Identity and authentication in a wireless network

• US 8,069,470 B1
• Filed: 04/13/2005
• Issued: 11/29/2011
• Est. Priority Date: 04/13/2005
• Status: Active Grant

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Oracle America, Inc. (Oracle Corporation)
• Inventors: Montenegro, Gabriel E.
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): Johnson; Carlton
• Application Number:
  US11/104,828
• Time in Patent Office: 2,421 Days
• Field of Search: None
• US Class Current: 726/3
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04W 12/10 Integrity
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A sensor system includes a controller and sensors, the system configured to ensure unique identity for each device. Methods are provided to generate new identities for those devices having duplicate addresses, and to transmit the new identity information to those devices.

Claims

1. A method for secure configuration of a sensor system comprising a sensor controller and a plurality of sensors, the method comprising:

generating, by the sensor controller, an old group key shared by the plurality of sensors, wherein the old group key incorporates a plurality of network identify information of the plurality of sensors for securely transmitting digital data within the sensor system;

sending, by the sensor controller, the old group key to each of the plurality of sensors;

receiving, at the sensor controller, a join request from a new sensor to join the plurality of sensors, wherein the join request comprises a first authentication means and a first network identity information identifying the new sensor, wherein the first network identity information comprises a hash of a public key with a predetermined binary value;

truncating the hash to a number of bits desired for use within the sensor system to generate a truncated hash;

determining, by the sensor controller, whether the first network identity information provided by the new sensor is already associated with a sensor among the plurality of sensors;

generating, by the sensor controller and in response to determining that the first network identity information is already associated with the sensor among the plurality of sensors, a second network identity information for identifying the new sensor, wherein the second network identity information comprises the truncated hash of the public key incremented by a predetermined amount;

generating, by the sensor controller and in response to generating the second network identity information for identifying the new sensor, a new group key shared by the plurality of sensors and the new sensor, wherein the new group key incorporates the plurality of network identify information of the plurality of sensors and the second network identify information of the new sensor for securely transmitting the digital data within the sensor system and replaces the old group key shared by the plurality of sensors without the new sensor; and

sending, by the sensor controller;

the second network identity information and the new group key to the new sensor, wherein the second network identity information replaces the first network identity information for the new sensor; and

the new group key to each of the plurality of sensors.

2. The method of claim 1, wherein the first authentication means comprises a digital signature created using a private key associated with the new sensor.

3. The method of claim 1, wherein the second network identity information comprises a second authentication means comprising a message authentication code using a pairwise key, wherein the pairwise key is created using a public key associated with the new sensor and a private key associated with the sensor controller.

4. The method of claim 1, wherein the first authentication means comprises a message authentication code using a pairwise key, wherein the pairwise key is created using a private key associated with the new sensor and a public key associated with the sensor controller.

5. The method of claim 1, wherein the second network identity information comprises a second authentication means comprising a digital signature created using a public key associated with the new sensor.

6. The method of claim 1, wherein at least a portion of the join request is encrypted using a key derived from a pairwise key created using a private key associated with the new sensor and a public key associated with the sensor controller.

7. The method of claim 1, wherein the new group key is shared by the plurality of sensors and the new sensor for digitally encrypting data within the sensor system.

8. A sensor system comprising:

a plurality of sensors; and

a sensor controller accessing a memory, wirelessly coupled to the plurality of sensors, and configured to;

generate an old group key shared by the plurality of sensors, wherein the old group key incorporates a plurality of network identify information of the plurality of sensors for securely transmitting digital data within the sensor system;

send the old group key to each of the plurality of sensors;

receive a join request from a new sensor to join the plurality of sensors, wherein the join request comprises a first authentication means and a first network identity information identifying the new sensor, wherein the first network identity information comprises a hash of a public key with a predetermined binary value;

truncate the hash to a number of bits desired for use within the sensor system to generate a truncated hash;

determine whether the first network identity information provided by the new sensor is already associated with a sensor among the plurality of sensors;

generate, in response to determining that the first network identity information is already associated with a sensor among the plurality of sensors, a second network identity information for identifying the new sensor, wherein the second network identity information comprises the truncated hash of the public key incremented by a predetermined amount;

generate, by the sensor controller and in response to generating the second network identity information for identifying the new sensor, a new group key shared by the plurality of sensors and the new sensor, wherein the new group key incorporates the plurality of network identify information of the plurality of sensors and the second network identify information of the new sensor for securely transmitting the digital data within the sensor system and replaces the old group key shared by the plurality of sensors without the new sensor; and

send;

the second network identity information and the new group key to the new sensor, wherein the second network identity information replaces the first network identity information for the new sensor; and

the new group key to each of the plurality of sensors.

