Systems and methods for “machine-to-machine” (M2M) communications between modules, servers, and an application using public key infrastructure (PKI)

• US 10,530,575 B2
• Filed: 07/16/2018
• Issued: 01/07/2020
• Est. Priority Date: 09/10/2013
• Status: Active Grant

• Current Assignee: John A. Nix
• Original Assignee: Network-1 Technologies, Inc.
• Inventors: Nix, John A.
• Primary Examiner(s): Pearson, David J
• Application Number:
  US16/036,506
• Publication Number:
  US 20180343117A1
• Time in Patent Office: 540 Days
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04J 11/00 Orthogonal multiplex systems, e.g. using WALSH codesH04J13/00 takes precedence
• CPC Class Codes: H04L 12/2854 Wide area networks, e.g. public data networks
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/72 Signcrypting, i.e. digital signing and encrypting simultaneously
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 9/006 : involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0816 : Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0841 : involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/085 : Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0861 : Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/088 : Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0894 : Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 : using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 : Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3066 : involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3239 : involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3249 : using RSA or related signature schemes, e.g. Rabin scheme
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 : of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/04 : Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys
• CPC Class Codes: H04W 12/40 : Security arrangements using identity modules
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 40/005 : Routing actions in the presence of nodes in sleep or doze mode
• CPC Class Codes: H04W 52/0216 : using a pre-established activity schedule, e.g. traffic indication frame
• CPC Class Codes: H04W 52/0235 : where the received signal is a power saving command
• CPC Class Codes: H04W 52/0277 : according to available power supply, e.g. switching off when a low battery condition is detected
• CPC Class Codes: H04W 76/27 : Transitions between radio resource control [RRC] states
• CPC Class Codes: H04W 8/082 : for traffic bypassing of mobility servers, e.g. location registers, home PLMNs or home agents
• CPC Class Codes: H04W 80/04 : Network layer protocols, e.g. mobile IP [Internet Protocol]
• CPC Class Codes: H04W 84/12 : WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/12 : Access point controller devices
• CPC Class Codes: H05K 999/99 : dummy group
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

Methods and systems are provided for supporting efficient and secure “Machine-to-Machine” (M2M) communications using a module, a server, and an application. A module can communicate with the server by accessing the Internet, and the module can include a sensor and/or an actuator. The module, server, and application can utilize public key infrastructure (PKI) such as public keys and private keys. The module can internally derive pairs of private/public keys using cryptographic algorithms and a first set of parameters. A server can authenticate the submission of derived public keys and an associated module identity. The server can use a first server private key and a second set of parameters to (i) send module data to the application and (ii) receive module instructions from the application. The server can use a second server private key and the first set of parameters to communicate with the module.

Claims

1. A system for supporting secure machine-to-machine communications, comprising:

(1) one or more processors; and

(2) non-transitory computer-readable memory operatively connected to the one or more processors, the non-transitory computer-readable memory having stored thereon machine-readable instructions that, when executed by the one or more processors cause the one or more processors to perform a method comprising;

(a) receiving, at the system, a first message from a user module, the first message including;

(i) a module identity string associated with the user module; and

(ii) a temporary module public key that was generated at the user module along with a corresponding temporary module private key;

(b) generating, by the system, a first common derived shared secret key using Diffie-Hellman based on at least;

(i) the temporary module public key; and

(ii) a server private key;

wherein the first common derived shared secret key is generated using Diffie-Hellman by the module based on at least;

(1) the temporary module private key associated with the temporary module public key; and

(2) a server public key associated with the server private key;

(c) receiving, by the system, a second message from the user module, wherein the second message includes a module identity, which is associated with, but different from the module identity string, and wherein the module identity is decrypted with the first common derived shared secret key;

(d) authenticating, by the system, the user module based at least on the module identity;

(e) receiving, from the user module at the system, a token with first encrypted data using a second common derived shared secret key;

(f) generating, by the system, the second common derived shared secret key; and

(g) decrypting the first encrypted data using the second common derived shared secret key.

2. The system of claim 1, wherein the non-transitory computer-readable memory further stores:

(i) a set of cryptographic algorithms to derive the first common derived shared secret key; and

(ii) a key derivation function to derive the first common derived shared secret key.

3. The system of claim 2, wherein a set of parameters of the cryptographic algorithm includes at least one of (x) an elliptic curve (ECC) named curve, or (y) an ECC function.

4. The system of claim 1, wherein the non-transitory computer-readable memory further stores:

(i) a set of cryptographic algorithms to derive the second common derived shared secret key; and

(ii) a key derivation function to derive the second common derived shared secret key.

5. The system of claim 4, wherein a set of parameters of the cryptographic algorithm includes at least one of (x) an elliptic curve (ECC) named curve, or (y) an ECC function.

6. The system of claim 1, wherein the non-transitory computer-readable memory further stores:

(i) a set of cryptographic algorithms including a key pair generation algorithm; and

(ii) machine-readable instructions that, when executed by the one or more processors cause the one or more processors to use the key pair generation algorithm and a set of parameters of the cryptographic algorithm for the module public key in order to derive the first server public key and the first server private key.

7. The system of claim 1, wherein the module identity string in the first message comprises a first string, wherein the module identity in the second message comprises a second string and wherein the first string and the second string are associated with a serial number of a module.

8. The system of claim 1, wherein the first message comprises a series of transmissions received at the system.

9. The system of claim 1, wherein the second message comprises a series of received transmissions.