Systems and methods for secure roll-over of device ownership
Systems, methods, and/or techniques for transferring ownership or rolling-over machine-to-machine (M2M) and/or internet of things (IoT) devices from a first owner to a second owner may be disclosed. For example, at a M2M and/or IoT device, a roll-over token and/or a message with the roll-over token may be received. The roll-over token may be configured to be used to transfer ownership and/or update credentials, and/or the roll-over token may be configured to be requested by a first device management server (DMS) associated with the first owner and/or may be generated by a reset server (RS), for example, in response to the request by the first DMS. A validity of the roll-over token may be checked or determined.
1. A method for transferring control of a machine-to-machine (M2M) device from a first device management server (DMS) to a second DMS, based on authorization from a reset server, the method comprising:
storing, in the M2M device, a reset credential from the reset server for validating a roll-over token generated by the reset server;
receiving, in the M2M device, from the reset server, the roll-over token, wherein the M2M device receives the roll-over token directly from the reset server or from the reset server via the first DMS;
determining, in the M2M device, a validity of the roll-over token based on the stored reset credential, wherein the validity determination includes the M2M device checking a Message Authentication Code (MAC) or a digital signature;
extracting, in the M2M device, from the roll-over token, a uniform resource identifier (URI) for the second DMS;
establishing a connection from the M2M device to the second DMS based on the extracted URI;
storing, in the M2M device, a second DMS credential and deleting a first DMS credential associated with the first DMS; and
establishing a secure connection with the second DMS based on the second DMS credential.
2. The method of claim 1 , wherein the roll-over token is generated by the reset server in response to a request from one of the first DMS and the second DMS.
3. The method of claim 1 , further comprising one of extracting the second DMS credential from the roll-over token and receiving the second DMS credential from the second DMS.
4. The method of claim 1 , wherein the roll-over token comprises a secure key.
5. The method of claim 4 , wherein the secure key comprises symmetric key-based credentials or public key-based credentials.
6. The method of claim 1 , further comprising decrypting the roll-over token.
7. The method of claim 1 , further comprising performing a mutual authentication between the M2M device and the second DMS before establishing a secure connection with the second DMS.
8. The method of claim 7 , further comprising establishing a secure channel with the second DMS based on the first DMS credential before establishing the secure connection with the second DMS.
9. The method of claim 7 , further comprising establishing a secure channel with the second DMS based on a temporary DMS credential before establishing the secure connection with the second DMS.
10. The method of claim 7 , wherein the mutual authentication and secure channel between the second DMS and the M2M device is established based on an M2M device key and a symmetric key.
11. A machine-to-machine (M2M) device that can transfer control of the M2M device from a first device management server (DMS) to a second DMS, based on authorization from a reset server, comprising:
a memory configured to store a reset credential for validation of a roll-over token generated by the reset server;
a processor configured to:
store, in the M2M device, the reset credential, wherein the reset credential is received in the M2M device from the reset server;
receive, in the M2M device, from the reset server, the roll-over token, wherein the M2M device receives the roll-over token directly from the reset server or from the reset server via the first DMS;
determine, in the M2M device, a validity of the roll-over token based on the stored reset credential, wherein the validity determination includes the M2M device checking a Message Authentication Code (MAC) or a digital signature;
extract, in the M2M device, from the roll-over token, a uniform resource identifier (URI) for the second DMS;
establish a connection from the M2M device to the second DMS based on the extracted URI;
store, in the M2M device memory, a second DMS credential and delete a first DMS credential associated with the first DMS; and
establish a secure connection with the second DMS based on the second DMS credential.
12. The M2M device of claim 11 , wherein the received roll-over token was generated by the reset server in response to a request from one of the first DMS and the second DMS.
13. The M2M device of claim 11 , wherein the processor is further configured to either extract the second DMS credential from the roll-over token or receive the second DMS credential from the second DMS.
14. The M2M device of claim 11 , wherein the roll-over token comprises a secure key.
15. The M2M device of claim 14 , wherein the secure key comprises symmetric key-based credentials or public key-based credentials.
16. The M2M device claim 11 , wherein the processor is further configured to decrypt the roll-over token.
17. The M2M device of claim 11 , wherein the processor is further configured to perform a mutual authentication between the M2M device and the second DMS before establishing a secure connection with the second DMS.
18. The M2M device of claim 17 , wherein the processor is further configured to establish the mutual authentication and secure channel between the second DMS and the M2M device based on an M2M device key and a symmetric key.
19. The M2M device of claim 17 , wherein the processor is further configured to establish a secure channel with the second DMS based on the first DMS credential before establishing the secure connection with the second DMS.
20. The M2M device of claim 17 , wherein the processor is further configured to establish a secure channel with the second DMS based on a temporary DMS credential before establishing the secure connection with the second DMS.