9. The sensor system of claim 8, wherein the first authentication means comprises a digital signature created using a private key associated with the new sensor.

10. The sensor system of claim 8, wherein the second network identity information comprises a second authentication means comprising a message authentication code using a pairwise key, wherein the pairwise key is created using a public key associated with the new sensor and a private key associated with the controller.

11. The sensor system of claim 8, wherein the first authentication means comprises a message authentication code using a pairwise key, wherein the pairwise key is created using a private key associated with the new sensor and a public key associated with the controller.

12. The sensor system of claim 8, wherein the second network identity information comprises a second authentication means comprising a digital signature created using a public key associated with the new sensor.

13. The sensor system of claim 8, wherein at least a portion of the join request is encrypted using a key derived from a pairwise key created using a private key associated with the new sensor and a public key associated with the controller.

generating, by the sensor controller, an old group key shared by the plurality of sensors, wherein the old group key incorporates a plurality of network identify information of the plurality of sensors for securely transmitting digital data within the sensor system;

sending, by the sensor controller, the old group key to each of the plurality of sensors;

receiving, at the sensor controller, a join request from a new sensor to join the plurality of sensors, wherein the join request comprises a first authentication means and a first network identity information identifying the new sensor, wherein the first network identity information comprises a hash of a public key with a predetermined binary value;

truncating the hash to a number of bits desired for use within the sensor system to generate a truncated hash;

determining whether the first network identity information provided by the new sensor is already associated with a sensor among the plurality of sensors;

generating, in response to determining that the first network identity information is already associated with a sensor among the plurality of sensors, a second network identity information for identifying the new sensor, wherein the second network identity information comprises the truncated hash of the public key incremented by a predetermined amount;

generating, by the sensor controller and in response to generating the second network identity information for identifying the new sensor, a new group key shared by the plurality of sensors and the new sensor, wherein the new group key incorporates the plurality of network identify information of the plurality of sensors and the second network identify information of the new sensor for securely transmitting the digital data within the sensor system and replaces the old group key shared by the plurality of sensors without the new sensor; and

sending, by the sensor controller;

the second network identity information and the new group key to the new sensor, wherein the second network identity information replaces the first network identity information for the new sensor; and

the new group key to each of the plurality of sensors.

14. A non-transitory storage medium having executable code stored thereon that when executed by a computer system implements a method for secure configuration of a sensor system comprising a sensor controller and a plurality of sensors, the method comprising:

generating, by the sensor controller, an old group key shared by the plurality of sensors, wherein the old group key incorporates a plurality of network identify information of the plurality of sensors for securely transmitting digital data within the sensor system;

sending, by the sensor controller, the old group key to each of the plurality of sensors;

receiving, at the sensor controller, a join request from a new sensor to join the plurality of sensors, wherein the join request comprises a first authentication means and a first network identity information identifying the new sensor, wherein the first network identity information comprises a hash of a public key with a predetermined binary value;

truncating the hash to a number of bits desired for use within the sensor system to generate a truncated hash;

determining whether the first network identity information provided by the new sensor is already associated with a sensor among the plurality of sensors;

generating, in response to determining that the first network identity information is already associated with a sensor among the plurality of sensors, a second network identity information for identifying the new sensor, wherein the second network identity information comprises the truncated hash of the public key incremented by a predetermined amount;

generating, by the sensor controller and in response to generating the second network identity information for identifying the new sensor, a new group key shared by the plurality of sensors and the new sensor, wherein the new group key incorporates the plurality of network identify information of the plurality of sensors and the second network identify information of the new sensor for securely transmitting the digital data within the sensor system and replaces the old group key shared by the plurality of sensors without the new sensor; and

sending, by the sensor controller;

the second network identity information and the new group key to the new sensor, wherein the second network identity information replaces the first network identity information for the new sensor; and

the new group key to each of the plurality of sensors.

15. The storage medium of claim 14, wherein the first authentication means comprises a digital signature created using a private key associated with the new sensor.

16. The storage medium of claim 14, wherein the second network identity information comprises a second authentication means comprising a message authentication code using a pairwise key, wherein the pairwise key is created using a public key associated with the new sensor and a private key associated with the sensor controller.

17. The storage medium of claim 14, wherein the first authentication means comprises a message authentication code using a pairwise key, wherein the pairwise key is created using a private key associated with the new sensor and a public key associated with the sensor controller.

18. The storage medium of claim 14, wherein the second network identity information comprises a second authentication means comprising a digital signature created using a public key associated with the new sensor.