, as appropriate. The thresholds used to make computational decisions may be determined statically, dynamically, or both statically and dynamically.

[0101] The described method, process or logic flow represents one or more examples of functionality consistent with the present disclosure and is not intended to limit the disclosure to the implementations described or illustrated, but is intended to be given the widest scope consistent with the principles and features described. The described method, process or logic flow can be performed by one or more programmable computers executing one or more computer programs to perform functions by operating on input data and generating output data. The method, process or logic flow can also be performed by special purpose logic circuitry, such as a CPU, FPGA, or ASIC, and the computer can also be implemented as a special purpose logic circuitry.

[0102] A computer for executing a computer program can be based on a general-purpose or special-purpose microprocessor, both, or other types of CPU. In general, the CPU will receive instructions and data from memory and write them to memory. The essential elements of a computer are a CPU for performing or executing instructions, and one or more memory devices for storing instructions and data. In general, a computer will also include one or more mass storage devices, such as magnetic disks, magneto-optical disks, or optical disks, for storing data, and be operatively coupled to receive data from or transfer data to the mass storage devices, or both. However, a computer does not necessarily have to have such devices. Furthermore, a computer can be embodied in other devices, such as a mobile telephone, a personal digital assistant (PDA), a mobile audio or video player, a game console, a global positioning system (GPS) receiver, or a portable memory storage device (e.g., Universal Serial Bus (USB), flash drive, to name a few).

[0103] The non-transitory computer readable medium for storing computer program instructions and data can include all forms of persistent / non-persistent or volatile / non-volatile memory, media, and memory devices, including, by way of example, semiconductor memory devices such as random access memory (RAM), read only memory (ROM), phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), erasable programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), and flash memory devices (magnetic devices, e.g., tapes, cartridges, cassettes, internal / removable disks), magneto-optical disks, and optical memory devices such as digital versatile / video disks (DVDs), compact disks (CD) ROMs, DVD+ / -R, DVD-RAM, DVD-ROM, high definition / high density (HD)-DVDs, and BLU-RAY® / BLU-RAY® disks (BDs), and other optical memory technologies. The memory may store various objects or data including caches, classes, frameworks, applications, modules, backup data, jobs, web pages, web page templates, data structures, database tables, repositories for storing dynamic information, or other suitable information including any parameters, variables, algorithms, instructions, rules, constraints or references. In addition, the memory may include other suitable data such as logs, policies, security or access data, or report files. The processor and the memory may be supplemented by or incorporated in special purpose logic circuitry.

[0104] To provide for interaction with a user, implementations of the subject matter described herein can be implemented on a computer having a display device, such as a cathode ray tube (CRT), liquid crystal display (LCD), light emitting diode (LED) or plasma monitor for displaying information to a user, and a keyboard and pointing device, such as a mouse, trackball or trackpad, for a user to provide input to the computer. Input can also be provided to the computer using a touch screen, such as a tablet computer surface with pressure sensitivity or a multi-touch screen using capacitive or electrical sensing. Other types of devices can be used to interact with a user. For example, feedback provided to the user can be any form of sensory feedback (such as visual, auditory, tactile or combination feedback types). Input from the user can be received in any form, including auditory, audio or tactile input. In addition, the computer can interact with a user by sending documents to and receiving documents from a client computing device being used by the user (e.g., by sending a web page to a web browser on the user's mobile computing device in response to a request received from the web browser).

[0105] The term "graphical user interface (GUI)" may be used in the singular or plural to describe one or more graphical user interfaces and each of the presentations of a particular graphical user interface. Thus, a GUI may refer to any graphical user interface, including but not limited to a web browser, touch screen, or command line interface (CLI), that processes information and efficiently displays information results to a user. Generally, a GUI may include some or all of the numerous user interface (UI) elements associated with a web browser, such as interactive fields, pull-down lists, and buttons. These and other UI elements may relate to or represent the functionality of a web browser.

