Automating internet of things security provisioning

Patent metadata

Field	Value
Publication number	US-10083291-B2
Application number	US-201615052751-A
Country	US
Kind code	B2
Filing date	Feb 24, 2016
Priority date	Feb 25, 2015
Publication date	Sep 25, 2018
Grant date	Sep 25, 2018

Abstract

In one embodiment, a security provisioning service automatically establishes trust in a device. Upon receiving a provisioning request, a security provisioning service identifies a verification item that is associated with the provisioning request. The security provisioning service performs one or more verification operations based on the provisioning request to determine whether the provisioning request is authorized. If the provisioning request is authorized, then the provisioning service establishes a verifiable identification for the device that is assured by the secure provisioning service and then executes the provisioning request. By automatically performing the verification operations to establish trust in the device, the provisioning service eliminates manual identification assurance operations that are performed as part of a conventional security provisioning process. Reducing the time and effort required to perform security provisioning increases the number of devices likely to implement security processes that increase the overall security of interacting using the Internet.

First claim

What is claimed is:

1. A computer-implemented method for establishing trust in an internet of things (“IoT”) device when provisioning the IoT device, the method comprising:
receiving, at a registration service executing on a hardware processor, a provisioning request from the IoT device for provisioning the IoT device within a network, wherein the provisioning request is signed with a private key stored within a memory of the IoT device and associated with a public key having a many-to-one relationship with a plurality of private keys, wherein the private key is included in the plurality of private keys;
determining, via the hardware processor, a verification item associated with the private key based on which the provisioning request is signed;
performing, via the hardware processor, one or more cryptographic operations on the verification item to determine that one or more provisioning operations are authorized; and
performing, via the hardware processor, the one or more provisioning operations to establish a verifiable identification for the IoT device within the network.

2. The computer-implemented method of claim 1 , wherein the verification item comprises a digital signature, and determining that one or more provisioning operations are authorized comprises:
identifying the public key that is associated with the digital signature; and
validating the digital signature based on the public key.

3. The computer-implemented method of claim 2 , wherein the private key comprises an Enhanced Privacy Identification (EPID) private key, the digital signature is generated using the EPID private key, and identifying the public key comprises selecting a EPID public key that is associated with the EPID private key.

4. The computer-implemented method of claim 2 , wherein the digital signature is generated using the private key, and identifying the public key comprises performing one or more look up operations on a device manifest based on a name of the IoT device, wherein the device manifest includes a plurality of public keys.

5. The computer-implemented method of claim 1 , further comprising determining that one or more provisioning operations are authorized by performing one or more look up operations on a device manifest based on the verification item.

6. The computer-implemented method of claim 5 , wherein the verification item comprises an Internet Protocol (IP) number, a domain name, or a certificate that includes the public key.

7. The computer-implemented method of claim 1 , wherein performing the one or more provisioning operations comprises storing the public key in a Domain Name System (DNS) based on a name of the IoT device.

8. The computer-implemented method of claim 1 , wherein performing the one or more provisioning operations comprises:
signing a certificate that includes a second public key to generate a signed certificate;
storing the second public key in a Domain Name System (DNS) based on a name of the IoT device; and
transmitting the signed certificate to the IoT device.

9. A non-transitory computer-readable storage medium including instructions that, when executed by a hardware processor, cause the hardware processor to perform the steps of:
receiving, at a registration service executing on the hardware processor, a first provisioning request from an IoT device for provisioning the IoT device within a network, wherein the provisioning request is signed with a private key stored within a memory of the IoT device and associated with a public key having a many-to-one relationship with a plurality of private keys, wherein the private key is included in the plurality of private keys;
determining distinguishing information associated with the IoT device in response to the first provisioning request;
selecting at least one authorization template included in a template database based on the distinguishing information; and
based on the at least one authorization template, generating a first authorization credential for the IoT device to establish a verifiable identification for the IoT device within the network.

10. The non-transitory computer-readable storage medium of claim 9 , wherein the distinguishing information comprises an Internet Protocol (IP) number, a domain name, an Enhanced Privacy Identification (EPID) public key, or a device type.

11. The non-transitory computer-readable storage medium of claim 9 , wherein the distinguishing information comprises the public key, and determining the distinguishing information comprises reading a public key infrastructure (PKI) certificate that includes the public key.

12. The non-transitory computer-readable storage medium of claim 9 , further comprising:
signing the first authorization credential to generate a signed authorization credential; and
transmitting the signed authorization credential to the IoT device.

13. The non-transitory computer-readable storage medium of claim 12 , further comprising inserting the signed authorization credential into a Domain Name System (DNS).

14. The non-transitory computer-readable storage medium of claim 9 , further comprising:
receiving a second provisioning request for a second IoT device;
performing one or more verification operations to determine whether an identification associated with the second IoT device is reliable; and
if the identification is reliable, then generating a second authorization credential for the second IoT device based on a first template that is not included in the at least one authorization template, or
if the identification is not reliable, then transmitting an error message to at least one of the IoT device and the second IoT device.

15. The non-transitory computer-readable storage medium of claim 9 , wherein selecting the at least one authorization template comprises performing one or more matching operations between the distinguishing information and a plurality of device profiles, wherein each device profile included in the plurality of device profiles is associated with one or more authorization templates included in the template database.

16. The non-transitory computer-readable storage medium of claim 9 , wherein generating the first authorization credential comprises creating a union of all authorizations included in the at least one authorization template that are applicable to the IoT device.

17. A system comprising:
a memory storing a provisioning engine; and
a hardware processor that is coupled to the memory and, when executing the provisioning engine, is configured to:
receive, at a registration service executing on the hardware processor, a provisioning request from an IoT device for provisioning the IoT device within a network, wherein the provisioning request is signed with a private key stored within a memory of the IoT device and associated with a public key having a many-to-one relationship with a plurality of private keys, wherein the private key is included in the plurality of private keys;
determine a verification item associated with the private key based on which the provisioning request is signed;
perform one or more cryptographic operations on the verification item to determine that one or more provisioning operations are authorized;
perform the one or more provisioning operations to generate a provisioning item that establishes a verifiable identification for the IoT device within the network; and
sign the provisioning item to generate a signed provisioning item.

18. The system of claim 17 , wherein the provisioning request comprises a public key infrastructure (PKI) certificate sign

Assignees

• Verisign Inc

Inventors

• James Stephen D
• Fregly Andrew
• Cathrow Andrew

Classifications

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04L61/3025

  Domain name generation or assignment · CPC title

• H04L67/04

  specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability · CPC title

• H04W4/70

  Services for machine-to-machine communication [M2M] or machine type communication [MTC] · CPC title

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title