Technologies for internet of things key management

Patent metadata

Field	Value
Publication number	US-11736277-B2
Application number	US-202117463453-A
Country	US
Kind code	B2
Filing date	Aug 31, 2021
Priority date	Dec 29, 2017
Publication date	Aug 22, 2023
Grant date	Aug 22, 2023

Abstract

Technologies for key management of internet-of-things (IoT) devices include an IoT device, an authority center server, and a group management server. The IoT device is configured to authenticate with an authority center server via an offline communication channel, receive a group member private key as a function of the authentication with the authority center server, and authenticate with a group management server via a secure online communication channel using the group member private key. The IoT device is further configured to receive a group shared key as a function of the authentication with the group management server, encrypt secret data with the group shared key, and transmit the encrypted secret data to the group management server. Other embodiments are described herein.

First claim

The invention claimed is:

1. A group management server, the group management server comprising:
at least one memory;
instructions in the group management server; and
one or more processors to execute the instructions to at least:
authenticate a first Internet of Things (IoT) device as a member of a first group using a first group member private key assigned to the first IoT device by an authority server, the first IoT device authenticated with the authority server via a first communication channel, wherein the first communication channel is isolated from a second communication channel utilized by the first IoT device to communicate with the group management server;
transmit a first group shared key to the first IoT device, the first group shared key generated as a function of the authentication with the authority server;
authenticate a second IoT device as a member of a second group using a second group member private key assigned to the second IoT device by the authority server, the second IoT device authenticated with the authority server via a third communication channel, wherein the third communication channel is isolated from a fourth communication channel utilized by the second IoT device to communicate with a group management server; and
transmit a second group shared key to the second IoT device, the second group shared key generated as a function of the authentication with the authority server.

2. The group management server of claim 1 , wherein, to authenticate with the authority server, the first IoT device is to:
establish the first communication channel using a key management protocol; and
transmit an authentication request to the authority server via the first communication channel,
wherein the authentication request indicates that the first IoT device has requested assignment to the first group member private key.

3. The group management server of claim 1 , wherein, to authenticate with the group management server, the first IoT device is to:
generate a credential as a function of the first group member private key; and
transmit the generated credential to the group management server,
wherein the generated credential attests the first IoT device to the group management server using a corresponding first group public key.

4. The group management server of claim 3 , wherein the credential comprises an authentication signature generated using the first group member private key.

5. The group management server of claim 3 , wherein to authenticate the first IoT device with the group management server, the one or more processors are to execute the instructions to negotiate a shared secret, and wherein an individual key is derived using the shared secret.

6. The group management server of claim 5 , wherein the one or more processors are to execute the instructions to encrypt the first group shared key using the individual key.

7. The group management server of claim 5 , wherein the one or more processors are to execute the instructions to:
authenticate the first IoT device using the individual key;
receive a request from the first IoT device to communicate peer-to-peer with another IoT device of a group to which the first IoT device corresponds; and
transmit a peer shared key assigned to the first IoT device and the other IoT device.

8. The group management server of claim 7 , wherein the first IoT device is to:
encrypt other secret data using the peer shared key; and
transmit the encrypted other secret data to the other IoT device.

9. The group management server of claim 8 , wherein the one or more processors are to execute the instructions to cause the first IoT device to mark the encrypted secret data as a multicast package prior to the transmission of the encrypted secret data to the group management server.

10. A method for key management of computing devices, the method comprising:
authenticating, by a computing device, with an authority center server via a first communication channel;
obtaining, by the computing device, a group member private key as a function of the authentication with the authority center server;
authenticating, by the computing device, with a group management server via a second communication channel using the group member private key, wherein the second communication channel is isolated from the first communication channel;
obtaining, by the computing device, a group shared key as a function of the authentication with the group management server;
encrypting, by the computing device, secret data with the group shared key; and
transmitting, by the computing device, the encrypted secret data to the group management server.

11. The method of claim 10 , wherein authenticating with the authority center server comprises (i) establishing the first communication channel using a key management protocol and (ii) transmitting an authentication request to the authority center server via the first communication channel, wherein the authentication request is usable to determine that the computing device is requesting to be assigned the group member private key.

12. The method of claim 10 , wherein the first communication channel is an offline communication channel and the second communication channel is an online communication channel, and wherein authenticating with the group management server comprises (i) generating a credential as a function of the group member private key and (ii) transmitting the generated credential to the group management server, wherein the generated credential is usable to attest the computing device to the group management server using a corresponding group public key.

13. The method of claim 12 , wherein the credential comprises an authentication signature generated using the group member private key.

14. The method of claim 12 , wherein authenticating with the group management server further comprises negotiating a shared secret with the group management server, wherein the shared secret is usable to derive an individual key, and wherein receiving the group shared key comprises to receive the group shared key encrypted by the group management server using the individual key.

15. The method of claim 14 , further comprising:
authenticating, by the computing device, an IoT computing device to the group management server using the individual key;
transmitting, by the computing device and subsequent to having successfully authenticated with the group management server, a request to the group management server requesting to communicate peer-to-peer with another computing device of a group to which the computing device corresponds and is managed by the group management server; and
receiving, by the computing device, a peer shared key assigned by the group management server to the computing device and the other computing device.

16. The method of claim 15 , further comprising:
encrypting, by the computing device, other secret data using the peer shared key; and
transmitting, by the computing device, the encrypted other secret data to the other computing device.

17. The method of claim 10 , further comprising marking, by the computing device, the encrypted secret data as a multicast package prior to the transmission of the encrypted secret data to the group management server.

18. A non-transitory computer readable medium comprising instructions that, when executed, cause a machine to at least:
authenticate a first Internet of Things (IoT) device as a member of a first group using a first group member private key assigned to the first IoT device by an authority server, the first Io

Assignees

• Intel Corp

Inventors

• Wei Changzhen
• Wang Junyuan
• Smith Ned
• Li Weigang
• Yu Ping

Classifications

• H04L9/0833 Primary

  involving conference or group key (network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065) · CPC title

• G06F21/45

  Structures or tools for the administration of authentication · CPC title

• G16Y30/10

  Security thereof · CPC title

• H04L9/0822

  using key encryption key · CPC title

• H04L9/321

  involving a third party or a trusted authority · CPC title