METHOD AND APPARATUS FOR PROVIDING SECURE COMMUNICATION AMONG CONSTRAINED DEVICES

• US 20170026185A1
• Filed: 07/20/2016
• Published: 01/26/2017
• Est. Priority Date: 07/21/2015
• Status: Active Grant

• Current Assignee: Entrust Corp.
• Original Assignee: Entrust Incorporated (Entrust Corp.)
• Inventors: Moses, Timothy Edward
• Granted Patent: US 10,728,043 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

In one example, an apparatus such as an authorization server and method for secure communication between constrained devices issues cryptographic communication rights among a plurality of constrained devices. Each of the plurality of constrained devices comprises no more than one cryptographic algorithm code module per cryptographic function. The method includes receiving a cryptographic communication rights request associated with at least a first of the plurality of constrained devices in response to a cryptographic algorithm update request, and includes providing a response including an identification of a subset of the plurality of constrained devices that have cryptographic communication rights with the identified first of the plurality of constrained devices. A software update server then updates the cryptographic code modules in the sub-set of the plurality of constrained devices.

Claims

1. A method for secure communication between constrained devices comprising:

issuing, by an authorization server, cryptographic communication rights among a plurality of constrained devices where each of the plurality of constrained devices comprises no more than one cryptographic algorithm code module per cryptographic function;

receiving, by the authorization server, a cryptographic communication rights request associated with at least a first of the plurality of constrained devices in response to a cryptographic algorithm update request; and

providing, by the authorization server, a response comprising an identification of a subset of the plurality of constrained devices that have cryptographic communication rights with the identified first of the plurality of constrained devices.

2. The method of claim 1 wherein providing, by the authorization server, the response comprising the identification of the subset of the plurality of constrained devices that have cryptographic communication rights comprises determining which of the plurality of constrained devices have cryptographic communication rights with the identified first constrained device based on authorized communication rights authorized by the authorization server.

3. The method of claim 1 comprising provisioning, by a software update server, a replacement cryptographic code module, in response to the cryptographic algorithm update request, to the subset of the plurality of constrained devices that have cryptographic communication rights with the identified first of the plurality of constrained devices, wherein the replacement cryptographic code module comprises at least one of:

a data encryption code module, a key encryption code module, a data signature code module, a key agreement code module and a data digest code module.

4. The method of claim 1 wherein issuing, by the authorization server, cryptographic communication rights among the plurality of constrained devices comprises issuing asymmetric key based configuration certificates or symmetric key based ticket to the plurality of constrained devices wherein the configuration certificates assign communication rights to each of the plurality of constrained devices to allow the plurality of constrained devices to cryptographically exchange information between the plurality of constrained devices.

5. The method of claim 1 comprising issuing the cryptographic communication rights request by a software update server in response to the software update server receiving the cryptographic algorithm update request.

6. The method of claim 1 comprising issuing the cryptographic communication rights request by a network management device in response to the network management device receiving the cryptographic algorithm update request.

7. An apparatus comprising:

logic operative to;

issue cryptographic communication rights among a plurality of constrained devices where each of the plurality of constrained devices comprises no more than one cryptographic algorithm code module per cryptographic function;

receive a cryptographic communication rights request associated with at least a first of the plurality of constrained devices in response to a cryptographic algorithm update request; and

provide a response comprising an identification of a subset of the plurality of constrained devices that have cryptographic communication rights with the identified first of the plurality of constrained devices.

8. The apparatus of claim 7 wherein the logic is operative to determine which of the plurality of constrained devices have cryptographic communication rights with the identified first constrained device based on authorized communication rights authorized by the authorization server.

9. The apparatus of claim 7 wherein the logic is operative to issue asymmetric key based configuration certificates or symmetric key based tickets to the plurality of constrained devices wherein the configuration certificates assign communication rights to each of the plurality of constrained devices to allow the plurality of constrained devices to cryptographically exchange information between the plurality of constrained devices.

10. A system comprising:

a plurality of constrained devices;

an authorization server, operatively coupled to the plurality of constrained devices, comprising logic operative to;

issue cryptographic communication rights among the plurality of constrained devices where each of the plurality of constrained devices comprises no more than one cryptographic algorithm code module per cryptographic function;

receive a cryptographic communication rights request associated with at least a first of the plurality of constrained devices in response to a cryptographic algorithm update request; and

provide a response comprising an identification of a subset of the plurality of constrained devices that have cryptographic communication rights with the identified first of the plurality of constrained devices; and

a software update server, operatively coupled to the plurality of constrained devices and to the authorization server, comprising logic operative to provision a replacement cryptographic code module, in response to a cryptographic algorithm update request, to a subset of a plurality of constrained devices that have cryptographic communication rights with an identified first of the plurality of constrained devices, wherein the replacement cryptographic code module comprises at least one of;

a data encryption code module, a key encryption code module, a data signature code module, a key agreement code module and a data digest code module.