IoT COMMUNICATION UTILIZING SECURE ASYNCHRONOUS P2P COMMUNICATION AND DATA EXCHANGE

Patent metadata

Field	Value
Publication number	US-2016337127-A1
Application number	US-201514712676-A
Country	US
Kind code	A1
Filing date	May 14, 2015
Priority date	May 14, 2015
Publication date	Nov 17, 2016
Grant date	—

Abstract

A device may receive a connection request including a digital certificate from an endpoint for establishing a secure connection for a communication, the digital certificate including a digital certificate chain identifying one or more certificate authorities associated with the digital certificate. The device may determine whether the digital certificate is valid based on the digital certificate chain identifying one or more certificate authorities trusted by the device. The device may determine whether the connection request includes a valid token. The device may generate a token based on the digital certificate being valid and an absence of a valid token included in the connection request. The device may associate the token with the digital certificate. The device may distribute the token to the endpoint. The device may establish the secure connection with the endpoint using the token associated with the digital certificate.

First claim

What is claimed is:

1 . A device, comprising:
one or more processors to:
receive a connection request including a digital certificate from an endpoint for establishing a secure connection for a communication,
the digital certificate including a digital certificate chain identifying one or more certificate authorities associated with the digital certificate;

determine whether the digital certificate is valid based on the digital certificate chain identifying one or more certificate authorities trusted by the device;
determine whether the connection request includes a valid token;
generate a token based on the digital certificate being valid and an absence of a valid token included in the connection request;
associate the token with the digital certificate;
distribute the token to the endpoint; and
establish the secure connection with the endpoint using the token associated with the digital certificate.

2 . The device of claim 1 , where the connection request is for establishing an asynchronous peer-to-peer communication and/or an asynchronous client-server communication.

3 . The device of claim 1 , where the connection request includes endpoint information and/or token information,
the endpoint information including certificate information, endpoint fingerprint information, and/or context information, the endpoint fingerprint information including device information, network information, and/or clock skew information.

4 . The device of claim 1 , where, when generating the token, the one or more processors are further to:
compare endpoint fingerprint information included in the connection request with stored endpoint fingerprint information; calculate an endpoint trust score for the endpoint based on the endpoint fingerprint information matching the stored endpoint fingerprint information; and generate the token when the endpoint trust score satisfies a threshold.

5 . The device of claim 4 , where the one or more processors are further to:
deny the connection request when the endpoint trust score does not satisfy the threshold.

6 . The device of claim 4 , where the one or more processors are further to:
receive a second connection request from the endpoint; compare endpoint fingerprint information included in the second connection request with stored endpoint fingerprint information; and calculate a new endpoint trust score for the endpoint based on the endpoint fingerprint information matching the stored endpoint fingerprint information by adjusting the endpoint trust score for the endpoint.

7 . The device of claim 6 , where, when calculating the new endpoint trust score, the one or more processors are further to:
adjust the endpoint trust score by increasing the endpoint trust score for a positive communication associated with the secure connection for the communication; or adjust the endpoint trust score by decreasing the endpoint trust score for a negative communication associated with the secure connection for the communication.

8 . A computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the one or more processors to:
receive an asynchronous connection request including a digital certificate from an endpoint for establishing a secure connection for a communication,
the digital certificate including a digital certificate chain identifying one or more certificate authorities associated with the digital certificate;

determine whether the digital certificate is valid based on the digital certificate chain identifying one or more certificate authorities trusted by the device;
determine whether the connection request includes a valid token;
generate a token based on the digital certificate being valid and an absence of a valid token included in the connection request;
associate the token with the digital certificate;
distribute the token to the endpoint; and
establish the secure connection with the endpoint using the token associated with the digital certificate.

9 . The computer-readable medium of claim 8 , where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
provide one or more instructions to create a secure container.

10 . The computer-readable medium of claim 9 , where the secure container is used to receive, manage, and/or store data exchanged during the communication in isolation.

11 . The computer-readable medium of claim 9 , where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
flush the secure container of data exchanged and stored during the communication.

12 . The computer-readable medium of claim 8 , where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
identify endpoint fingerprint information for the endpoint; compare the endpoint fingerprint information with stored endpoint fingerprint information; and determine whether the endpoint is known based on the endpoint fingerprint information matching the stored endpoint fingerprint information.

13 . The computer-readable medium of claim 12 , where the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
interrogate the endpoint, based on the endpoint not being known, to identify the endpoint.

14 . The computer-readable medium of claim 8 , where the one or more instructions, that cause the one or more processors to generate the token, further cause the one or more processors to:
deny the connection request when the digital certificate is not valid; and provide an error message that the digital certificate is not valid.

15 . The computer-readable medium of claim 8 , where, when generating the token, the one or more instructions, when executed by the one or more processors, further cause the one or more processors to:
generate the token using endpoint information; and calculate a time-to-live for the token using the endpoint information and/or historical token information.

16 . A method, comprising:
receiving, by a device, a connection request including a digital certificate from an endpoint for establishing a secure connection for a communication; determining, by the device, whether the connection request includes a token; generating, by the device, a token based on an absence of a token in the connection request; associating, by the device, the token with the digital certificate; distributing, by the device, the token to the endpoint; providing, by the device, instructions to create a secure container; establishing, by the device, the secure connection with the endpoint using the token associated with the digital certificate; and using the secure container to receive, manage, and/or store data exchanged during the communication.

17 . The method of claim 16 , further comprising:
determining whether the digital certificate is valid based on the digital certificate including a digital certificate chain identifying one or more certificate authorities trusted by the device; and providing an error message that the digital certificate is not valid based on the digital certificate chain not identifying a certificate authority trusted by the device.

18 . The method of claim 16 , where, when determining whether the connection request includes the token, further comprises:
determining whether the token is

Assignees

• Verizon Patent & Licensing Inc

Inventors

• Schultz Paul T
• Sartini Robert A

Classifications

• H04L9/3265

  using certificate chains, trees or paths; Hierarchical trust model · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/3234 Primary

  involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853) · CPC title

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• H04W4/70

  Services for machine-to-machine communication [M2M] or machine type communication [MTC] · CPC title