System, apparatus and method for migrating a device having a platform group
View Patent ↗In one embodiment, an apparatus comprises a processor to execute instructions and having at least a first logic to execute in a trusted execution environment, a secure storage to store a platform group credential, and a first logical device comprising at least one hardware logic. The platform group credential may be dynamically provisioned into the apparatus and corresponding to an enhanced privacy identifier associated with the apparatus. The first logical device may have a first platform group private key dynamically provisioned into the first logical device and corresponding to an enhanced privacy identifier associated with the first logical device, to bind the first logical device to the apparatus. Other embodiments are described and claimed.
1. At least one non-transitory computer readable storage medium comprising instructions that when executed by a processor of a first Internet of Things (IoT) device, enable the first IoT device to:
receive, in a first logic of the first IoT device from a zone controller of a network, a dynamically provisioned first platform group key for the first IoT device;
store the first platform group key in a first storage of the first IoT device;
instantiate a first logical device in the first IoT device;
receive a dynamically provisioned first logical device platform group private key for the first logical device from the zone controller;
store the first logical device platform group private key in a second storage of the first IoT device, to bind the first logical device to the first IoT device;
receive, by the first IoT device, a request to migrate the first logical device from the first IoT device to a second IoT device having a dynamically provisioned second platform group key; and
remove the first logical device platform group private key from the second storage,
wherein each of the dynamically provisioned first and second platform group keys corresponds to an enhanced privacy-preserving identifier credential having group semantics.
2. The at least one non-transitory computer readable medium of claim 1 , further comprising instructions that when executed by the processor of the first IoT device, enable the first IoT device, responsive to the request, to:
encrypt a state of the first logical device; and
send the encrypted state of the first logical device to the second IoT device.
3. The at least one non-transitory computer readable medium of claim 2 , wherein the first platform group key remains in the first storage of the first IoT device after the first logical device migration.
4. The at least one non-transitory computer readable medium of claim 1 , further comprising instructions that when executed by the processor of the first IoT device, enable the first logical device to authenticate to the second IoT device using the first platform group key.
5. The at least one non-transitory computer readable medium of claim 4 , further comprising instructions that when executed by the processor of the first IoT device, enable the first logical device to use the first logical device platform group private key to sign a challenge from the second IoT device, to verify that the first logical device is of the first IoT device.
6. The at least one non-transitory computer readable medium of claim 1 , further comprising instructions that when executed by the processor of the first IoT device, enable the first IoT device to:
receive an encrypted image of a second logical device from the second IoT device;
isolate the encrypted image and establish a connection to the zone controller to cause the zone controller to generate a second logical device platform group private key for the second logical device; and
receive and store the second logical device platform group private key in the second storage of the first IoT device.
7. The at least one non-transitory computer readable medium of claim 6 , further comprising instructions that when executed by the processor of the first IoT device, enable the first IoT device to use the second logical device platform group private key and the first platform group key to authenticate the second logical device to a third IoT device.
8. The at least one non-transitory computer readable medium of claim 1 , wherein each of the dynamically provisioned first and second platform group keys corresponds to a respective Enhanced Privacy Identification (EPID) key.
9. An apparatus comprising:
a processor to execute instructions, the processor having at least a first hardware logic that executes in a trusted execution environment;
a secure storage to store a first platform group credential, the first platform group credential dynamically provisioned into the apparatus; and
a first logical device comprising at least one hardware logic, the first logical device having a first platform group private key, the first platform group private key dynamically provisioned into the first logical device and corresponding to an enhanced privacy identifier associated with the first logical device,
wherein the processor of the apparatus is configured to:
receive a request to migrate the first logical device from the apparatus to a second apparatus having a second platform group credential dynamically provisioned into the second apparatus; and
in response to the request, remove the first platform group private key of the first logical device, wherein each of the dynamically provisioned first and second platform group credentials corresponds to an enhanced privacy-preserving identifier credential having group semantics and respectively associated with the apparatus and the second apparatus.
10. The apparatus of claim 9 , wherein the first platform group private key is stored in a second secure storage associated with the first logical device.
11. The apparatus of claim 9 , wherein the first logical device is dynamically migratable to the second apparatus.
12. The apparatus of claim 11 , wherein the processor of the apparatus encrypts a state of the first logical device prior to migration of the first logical device to the second apparatus, the encrypted state of the first logical device not having the first platform group private key.
13. The apparatus of claim 9 , wherein the first platform group credential and the first platform group private key are different from a manufacturer enhanced privacy identifier associated with the apparatus by a manufacturer of the apparatus.
14. A method comprising:
receiving, in a first logic of a first Internet of Things (IoT) device from a zone controller of a network, a dynamically provisioned first platform group key for the first IoT device and storing the first platform group key in a first storage;
instantiating a first logical device in the first IoT device;
receiving a dynamically provisioned first logical device platform group private key for the first logical device from the zone controller and storing the first logical device platform group private key in a second storage, to bind the first logical device to the first IoT device;
receiving, by the first IoT device, a request to migrate the first logical device from the first IoT device to a second IoT device having a dynamically provisioned second platform group key; and
removing the first logical device platform group private key from the second storage,
wherein each of the dynamically provisioned first and second platform group keys corresponds to an enhanced privacy-preserving identifier credential having group semantics.
15. The method of claim 14 , further comprising, responsive to the request:
encrypting a state of the first logical device; and
sending the encrypted state of the first logical device to the second IoT device.
16. The method of claim 15 , wherein the first platform group key remains in the first storage after the first logical device migration.
17. The method of claim 14 , further comprising authenticating to the second IoT device using the first platform group key.
18. The method of claim 17 , wherein authenticating to the second IoT device comprises using the first logical device platform group private key to sign a challenge from the second IoT device, to verify that the first logical device is of the first IoT device.
19. The method of claim 14 , further comprising:
receiving, in the first IoT device, an encrypted image of a second logical device from the second IoT device;
isolating the encrypted image and establishing a connection to the zone controller to cause the zone controller to generate a second logical device platform group private key for the second logical device; and
receiving and storing the second logical device platform group private key in the second storage.
20. The method of claim 14 , wherein each of the dynamically provisioned first and second platform group keys corresponds to a respective Enhanced Privacy Identification (EPID) key.