Method and apparatus for providing secure communication among constrained devices

1. A method for secure communication between constrained devices comprising:

issuing, by an authorization server, cryptographic communication rights among a plurality of constrained devices where each of the plurality of constrained devices comprises no more than one cryptographic algorithm code module per cryptographic function the cryptographic function including one of data encryption, key encryption, data signature generation, key agreement and data digests;

receiving, by the authorization server, a cryptographic communication rights request associated with at least a first of the plurality of constrained devices in response to a cryptographic algorithm update request that requests a replacement cryptographic code module update for an identified constrained device, the cryptographic communication rights request issued by one of a software update server in response to the software update server receiving the cryptographic algorithm update request and a network management device in response to the network management device receiving the cryptographic algorithm update request;

providing, by the authorization server, a response to the cryptographic communication rights request that requests the replacement cryptographic code module update, comprising an identification of a subset of the plurality of constrained devices that have cryptographic communication rights in common with the identified first of the plurality of constrained devices;

issuing the cryptographic communication rights request by a software update server in response to the software update server receiving the cryptographic algorithm update request;

suspending, by a network management device, the identified constrained device network management in response to the request for the replacement cryptographic code module update for the identified constrained device;

provisioning, by a software update server, a replacement cryptographic code module, in response to the cryptographic algorithm update request, to the subset of the plurality of constrained devices that have cryptographic communication rights with the identified first of the plurality of constrained devices, wherein the replacement cryptographic code module comprises at least one of: a data encryption code module, a key encryption code module, a data signature code module, a key agreement code module and a data digest code module; and

lifting, by the network management device, the suspension of the identified constrained device network management in response to the provisioning of the replacement cryptographic code module update for the identified constrained device.

2. The method of claim 1 wherein providing, by the authorization server, the response comprising the identification of the subset of the plurality of constrained devices that have cryptographic communication rights comprises determining which of the plurality of constrained devices have cryptographic communication rights with the identified first constrained device based on authorized communication rights authorized by the authorization server.

3. The method of claim 1 wherein issuing, by the authorization server, cryptographic communication rights among the plurality of constrained devices comprises issuing asymmetric key based configuration certificates or symmetric key based ticket to the plurality of constrained devices wherein the configuration certificates assign communication rights to each of the plurality of constrained devices to allow the plurality of constrained devices to cryptographically exchange information between the plurality of constrained devices.

4. The method of claim 1 comprising issuing the cryptographic communication rights request by a software update server in response to the software update server receiving the cryptographic algorithm update request.

5. The method of claim 1 comprising issuing the cryptographic communication rights request by a network management device in response to the network management device receiving the cryptographic algorithm update request.

6. A system comprising:

a plurality of constrained devices;

an authorization server, operatively coupled to the plurality of constrained devices, comprising logic operative to:

issue cryptographic communication rights among the plurality of constrained devices where each of the plurality of constrained devices comprises no more than one cryptographic algorithm code module per cryptographic function, the cryptographic function including one of data encryption, key encryption, data signature generation, key agreement and data digests;

receive a cryptographic communication rights request associated with at least a first of the plurality of constrained devices in response to a cryptographic algorithm update request that requests a replacement cryptographic code module update for an identified constrained device, the cryptographic communication rights request issued by one of a software update server in response to the software update server receiving the cryptographic algorithm update request and a network management device in response to the network management device receiving the cryptographic algorithm update request; and

provide a response to the cryptographic communication rights request that requests the replacement cryptographic code module update, comprising an identification of a subset of the plurality of constrained devices that have cryptographic communication rights in common with the identified first of the plurality of constrained devices; and

a software update server, operatively coupled to the plurality of constrained devices and to the authorization server, comprising logic operative to issue the cryptographic communication rights request in response to the software update server receiving the cryptographic algorithm update request;

suspending, by a network management device, the identified constrained device network management in response to the request for the replacement cryptographic code module update for the identified constrained device,

provisioning, by the software update server, a replacement cryptographic code module, in response to the cryptographic algorithm update request, to the subset of the plurality of constrained devices that have cryptographic communication rights with the identified first of the plurality of constrained devices, wherein the replacement cryptographic code module comprises at least one of: a data encryption code module, a key encryption code module, a data signature code module, a key agreement code module and a data digest code module; and

lifting, by the network management device, the suspension of the identified constrained device network management in response to the provisioning of the replacement cryptographic code module update for the identified constrained device.

