SYSTEM AND METHOD FOR SECURE COMMUNICATIONS AMONG MULTIPLE DEVICES
There is described a building management system for secure communications among a mobile device, a sensor, and a remote server. The mobile device broadcasts a beacon that includes an obfuscated identification and a first ciphertext. The sensor receives the beacon from the mobile device, generates an identity-based key based on the obfuscated identification, determines a first plain text by decrypting the first ciphertext using the identity-based key, and performs a sensor function based on at least a portion of the first plain text. The remote server receives a message from the sensor that includes a second ciphertext based at least in part on the first plain text. The remote server also generates a real identity based on the obfuscated identification, determines a second plain text based on the second ciphertext, and performs a server function based on at least a portion of the second plain text.
1 . A building management system for secure communications among multiple devices, the system comprising:
a mobile device configured to broadcast a beacon, the beacon including an obfuscated identification and a first ciphertext;
a sensor configured to receive the beacon from the mobile device, generate an identity-based key based on the obfuscated identification, determine a first plain text by decrypting the first ciphertext using the identity-based key, and perform at least one sensor function based on at least a portion of the first plain text; and
a remote server configured to receive a message from the sensor, generate a real identity based on the obfuscated identification, determine a second plain text based on the second ciphertext, and perform at least one server function based on the real identity and at least a portion of the second plain text, wherein the message including a second ciphertext based at least in part on the first plain text.
2 . The building management system as described in claim 1 , wherein the message includes data originating from a plurality of beacons received by the sensor from the mobile device.
3 . The building management system as described in claim 1 , wherein:
the sensor determines the second plain text based in part on the first plain text, the second plain text being different from the first plain text; and
the sensor determines the second ciphertext based on the second plain text.
4 . The building management system as described in claim 1 , wherein the sensor applies a key derivation function to generate the identity-based key based on the obfuscated identification and a root key stored commonly at the mobile device and the sensor.
5 . The building management system as described in claim 1 , wherein each of the first plain text and the second plain text includes at least one of a sequence number, a battery status, a motion datum, or a telemetry datum.
6 . The building management system as described in claim 1 , wherein:
the sensor maps the obfuscated identification to a short identification;
the short identification is shorter than the obfuscated identification; and
the message includes at least one of the obfuscated identification or the short identification.
7 . A sensor of a building management system for secure communication from a mobile device to a remote server comprising:
a communication component configured to receive a beacon from the mobile device and transmit a message to the remote server, the beacon including an obfuscated identification and a first ciphertext, the message including a second ciphertext based at least in part on a plain text determined from the first ciphertext; and
a processor configured to generate an identity-based key based on the obfuscated identification, determine the plain text by decrypting the first ciphertext using the identity-based key, and perform at least one sensor function based on at least a portion of the plain text.
8 . The sensor as described in claim 7 , wherein the message includes data originating from a plurality of beacons received from the mobile device.
9 . The sensor as described in claim 7 , wherein:
the plain text is a first plain text;
the processor determines a second plain text based in part on the first plain text, the second plain text being different from the first plain text; and
the processor determines a second ciphertext based on the second plain text.
10 . The sensor as described in claim 7 , further comprising a memory component configured to store a root key, wherein the processor generates the identity-based key based on the obfuscated identification and the root key.
11 . The sensor as described in claim 7 , wherein the processor generates the identity-based key by applying a key derivation function to the obfuscated identification and the root key.
12 . The sensor as described in claim 7 , wherein the plain text includes at least one of a sequence number, a battery status, a motion datum, or a telemetry datum.
13 . The sensor as described in claim 7 , wherein:
the processor maps the obfuscated identification to a short identification;
the short identification is shorter than the obfuscated identification; and
the message includes at least one of the obfuscated identification or the short identification.
14 . A method of a sensor of a building management system for secure communication from a mobile device to a remote server, the method comprising:
receiving a beacon from the mobile device;
identifying an obfuscated identification and a first ciphertext from the beacon;
generating an identity-based key based on the obfuscated identification;
determining a plain text based on the first ciphertext, wherein determining the plain text includes decrypting the first ciphertext using the identity-based key;
performing at least one sensor function by the sensor based on at least a portion of the plain text; and
transmitting a message to the remote server, the message including a second ciphertext based at least in part on the plain text.
15 . The method as described in claim 14 , wherein the message includes data originating from a plurality of beacons received from the mobile device.
16 . The method as described in claim 14 , wherein the plain text is a first plain text and the method further comprises:
determining a second plain text based in part on the first plain text, the second plain text being different from the first plain text; and
determining the second ciphertext based on the second plain text.
17 . The method as described in claim 14 , wherein generating the identity-based key includes generating the identity-based key based on the obfuscated identification and a root key stored at the sensor.
18 . The method as described in claim 14 , wherein generating the identity-based key includes applying a key derivation function to the obfuscated identification and the root key.
19 . The method as described in claim 14 , wherein the plain text includes at least one of a sequence number, a battery status, a motion datum, or a telemetry datum.
20 . The method as described in claim 14 , further comprising mapping the obfuscated identification to a short identification, wherein:
the short identification is shorter than the obfuscated identification, and
the message includes at least one of the obfuscated identification or the short identification.