Secure simple enrollment

摘要

Methods, systems, and apparatus are disclosed for generating one or more device identifiers based on a public key associated with a respective device. Various embodiments include condensing and/or hashing a device public key to generate the corresponding device identifier. By using the relationship between a device public key and its device identifier, public key exchanges are implemented to verify this relationship and facilitate device enrollment into one or more networks. The embodiments further describe enrolling one or more devices into networks and/or authorizing devices to enroll one more devices into networks based on public key exchanges and verification that the one or more device identifiers match the respective public keys. Embodiments for authorizing other devices describe a first device enrolling a second device in a first network and authorizing a third device to enroll the second device in a second network using an exchange of public keys and/or messages.

主权项

1. A method, comprising:
receiving, at a first device having a first public key, an identifier associated with the first device, the identifier received from a second device; receiving, at the first device, a second public key associated with the second device; generating, at the first device, a session key based on a combination of the first public key and the second public key; authenticating, at the first device, the second device using the session key; determining, at the first device, whether the identifier received from the second device corresponds to the first public key; and enrolling, using the first device, the second device in a network including the first device based on determining that the identifier received from the second device corresponds to the first public key.