System, apparatus and method for safety state management of internet things (IoT) devices

• US 9,985,946 B2
• Filed: 12/22/2015
• Issued: 05/29/2018
• Est. Priority Date: 12/22/2015
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Smith, Ned M., Poornachandran, Rajesh, Heldt-Sheller, Nathan
• Primary Examiner(s): Shiferaw, Eleni A
• Assistant Examiner(s): Khan, Sher A
• Application Number:
  US14/977,742
• Publication Number:
  US 20170180340A1
• Time in Patent Office: 889 Days
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/0847 involving identity based encryption [IBE] schemes
• CPC Class Codes: H04L 9/3255 using group based signatures, e.g. ring or threshold signatures
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

In one embodiment, a device includes: at least one processor; at least one sensor to sense an environmental condition; and a storage to store instructions that, when executed by the at least one processor, enable the device to: receive an encrypted nonce from a safety controller; decrypt the encrypted nonce using a value obtained from an entropy multiplexing seed tree generated by the device based at least in part on an initialization seed value received from the safety controller; responsive to decryption of the nonce, update a portion of a shared memory associated with the device to identify a safety state of the device; and encrypt a second nonce using the value obtained from the entropy multiplexing seed tree and send the encrypted second nonce to the safety controller. Other embodiments are described and claimed.

Claims

1. At least one non-transitory computer readable storage medium comprising instructions that when executed enable a system to:

provide an initialization seed value to a first network including a plurality of nodes for distribution to the plurality of nodes, for use in the plurality of nodes to generate an entropy multiplexing safety seed tree in the plurality of nodes, the entropy multiplexing safety seed tree to encode a time and a segmentation of a distributed sparse shared memory comprising a transactional memory, wherein each of the plurality of nodes includes a local memory to be mapped and synchronized to a unique region of the distributed sparse shared memory;

receive, in a safety controller coupled to the first network, a plurality of attestation values and a plurality of safety reports from a plurality of reporting nodes of the first network, each of the plurality of attestation values randomly generated in the corresponding reporting node using the entropy multiplexing safety seed tree based on the initialization seed value received from the safety controller;

determine whether at least a threshold number of the plurality of attestation values are a same value comprising a common g^a value;

responsive to at least the threshold number of the plurality of attestation values being the same value, decrypt the plurality of safety reports using a corresponding decryption key for each node obtained from the entropy multiplexing safety seed tree and process the decrypted plurality of safety reports to obtain aggregated safety data of the plurality of nodes; and

update the distributed sparse shared memory coupled to the safety controller, based at least in part on the aggregated safety data.

2. The at least one non-transitory computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to update the distributed sparse shared memory by storage of safety state information of a first node of the plurality of nodes into a first predetermined location of the distributed sparse shared memory associated with the first node.

3. The at least one non-transitory computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to decrypt a first portion of the aggregated safety data associated with a first node using a first decryption key obtained from the entropy multiplexing safety seed tree of the safety controller.

4. The at least one non-transitory computer readable storage medium of claim 1, wherein the plurality of nodes comprises Internet of Things (IoT) devices, wherein the first network comprises an IoT network.

5. A method comprising:

providing an initialization seed value to a first network including a plurality of nodes for distribution to the plurality of nodes, for use in the plurality of nodes to generate an entropy multiplexing safety seed tree in the plurality of nodes, the entropy multiplexing safety seed tree to encode a time and a segmentation of a distributed sparse shared memory comprising a transactional memory, wherein each of the plurality of nodes includes a local memory to be mapped and synchronized to a unique region of the distributed sparse shared memory;

receiving, in a safety controller coupled to the first network, a plurality of attestation values and a plurality of safety reports from a plurality of reporting nodes of the first network, each of the plurality of attestation values randomly generated in the corresponding reporting node using the entropy multiplexing safety seed tree based on the initialization seed value received from the safety controller;

determining whether at least a threshold number of the plurality of attestation values are a same value comprising a common g^a value;

responsive to at least the threshold number of the plurality of attestation values being the same value, decrypting the plurality of safety reports using a corresponding decryption key for each node obtained from the entropy multiplexing safety seed tree and processing the decrypted plurality of safety reports to obtain aggregated safety data of the plurality of nodes; and

updating the distributed sparse shared memory coupled to the safety controller, based at least in part on the aggregated safety data.

6. The method of claim 5, further comprising storing safety state information of a first node of the plurality of nodes into a first predetermined location of the distributed sparse shared memory associated with the first node.

7. The method of claim 5, further comprising:

decrypting a first portion of the aggregated safety data associated with a first node using a first decryption key obtained from the entropy multiplexing safety seed tree of the safety controller.

8. The method of claim 5, further comprising:

entering a trusted execution environment to receive the plurality of safety reports; and

determining whether at least the threshold number of the plurality of attestation values comprises the common g^a value.