Systems and Methods for "Machine-to-Machine" (M2M) Communications Between Modules, Servers, and an Application using Public Key Infrastructure (PKI)

• US 20150106616A1
• Filed: 10/16/2013
• Published: 04/16/2015
• Est. Priority Date: 09/10/2013
• Status: Active Grant

• Current Assignee: John A. Nix
• Original Assignee: M2M and IoT Technologies LLC
• Inventors: Nix, John A.
• Granted Patent: US 9,276,740 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04J 11/00 Orthogonal multiplex systems, e.g. using WALSH codesH04J13/00 takes precedence
• CPC Class Codes: H04L 12/2854 Wide area networks, e.g. public data networks
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/72 Signcrypting, i.e. digital signing and encrypting simultaneously
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 9/006 : involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0816 : Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0841 : involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/085 : Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0861 : Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/088 : Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0894 : Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 : using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 : Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3066 : involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3239 : involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3249 : using RSA or related signature schemes, e.g. Rabin scheme
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 : of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/04 : Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys
• CPC Class Codes: H04W 12/40 : Security arrangements using identity modules
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 40/005 : Routing actions in the presence of nodes in sleep or doze mode
• CPC Class Codes: H04W 52/0216 : using a pre-established activity schedule, e.g. traffic indication frame
• CPC Class Codes: H04W 52/0235 : where the received signal is a power saving command
• CPC Class Codes: H04W 52/0277 : according to available power supply, e.g. switching off when a low battery condition is detected
• CPC Class Codes: H04W 76/27 : Transitions between radio resource control [RRC] states
• CPC Class Codes: H04W 8/082 : for traffic bypassing of mobility servers, e.g. location registers, home PLMNs or home agents
• CPC Class Codes: H04W 80/04 : Network layer protocols, e.g. mobile IP [Internet Protocol]
• CPC Class Codes: H04W 84/12 : WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/12 : Access point controller devices
• CPC Class Codes: H05K 999/99 : dummy group
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

Methods and systems are provided for supporting efficient and secure “Machine-to-Machine” (M2M) communications using a module, a server, and an application. A module can communicate with the server by accessing the Internet, and the module can include a sensor and/or an actuator. The module, server, and application can utilize public key infrastructure (PKI) such as public keys and private keys. The module can internally derive pairs of private/public keys using cryptographic algorithms and a first set of parameters. A server can authenticate the submission of derived public keys and an associated module identity. The server can use a first server private key and a second set of parameters to (i) send module data to the application and (ii) receive module instructions from the application. The server can use a second server private key and the first set of parameters to communicate with the module.

Claims

1. A method for supporting machine-to-machine communications, the method performed by a server, the method comprising:

authenticating a first message, wherein the first message includes a first module public key and a module identity;

receiving a module instruction and the module identity from an application server;

waiting to receive a second message that includes the module identity before sending the module instruction in a server encrypted data;

receiving the second message, wherein the second message includes a module encrypted data and a source Internet protocol address and port (IP;

port) number;

sending a response to the source IP;

port number, wherein the response includes the server encrypted data, wherein the server encrypted data is ciphered using the first module public key, and wherein the server encrypted data includes the module instruction and a security token; and

,

authenticating a third message using the first module public key, wherein the third message includes a second module public key and the module identity.

2. The method of claim 1, wherein a module using the module identity sends the first, second, and third messages, wherein the module includes a set of cryptographic algorithms to derive (i) the first module public key and a first module private key and (ii) the second module public key and a second module private key, and wherein before receiving the third message, the server sends an instruction for the module to derive the second module public key.

3. The method of claim 1, further comprising decrypting at least one of (i) the first module public key in the first message and the (ii) the second module public key in the third message.

4. The method of claim 3, further comprising decrypting a set of parameters in at least one of the first message and the third message, wherein the set of parameters include at least one of (i) an elliptic curve cryptography (ECC) named curve, (ii) an ECC defining equation, and (iii) a modulus for an RSA algorithm.

5. The method of claim 1, wherein authenticating further comprises using at least one of (i) a message digest, (ii) a symmetric key, (iii) a shared secret key, (iv) a module digital signature, and (v) a secure connection.

6. The method of claim 1, wherein the module instruction received from the application server is decrypted using a first server public key, wherein the first server public key is processed using an RSA algorithm, wherein the server encrypted data is encrypted using a second server public key, and wherein the second server public key is processed using an ECC algorithm.

7. The method of claim 1, wherein the module identity in the first message comprises a first string, and wherein the module identity in the second message comprises a second string, and wherein the first string and the second string are associated with a serial number of a module.

