DEVICE NAMING IN AN INTERNET OF THINGS

• US 20160366123A1
• Filed: 09/25/2015
• Published: 12/15/2016
• Est. Priority Date: 06/10/2015
• Status: Abandoned Application

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Smith, Ned M., Heldt-Sheller, Nathan, Schrecker, Sven
• Application Number:
  US14/865,987
• Publication Number:
  US 20160366123A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 61/3025 Domain name generation or assignment
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

In an example, there is disclosed a computing apparatus, having: a network interface; and one or more logic elements providing a name management engine, operable to: receive a self-assigned name registration request for a name N1 from an endpoint device via the network interface; compare N1 to a database of registered names; determine that the name has not been registered; and sign a certificate for N1. The engine is further operable to determine that the name has been registered, and send a notification that the name is not available. There is also disclosed a computer-readable medium having executable instructions for providing a name management engine, and a method of providing a name management engine.

Claims

1. A computing apparatus, comprising:

a network interface; and

one or more logic elements comprising a name management engine, operable to;

receive a self-assigned name registration request for a name N1 from an endpoint device via the network interface;

compare N1 to a database of registered names;

determine that the name has not been registered; and

sign a certificate for N1.

2. The computing apparatus of claim 1, wherein the name management engine is further operable to determine that the name has been registered, and send a notification that the name is not available.

3. The computing apparatus of claim 1, wherein the name management engine is further operable to determine that the endpoint device has a trusted execution environment (TEE) meeting a minimum security requirement, and wherein the certificate is a high veracity certificate.

4. The computing apparatus of claim 1, wherein the name management engine is further operable to determine that the endpoint device does not have a trusted execution environment (TEE) meeting a minimum security requirement, and wherein the certificate is a low veracity certificate.

5. The computing apparatus of claim 1, wherein the name management engine is further operable to determine that the name registration request is signed by a valid signature, and wherein the certificate is a high veracity certificate.

6. The computing apparatus of claim 5, wherein the valid signature is a proof of possession valid signature.

7. The computing apparatus of claim 1, wherein the name management engine is further operable to determine that the name registration request is not signed by a valid signature, and wherein the certificate is a low veracity certificate.

8. The computing apparatus of claim 1, wherein the name management engine is operable to receive a certificate revocation list (CRL).

9. The computing apparatus of claim 8, wherein receiving the CRL comprises receiving a name revocation request via the network interface.

10. The computing apparatus of claim 9, wherein the name revocation request is post-dated.

11. The computing apparatus of claim 8, wherein receiving the CRL comprises receiving a batch CRL via the network interface.

12. The computing apparatus of claim 8, wherein the name management engine is further operable to mark a plurality of names in the registered name database as revoked, wherein the plurality of names appear on the CRL.

13. The computing apparatus of claim 8, wherein the CRL is anonymized.

14. One or more tangible, non-transitory computer readable storage mediums having stored thereon executable instructions for providing a name management engine, wherein the name management engine is configured to:

receive a self-assigned name registration request for a name N1 from an endpoint device via a network interface;

compare N1 to a database of registered names;

determine that the name has not been registered; and

sign a certificate for N1.

15. The one or more tangible, computer-readable storage mediums of claim 14, wherein the name management engine is further operable to determine that the name has been registered, and send a notification that the name is not available.

16. The one or more tangible, computer-readable storage mediums of claim 14, wherein the name management engine is further operable to determine that the endpoint device has a trusted execution environment (TEE) meeting a minimum security requirement, and wherein the certificate is a high veracity certificate.

17. The one or more tangible, computer-readable storage mediums of claim 14, wherein the name management engine is further operable to determine that the endpoint device does not have a trusted execution environment (TEE) meeting a minimum security requirement, and wherein the certificate is a low veracity certificate.

18. The one or more tangible, computer-readable storage mediums of claim 14, wherein the name management engine is further operable to determine that the name registration request is signed by a valid proof of possession signature, and wherein the certificate is a high veracity certificate.

19. The one or more tangible, computer-readable storage mediums of claim 14, wherein the name management engine is further operable to determine that the name registration request is not signed by a valid signature, and wherein the certificate is a low veracity certificate.

20. The one or more tangible, computer-readable storage mediums of claim 14, wherein the name management engine is operable to receive an anonymized certificate revocation list (CRL).

21. The one or more tangible, computer-readable storage mediums of claim 20, wherein receiving the CRL comprises receiving a name revocation request via the network interface.

22. The one or more tangible, computer-readable storage mediums of claim 21, wherein the name revocation request is post-dated.

23. The one or more tangible, computer-readable storage mediums of claim 20, wherein receiving the CRL comprises receiving a batch CRL via the network interface.

24. A computing apparatus, comprising:

a network interface; and

a key management engine operable to;

determine that a first device D1 in a first realm R1 with the computing apparatus needs to establish a connection with a second device D2 in a second realm R2;

establish a secure channel with a secure management service of the second realm R2; and

issue a key management ticket for D1 to securely communicate with D2.

25. The computing apparatus of claim 24, wherein the key management engine is further operable to perform a domain name system (DNS) lookup of a name for R1 or R2 on a DNS-based authentication of named entities (DANE) service.