Secure pairing mechanism in a wireless communication system
A novel and useful mechanism for providing security features to a wireless communications system that otherwise does not have such features. Security features including encryption and decryption of communications, secure key exchange, secure pairing, and secure re-pairing are provided. The invention is applicable to wireless communication systems such as IO-Link Wireless. The encryption/decryption mechanism uses AES-256 block cypher with counter mode to generate blocks of cypher bits used to encrypt and decrypt communications between the master and devices. Session keys are generated using a random salt and a counter value. The random salt is generated using a secure random number generator such as the CSPRNG algorithm. A master key (or device key) is also used in generating session keys. Session keys are not permanent and are used to encrypt/decrypt only a finite amount of data. Once exhausted, the session key is replaced by a new one and cypher bits are generated using the new session key. A synchronized key jump procedure ensures that the master and device switch to the new session key at the same time.
1. A method of secure initial pairing between a master and a device in a wireless communications network, the method comprising:
utilizing a key agreement protocol on said master and said device to generate a private key and a public key on both said master and said device;
said master and said device exchanging their respective public keys in plaintext over a wireless communications link;
generating on both said master and said device a shared session key;
obtaining a master key and transmitting said master key to said device encrypted using said shared session key; and
obtaining and/or retrieving a device key and transmitting said device key to said master encrypted using said shared session key.
2. The method according to claim 1 , wherein said key agreement protocol comprises an elliptic-curve Diffie-Helman (ECDH) key agreement protocol.
3. The method according to claim 1 , wherein said shared session key is generated using one or more iterations of a secure hash algorithm (SHA) algorithm.
4. The method according to claim 1 , further comprising:
receiving, on said device, said encrypted master key transmitted over said wireless communications link;
decrypting said encrypted master key utilizing said shared session key; and
storing said master key on said device.
5. The method according to claim 1 , further comprising:
receiving, on said master, said encrypted device key transmitted over said wireless communications link;
decrypting said encrypted device key utilizing said shared session key; and
storing said device key on said master.
6. The method according to claim 1 , wherein said method of secure initial pairing is performed separately between each device in said wireless communications network and said master.
7. A method of secure re-pairing between a master and a device in a wireless communications network, the method comprising:
generating a salt on said master and transmitting said salt to said device;
generating a shared session key on both said master and said device utilizing said salt and a device key previously known to both said master and said device; and
retrieving and transmitting a master key to said device encrypted using said shared session key.
8. The method according to claim 7 , wherein said shared session key is generated using one or more iterations of a secure hash algorithm (SHA) algorithm.
9. The method according to claim 7 , further comprising:
receiving, on said device, said encrypted master key transmitted over said wireless communications link;
decrypting said encrypted master key utilizing said shared session key; and
storing said master key on said device.
10. The method according to claim 7 , wherein said method of secure re-pairing is performed separately as needed between each device in said wireless communications network and said master.
11. The method according to claim 7 , wherein said salt comprises a random number.
12. A method of secure pairing between a master and a device in a wireless communications network, the method comprising:
utilizing a key agreement protocol on said master and said device to generate a private key and a public key on both said master and said device;
said master and said device exchanging their respective public keys in plaintext over a wireless communications link;
generating a device key on both said master and said device;
generating a salt on said master and transmitting said salt to said device;
generating a shared session key on both said master and said device utilizing said salt and said device key; and
generating a master key and transmitting said master key to said device encrypted using said shared session key.
13. The method according to claim 12 , wherein said key agreement protocol comprises an elliptic-curve Diffie-Helman (ECDH) key agreement protocol.
14. The method according to claim 12 , wherein said shared session key is generated utilizing one or more iterations of a secure hash algorithm (SHA) algorithm.
15. The method according to claim 12 , further comprising:
receiving, on said device, said encrypted master key transmitted over said wireless communications link;
decrypting said encrypted master key utilizing said shared session key; and
storing said master key on said device.
16. The method according to claim 12 , wherein said method of secure pairing is performed separately between each device in said wireless communications network and said master.
17. An apparatus for secure pairing between a master and a device in a wireless communications network, comprising:
a frequency hopping radio transmitter;
a frequency hopping radio receiver;
a processor coupled to and operative to control said frequency hopping radio transmitter and said frequency hopping radio receiver;
said processor programmed to:
utilize a key agreement protocol to generate a private key and a public key;
transmit said public key in plaintext to said device over a wireless communications link;
generate a shared session key;
generate and/or retrieve a master key and transmit said master key to said device encrypted using said shared session key; and
receive and decrypt an encrypted device key received from said device utilizing said shared session key.
18. The apparatus according to claim 17 , wherein said radio transmitter and said radio receiver are configured to conform to the IO-Link Wireless standard.
19. An apparatus for secure pairing between a device and master in a wireless communications network, comprising:
a frequency hopping radio transmitter;
a frequency hopping radio receiver;
a processor coupled to and operative to control said frequency hopping radio transmitter and said frequency hopping radio receiver;
said processor programmed to:
utilize a key agreement protocol to generate a private key and a public key;
transmit said public key in plaintext to said master over a wireless communications link;
generate a shared session key;
obtain a device key and transmit said device key to said master encrypted using said shared session key; and
receive and decrypt an encrypted master key received from said master utilizing said shared session key.
20. The apparatus according to claim 19 , wherein said radio transmitter and said radio receiver are configured to conform to the IO-Link Wireless standard.