Blockchain-assisted public key infrastructure for internet of things applications

Patent metadata

Field	Value
Publication number	US-10382485-B2
Application number	US-201715431138-A
Country	US
Kind code	B2
Filing date	Feb 13, 2017
Priority date	Dec 23, 2016
Publication date	Aug 13, 2019
Grant date	Aug 13, 2019

Abstract

An approach is disclosed for registering and authenticating Internet of things (IoT) devices. In one embodiment, an installation device receives, from an IoT device, an identifier (ID) and a hash of a public key, where the IoT device itself generates the ID, the public key, and a private key. To register the IoT device, a blockchain wallet in the installation devices generates a blockchain transaction which adds the received ID and hash of the public key as a name and value pair in a name/value storage (NVS). The hash of the public key may then be retrieved from the NVS and used in authentication of the IoT device to other IoT devices or servers, among other things.

First claim

We claim:

1. A computer-implemented method of registering a device to a computer system, the computer system comprising a blockchain and a name/value storage (NVS), wherein the NVS is an add-on database to the blockchain, wherein name and value pairs in the NVS can be modified using a modify operation and deleted using a delete operation, the method comprising:
receiving, from the device, an identifier (ID) and a hash of a public key, wherein the device generates the ID, the public key, and a private key; and
generating a first blockchain transaction, wherein the first blockchain transaction adds the received ID and hash of the public key to a first block, and adds the first block to a blockchain, wherein the received ID and hash of the public key located within the first block cannot be altered retrospectively, and further wherein the first blockchain transaction adds the received ID and hash of the public key as a name and value pair in the NVS.

2. The method of claim 1 , further comprising:
transmitting, to the device, a blockchain wallet public key;
receiving, from the device, a first message indicating whether the device successfully stored the blockchain wallet public key in a non-volatile memory; and
if the first message indicates that the device did not successfully store the blockchain wallet public key in the non-volatile memory, re-transmitting the blockchain wallet public key to the device.

3. The method of claim 2 , further comprising:
transmitting, to the device, a second message instructing the device to generate a new public key and a new private key, wherein the second message includes a signature signed with a private key of the blockchain wallet, and wherein the device verifies the signature using the blockchain wallet public key stored in the non-volatile memory;
receiving a hash of the new public key from the device; and
generating a second blockchain transaction which updates the value associated with the ID of the device to be the hash of the new public key.

4. The method of claim 1 , further comprising, generating a third blockchain transaction which changes a status of the ID and the hash of the public key in the NVS to revoked, wherein, in the revoked status, a blockchain wallet private key cannot be used to modify or delete the status, the ID, the hash of the public key, or an associated expiration date in the NVS.

5. The method of claim 4 , wherein the ID and the hash of the public key in the NVS that are revoked are maintained in the NVS until the expiration date.

6. The method of claim 1 , wherein, subsequent to the first blockchain transaction which adds the received ID and hash of the public key in the name/value storage (NVS), the device is authenticated to another computing device by:
transmitting, by the device to the other computing device, either information including the ID and the public key, or the ID and a self-signed certificate;
determining, by the other computer device based on the ID, whether the device is a registered device; and
if the device is a registered device:
determining, by the other computing device, a hash of the public key,
comparing, by the other computing device, the determined hash of the public key with a hash of the public key retrieved from the NVS, and
if the determined hash of the public key equals the hash of the public key retrieved from the NVS:
running, by the other computing device, a challenge-response test to verify that the device has the private key; and
if the device passes the challenge-response test, authenticating, by the other computing device, the device.

7. The method of claim 6 , wherein the NVS from which the public key is retrieved is an NVS of a public blockchain wallet.

8. The method of claim 1 , wherein:
the ID is a random value; and
the device generates the ID, the public key, and the private key during installation of the device or in response to a press of a button on the device.

9. The method of claim 1 , wherein the first blockchain transaction specifies as an input address a first owner's wallet public key and as an output address a second owner's wallet public key.

10. The method of claim 1 , wherein the device is one of a sensor, a camera, an actuator, a battery, a smart meter, a smart lock, a light, a parking sensor, or a light.

11. The computer-implement method of claim 1 , wherein each name-value pair in the NVS is unique.

12. A non-transitory computer-readable medium comprising instructions executable by a computer, the computer having one or more physical central processing units (CPUs), wherein the instructions, when executed, cause the computer to perform operations for registering a device to a computer system, the computer system comprising a blockchain and a name/value storage (NVS), wherein the NVS is an add-on database to the blockchain, wherein name and value pairs in the NVS can be modified using a modify operation and deleted using a delete operation, the operations comprising:
receiving, from the device, an identifier (ID) and a hash of a public key, wherein the device generates the ID, the public key, and a private key; and
generating a first blockchain transaction, wherein the first blockchain transaction adds the received ID and hash of the public key to a first block, and adds the first block to a blockchain, wherein the received ID and hash of the public key located within the first block cannot be altered retrospectively, and further wherein the first blockchain transaction adds the received ID and hash of the public key as a name and value pair in the NVS.

13. The computer-readable medium of claim 12 , the operations further comprising:
transmitting, to the device, a blockchain wallet public key;
receiving, from the device, a first message indicating whether the device successfully stored the blockchain wallet public key in a non-volatile memory; and
if the first message indicates that the device did not successfully store the blockchain wallet public key in the non-volatile memory, re-transmitting the blockchain wallet public key to the device.

14. The computer-readable medium of claim 12 , the operations further comprising:
transmitting, to the device, a second message instructing the device to generate a new public key and a new private key, wherein the second message includes a signature signed with a private key of the blockchain wallet, and wherein the device verifies the signature using the blockchain wallet public key stored in the non-volatile memory;
receiving a hash of the new public key from the device; and
generating a second blockchain transaction which updates the value associated with the ID of the device to be the hash of the new public key.

15. The computer-readable medium of claim 12 , the operations further comprising, generating a third blockchain transaction which changes a status of the ID and the hash of the public key in the NVS to revoked, wherein, in the revoked status, a blockchain wallet private key cannot be used to modify or delete the status, the ID, the hash of the public key, or an associated expiration date in the NVS.

16. The computer-readable medium of claim 15 , wherein the ID and the hash of the public key in the NVS that are revoked are maintained in the NVS until the expiration date.

17. The computer-readable medium of claim 12 , wherein, subsequent to the first blockchain transaction which adds the received ID and hash of the public key in the name/value storage (NVS), the device is authenticated to another computing device by:
transmitting, by the device to the other computing device,

Assignees

• Vmware Inc

Inventors

• Won Jong Ho
• Bollella Gregory

Classifications

• H04L2209/64

  Self-signed certificates · CPC title

• H04L9/3247

  involving digital signatures · CPC title

• H04L2209/38

  Electricity · mapped topic

• H04L9/3239

  involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD · CPC title

• G06F21/44 Primary

  Program or device authentication · CPC title