Set of servers for “machine-to-machine” communications using public key infrastructure
Inventors
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-12355872-B2
Publication Date
2025-07-08
Expiration Date
Abstract
A set of servers can support secure and efficient “Machine to Machine” communications using an application interface and a module controller. The set of servers can record data for a plurality of modules in a shared module database. The set of servers can (i) access the Internet to communicate with a module using a module identity, (i) receive server instructions, and (iii) send module instructions. Data can be encrypted and decrypted using a set of cryptographic algorithms and a set of cryptographic parameters. The set of servers can (i) receive a module public key with a module identity, (ii) authenticate the module public key, and (iii) receive a subsequent series of module public keys derived by the module with a module identity. The application interface can use a first server private key and the module controller can use a second server private key.
Core Innovation
The system stores a key derivation function that uses an elliptic curve Diffie-Hellman (ECDH) algorithm and a symmetric ciphering algorithm. The server derives a server private key and a first server public key using cryptographic parameters, receives a module public key, and derives a shared symmetric key using the keys and parameters including an elliptic curve. The server encrypts a module instruction containing a second server public key and a server digital signature using the shared symmetric key, and transmits the resulting server encrypted data to the user module.
The user module decrypts the server encrypted data using its derived shared symmetric key and verifies an identity of the server using the server digital signature. Server-mediated communications encompass interactions between user modules and application servers, including exchanging encrypted instructions, sensor data, actuator settings, and timestamped acknowledgements. The system further supports key generation and rotation, secure communication through network firewalls or shared infrastructure, and polling or shared database arrangements for intermittently available modules.
Claims Coverage
The claims identify one independent claim comprising four inventive features covering key generation, shared symmetric key derivation, instruction encryption, and server identity verification.
Server key generation and module message receipt
The server derives a server private key and a first server public key using cryptographic parameters, and receives a message from a user module containing a module public key and cryptographic parameters including an elliptic curve.
ECDH-based shared symmetric key derivation
The server derives a shared symmetric key using a key derivation function that utilizes an ECDH algorithm, the first server public key, the module public key, the server private key, and the cryptographic parameters.
Encryption of module instruction and server digital signature
The server encrypts, using the shared symmetric key and a symmetric ciphering algorithm, a module instruction that includes a second server public key and a server digital signature generated by the server, generating server encrypted data.
User-module decryption and server identity verification
The server sends a response comprising the server encrypted data to the user module, which decrypts the data using its derived shared symmetric key to provide the second server public key and uses the server digital signature to verify the identity of the server.
The independent claim integrates ECDH-based shared symmetric key derivation with symmetric encryption of a module instruction and a server digital signature, enabling the user module to verify the identity of the server.
Stated Advantages
Elliptic-curve cryptography reduces key length, message size, processing, and energy use.
Random security tokens provide replay resistance.
The user module uses the server digital signature to verify an identity of the server.
Documented Applications
Server-mediated communications between modules and application servers, including exchanging encrypted instructions, sensor data, and timestamped acknowledgements.
Communication with intermittently available modules using polling or shared module database arrangements.
Transmission of encrypted sensor data and actuator settings, secure-connection setup, data transfer, and communication through network firewalls or shared application-server infrastructure.
Interested in licensing this patent?