Method and apparatus for providing secure communication among constrained devices
First Claim
1. A method for secure communication between constrained devices comprising:
- issuing, by an authorization server, cryptographic communication rights among a plurality of constrained devices where each of the plurality of constrained devices comprises no more than one cryptographic algorithm code module per cryptographic function wherein issuing comprises issuing asymmetric key based configuration certificates or symmetric key based tickets to the plurality of constrained devices that include data identifying at least other constrained devices of the plurality of constrained devices with whom a subject constrained device is permitted to cryptographically communicate with to allow the plurality of constrained devices to cryptographically exchange information between specified ones of the plurality of constrained devices;
receiving, by the authorization server, a cryptographic communication rights request associated with at least a first of the plurality of constrained devices in response to a cryptographic algorithm update request that requests a replacement cryptographic code module update for a constrained device;
providing, by the authorization server, a response to the cryptographic communication rights request that requests a replacement cryptographic code module update, comprising an identification of a subset of the plurality of constrained devices that have cryptographic communication rights in common with the identified first of the plurality of constrained devices;
wherein providing, by the authorization server, the response comprising the identification of the subset of the plurality of constrained devices that have cryptographic communication rights comprises determining which of the plurality of constrained devices have cryptographic communication rights with the identified first constrained device based on authorized communication rights authorized by the authorization server; and
wherein the issued asymmetric key based configuration certificates or symmetric key based tickets further include data identifying an action that the subject constrained device is permitted to perform on another constrained device.
3 Assignments
0 Petitions
Accused Products
Abstract
In one example, an apparatus such as an authorization server and method for secure communication between constrained devices issues cryptographic communication rights among a plurality of constrained devices. Each of the plurality of constrained devices comprises no more than one cryptographic algorithm code module per cryptographic function. The method includes receiving a cryptographic communication rights request associated with at least a first of the plurality of constrained devices in response to a cryptographic algorithm update request, and includes providing a response including an identification of a subset of the plurality of constrained devices that have cryptographic communication rights with the identified first of the plurality of constrained devices. A software update server then updates the cryptographic code modules in the sub-set of the plurality of constrained devices.
-
Citations
7 Claims
-
1. A method for secure communication between constrained devices comprising:
-
issuing, by an authorization server, cryptographic communication rights among a plurality of constrained devices where each of the plurality of constrained devices comprises no more than one cryptographic algorithm code module per cryptographic function wherein issuing comprises issuing asymmetric key based configuration certificates or symmetric key based tickets to the plurality of constrained devices that include data identifying at least other constrained devices of the plurality of constrained devices with whom a subject constrained device is permitted to cryptographically communicate with to allow the plurality of constrained devices to cryptographically exchange information between specified ones of the plurality of constrained devices; receiving, by the authorization server, a cryptographic communication rights request associated with at least a first of the plurality of constrained devices in response to a cryptographic algorithm update request that requests a replacement cryptographic code module update for a constrained device; providing, by the authorization server, a response to the cryptographic communication rights request that requests a replacement cryptographic code module update, comprising an identification of a subset of the plurality of constrained devices that have cryptographic communication rights in common with the identified first of the plurality of constrained devices; wherein providing, by the authorization server, the response comprising the identification of the subset of the plurality of constrained devices that have cryptographic communication rights comprises determining which of the plurality of constrained devices have cryptographic communication rights with the identified first constrained device based on authorized communication rights authorized by the authorization server; and wherein the issued asymmetric key based configuration certificates or symmetric key based tickets further include data identifying an action that the subject constrained device is permitted to perform on another constrained device. - View Dependent Claims (2, 3, 4)
-
-
5. An apparatus comprising:
-
one or more hardware processors operative to; issue cryptographic communication rights among a plurality of constrained devices where each of the plurality of constrained devices comprises no more than one cryptographic algorithm code module per cryptographic function; receive a cryptographic communication rights request associated with at least a first of the plurality of constrained devices in response to a cryptographic algorithm update request that requests a replacement cryptographic code module update for a constrained device; provide a response to the cryptographic communication rights request that requests a replacement cryptographic code module update, comprising an identification of a subset of the plurality of constrained devices that have cryptographic communication rights in common with the identified first of the plurality of constrained devices; determine which of the plurality of constrained devices have cryptographic communication rights with the identified first constrained device based on authorized communication rights authorized by the authorization server, wherein the one or more processors is operative to issue asymmetric key based configuration certificates or symmetric key based tickets to the plurality of constrained devices that include data identifying at least other constrained devices of the plurality of constrained devices with whom a subject constrained device is permitted to cryptographically communicate with to allow the plurality of constrained devices to cryptographically exchange information between specified ones of the plurality of constrained devices; and wherein the issued asymmetric key based configuration certificates or symmetric key based tickets further include data identifying an action that the subject constrained device is permitted to perform on another constrained device.
-
-
6. A system comprising:
-
a plurality of constrained devices; an authorization server, operatively coupled to the plurality of constrained devices, comprising logic operative to; issue cryptographic communication rights among the plurality of constrained devices where each of the plurality of constrained devices comprises no more than one cryptographic algorithm code module per cryptographic function wherein issuing comprises issuing asymmetric key based configuration certificates or symmetric key based tickets to the plurality of constrained devices that include data identifying at least other constrained devices of the plurality of constrained devices with whom a subject constrained device is permitted to cryptographically communicate with to allow the plurality of constrained devices to cryptographically exchange information between specified ones of the plurality of constrained devices and wherein the issued asymmetric key based configuration certificates or symmetric key based tickets further include data identifying an action that the subject constrained device is permitted to perform on another constrained device; receive a cryptographic communication rights request associated with at least a first of the plurality of constrained devices in response to a cryptographic algorithm update request that requests a replacement cryptographic code module update for a constrained device; and provide a response to the cryptographic communication rights request that requests a replacement cryptographic code module update, comprising an identification of a subset of the plurality of constrained devices that have cryptographic communication rights in common with the identified first of the plurality of constrained devices; determine which of the plurality of constrained devices have cryptographic communication rights with the identified first constrained device based on authorized communication rights authorized by the authorization server, and a software update server, operatively coupled to the plurality of constrained devices and to the authorization server, comprising logic operative to provision a replacement cryptographic code module, in response to the cryptographic algorithm update request, to a subset of a plurality of constrained devices that have cryptographic communication rights with an identified first of the plurality of constrained devices, wherein the replacement cryptographic code module comprises at least one of;
a data encryption code module, a key encryption code module, a data signature code module, a key agreement code module and a data digest code module. - View Dependent Claims (7)
-
Specification