System and method for establishing secure communication channels with internet of things (IoT) devices

Patent metadata

Field	Value
Publication number	US-10419930-B2
Application number	US-201615167799-A
Country	US
Kind code	B2
Filing date	May 27, 2016
Priority date	May 27, 2016
Publication date	Sep 17, 2019
Grant date	Sep 17, 2019

Abstract

A system and method are described for establishing secure communication channels. For example, one embodiment of a system includes an IoT device comprising secret/counter processing logic/circuitry to generate a master secret, the master secret to be transmitted to an IoT service. The system may include one or more IoT hubs to receive the master secret from the IoT service over a first secure communication channel. At least one of the IoT hubs can use the master secret to establish a second secure communication channel with the IoT device.

First claim

What is claimed is:

1. A system comprising: an IoT device comprising secret/counter processing logic/circuitry to generate a master secret, the master secret to be transmitted to an IoT service,
wherein the secret/counter processing logic/circuitry is to generate a first counter and use a value of the first counter in combination with the master secret to generate a shared secret, wherein the secret/counter processing logic/circuitry is to generate a second counter;
one or more IoT hubs to receive the master secret from the IoT service over a first secure communication channel, at least one of the IoT hubs to use the master secret to establish a second secure communication channel with the IoT device;
keyed-hash message authentication code (HMAC) generation logic/circuitry to use the shared secret as a key to generate an HMAC with the second counter value and data from an advertising packet
wherein the IoT device is to generate an advertising packet comprising a specified set of bytes from the HMAC and the second counter value;
and shared secret generation logic to generate a plurality of shared secrets associated with the IoT device using the master secret and the first counter value and to store the plurality of shared secrets.

2. The system as in claim 1 wherein the master secret is to be transmitted to the IoT service by setting the master secret as a system attribute on the IoT device, the IoT device comprising circuitry/logic to automatically synchronize its system attributes with the IoT service.

3. The system as in claim 1 wherein a keyed-hash message authentication code (HMAC) is used to generate the shared secret using the master secret as a key for the HMAC and the first counter as the data.

4. The system as in claim 1 wherein the data from the advertising packet comprises a manufacturer ID, manufacturer flags, a device ID, and/or a protocol version, the data from the advertising packet followed by the second counter value.

5. The system as in claim 4 further comprising:
a N byte buffer to store the data from the advertising packet and the second counter value, wherein the second counter value is to be followed by a sequence of zeroes to pad out to N bytes.

6. The system as in claim 1 wherein the IoT device is to generate an advertising packet comprising a specified set of bytes from the HMAC and the second counter value, the system further comprising: a timer configured to fire based on a frequency specified in a system attribute, wherein when the timer fires, the secret/counter processing logic/circuit is to increment the first counter value and generate a new shared secret using the incremented first counter value in combination with the master secret.

7. The system as in claim 6 wherein the secret/counter processing logic/circuit is to also increment the second counter value in response to the timer firing.

8. The system as in claim 6 wherein the secret/counter processing logic/circuit is to also increment the second counter value in response a detected change to one or more advertising flags.

9. The system as in claim 1 wherein the IoT hub comprises: HMAC generation logic to generate a plurality of HMACs using the plurality of shared secrets and data from an advertising packet received from the IoT device.

10. The system as in claim 9 wherein the data from the advertising packet includes the second counter value and advertising data.

11. The system as in claim 10 wherein the IoT hub further comprises:
HMAC analysis logic to compare specified bytes of an HMAC to secret bytes in an advertising packet received from the IoT device, wherein if no match is found, an alert condition is to be reported to the IoT service.

12. A method comprising: generating a master secret on an IoT device, the master secret to be transmitted to an IoT service;
receiving the master secret from the IoT service at one or more IoT hubs over a first secure communication channel;
using the master secret to establish a second secure communication channel with the IoT device; generating a first counter;
using a value of the first counter in combination with the master secret to generate a shared secret; generating a second counter;
using the shared secret as a key to generate an HMAC with the second counter value and data from an advertising packet
wherein the IoT device is to generate an advertising packet comprising a specified set of bytes from the HMAC and the second counter value;
generating a plurality of shared secrets associated with the IoT device on the IoT hub using the master secret and the first counter value; and storing the plurality of shared secrets.

13. The method as in claim 12 wherein the master secret is to be transmitted to the IoT service by setting the master secret as a system attribute on the IoT device, the IoT device comprising circuitry/logic to automatically synchronize its system attributes with the IoT service.

14. The method as in claim 12 wherein a keyed-hash message authentication code (HMAC) is used to generate the shared secret using the master secret as a key for the HMAC and the first counter as the data.

15. The method as in claim 12 wherein the data from the advertising packet comprises a manufacturer ID, manufacturer flags, a device ID, and/or a protocol version, the data from the advertising packet followed by the second counter value.

16. The method as in claim 15 further comprising:
storing the data from the advertising packet and the second counter value in an N byte buffer, wherein the second counter value is to be followed by a sequence of zeroes to pad out to N bytes.

17. The method as in claim 12 wherein the IoT device is to generate an advertising packet comprising a specified set of bytes from the HMAC and the second counter value, the method further comprising: configuring a timer to fire based on a frequency specified in a system attribute, wherein when the timer fires, the first counter value is incremented and a new shared secret generated using the incremented first counter value in combination with the master secret.

18. The method as in claim 17 further comprising:
incrementing the second counter value in response to the timer firing.

19. The method as in claim 17 further comprising:
incrementing the second counter value in response a detected change to one or more advertising flags.

20. The method as in claim 12 further comprising: generating a plurality of HMACs on the IoT hub using the plurality of shared secrets and data from an advertising packet received from the IoT device.

21. The method as in claim 20 wherein the data from the advertising packet includes the second counter value and advertising data.

22. The method as in claim 21 further comprising:
comparing specified bytes of an HMAC to secret bytes in an advertising packet received from the IoT device, wherein if no match is found, an alert condition is to be reported to the IoT service.

Assignees

• Afero Inc

Inventors

• Holland Shannon
• Pointer Robey
• Sewerynek Stephen
• Heckman Nickolas
• Auito Chris
• Finkelstein Lucas
• Zimmerman Scott

Classifications

• H04L9/0861 Primary

  Generation of secret information including derivation or calculation of cryptographic keys or passwords · CPC title

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04L9/3242

  involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title