Secure PKI communications for “machine-to-machine” modules, including key derivation by modules and authenticating public keys

摘要

Methods and systems are provided for efficient and secure “Machine-to-Machine” (M2M) between modules and servers. A module can communicate with a server by accessing the Internet, and the module can include a sensor and/or actuator. The module and server can utilize public key infrastructure (PKI) such as public keys to encrypt messages. The module and server can use private keys to generate digital signatures for datagrams sent and decrypt messages received. The module can internally derive pairs of private/public keys using cryptographic algorithms and a set of parameters. A server can use a shared secret key to authenticate the submission of derived public keys with an associated module identity. For the very first submission of a public key derived the module, the shared secret key can comprise a pre-shared secret key which can be loaded into the module using a pre-shared secret key code.

主权项

1. A method for a hardware module with a radio to use a public key and a private key, the method performed by the hardware module, the method comprising:
receiving a set of parameters, wherein the set of parameters includes a value for an elliptic curve and a key length; deriving the private key and the public key using a key pair generation algorithm with the received set of parameters, wherein the hardware module records the derived private key in a nonvolatile memory, wherein the derived private key is used at least, in part, for processing a module digital signature, and wherein the hardware module authenticates with the module digital signature; reading (i) a module identity using a read-only address in the hardware module, and (ii) a shared secret key from the nonvolatile memory; transmitting via the radio a first message, wherein the first message includes the derived public key, a module public key identity and the module identity, and wherein the hardware module uses the shared secret key to authenticate the first message; transmitting via the radio a second message from an interne protocol address and port (IP:port) number, wherein the second message includes a module encrypted data, the module identity, and the module digital signature, wherein the module encrypted data (i) is ciphered using an asymmetric ciphering algorithm and (ii) includes a value for a symmetric key, and wherein the module digital signature is processed using the derived private key; and, receiving via the radio a response at the IP:port number, wherein the response includes a server encrypted data, and wherein the server encrypted data includes a module instruction, and wherein the server encrypted data is decrypted using the symmetric key.