[0106] Implementations of the subject matter described herein can be implemented in a computing system, which may include back-end components such as, for example, a data server, or may include middleware components, for example, an application server, or may include front-end components, for example, a client computer having a graphical user interface or a web browser through which a user may interact with an implementation of the subject matter described herein, or may include any combination of one or more such back-end, middleware, or front-end components. The components of the system may be interconnected by any form or medium of wired or wireless digital data communication (or combination of data communication), for example, a communications network. Examples of communications networks include local area networks (LANs), radio access networks (RANs), metropolitan area networks (MANs), wide area networks (WANs), worldwide interoperable microwave access (WIMAX), wireless local area networks (WLANs), for example, using 802.11x or other protocols, all or part of the Internet, other communications networks, or combinations of communications networks. A communications network may communicate, for example, Internet Protocol (IP) packets, Frame Relay frames, Asynchronous Transfer Mode (ATM) cells, voice, video, data or other information between network nodes.

[0107] A computing system may include clients and servers. Clients and servers are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.

[0108] In some implementations, any or all of the components of a computing system, both hardware and / or software, may interface with each other and / or may interface using APIs and / or a service layer. APIs may include specifications for routines, data structures, and object classes. APIs may be either computer language independent or dependent and may refer to a complete interface, a single function, or a set of APIs. The service layer provides software services to the computing system. The functionality of the various components of the computing system may be accessible to all service consumers through this service layer. The software services provide reusable, defined business functionality through a defined interface. For example, the interface may be software written in JAVA, C++, or other suitable language that provides data in XML format or other suitable format. The APIs and / or service layer may be integrated components and / or stand-alone components associated with other components of the computing system. Additionally, any or all parts of the service layer may be implemented as child modules or sub-modules of other software modules, enterprise applications, or hardware modules without departing from the scope of this disclosure.

[0109] Although the present specification contains many specific implementation details, this should not be construed as a limitation on the scope of any inventive concept or the scope that can be claimed, but rather as a description of features that may be specific to a particular implementation of a particular inventive concept. Certain features described in the present specification in the context of another implementation can also be implemented in combination in a single implementation. Conversely, various features described in the context of a single implementation can also be implemented in multiple implementations separately or in any subcombination. Furthermore, although previously described features may be described as operating in a certain combination and may even be initially claimed as such, one or more features from the claimed combination may in some cases be excluded from the combination, and the claimed combination may be directed to a subcombination or a variation of the subcombination.

[0110] Particular implementations of the subject matter have been described. Other implementations, alternatives, and permutations of the described implementations are within the scope of the following claims, as will be apparent to those skilled in the art. Although operations are depicted in the figures or claims in a particular order, this should not be understood as requiring such operations to be performed in the particular order or sequential order shown, or that all illustrated operations be performed (some operations can be considered optional), to achieve desired results. In some cases, multitasking or parallel processing (or a combination of multitasking and parallel processing) can be performed where useful and deemed appropriate.

[0111] The separation or integration of various system modules and components in previously described implementations should not be understood as requiring such separation or integration in all implementations, and it should be understood that the program components and systems described may generally be integrated together in a single software product or packaged into multiple software modules.

[0112] Therefore, the previously described exemplary implementations do not define or constrain this disclosure. Other changes, substitutions, and alterations are also possible without departing from the scope of this disclosure.

[0113] Furthermore, any claimed implementations are believed to be applicable to a computer system comprising at least a computer-implemented method, a non-transitory computer-readable medium storing computer-readable instructions for performing the computer-implemented method, and a computer memory interoperably coupled with a hardware processor configured to perform the computer-implemented method or instructions stored on the non-transitory computer-readable medium.

Claims

1. A method, the method comprising: generating, by a first operating system (OS), a first transport key; transmitting a random salt from the first OS to a second OS using the first transport key; generating, by the first OS, a second transport key using the random salt; receiving, by the first OS, a first response from the second OS, the first response comprising data, the data comprising a bit mask, each bit of the bit mask indicating whether a corresponding byte comprises data or filler; determining, by the first OS, that the data in the first response matches the random salt; transmitting provisioning credentials from the first OS to the second OS by using the second transport key; A method comprising:

2. The method of claim 1 , wherein the provisioning credentials comprise at least one of a private key of a certification authority (CA) or a certificate of the CA.

