Secure PKI communications for “machine-to-machine” modules, including key derivation by modules and authenticating public keys
First Claim
1. A module for securely communicating over a wireless network comprises:
- (1) one or more processors; and
(2) a first non-transitory computer-readable memory operatively connected to the one or more processors, the first non-transitory computer-readable memory having stored thereon machine-readable instructions that, when executed by the one or more processors cause the one or more processors to perform a method comprising steps of;
(a) recording in the first non-transitory computer-readable memory, at least the following;
(i) a first set of parameters for a secure hash algorithm;
(ii) a second set of parameters for an elliptic curve algorithm; and
(iii) a first public key which corresponds to a first private key;
(b) deriving a module private key and a corresponding module public key using the second set of parameters;
(c) generating a first shared secret key using a first elliptic curve Diffie-Hellman key exchange, and based at least in part, on the first public key;
(d) sending, to a first computing device which is connected to the wireless network, a first message including the derived module public key, wherein at least a portion of the first message is encrypted using a third set of parameters that is based on a symmetric ciphering algorithm and the derived first shared secret key;
(e) receiving, from the first computing device, a second message comprising encrypted data, which is encrypted, by the first computing device, using the symmetric ciphering algorithm and a derived second shared secret key, wherein the second shared secret key is derived by the first computing device using a second elliptic curve Diffie-Hellman key exchange based at least, in part, on the derived module public key; and
(f) decrypting the encrypted data using the third set of parameters and the derived second shared secret key.
3 Assignments
0 Petitions
Accused Products
Abstract
Methods and systems are provided for efficient and secure “Machine-to-Machine” (M2M) between modules and servers. A module can communicate with a server by accessing the Internet, and the module can include a sensor and/or actuator. The module and server can utilize public key infrastructure (PKI) such as public keys to encrypt messages. The module and server can use private keys to generate digital signatures for datagrams sent and decrypt messages received. The module can internally derive pairs of private/public keys using cryptographic algorithms and a set of parameters. A server can use a shared secret key to authenticate the submission of derived public keys with an associated module identity. For the very first submission of a public key derived the module, the shared secret key can comprise a pre-shared secret key which can be loaded into the module using a pre-shared secret key code.
-
Citations
16 Claims
-
1. A module for securely communicating over a wireless network comprises:
-
(1) one or more processors; and (2) a first non-transitory computer-readable memory operatively connected to the one or more processors, the first non-transitory computer-readable memory having stored thereon machine-readable instructions that, when executed by the one or more processors cause the one or more processors to perform a method comprising steps of; (a) recording in the first non-transitory computer-readable memory, at least the following; (i) a first set of parameters for a secure hash algorithm; (ii) a second set of parameters for an elliptic curve algorithm; and (iii) a first public key which corresponds to a first private key; (b) deriving a module private key and a corresponding module public key using the second set of parameters; (c) generating a first shared secret key using a first elliptic curve Diffie-Hellman key exchange, and based at least in part, on the first public key; (d) sending, to a first computing device which is connected to the wireless network, a first message including the derived module public key, wherein at least a portion of the first message is encrypted using a third set of parameters that is based on a symmetric ciphering algorithm and the derived first shared secret key; (e) receiving, from the first computing device, a second message comprising encrypted data, which is encrypted, by the first computing device, using the symmetric ciphering algorithm and a derived second shared secret key, wherein the second shared secret key is derived by the first computing device using a second elliptic curve Diffie-Hellman key exchange based at least, in part, on the derived module public key; and (f) decrypting the encrypted data using the third set of parameters and the derived second shared secret key. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16)
-
Specification