Systems and methods for “machine-to-machine” (M2M) communications between modules, servers, and an application using public key infrastructure (PKI)
Methods and systems are provided for supporting efficient and secure “Machine-to-Machine” (M2M) communications using a module, a server, and an application. A module can communicate with the server by accessing the Internet, and the module can include a sensor and/or an actuator. The module, server, and application can utilize public key infrastructure (PKI) such as public keys and private keys. The module can internally derive pairs of private/public keys using cryptographic algorithms and a first set of parameters. A server can authenticate the submission of derived public keys and an associated module identity. The server can use a first server private key and a second set of parameters to (i) send module data to the application and (ii) receive module instructions from the application. The server can use a second server private key and the first set of parameters to communicate with the module.
1. A method for supporting secure machine-to-machine communications, comprising:
(a) receiving, at a server, a first message from a user module, the first message including:
(i) a module identity string associated with the user module, and
(ii) a temporary module public key that was generated at the user module along with a temporary module private key;
(b) providing a server public key corresponding to a server private key;
(c) generating, by the server, a first common derived shared secret key using Diffie-Hellman based on at least:
(i) the temporary module public key;
(ii) the server private key;
wherein the first common derived shared secret key can be generated using Diffie-Hellman by the module based on at least:
(i) the temporary module private key associated with the temporary module public key; and
(ii) the server public key associated with the server private key;
(d) receiving, at the server, a second message from the user module, wherein the second message includes a module identity, which is associated with but different from the module identity string, and wherein the module identity is decrypted with the first common derived shared secret key;
(e) authenticating, at the server, the user module based at least on the module identity;
(f) receiving, from the user module at the server, a token with first encrypted data using a second common derived shared secret key;
(g) generating, at the server, the second common derived shared secret key; and
(h) decrypting the first encrypted data using the second common derived shared secret key.
2. The method of claim 1 , wherein the server includes a set of cryptographic algorithms and a key derivation function to derive the first common derived shared secret key.
3. The method of claim 2 , wherein the set of cryptographic parameters includes at least one of (x) an elliptic curve (ECC) named curve, or (y) an ECC function.
4. The method of claim 1 , wherein the server includes a set of cryptographic algorithms and a key derivation function to derive the second common derived shared secret key.
5. The method of claim 4 , wherein the set of cryptographic parameters includes at least one of (x) an elliptic curve (ECC) named curve, or (y) an ECC function.
6. The method of claim 1 , wherein the server includes a set of cryptographic algorithms including a key pair generation algorithm, and wherein the server uses (i) the key pair generation algorithm and (ii) a set of cryptographic parameters for the module public key in order to derive the first server public key and the first server private key.
7. The method of claim 1 , wherein the module identity string in the first message comprises a first string, wherein the module identity in the second message comprise a second string and wherein the first string and the second string are associated with a serial number of a module.
8. The method of claim 1 , wherein the first message comprises a series of transmissions received at the server.
9. The method of claim 1 , wherein the second message comprises a series of transmissions received at the server.