8. The method of claim 1, wherein ciphering the server encrypted data using the first module public key further comprises ciphering the server encrypted data with a symmetric key, wherein the symmetric key is shared by using at least one of (i) the first module public key and a key derivation function, (ii) an asymmetric ciphering algorithm and the first module public key to encrypt the symmetric key, wherein the server sends the symmetric key, and (iii) a module digital signature verified with the module public key, wherein the server receives the symmetric key and the module digital signature.

9. A method for supporting machine-to-machine communications, the method performed by a server, the method comprising:

authenticating a first message, wherein the first message includes a first module public key and a module identity;

receiving a second message, wherein the second message includes the module identity and a module encrypted data, wherein the module encrypted data includes a sensor measurement and a security token;

reading the sensor measurement by decrypting the module encrypted data using a first server private key;

using a secure connection and a second server private key to send the sensor measurement and the module identity to an application server; and

,

authenticating a third message;

wherein the third message includes a second module public key and the module identity;

10. The method of claim 9, wherein decrypting the module encrypted data using the first server private key further comprises decrypting the module encrypted data using a symmetric key, wherein the symmetric key is shared by at least one of (i) sending the symmetric key and a server digital signature, wherein the server digital signature is processed using the first server private key, and (ii) using a key derivation function and the first server private key.

11. The method of claim 9, wherein decrypting the module encrypted data using the first server private key further comprises, in sequence:

receiving a symmetric key that is encrypted using an asymmetric ciphering algorithm;

using the first server private key to decrypt the symmetric key; and

,

decrypting the sensor measurement using the symmetric key.

12. The method of claim 9, wherein authenticating the first message further comprises using at least one of (i) a message digest, (ii) a symmetric key, (iii) a shared secret key, (iv) a module digital signature, and (v) a secure connection.

13. The method of claim 9, wherein a module using the module identity sends the first, second, and third messages, wherein the module includes a set of cryptographic algorithms to derive (i) the first module public key and a first module private key and (ii) the second module public key and a second module private key, and wherein before receiving the third message, the server sends an instruction for the module to derive the second module public key.

14. The method of claim 9, wherein the module identity in the first message comprises a first string, and wherein the module identity in the second message comprises a second string, and wherein the first string and the second string are associated with a serial number of a module.

15. The method of claim 9, further comprising decrypting at least one of (i) the first module public key in the first message and the (ii) the second module public key in the third message.

16. The method of claim 15, further comprising decrypting a set of parameters in at least one of the first message and the third message, wherein the set of parameters include at least one of (i) an elliptic curve cryptography (ECC) named curve, (ii) an ECC defining equation, and (iii) a modulus for an RSA algorithm.

17. The method of claim 9, further comprising processing (i) the first server private key using an elliptic curve cryptography (ECC) algorithm, (ii) the second server private key using an RSA algorithm.

18. A system for supporting machine-to-machine communications, the system comprising:

a set of cryptographic algorithms for using (i) a first server private key with a first set of parameters and (ii) a second server private key with a second set of parameters, and for authenticating a first message, wherein the first message includes a module public key and a module identity;

a module controller for sending a server digital signature processed using the first server private key, for receiving a module encrypted data and the module identity, wherein the module encrypted data includes a sensor measurement and a security token, for using a symmetric key to decrypt the module encrypted data, for using the module public key and the first set of parameters to verify a module digital signature, for sending a module instruction within a server encrypted data, and for waiting until after (a) receiving a second message which includes the module identity and a source Internet protocol address and port (IP;

port) number before (b) sending the module instruction to the source IP;

port number; and

,

a server program for establishing a secure connection with an application using the second server private key and the second set of parameters, for sending the sensor measurement and the module identity to the application via the secure connection, and for receiving the module instruction from the application;

19. The system of claim 18, further comprising a module with the module identity for sending the first message and the second message, wherein the module derives the module public key and a module private key using the first set of parameters.

20. The system of claim 19, wherein the module controller sends (i) the first set of parameters and (ii) an instruction for the module to derive the module public key and the module private key, before the module sends the first message.

21. The system of claim 18, further comprising the cryptographic algorithms for decrypting at least one of the first module public key and the first set of parameters, wherein the first set of parameters include at least one of (i) an elliptic curve cryptography (ECC) named curve, (ii) an ECC defining equation, and (iii) a modulus for an RSA algorithm.

22. The system of claim 18, wherein the secure connection with the application comprises at least one of (i) a transport layer security (TLS) connection, (ii) an IPSec connection, and (iii) a virtual private network (VPN) between a server and the application server, and wherein the server includes the module controller and the server application.

23. The system of claim 18, wherein the first set of parameters is associated with an elliptic curve cryptography (ECC) algorithm, and wherein the second set of parameters is associated with an RSA algorithm.

24. The system of claim 18, further comprising the cryptographic algorithms for authenticating the first message using at least one of (i) a message digest, (ii) a shared secret key, and (iii) a module digital signature.