7. The system of claim 6 wherein providing, by the authorization server, the response comprising the identification of the subset of the plurality of constrained devices that have cryptographic communication rights comprises determining which of the plurality of constrained devices have cryptographic communication rights with the identified first constrained device based on authorized communication rights authorized by the authorization server.

8. The system of claim 6 wherein issuing, by the authorization server, cryptographic communication rights among the plurality of constrained devices comprises issuing asymmetric key based configuration certificates or symmetric key based ticket to the plurality of constrained devices wherein the configuration certificates assign communication rights to each of the plurality of constrained devices to allow the plurality of constrained devices to cryptographically exchange information between the plurality of constrained devices.

9. The system of claim 6 comprising issuing the cryptographic communication rights request by the software update server in response to the software update server receiving the cryptographic algorithm update request.

10. The system of claim 6 comprising issuing the cryptographic communication rights request by the network management device in response to the network management device receiving the cryptographic algorithm update request.

11. A non-transitory storage medium that stores executable instructions that when executed by one or more processors causes the one or more processors to:

issue cryptographic communication rights among a plurality of constrained devices where each of the plurality of constrained devices comprises no more than one cryptographic algorithm code module per cryptographic function the cryptographic function including one of data encryption, key encryption, data signature generation, key agreement and data digests;

receive a cryptographic communication rights request associated with at least a first of the plurality of constrained devices in response to a cryptographic algorithm update request that requests a replacement cryptographic code module update for an identified constrained device, the cryptographic communication rights request issued by one of a software update server in response to the software update server receiving the cryptographic algorithm update request and a network management device in response to the network management device receiving the cryptographic algorithm update request;

provide a response to the cryptographic communication rights request that requests the replacement cryptographic code module update, comprising an identification of a subset of the plurality of constrained devices that have cryptographic communication rights in common with the identified first of the plurality of constrained devices; and

issuing the cryptographic communication rights request by a software update server in response to the software update server receiving the cryptographic algorithm update request;

suspend the identified constrained device network management in response to the request for the replacement cryptographic code module update for the identified constrained device;

provision a replacement cryptographic code module, in response to the cryptographic algorithm update request, to the subset of the plurality of constrained devices that have cryptographic communication rights with the identified first of the plurality of constrained devices, wherein the replacement cryptographic code module comprises at least one of: a data encryption code module, a key encryption code module, a data signature code module, a key agreement code module and a data digest code module; and

lift the suspension of the identified constrained device network management in response to the provisioning of the replacement cryptographic code module update for the identified constrained device.

12. The non-transitory storage medium of claim 11 comprising executable instructions that when executed by the one or more processors causes the one or more processors to:

provide the response comprising the identification of the subset of the plurality of constrained devices that have cryptographic communication rights and comprises determining which of the plurality of constrained devices have cryptographic communication rights with the identified first constrained device based on authorized communication rights authorized by an authorization server.

13. The non-transitory storage medium of claim 11 comprising executable instructions that when executed by the one or more processors causes the one or more processors to:

issue cryptographic communication rights among the plurality of constrained devices by issuing asymmetric key based configuration certificates or symmetric key based ticket to the plurality of constrained devices wherein the configuration certificates assign communication rights to each of the plurality of constrained devices to allow the plurality of constrained devices to cryptographically exchange information between the plurality of constrained devices.

14. The non-transitory storage medium of claim 11 comprising executable instructions that when executed by the one or more processors causes the one or more processors to:

issue the cryptographic communication rights request by a software update server in response to the software update server receiving the cryptographic algorithm update request.

15. The non-transitory storage medium of claim 11 comprising executable instructions that when executed by the one or more processors causes the one or more processors to:

issue the cryptographic communication rights request by a network management device in response to the network management device receiving the cryptographic algorithm update request.