Security management for net worked client devices using a distributed ledger service
A system and method for managing a plurality of network-enabled client devices such as Internet of Things (IoT) and smart devices employs a distributed ledger or blockchain to store security-related information for each client device. Access to the distributed ledger is provided through a proxy computing system that is configured to exchange security-related messages with the client devices over a first communication path, which may be over a public network; and to engage in transactions with or query the distributed ledger on behalf of the client devices over a second communication path, which is a private channel Vendible data published by the client devices may be routed by the proxy computing system to a data broker or publishing system in a manner that removes identifying information from the vendible data.
1. A system for managing a plurality of network-enabled devices, comprising:
a distributed ledger computing system comprising processor devices configured to maintain a distributed ledger for storing security-related information for the plurality of network-enabled devices;
a proxy computing system comprising at least one processor device configured to exchange security-related messages with the plurality of network-enabled devices over a first communication path to engage in transactions or call functions with the distributed ledger on behalf of the network-enabled device over a different second communication path,
wherein the distributed ledger computing system comprises a repository storing a copy of the distributed ledger, the copy of the distributed ledger being updated when a change is made to the distributed ledger; and
wherein the at least one processor device of the proxy computing system is further configured to access the copy of the distributed ledger over a third communication path distinct from the second communication path, and to further:
receive, from a network-enabled device of the plurality of network-enabled devices over the first communication path, a security-related request,
generate a transaction or a function call for the distributed ledger, the transaction including a unique identifier of the network-enabled device;
transmit the transaction or function call to the distributed ledger computing system for execution on the distributed ledger over the second communication path; and
retrieve, from the copy of the distributed ledger over the third communication path, security-related information for transmission to the network-enabled device of the plurality of network-enabled devices in response to the security-related request.
2. The system of claim 1 , wherein the distributed ledger stores associations between unique identifiers defined for the plurality of network-enabled devices and corresponding encryption keys.
3. The system of claim 1 , wherein the distributed ledger stores at least one of:
pairing associations between network-enabled devices, and
associations between administrator devices and network-enabled devices.
4. The system of claim 1 , wherein the proxy computing system is further configured to receive an output from the distributed ledger computing system in response to the executed transaction or function.
5. The system of claim 1 , wherein the transaction or function call comprises a transaction adding a pairing association between the network-enabled device and a second network-enabled client device, and the security-related information retrieved from the copy of the distributed ledger comprises a public key for the second network-enabled device.
6. The system of claim 1 , further comprising the plurality of network-enabled devices.
7. The system of claim 6 , wherein each network-enabled device is configured to self-generate a unique identifier for identifying the network-enabled device in the distributed ledger.
8. The system of claim 1 , wherein the security-related request from the network-enabled device received over the first communication path comprises a request to register the network-enabled device on the distributed ledger.
9. The system of claim 1 , wherein the distributed ledger stores associations between administrator devices and network-enabled devices, the at least one processor of the proxy computing system being further configured to:
receive a request to add a device as an administrator device for a designated network-enabled device;
verify addition of the administrator device for the designated network-enabled device; and
initiate a transaction or function call to add a record to the distributed ledger associating the device as an administrator device for the designated network-enabled device.
10. The system of claim 1 , wherein the at least one processor of the proxy computing system is further configured to:
receive a request to add a user computing device as a user device for a designated network-enabled device;
determine that the request is authorized by an administrator associated with the designated network-enabled device; and
execute a transaction or function call to add a record to the distributed ledger associating the user computing device as a user device for the designated network-enabled device.
11. A method for managing a plurality of network-enabled devices, comprising:
maintaining, by a distributed ledger computing system, a distributed ledger for storing security-related information for a plurality of network-enabled devices;
a proxy computing system exchanging security-related messages with a plurality of network-enabled devices over a first communication path;
the proxy computing system transmitting, over a different second communication path and on behalf of the plurality of network-enabled devices, transactions or calls of functions for a distributed ledger storing security-related information for the plurality of network-enabled devices,
wherein the distributed ledger computing system comprises a repository storing a copy of the distributed ledger, the copy of the distributed ledger being updated when a change is made to the distributed ledger, the method further comprising:
the proxy computing system accessing the copy of the distributed ledger over a third communication path distinct from the second communication path;
the proxy computing system receiving, from a network-enabled device of the plurality of network-enabled devices over the first communication path, a security-related request;
the proxy computing system generating a transaction or a function call for the distributed ledger, the transaction including a unique identifier of the network-enabled device;
the proxy computing system transmitting the transaction or function call to the distributed ledger computing system for execution on the distributed ledger over the second communication path; and
the proxy computing system retrieving, from the copy of the distributed ledger over the third communication path, security-related information for transmission to the network-enabled device of the plurality of network-enabled devices in response to the security-related request.
12. The method of claim 11 , wherein the distributed ledger stores associations between unique identifiers defined for the plurality of network-enabled devices and corresponding encryption keys.
13. The method of claim 11 , wherein the distributed ledger stores at least one of:
pairing associations between network-enabled devices, and
associations between administrator devices and network-enabled devices.
14. The method of claim 11 , further comprising the proxy computing system receiving an output from the distributed ledger computing system in response to the executed transaction or function.
15. The method of claim 11 , wherein the transaction or function call comprises a transaction adding a pairing association between the network-enabled device and a second network-enabled device, and the security-related information retrieved from the copy of the distributed ledger comprises a public key for the second network-enabled v device.
16. The method of claim 11 , wherein each network-enabled device is configured to self-generate a unique identifier for identifying the network-enabled device in the distributed ledger.
17. The method of claim 11 , wherein the security-related request from the network-enabled device received over the first communication path comprises a request to register the network-enabled device on the distributed ledger.
18. The method of claim 11 , wherein the distributed ledger stores associations between administrator devices and network-enabled devices, the method further comprising the proxy computing system:
receiving a request to add a device as an administrator device for a designated network-enabled device;
verifying addition of the administrator device for the designated network-enabled device; and
initiating a transaction or function call to add a record to the distributed ledger associating the device as an administrator device for the designated network-enabled device.
19. The method of claim 11 , further comprising the proxy computing system:
receiving a request to add a user computing device as a user device for a designated network-enabled device;
determining that the request is authorized by an administrator associated with the designated network-enabled device; and
executing a transaction or function call to add a record to the distributed ledger associating the user computing device as a user device for the designated network-enabled device.