M2M Module PKI Key Derivation and Pre-stored Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing M2M communication systems face challenges in securing and efficiently managing wireless module communications, particularly in conserving battery life and radio-frequency spectrum resources, while ensuring secure data transmission through public Internet protocols, especially when modules sleep for extended periods and need to re-establish secure tunnels.
Innovation Solution
The implementation of cryptographic algorithms within wireless modules and servers for secure key generation, authentication, and communication using asymmetric and symmetric ciphering, digital signatures, and secure hash functions, allowing for efficient and secure communication using public key infrastructure (PKI) standards like X.509 and elliptic curve cryptography, enabling modules to securely derive and update public and private keys without external intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Use of energy by moving object
If modules sleep for extended periods to conserve battery life, then energy consumption is reduced, but secure tunnels need to be re-established upon waking which increases complexity and time
Solution Approach 1:
The system performs preliminary actions by pre-generating and storing multiple certificate authorities and their corresponding public keys in the module's memory before sleep mode. When the module wakes up, it can immediately use these pre-stored credentials to re-establish secure connections without needing to perform complex key generation or authentication handshakes, thus resolving the contradiction between energy conservation and connection re-establishment complexity
Solution Approach 2:
The module is designed to autonomously manage its own cryptographic credentials by self-generating key pairs and self-registering with multiple certificate authorities while online. This self-service capability allows the module to independently re-establish secure tunnels using pre-configured credentials without external intervention, reducing the complexity of wake-up reconnection procedures
2Reliability
If traditional PKI authentication is used for each connection, then security is maintained, but energy consumption and bandwidth usage increase due to repeated handshakes
Solution Approach 1:
The system performs preliminary authentication by establishing trust relationships with multiple certificate authorities while the module is online and powered. These pre-established trust relationships are stored in the module's memory, allowing rapid re-authentication upon wake-up without repeating the full PKI handshake process, thus reducing energy consumption while maintaining security
Solution Approach 2:
The module periodically updates and refreshes its stored certificate authorities and public keys during online periods. This periodic maintenance ensures that the pre-configured credentials remain valid and secure, allowing the module to skip lengthy authentication handshakes during sleep-wake cycles while maintaining robust security through regularly updated credentials
3Extent of automation
If modules generate and update cryptographic keys independently, then external intervention is reduced and autonomy is increased, but key management complexity increases
Solution Approach 1:
The key management system is segmented into distinct functional components: key generation, key storage, key selection, and key rotation. Each component operates independently with well-defined interfaces, allowing the module to autonomously manage cryptographic keys through modular operations. This segmentation reduces overall complexity by making each individual task simpler while maintaining high automation capability
4Reliability
If secure tunnels are re-established after sleep periods, then communication security is maintained, but communication delay and loss of time occur
Solution Approach 1:
The system performs preliminary configuration by storing multiple certificate authorities and their public keys in the module's memory before entering sleep mode. When the module wakes up, it can immediately initiate secure communication using these pre-stored credentials, significantly reducing reconnection time while maintaining security through pre-validated authentication mechanisms
Solution Approach 2:
Multiple certificate authorities act as intermediaries that the module can contact for authentication. By pre-configuring multiple CA endpoints and their public keys, the module has redundant pathways for re-establishing secure connections, reducing dependency on any single authentication server and minimizing reconnection delays through failover capabilities
Data Source
AI summary
Methods and systems are provided for efficient and secure “Machine-to-Machine” (M2M) between modules and servers. A module can communicate with a server by accessing the Internet, and the module can include a sensor and/or actuator. The module and server can utilize public key infrastructure (PKI) such as public keys to encrypt messages. The module and server can use private keys to generate digital signatures for datagrams sent and decrypt messages received. The module can internally derive pairs of private/public keys using cryptographic algorithms and a set of parameters. A server can use a shared secret key to authenticate the submission of derived public keys with an associated module identity. For the very first submission of a public key derived the module, the shared secret key can comprise a pre-shared secret key which can be loaded into the module using a pre-shared secret key code.