Systems and methods for “Machine-to-Machine” (M2M) communications between modules, servers, and an application using public key infrastructure (PKI)
Inventors
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-11258595-B2
Publication Date
2022-02-22
Expiration Date
Abstract
Methods and systems are provided for supporting efficient and secure “Machine-to-Machine” (M2M) communications using a module, a server, and an application. A module can communicate with the server by accessing the Internet, and the module can include a sensor and/or an actuator. The module, server, and application can utilize public key infrastructure (PKI) such as public keys and private keys. The module can internally derive pairs of private/public keys using cryptographic algorithms and a first set of parameters. A server can authenticate the submission of derived public keys and an associated module identity. The server can use a first server private key and a second set of parameters to (i) send module data to the application and (ii) receive module instructions from the application. The server can use a second server private key and the first set of parameters to communicate with the module.
Core Innovation
The invention supports secure machine to machine communications in which a server stores a server private key, module identity information for a module, and a pre-shared secret key associated with the module. The module identity information comprises a permanent identifier for the module, and the server uses the server private key and the module identity information to receive module-provided cryptographic material and to enable subsequent key establishment and authentication.
The server receives, from the module, a module public key derived by the module, parameters associated with the module public key, and module encrypted data, where the module encrypted data comprises data encrypted at the module. The server derives a shared secret key using an Elliptic Curve Diffie-Hellman algorithm based at least on the module public key and the server private key, and the shared secret key is derived by the module using an Elliptic Curve Diffie-Hellman algorithm based at least on a server public key corresponding to the server private key and a module private key corresponding to the module public key.
Using the derived shared secret key, the server decrypts the module encrypted data such that the decrypted encrypted data includes a module identity. The server then authenticates the module with the module identity using the pre-shared secret key and a digest algorithm, where the digest algorithm uses a challenge from the server and a hash value from the module. The architecture is presented as an IoT/M2M communications security approach with cryptographic components for key generation, key derivation, and digital signatures, and with support for secure handling of module data and server responses.
Claims Coverage
The document includes one independent claim directed to a secure machine-to-machine communications method, with multiple dependent claims refining the independent claim by constraining modules, cryptographic parameters/algorithms, storage of keys, and message/packet handling. The independent claim has five inventive features centered on key establishment, decryption, and authentication.
Server storage of server private key, module identity, and pre-shared secret key
Storing, in memory operatively connected to at least one server, a server private key, module identity information associated with at least one module, and a pre-shared secret key associated with the at least one module, wherein the module identity information comprises a permanent identifier for the at least one module.
Receiving module public key and encrypted module data
Receiving, by the at least one server from a first module, a first module public key derived by the first module, parameters associated with the first module public key, and first module encrypted data, wherein the first module encrypted data comprises data encrypted at the first module.
Elliptic Curve Diffie-Hellman shared secret derivation with server private key and module public key
Deriving, by the at least one server, a shared secret key using an Elliptic Curve Diffie-Hellman algorithm based at least on the first module public key and the server private key, wherein the derived shared secret key is derived by the first module using the Elliptic Curve Diffie-Hellman algorithm based at least on a server public key corresponding to the server private key and a first module private key corresponding to the first module public key.
Decrypting encrypted data to obtain first module identity
Decrypting, by the at least one server, the first module encrypted data based at least on the derived shared secret key, wherein the decrypted first module encrypted data includes a first module identity.
Authenticating the module using pre-shared secret key and digest with server challenge and module hash value
Authenticating the first module with the first module identity using the pre-shared secret key and a digest algorithm, wherein the digest algorithm uses a challenge from the at least one server and a hash value from the first module.
Claim coverage is centered on the independent claim, which combines server-side storage of server private key, module identity, and pre-shared secret key; receiving module public key and module encrypted data; deriving a shared secret using Elliptic Curve Diffie-Hellman with reciprocal derivation at the module; decrypting to recover module identity; and authenticating using the pre-shared secret key and a digest algorithm based on a server challenge and a module hash value.
Stated Advantages
Supports secure machine to machine communications.
Implements reliable and secure message transport using UDP/UDP Lite with optional channel coding and sending multiple packet copies, with server-side combination to correct bit errors.
Mitigates replay attacks using a short timer window for duplicate packets.
Supports firewall and NAT traversal using source-port-based responses and periodic firewall port-binding keep-alives when modules are non-persistent.
Provides encrypted and signature-protected server instructions in responses and supports key rotation.
Documented Applications
Secure message transport and secure machine to machine communications for M2M modules.
Firewall/NAT traversal support for non-persistent modules in communications.
Server processing flow for decrypting/authenticating received packets and sending encrypted/signature-protected server instructions as part of M2M communications.
Interested in licensing this patent?