3. The method of claim 1 , wherein the data comprises an indicator that points to one of a consecutive order or a reverse order.

4. 2. The method of claim 1, wherein whether the data matches the random salt is determined by running a hashing function on the random salt to generate a hash result and determining whether the hash result matches the data.

5. 2. The method of claim 1, wherein the first OS and the second OS run on the same device, and the first OS and the second OS perform a multi-transport layer security (mTLS) process.

6. A non-transitory computer-readable medium, the computer-readable medium containing instructions that, when executed, cause an electronic device to perform an operation, the operation comprising: generating, by a first operating system (OS), a first transport key; transmitting a random salt from the first OS to a second OS using the first transport key; generating, by the first OS, a second transport key using the random salt; receiving, by the first OS, a first response from the second OS, the first response comprising data, the data comprising a bit mask, each bit of the bit mask indicating whether a corresponding byte comprises data or filler; determining, by the first OS, that the data in the first response matches the random salt; transmitting provisioning credentials from the first OS to the second OS by using the second transport key; 1. A computer-readable medium comprising:

7. The computer-readable medium of claim 6 , wherein the provisioning credentials comprise at least one of a private key of a certification authority (CA) or a certificate of the CA.

8. The computer-readable medium of claim 6 , wherein the data comprises an indicator that points to one of a sequential order or a reverse order.

9. 7. The computer-readable medium of claim 6, wherein whether the data matches the random salt is determined by running a hashing function on the random salt to generate a hash result and determining whether the hash result matches the data.

10. 7. The computer-readable medium of claim 6, wherein the first OS and the second OS run on the same device, and the first OS and the second OS perform a multi-transport layer security (mTLS) process.

11. 1. A computer implemented system, comprising: one or more computers; one or more computer memory devices interoperably coupled to the one or more computers and having a tangible, non-transitory, machine-readable medium storing one or more instructions; Equipped with The one or more instructions, when executed by the one or more computers, perform one or more operations, the one or more operations including: generating, by a first operating system (OS), a first transport key; transmitting a random salt from the first OS to a second OS using the first transport key; generating, by the first OS, a second transport key using the random salt; receiving, by the first OS, a first response from the second OS, the first response comprising data, the data comprising an indicator indicating one of a sequential order or a reverse order; determining, by the first OS, that the data in the first response matches the random salt; transmitting provisioning credentials from the first OS to the second OS by using the second transport key; 1. A computer-implemented system comprising:

12. The computer-implemented system of claim 11 , wherein the provisioning credentials comprise at least one of a private key of a certificate authority (CA) or a certificate of the CA.

13. 12. The computer-implemented system of claim 11, wherein the data comprises a bit mask, each bit of the bit mask indicating whether a corresponding byte comprises data or filler.

14. 12. The computer-implemented system of claim 11, wherein whether the data matches the random salt is determined by running a hashing function on the random salt to generate a hash result and determining whether the hash result matches the data.

15. The computer-implemented system of claim 11, wherein the first OS and the second OS operate on the same device, and the first OS and the second OS perform a multi-transport layer security (mTLS) process.

16. The method of claim 1, wherein the provisioning authentication information comprises at least one of an entity private key or an entity public key.

17. The method of claim 1, wherein the provisioning credentials comprise at least one of an entity certificate or a key encryption key.

18. The computer-implemented system of claim 11, wherein the provisioning authentication information comprises at least one of an entity private key or an entity public key.

19. The computer-implemented system of claim 11, wherein the provisioning credentials comprise at least one of an entity certificate or a key encryption key.

20. The computer-readable medium of claim 6, wherein the provisioning authentication information comprises at least one of an entity private key or an entity public key.

Images