Systems, methods, and devices for device credential protection

Patent metadata

Field	Value
Publication number	US-2018123784-A1
Application number	US-201615565778-A
Country	US
Kind code	A1
Filing date	Apr 22, 2016
Priority date	Apr 24, 2015
Publication date	May 3, 2018
Grant date	—

Abstract

Systems, methods, and/or techniques may be disclosed to prevent credentials from being compromised during an attack or theft of Internet of Things (IoT) devices. Secure communications between IoT devices and a device management server may be managed. A group master key may be received at a local key generation unit or a particular IoT attached to a local area network. A first session group key may be generated at the local key generation unit or the particular IoT device using the received group master key and a sequence number. The first session group key may be sent from the local key generation unit to each of a plurality of IoT devices via the local area network.

First claim

1 - 22 . (canceled)

23 . An Internet of Things (IoT) device comprising:
a memory; and a processor, wherein the processor is configured to: receive a pre-shared key unique to the IoT device; receive a first session group key from a device associated with a same local network as the IoT device that was generated based on a group master key and a first sequence number, the first session group key being valid for a time interval; and send an encrypted message to a device management server (DMS) to establish a secure channel with the DMS, the encrypted message comprising an identifier comprising an indication of the first sequence number, the encrypted message being encrypted based on the first session group key and the pre-shared key.

24 . The IoT device of claim 23 , wherein the processor is configured to:
concatenate the first session group key and the pre-shared key; and encrypt the encrypted message as based on the concatenated keys.

25 . The IoT device of claim 23 , wherein the processor is configured to:
determine a combined key based on cryptographic processing involving the first session group key and the pre-shared key; and encrypt the encrypted message based on the combined key.

26 . The IoT device of claim 25 , wherein the cryptographic processing comprises a pseudorandom function (PRF).

27 . The IoT device of claim 23 , wherein the first session group key is valid if the first sequence number is within a range of sequence numbers and the session group key is invalid if the first sequence number is not within the range of sequence numbers.

28 . The IoT device of claim 23 , wherein the group master key is associated with a maximum number of session group keys.

29 . The IoT device of claim 28 , wherein the first session group key was generated based on the group master key for a specified range of sequence numbers.

30 . The IoT device of claim 23 , wherein the first sequence number is associated with a time interval during which the first session group key associated with the first sequence number is valid.

31 . The IoT device of claim 23 , wherein the processor is configured to receive a second session group key via the same local network, and wherein the second session group key is associated with a second sequence number.

32 . The IoT device of claim 23 , wherein the processor is further configured to receive, from the same local network, the first sequence number or an indication of the first sequence number.

33 . A device comprising:
a memory; and a processor configured to: receive a group master key; generate a first session group key based on the group master key and a sequence number, the first session group key being valid for a first time period; send the first session group key to an Internet of Things (IoT) device via a local network; update the sequence number; generate a second session group key based on the group master key and the updated sequence number, the second session group key being valid for a second time period; and send the second session group key to the IoT device via the local network.

34 . The device of claim 33 , wherein the processor is further configured to send an indication of the sequence number to the IoT device.

35 . The device of claim 33 , wherein the processor is further configured to:
on a condition that a maximum number of session group keys that can be generated based on the group master key is not exceeded, update the sequence number and generate the second session group key based on the group master key and the updated sequence number.

36 . A method of using an Internet of Things (IoT) device, comprising:
receiving a pre-shared key unique to the IoT device; receiving a first session group key from a device associated with a same local network as the IoT device that was generated based on a group master key and a first sequence number, the first session group key being valid for a time interval; and sending an encrypted message to a device management server (DMS) to establish a secure channel with the DMS, the encrypted message comprising an identifier comprising an indication of the first sequence number, the encrypted message being encrypted based on the first session group key and the pre-shared key.

37 . The method of claim 36 , further comprising concatenating the first session group key and the pre-shared key; and encrypting the encrypted message based on the concatenated keys.

38 . The method of claim 36 , wherein the first session group key is valid if the first sequence number is within a range of sequence numbers and the session group key is invalid if the first sequence number is not within the range of sequence numbers.

39 . The method of claim 36 , wherein the group master key is associated with a maximum number of session group keys.

40 . The method of claim 39 , wherein the first session group key was generated based on the group master key for a specified range of sequence numbers.

41 . The method of claim 36 , wherein the first sequence number is associated with a time interval during which the first session group key associated with the first sequence number is valid.

42 . The method of claim 36 , further comprising receiving a second session group key via the same local network, and wherein the second session group key is associated with a second sequence number.

Assignees

• Pcms Holdings Inc

Inventors

• Gehrmann Christian M

Classifications

• H04L9/30

  Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L9/0869

  involving random numbers or seeds · CPC title

• H04L9/14

  using a plurality of keys or algorithms · CPC title

• H04L9/0822 Primary

  using key encryption key · CPC title