Dynamic domain key exchange for authenticated device to device communications

• US 10,250,383 B1
• Filed: 09/21/2018
• Issued: 04/02/2019
• Est. Priority Date: 03/20/2018
• Status: Active Grant

• Current Assignee: DigiCert Incorporated
• Original Assignee: Mocana Corporation (DigiCert Incorporated)
• Inventors: Kumar, Srinivas, Gupta, Atul, Malibiradar, Pramod, Uchil, Shreya
• Primary Examiner(s): Vaughan, Michael R
• Application Number:
  US16/138,030
• Time in Patent Office: 193 Days
• Field of Search: None
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2209/84 Vehicles
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/009 specially adapted for networks, e.g. wireless sensor networks, ad-hoc networks, RFID networks or cloud networks
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/0433 Key management protocols
• CPC Class Codes: H04W 12/0471 Key exchange
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/108 Source integrity
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 4/06 Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
• CPC Class Codes: H04W 4/40 for vehicles, e.g. vehicle-to-pedestrians [V2P]
• CPC Class Codes: H04W 4/46 : for vehicle-to-vehicle communication [V2V]

Abstract

A method of dynamically generating a domain based public group key and private member keys using a domain key agent, a domain key service of a domain key broker, and a domain key distribution center. The method includes: sending to the domain key service of a domain key broker a request for a private member key for the domain, wherein the request includes proof of possession of a vehicle private key associated with a vehicle certificate and a vehicle public key; receiving from the domain key service a private member key and a public group key; sending a message digitally signed using the member private key; verifying the digital signature on the received message using the public group key; and dynamically renewing the public group key and private member key based on the domain.

Claims

1. A method for secure message exchanges between vehicles in an autonomous domain using i) a domain key agent, a wireless supplicant, and a domain keystore at a first and second vehicle, ii) a domain key service and a wireless authenticator at a domain key broker, iii) a domain key factory service at a remote domain key distribution center, and iv) an enrollment service at a remote enrollment server, the method comprising:

scanning, by the wireless supplicant on each the first and second vehicle, a wireless network for the autonomous domain by a service set identifier (SSID) and channel for the autonomous domain;

retrieving, by the domain key agent on each the first and second vehicle, a group public key, a member private key, and a member certificate from the domain keystore for the SSID;

discovering, by the domain key agent on each the first and second vehicle, the wireless authenticator on the domain key broker;

authenticating each the first and second vehicle, by the domain key agent on each the first and second vehicle respectively, with the wireless authenticator on the domain key broker;

listening, on an authentication port by the domain key service for authentication requests from the wireless authenticator on the domain key broker to validate a vehicle certificate;

querying, by the domain key agent on each the first and second vehicle from the wireless authenticator on the domain key broker, a domain key service address and service port for the autonomous domain;

listening, on the service port by the domain key service for registration requests from the domain key agent on each a first and a second vehicle, for the group public key, the member private key and the member certificate;

processing, by the domain key service the received registration request, and sending a group public key and a member private key request to the domain key factory service for generation of a domain group public key and a domain member private key associated with a vehicle unique identifier of each the first and second vehicles;

processing, by the domain key service the received registration request, and sending an enrollment request to the enrollment service for a member certificate associated with the vehicle unique identifier of each the first and second vehicles;

receiving, by the domain key agent on each the first vehicle and second vehicle from the domain key service, the domain group public key, the domain member private key and the member certificate associated with the vehicle unique identifier in response to the registration request;

sending, by the domain key agent on at least one of the first and second registered vehicles, a message signed using the domain member private key to another registered vehicle in the domain; and

verifying, by the domain key agent on at least one of the first and second registered vehicles, a received signed message from the other registered vehicle within the domain using the domain group public key.

2. The method of claim 1, wherein the wireless supplicant on the first vehicle comprises a Wi-Fi or cellular supplicant, and the wireless authenticator on the domain key broker comprises a Wi-Fi or cellular access point.

3. The method of claim 1, wherein the domain keystore of the domain key agent comprises at least one of a table of cached records associated to a SSID, a domain type, a group public key, a member private key, a member certificate, and a timestamp.

4. The method of claim 3, wherein the domain key agent uses the group public key, the member private key, and the member certificate based on the dynamically discovered domain SSID for the first vehicle.