System, Apparatus and Method for Secure Network Bridging Using A Rendezvous Service and Multiple Key Distribution Servers

Patent metadata

Field	Value
Publication number	US-2016366105-A1
Application number	US-201514864940-A
Country	US
Kind code	A1
Filing date	Sep 25, 2015
Priority date	Jun 9, 2015
Publication date	Dec 15, 2016
Grant date	—

Abstract

In one embodiment, a method includes: receiving, in a rendezvous server (RS), a first registration message (FRM) from a first registrar of a first network domain (FND), the FRM including a first device roster of a plurality of first devices of the FND; receiving, in the RS, a second registration message (SRM) from a second registrar of a second network domain (SND), the SRM including a second device roster of a plurality of second devices of the SND; and generating a first rendezvous point (RP) based at least in part on a plurality of key management server identifiers each associated with a key management server of the FND and SND, the first RP to enable the plurality of key management servers to perform key management exchange to generate at least one group key.

First claim

What is claimed is:

1 . At least one computer readable storage medium comprising instructions that when executed enable a system to:
receive, in a rendezvous server, a first registration message from a first registrar of a first network domain, the first registration message including a first device roster of a plurality of first devices of the first network domain; receive, in the rendezvous server, a second registration message from a second registrar of a second network domain, the second registration message including a second device roster of a plurality of second devices of the second network domain; and generate a first rendezvous point based at least in part on a plurality of key management server identifiers each associated with a key management server of the first and second network domains, the first rendezvous point to enable the plurality of key management servers to perform key management exchange to generate at least one group key for communication between at least some of the first devices of the first network domain and at least some of the second devices of the second network domain.

2 . The at least one computer readable storage medium of claim 1 , further comprising instructions that when executed enable the system to generate a second rendezvous point based at least in part on a plurality of gateway server identifiers each associated with a gateway server of the first and second network domains, the second rendezvous point to enable publication of an encrypted message to a subscriber list including one or more of the plurality of first devices and one or more of the plurality of second devices.

3 . The at least one computer readable storage medium of claim 2 , further comprising instructions that when executed enable the system to:
receive, in the gateway server of the first domain, the at least one group key and the encrypted message from one or more of the plurality of first devices; and decrypt, in the gateway server of the first domain, the encrypted message.

4 . The at least one computer readable storage medium of claim 2 , further comprising instructions that when executed enable the system to form a roster that includes the first device roster, the second device roster, the plurality of key management server identifiers, and the plurality of gateway server identifiers.

5 . The at least one computer readable storage medium of claim 4 , further comprising instructions that when executed enable the system to:
receive, in the rendezvous server, a request for the at least one group key from one of the plurality of key management servers that is: (a) associated with the second network domain, and (b) has a key management server identifier included in the roster; and receive, in the rendezvous server, a reply to the request from one of the plurality of key management servers that is: (a) associated with the first network domain, and (b) has another key management server identifier included in the roster; wherein the reply includes the at least one group key.

6 . The at least one computer readable storage medium of claim 2 , further comprising instructions that when executed enable the system to receive, in the rendezvous server at the second rendezvous point, (a) the encrypted message from one or more of the plurality of second devices via the gateway server of the second network domain, and (b) another encrypted message from one or more of the plurality of first devices without using any gateway server of the first network domain.

7 . The at least one computer readable storage medium of claim 6 , further comprising instructions that when executed enable the system to generate the second rendezvous point based at least in part on an identifier associated with the another of the one or more of the plurality of first devices.

8 . The at least one computer readable storage medium of claim 6 , further comprising instructions that when executed enable the system to send, from the rendezvous server at the first rendezvous point, the at least one group key to one or more of the plurality of second devices via one of the plurality of key management servers associated with the second network domain.

9 . The at least one computer readable storage medium of claim 2 , further comprising instructions that when executed enable the system to receive, in the rendezvous server, the at least one group key from one of the plurality of key management servers associated with the first network domain.

10 . The at least one computer readable storage medium of claim 9 , further comprising instructions that when executed enable the system to send, from the rendezvous server, the at least one group key to one of the plurality of key management servers associated with the second network domain.

11 . The at least one computer readable storage medium of claim 10 , further comprising instructions that when executed enable the system to receive the at least one group key from one of the plurality of key management servers associated with the first network domain while the at least one group key is encrypted with a symmetric key shared between the plurality of key management servers associated with the first and second networks, wherein the rendezvous server does not possess the symmetric key.

12 . The at least one computer readable storage medium of claim 11 , further comprising instructions that when executed enable the system to:
receive, in the rendezvous server, the encrypted message from one or more of the plurality of second devices via the gateway server of the second network domain; and communicate, from the rendezvous server, the encrypted message to one or more of the plurality of first devices; wherein the encrypted message is encrypted with the at least one group key and the rendezvous server does not possess the at least one group key.

13 . The at least one computer readable storage medium of claim 2 , further comprising instructions that when executed enable the system to:
generate the first rendezvous point based at least in part on a hash of the plurality of key management server identifiers; and generate the second rendezvous point based at least in part on a hash of the plurality of gateway server identifiers.

14 . The at least one computer readable storage medium of claim 1 , further comprising instructions that when executed enable the system to:
receive, in the rendezvous server, a request for the at least one group key from one of the plurality of key management servers associated with the second network domain; and receive, in the rendezvous server, a reply to the request from one of the plurality of key management servers associated with the first network domain; wherein the reply includes the at least one group key and context indicating the at least one group key corresponds to cross domain device-to-device interactions.

15 . The at least one computer readable storage medium of claim 1 , further comprising instructions that when executed enable the system to receive, in the rendezvous server at the second rendezvous point, the encrypted message from one or more of the plurality of second devices; wherein the one or more of the plurality of second devices are constrained.

16 . The at least one computer readable storage medium of claim 1 , further comprising instructions that when executed:
receive, in the rendezvous server, a third registration message from a third registrar of a third network domain, the third registration message including a third device roster of a plurality of third devices of the third network domain; and generate the

Assignees

• Intel Corp

Inventors

• Smith Ned M
• Agerstam Mats G

Classifications

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L67/1063

  Discovery through centralising entities · CPC title

• H04W88/16

  Gateway arrangements · CPC title

• H04W76/023

  Electricity · mapped topic

• H04L63/061 Primary

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title