System and method for recording device lifecycle transactions as versioned blocks in a blockchain network using a transaction connector and broker service

• US 10,657,261 B2
• Filed: 11/05/2018
• Issued: 05/19/2020
• Est. Priority Date: 11/30/2017
• Status: Active Grant

• Current Assignee: DigiCert Incorporated
• Original Assignee: Mocana Corporation (DigiCert Incorporated)
• Inventors: Kumar, Srinivas, Gupta, Atul, Ulanov, Ruslan, Uchil, Shreya
• Primary Examiner(s): Pan, Hang
• Application Number:
  US16/180,200
• Publication Number:
  US 20190163912A1
• Time in Patent Office: 561 Days
• CPC Class Codes: G06F 16/1834 implemented based on peer-to-peer networks, e.g. gnutella p2p communication protocols H04L67/104
• CPC Class Codes: G06F 16/27 Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: G06F 9/445 Program loading or initiating bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 41/08 Configuration management of networks or network elements address allocation H04L61/50
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3297 involving time stamps, e.g. generation of time stamps
• CPC Class Codes: H04L 9/50 : using hash chains, e.g. blockchains or hash trees

Abstract

A method of building a device historian, across a supply chain of device manufactures and managers, by a plurality of device management services comprising an enrollment service, an update service, a policy service, and an analytics service, a transaction connector, a blockchain broker service participating as a node in a blockchain network, and transaction filters. The method comprises sending, by the plurality of device management services a transaction record over the transaction connector to the blockchain broker service, receiving, by the blockchain broker service, the transaction record, filtering, by the blockchain broker service, information in the transaction record based on the transaction filters, preparing, by the blockchain broker service, a versioned block based on the filtered information from the transaction record, and adding, by the blockchain broker service, the versioned block to the blockchain network.

Claims

1. A method of updating a device, that has been authenticated with an immutable device unique identifier generated using device attributes discovered by an update client on the device, an update service in a supply chain network of providers and publishers, orchestration rules, a local ledger, and a blockchain broker service, the method comprising:

authenticating, by the update service, the device using a device unique registration issued by the update service associated with the immutable device unique identifier;

sending, by the update client on the device, a device request for an update package for the device from the update service in the supply chain network, wherein the device request from the authenticated device includes a device manifest and discovered device attributes, and wherein the discovered device attributes comprises of static factory configured settings and dynamically configured properties;

receiving, by the update service, the device request;

processing, by the update service, the received device request using the orchestration rules to prepare update packages, initially signed and encrypted by providers in the supply chain, for the device based on the device manifest and device attributes;

preparing, by the update service, by re-signing and re-encrypting the update package, as the publisher in the supply chain, based on the orchestration rules established for a network service of the supply chain network;

sending, by the update service, the doubly signed and reencrypted update package to the device; and

recording, by the update service, a request log for the device as an entry in the local ledger, and distributing blocks of transaction records to the blockchain broker service to maintain a distributed ledger to reproduce history of update packages sent to a plurality of devices by a plurality of publishers in the supply chain.

2. The method of claim 1, wherein the request log for the device is doubly signed and reencrypted and includes at least a request counter, request operation data, a request nonce, a device request signature, a request hash, a device signature, a device certificate identifier, a publisher signature, a publisher certificate identifier, a publisher package identifier, a device identifier based on the discovered dynamic device attributes and a publisher identifier.

3. The method of claim 2, wherein the distributed ledger in the blockchain broker service has adequate transaction records to reproduce a history of device updates and service transactions for cross domain traceability to the supply chain network of providers and publishers.

4. A method of updating a device, that has been authenticated with an immutable device unique identifier generated using dynamic device attributes discovered by an update client on the device, a plurality of providers of update packages, an update service of a plurality of publishers in a supply chain network of providers and publishers, orchestration rules, a local ledger, and a blockchain broker service, the method comprising:

authenticating, by the update service, the device using a device unique registration issued by the update service associated with the immutable device unique identifier;

sending, by the update client on the device, a device request for an update package for the device from the update service in the supply chain network, wherein the device request from the authenticated device includes a device manifest and discovered device attributes, and wherein the discovered device attributes comprises of static factory configured settings and dynamically configured properties;

receiving, by the update service, the device request;

processing, by the update service, the received device request using the orchestration rules to prepare update packages, initially signed and encrypted by providers in the supply chain, for the device based on the device manifest and device attributes;

preparing, by the update service, by re-signing and re-encrypting the update package, as the publisher in the supply chain, based on the orchestration rules established for a network service of the supply chain network;

sending, by the update service, the doubly signed and reencrypted update package to the device; and

recording, by the update service, a request log for the device as an entry in the local ledger, and distributing blocks of transaction records to the blockchain broker service to maintain a distributed ledger to reproduce history of provider packages sent to a plurality of authenticated devices by a plurality of providers and publishers in the supply chain.

5. The method of claim 4, wherein the request log for the device is doubly signed and reencrypted and includes at least a request counter, request operation data, a request nonce, a device request signature, a request hash, a device signature, a device certificate identifier, a publisher signature, a publisher certificate identifier, a publisher package identifier, a device identifier based on the discovered dynamic device attributes, a publisher identifier, and a provider package identifier.

6. The method of claim 5, wherein the distributed ledger in the blockchain broker service has adequate transaction records to reproduce a history of device updates and service transactions for cross domain traceability to a supply chain of update package providers.

7. A method of updating a device, that has been authenticated with an immutable device unique identifier generating using device attributes discovered by an update client on the device, an update service in a supply chain network of providers and publishers, orchestration rules, a local ledger, and a blockchain broker service, the method comprising:

authenticating, by the update service, the device using a device unique registration issued by the update service associated with the immutable device unique identifier;

sending, by the update client, a device request for an update package for the device from the update service in the supply chain network, wherein the device request from the authenticated device includes a device manifest and discovered device attributes comprising static factory configured settings and dynamically configured properties;

receiving, by the update service, the device request and authenticating the device;

processing, by the update service, the received device request using the orchestration rules to prepare update packages, initially signed and encrypted by providers in the supply chain, for the device based on the device manifest and device attributes;

preparing, by the update service, by re-signing and re-encrypting the update package, as the publisher in the supply chain, based on the orchestration rules established for a network service of the supply chain network;

sending, by the update service, the doubly signed and reencrypted update package to the device; and

recording, by the update service, a request log for the device as an entry in the local ledger, and distributing blocks of transaction records to the blockchain broker service to maintain a distributed ledger to reproduce history of the device, wherein the request log includes a publisher identifier or a provider identifier.