Certificate-based remote dynamic isolation of IOT devices using distributed ledger technologies

Patent metadata

Field	Value
Publication number	US-11729004-B2
Application number	US-202117475397-A
Country	US
Kind code	B2
Filing date	Sep 15, 2021
Priority date	Jun 3, 2021
Publication date	Aug 15, 2023
Grant date	Aug 15, 2023

Abstract

Methods and systems for remote dynamic isolation of IoT devices are provided. One system includes a first IoT device and a second IoT device configured with an active communication channel with the first IoT device and a role certificate. An operator device is configured to interact with a distributed ledger to issue and revoke role certificates for a plurality of devices including the first IoT device and the second IoT device. The first IoT device periodically validates a role certificate proof received from the second IoT device with an entry of the role certificate proof recorded on the distributed ledger.

First claim

What is claimed is:

1. A system comprising:
a first IoT device (Internet of Things);
a second IoT device configured with an active communication channel with the first IoT device and a role certificate; and
an operator device configured to interact with a distributed ledger to issue and revoke role certificates for a plurality of devices including the first IoT device and the second IoT device;
wherein, the first IoT device periodically validates a role certificate proof received from the second IoT device with an entry of the role certificate proof recorded on the distributed ledger.

2. The system of claim 1 , wherein the first IoT device terminates the active communication channel when the validation of the role certificate proof fails.

3. The system in claim 1 , wherein the operator computing device invalidates the role certificate in response to an indication that the second IoT device is compromised.

4. The system of claim 1 , wherein the validation of die role certificate proof does not depend on the protocol used for the active communication channel.

5. The system of claim 1 , wherein the role certificate includes one or more communities of interest which defines a group of devices the second IoT device is allowed to establish a communication channel with.

6. The system of claim 1 , wherein the operator computing device is connected to a centralized management service which defines the role certificate for the plurality of devices.

7. A method of establishing trust between devices, the method comprising:
establishing, at a first IoT (Internet of Things) device, a communication channel with a second IoT device;
requesting and receiving, at the first IoT device, a role certificate proof from the second IoT device, wherein the role certificate proof is managed by an operator device; and
verifying periodically, at the first IoT device, the role certificate proof with an entry of the role certificate proof recorded on a distributed ledger.

8. The method of claim 7 , the method further comprising:
terminating the communication channel when the validation of the role certificate proof fails.

9. The method of claim 7 , the method further comprising:
invalidating, by the operator device, the role certificate and updating the entry of the role certificate proof on the distributed ledger in response to an indication that the second IoT device is compromised.

10. The method of claim 7 , wherein the validation of the role certificate does not depend on the protocol used for the active communication channel.

11. The method of claim 7 , wherein the role certificate includes one or more communities of interest which defines a group of devices the second IoT device is allowed to establish a communication channel with.

12. The method of claim 7 , wherein the operator device is connected to a centralized management service which defines the role certificate for a plurality of devices.

13. A method for managing devices, the method comprising:
assigning, from an operator device, a first role certificate to a first IoT (Internet of Things) device and a second role certificate to a second IoT device;
registering, using the operator device, a proof for each of the role certificates on a distributed ledger;
invalidating a role certificate for the second IoT device;
registering the invalidation of the role certificate on the distributed ledger, such that the first IoT device terminates communication with the second IoT device when validating the second role certificate.

14. The method of claim 13 , wherein the operator device is unaware of a communication protocol used between the first IoT device and the second IoT device.

15. The method of claim 13 , wherein, the first IoT device periodically validates the role certificate of the second IoT device on the distributed ledger.

16. The method of claim 13 , wherein invalidating the role certificate is done in response to receiving an indication that the second IoT device is compromised.

17. The method of claim 13 , the method further comprising:
receiving, at the operator device, a community of interest list from a centralized service; and
generating, at the operator device, a role certificate based on the community of interest list.

18. The method of claim 17 , wherein the first IoT device and second IoT device establish a communication channel based on both devices being included in the community of interest list.

19. The method of claim 17 , wherein the operator device assigns the role certificate to an associated device.

20. The method of claim 13 , wherein the operator device reissues a role certificate to the second IoT device to resume communications between the first IoT device and the second IoT device.

Assignees

• Panchamia Sanket
• Pandey Kanupriya
• Entezari Mehdi
• Patil Sachin B
• Kk Amith
• Johnson Robert A
• Unisys Corp

Inventors

• Panchamia Sanket
• Pandey Kanupriya
• Entezari Mehdi
• Patil Sachin B
• Kk Amith
• Johnson Robert A

Classifications

• H04L9/3268 Primary

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• H04L9/083

  involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP] · CPC title

• H04L9/0891

  Revocation or update of secret information, e.g. encryption key update or rekeying · CPC title

• H04L9/3215

  using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18) · CPC title

• H04L9/50 Primary

  using hash chains, e.g. blockchains or hash trees · CPC title