Secure PKI communications for “machine-to-machine” modules, including key derivation by modules and authenticating public keys
First Claim
1. A method of generating keys for a module to securely communicate over a wireless network comprising the steps of:
- (a) recording in memory of the module at least the following;
(i) a first set of parameters for a secure hash algorithm;
(ii) a second set of parameters for an elliptic curve algorithm; and
(iii) a first public key which corresponds to a first private key;
(b) deriving, by the module, a module private key and a corresponding module public key using the second set of parameters;
(c) generating, by the module, a first shared secret key using a first elliptic curve Diffie-Hellman key exchange, and based at least in part, on the first public key;
(d) sending, from the module to a first computing device which is connected to the wireless network, a first message including the derived module public key, wherein at least a portion of the first message is encrypted using a third set of parameters that is based on a symmetric ciphering algorithm and the derived first shared secret key;
(e) receiving, by the module from the first computing device, a second message comprising encrypted data, which is encrypted, by the first computer device, using the symmetric ciphering algorithm and a derived second shared secret key, wherein the second shared secret key is derived by the first computer device using a second elliptic curve Diffie-Hellman key exchange based at least, in part, on the derived module public key; and
(f) decrypting, by the module, the encrypted data using the third set of parameters and the derived second shared secret key.
3 Assignments
0 Petitions
Accused Products
Abstract
Methods and systems are provided for efficient and secure “Machine-to-Machine” (M2M) between modules and servers. A module can communicate with a server by accessing the Internet, and the module can include a sensor and/or actuator. The module and server can utilize public key infrastructure (PKI) such as public keys to encrypt messages. The module and server can use private keys to generate digital signatures for datagrams sent and decrypt messages received. The module can internally derive pairs of private/public keys using cryptographic algorithms and a set of parameters. A server can use a shared secret key to authenticate the submission of derived public keys with an associated module identity. For the very first submission of a public key derived the module, the shared secret key can comprise a pre-shared secret key which can be loaded into the module using a pre-shared secret key code.
-
Citations
11 Claims
-
1. A method of generating keys for a module to securely communicate over a wireless network comprising the steps of:
-
(a) recording in memory of the module at least the following; (i) a first set of parameters for a secure hash algorithm; (ii) a second set of parameters for an elliptic curve algorithm; and (iii) a first public key which corresponds to a first private key; (b) deriving, by the module, a module private key and a corresponding module public key using the second set of parameters; (c) generating, by the module, a first shared secret key using a first elliptic curve Diffie-Hellman key exchange, and based at least in part, on the first public key; (d) sending, from the module to a first computing device which is connected to the wireless network, a first message including the derived module public key, wherein at least a portion of the first message is encrypted using a third set of parameters that is based on a symmetric ciphering algorithm and the derived first shared secret key; (e) receiving, by the module from the first computing device, a second message comprising encrypted data, which is encrypted, by the first computer device, using the symmetric ciphering algorithm and a derived second shared secret key, wherein the second shared secret key is derived by the first computer device using a second elliptic curve Diffie-Hellman key exchange based at least, in part, on the derived module public key; and (f) decrypting, by the module, the encrypted data using the third set of parameters and the derived second shared secret key. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11)
-
Specification