Simple Group Security for Machine-to-Machine Networking (SGSM2M)

• US 20130028411A1
• Filed: 01/13/2012
• Published: 01/31/2013
• Est. Priority Date: 07/25/2011
• Status: Abandoned Application

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Arkko, Jari, Novo Diaz, Oscar, Keranen, Ari, Rissanen, Heidi-Maria
• Application Number:
  US13/394,514
• Publication Number:
  US 20130028411A1
• Time in Patent Office: Days
• US Class Current: 380/28
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0866 involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics
• CPC Class Codes: H04L 9/3255 using group based signatures, e.g. ring or threshold signatures
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/76 Group identity
• CPC Class Codes: H04W 4/08 User group management
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

A group identity for a set of devices is generated by acquiring an identity for each one of the devices and joining the identities into a common identity data set. A group identity for the set of devices is created by performing a hash function on the common identity set and using a resulting hash value as the group identity. A group identity for a set of devices is verified by acquiring a first group identity from a trusted party. An identity is acquired from each device in the set and the identities are joined into a common identity data set and a second group identity is created for the set of devices by performing a hash function on the common identity data set. A determination is made whether there is a match between the first group identity and the second group identity.

Claims

1. A method of generating a group identity for a set of devices, the method comprising:

acquiring an identity for each one of the devices in the set;

joining the identities into a common identity data set;

creating the group identity for the set of devices by performing a hash function on the common identity data set.

2. The method of claim 1, wherein joining the identities into a common identity data set comprises:

concatenating the identities of the set of devices.

3. The method of claim 1, wherein the identity of each device is a public key of the device.

4. The method of any claim 1, wherein the respective identity of each one of the devices is a hash of the public key of the device.

5. The method of claim 3, wherein the respective identity of each one of the devices is created by joining together the respective public key of each one of the devices in the set in a unique order for each one of the devices and performing a hash function on the public keys that are joined together for each one of the devices.

6. The method of claim 1, further comprising:

generating a private-public key pair for each one of the devices in the set.

7. The method of claim 3, further comprising:

providing each one of the devices in the set with the respective public key of each remaining one of the devices in the set.

8. The method of claim 1, further comprising:

providing each one of the devices in the set with an identity of a party creating the group identity.

9. The method of claim 8, further comprising:

encrypting the identity of the party with the respective public key of the one of the devices to which the encrypted identity is to be sent.

10. A device for generating a group identity for a set of devices, the device comprising a processing unit being configured to:

acquire an identity for each one of the devices in the set;

join the identities into a common identity data set;

create the group identity for the set of devices by performing a hash function on the common identity data set.

11. A method of verifying a group identity for a set of devices, comprising:

acquiring, from a trusted party, a first group identity;

acquiring an identity from each one of the devices in the set;

joining the identities into a common identity data set;

creating a second group identity for the set of devices by performing a hash function on the common identity data set; and

determining whether there is a match between the first group identity and the second group identity.

12. The method of claim 11, further comprising:

receiving a digital signature from at least one one of the devices; and

verifying correctness of the digital signature by means of a corresponding public key.

13. The method of claim 12, wherein receiving the digital signature from at least one of the devices further comprises receiving a timestamp associated with the digital signature, the method further comprising:

ignoring a message accompanying the digital signature if the value of the timestamp deviates from actual time of reception of the message by more than a threshold value.

14. The method of claim 12, wherein receiving the digital signature from at least one of the devices further comprises receiving a monotonically increasing sequence number associated with the digital signature, the method further comprising:

ignoring a message accompanying the digital signature if the sequence number of the message is not greater than a sequence number accompanying a previously received message.

15. The method of claim 11, wherein the first group identity is acquired from a packaging in which the set of devices is delivered.

20. A system comprising:

a processor; and

a memory having a computer program stored thereon, the computer program being configured to carry out the method of claim 11.

21. A computer program product comprising:

a computer readable medium, the computer readable medium having a computer program embodied therein, the computer program being configured to carry out the method of claim 11.

16. A device for verifying a group identity for a set of devices, the device comprising a processing unit being configured to:

acquire, from a trusted party, a first group identity;

acquire an identity from each one of the devices in the set;

join the identities into a common identity data set;

create a second group identity for the set of devices by performing a hash function on the common identity data set; and

determine whether there is a match between the first group identity and the second group identity.

17. The device of claim 16, said device being a hand-held device configured to acquire the first group identity and the respective identities from each of the devices in the set by means of scanning.

18. The device of claim 16, said device being a remotely located device configured to acquire the first group identity and the respective identities from each of the devices via a communication interface.

19. The device of claim 18, said device being configured to acquire the first group identity via communication with a scanning device operable to read the first group identity, and to acquire the respective identities from each of the devices by means of communication with each one of the devices in the set.