Secure group communications

• US 9,071,588 B2
• Filed: 10/04/2012
• Issued: 06/30/2015
• Est. Priority Date: 08/05/2002
• Status: Expired due to Fees

• Current Assignee: RPX Clearinghouse LLC (RPX Corporation)
• Original Assignee: RPX Clearinghouse LLC (RPX Corporation)
• Inventors: Dondeti, Lakshminath
• Primary Examiner(s): Parthasarathy, Pramila
• Application Number:
  US13/645,137
• Publication Number:
  US 20130247158A1
• Time in Patent Office: 999 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

A device for use in a system with multiple receiving units, and multiple intermediate units each configured to communicate with the device and at least some of the multiple receiving units, includes a communication module configured to send information toward and receive information from the receiving units and the intermediate units, a memory, and a processor coupled to the memory and the communication module. The processor is configured to: cause the communication module to send information toward each of the receiving units sufficient for the receiving units to obtain a key chain corresponding to that receiving unit, each key chain containing a plurality of keys, each key in each key chain being related to other keys in the respective key chains by at least one inverse of a one-way function; select a key from a key chain associated with a particular receiving unit and stored in the memory; and cause the communication module to send the selected key, and an indication of which receiving unit the selected key is associated with, toward the intermediate unit associated with the particular receiving unit.

Claims

1. A method of providing secure communication in a system comprising a master device, at least one auxiliary device and at least one end device, the method comprising:

establishing a secure communication path between the master device and the at least one end device;

agreeing by the master device and the end device on information necessary to produce at least one key;

generating the at least one key;

providing the at least one key from the master device to the at least one auxiliary device;

authenticating the at least one auxiliary device by the at least one end device using the at least one key; and

establishing another secure communication path between the at least one auxiliary device and the at least one end device.

2. The method of claim 1, wherein the master device generates the at least one key.

3. The method of claim 1, comprising storing the at least one key at the at least one end device.

4. The method of claim 1, comprising storing the at least one key at the master device.

5. The method of claim 1, comprising tearing down the secure communication path between the master device and the at least one end device.

6. The method of claim 5, comprising tearing down the secure communication path between the master device and the at least one end device before establishing the other secure communication path between the at least one auxiliary device and the at least one end device.

7. The method of claim 1, wherein the at least one key comprises at least one respective key corresponding to each end device.

8. The method of claim 1, wherein the at least one respective key comprises a respective key chain corresponding to each end device, each key chain comprising a respective predetermined number of keys.

9. The method of claim 8, wherein the predetermined number of keys is agreed upon by the master device and the at least one end device.

10. The method of claim 8, wherein a key chain corresponding to a first end device has a first predetermined number of keys and a key chain corresponding to a second end device has a second predetermined number of keys, the second number being different from the first number.

11. The method of claim 8, wherein the each key of each key chain is related to at least one other key of that key chain by at least one one-way function.

12. The method of claim 8, wherein a first key in each key chain is generated from a primary seed by:

applying a first one-way function to the primary seed to generate a first seed; and

applying a second one-way function to the first seed to generate a the first key, the second one-way function being different from the first one-way function.

13. The method of claim 12, wherein further keys in each key chain are generated from a seed already generated by:

applying the first one-way function to a seed already generated to generate a next seed;

and applying the second one-way function to the next seed to generate a next key.

14. The method of claim 13, further comprising repeating applying the first one-way function to a seed already generated to generate a next seed and applying the second one-way function to the next seed to generate a next key until the predetermined number of keys are generated for each key chain.

15. The method of claim 8, wherein:

each auxiliary device is associated with at least one end device; and

providing the at least one key to the at least one auxiliary device comprises providing to each auxiliary device a key of a respective key chain corresponding to each end device associated with the auxiliary device.

16. The method of claim 15, comprising:

detecting a change of association of an end device from a first auxiliary device to a second auxiliary device;

providing a previous key in the key chain corresponding to the end device to the second auxiliary device; and

authenticating the second auxiliary device by comparing the key provided to the second auxiliary device to a

key in a key chain corresponding to the end device at the end device.

17. The method of claim 16, wherein detecting a change of association comprises receiving an indication of a changed association of the end device from the first auxiliary device to the second auxiliary device.

18. The method of claim 16, wherein detecting a change of association comprises issuing a command from the master device to change an association of an end device from the first auxiliary device to the second auxiliary device.

19. The method of claim 1, wherein:

each auxiliary device is associated with at least one end device; and

providing the at least one key to the at least one auxiliary device comprises providing to each auxiliary device a respective key corresponding to each end device associated with the auxiliary device.

20. The method of claim 1, comprising tracking at the master device each key provided to each auxiliary device and the association of each key with a respective end device.

21. The method of claim 1, comprising communication between the at least one auxiliary device and the at least one end device over the second secure communication path using keys in the key chain provided to the at least one auxiliary device and stored at the at least one end device.