Set of servers for “machine-to-machine” communications using public key infrastructure
Inventors
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-9998281-B2
Publication Date
2018-06-12
Expiration Date
Abstract
A set of servers can support secure and efficient “Machine to Machine” communications using an application interface and a module controller. The set of servers can record data for a plurality of modules in a shared module database. The set of servers can (i) access the Internet to communicate with a module using a module identity, (i) receive server instructions, and (iii) send module instructions. Data can be encrypted and decrypted using a set of cryptographic algorithms and a set of cryptographic parameters. The set of servers can (i) receive a module public key with a module identity, (ii) authenticate the module public key, and (iii) receive a subsequent series of module public keys derived by the module with a module identity. The application interface can use a first server private key and the module controller can use a second server private key.
Core Innovation
The disclosed methods and system support machine-to-machine communications between a module, servers, and an application server using public key infrastructure. The servers authenticate module identities and digital signatures, select cryptographic parameters using the module identity, and verify derived module public keys. The servers then decrypt module encrypted data to obtain a value and transmit the value and module identity to an application server over a secure connection.
The system and methods facilitate communication with a module positioned behind a firewall or network address translation when reconnecting at a different source IP:port number. Cryptographic parameters provided by the servers enable the module to derive a key pair, while a database records module identities and public keys. The servers subsequently deliver encrypted instructions ciphered with verified public keys to the module at the updated source address.
Claims Coverage
The claims identify three independent claims directed to three inventive features for supporting machine-to-machine communications.
Server authentication and encrypted module data processing
Servers verify a module digital signature, select cryptographic parameters using the module identity, verify a second module public key, decrypt module encrypted data to obtain a value, and transmit the value and module identity to an application server over a secure connection.
Firewall-aware delivery of encrypted module instructions
A module controller provides cryptographic parameters to a module behind a firewall for deriving a key pair, receives a second module public key, and delivers an encrypted module instruction after the module reconnects at a different source IP:port number, utilizing an application interface and a module database.
Database-coordinated key provisioning and instruction delivery
Servers query a module database for a first module public key, authenticate the module identity, provide cryptographic parameters for key derivation, verify a received second module public key, and transmit an application-server instruction within encrypted data ciphered with the second module public key to the module at a changed source IP:port number.
Together, the three inventive features cover server-side module authentication, cryptographic parameter management, and secure transmission of sensor values and application instructions when a module reconnects from behind a firewall at a modified source IP:port address.
Stated Advantages
Polling and shared-database arrangements improve delivery of instructions to intermittently available modules.
Multi-server coordination through a shared module database supports scalable module management and more efficient communication.
Reduced module power, bandwidth, and radio-spectrum use.
Secure key renewal without physical SIM replacement.
Elliptic curve cryptography reduces key size, message length, radio use, and module processing and energy demands.
Documented Applications
Machine-to-machine communications between modules, servers, and application servers.
Remote sensor monitoring and secure forwarding of encrypted sensor values from a module to an application server over a secure connection.
Delivery of application-server instructions to a module that reconnects behind a firewall or network address translation at a different source IP:port address.
Actuator control.
Interested in licensing this patent?