Technologies for internet of things key management

Patent metadata

Field	Value
Publication number	US-11115193-B2
Application number	US-201716649192-A
Country	US
Kind code	B2
Filing date	Dec 29, 2017
Priority date	Dec 29, 2017
Publication date	Sep 7, 2021
Grant date	Sep 7, 2021

Abstract

Technologies for key management of internet-of-things (IoT) devices include an IoT device, an authority center server, and a group management server. The IoT device is configured to authenticate with an authority center server via an offline communication channel, receive a group member private key as a function of the authentication with the authority center server, and authenticate with a group management server via a secure online communication channel using the group member private key. The IoT device is further configured to receive a group shared key as a function of the authentication with the group management server, encrypt secret data with the group shared key, and transmit the encrypted secret data to the group management server. Other embodiments are described herein.

First claim

The invention claimed is:

1. An internet-of-things (IoT) device for key management, the IoT device comprising:
one or more processors; and
one or more data storage devices having stored therein a plurality of instructions that, when executed by the one or more processors, cause the IoT device to:
authenticate with an authority center server via an offline communication channel;
receive a group member private key as a function of the authentication with the authority center server;
authenticate with a group management server via a secure online communication channel using the group member private key;
receive a group shared key as a function of the authentication with the group management server;
encrypt secret data with the group shared key; and
transmit the encrypted secret data to the group management server.

2. The IoT device of claim 1 , wherein to authenticate with the authority center server comprises to:
establish the offline communication channel using a key management protocol; and
transmit an authentication request to the authority center server via the offline communication channel,
wherein the authentication request is usable to determine that the IoT device has requested to be assigned the group member private key.

3. The IoT device of claim 1 , wherein to authenticate with the group management server comprises to:
generate a credential as a function of the group member private key; and
transmit the generated credential to the group manager server,
wherein the generated credential is usable to attest the IoT device to the group manager server using a corresponding group public key.

4. The IoT device of claim 3 , wherein the credential comprises an authentication signature generated using the group member private key.

5. The IoT device of claim 3 , wherein to authenticate with the group management server further comprises to negotiate a shared secret with the group manager server, and wherein the shared secret is usable to derive an individual key.

6. The IoT device of claim 5 , wherein to receive the group shared key comprises to receive the group shared key encrypted by the group manager server using the individual key.

7. The IoT device of claim 5 , wherein the plurality of instructions further cause the IoT device to:
authenticate the IoT device to the group manager server using the individual key;
transmit, subsequent to having successfully authenticated with the group manager server, a request to the group manager server requesting to communicate peer-to-peer with another IoT device of a group to which the IoT device corresponds and is managed by the group manager server; and
receive a peer shared key assigned by the group manager server to the IoT device and the other IoT device.

8. The IoT device of claim 7 , wherein the plurality of instructions further cause the IoT device to:
encrypt other secret data using the peer shared key; and
transmit the encrypted other secret data to the other IoT device.

9. The IoT device of claim 1 , wherein the plurality of instructions further cause the IoT device to mark the encrypted secret data as a multicast package prior to the transmission of the encrypted secret data to the group management server.

10. One or more non-transitory machine-readable storage media comprising a plurality of instructions stored thereon that, in response to being executed, cause a compute internet-of-things (IoT) device to:
authenticate with an authority center server via an offline communication channel;
receive a group member private key as a function of the authentication with the authority center server;
authenticate with a group management server via a secure online communication channel using the group member private key;
receive a group shared key as a function of the authentication with the group management server;
encrypt secret data with the group shared key; and
transmit the encrypted secret data to the group management server.

11. The one or more non-transitory machine-readable storage media of claim 10 , wherein to authenticate with the authority center server comprises to:
establish the offline communication channel using a key management protocol; and
transmit an authentication request to the authority center server via the offline communication channel,
wherein the authentication request is usable to determine that the compute internet-of-things (IoT) device has requested to be assigned the group member private key.

12. The one or more non-transitory machine-readable storage media of claim 10 , wherein to authenticate with the group management server comprises to:
generate a credential as a function of the group member private key; and
transmit the generated credential to the group manager server,
wherein the generated credential is usable to attest the compute internet-of-things (IoT) device to the group manager server using a corresponding group public key.

13. The one or more non-transitory machine-readable storage media of claim 12 , wherein the credential comprises an authentication signature generated using the group member private key.

14. The one or more non-transitory machine-readable storage media of claim 12 , wherein to authenticate with the group management server further comprises to negotiate a shared secret with the group manager server, and wherein the shared secret is usable to derive an individual key.

15. The one or more non-transitory machine-readable storage media of claim 14 , wherein to receive the group shared key comprises to receive the group shared key encrypted by the group manager server using the individual key.

16. The one or more non-transitory machine-readable storage media of claim 14 , wherein the plurality of instructions further cause the compute internet-of-things (IoT) device to:
authenticate the compute internet-of-things (IoT) device to the group manager server using the individual key;
transmit, subsequent to having successfully authenticated with the group manager server, a request to the group manager server requesting to communicate peer-to-peer with another compute device of a group to which the compute internet-of-things (IoT) device corresponds and is managed by the group manager server; and
receive a peer shared key assigned by the group manager server to the compute internet-of-things (IoT) device and the other compute internet-of-things (IoT) device.

17. The one or more non-transitory machine-readable storage media of claim 16 , wherein the plurality of instructions further cause the compute internet-of-things (IoT) device to:
encrypt other secret data using the peer shared key; and
transmit the encrypted other secret data to the other compute device.

18. A method for key management of internet-of-things (IoT) devices, the method comprising:
authenticating, by an IoT device, with an authority center server via an offline communication channel;
receiving, by the IoT device, a group member private key as a function of the authentication with the authority center server;
authenticating, by the IoT device, with a group management server via a secure online communication channel using the group member private key;
receiving, by the IoT device, a group shared key as a function of the authentication with the group management server;
encrypting, by the IoT device, secret data with the group shared key; and
transmitting, by the IoT device, the encrypted secret data to the group management server.

19. The method of claim 18 , wherein authenticating with the authority center server

Assignees

• Intel Corp

Inventors

• Wei Changzheng
• Wang Junyuan
• Smith Ned
• Li Weigang
• Yu Ping

Classifications

• H04L9/14 Primary

  using a plurality of keys or algorithms · CPC title

• H04W12/043

  using a trusted network node as an anchor · CPC title

• H04L9/3215

  using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18) · CPC title

• H04L9/321

  involving a third party or a trusted authority · CPC title

• G06F21/45

  Structures or tools for the administration of authentication · CPC title