Set of servers for “machine-to-machine” communications using public key infrastructure
A set of servers can support secure and efficient “Machine to Machine” communications using an application interface and a module controller. The set of servers can record data for a plurality of modules in a shared module database. The set of servers can (i) access the Internet to communicate with a module using a module identity, (i) receive server instructions, and (iii) send module instructions. Data can be encrypted and decrypted using a set of cryptographic algorithms and a set of cryptographic parameters. The set of servers can (i) receive a module public key with a module identity, (ii) authenticate the module public key, and (iii) receive a subsequent series of module public keys derived by the module with a module identity. The application interface can use a first server private key and the module controller can use a second server private key.
1. A method to support secure machine to machine communications, the method performed by a server, the method comprising:
a) storing, by the server, (i) a key derivation function, wherein the key derivation function uses an elliptic curve Diffie-Hellman (ECDH) algorithm, and (ii) a symmetric ciphering algorithm;
b) deriving, by the server, a server private key and a first server public key using cryptographic parameters;
c) receiving, by the server, a message from a user module, wherein the message includes (i) a module public key, and (ii) the cryptographic parameters for the module public key, wherein the cryptographic parameters include an elliptic curve;
d) deriving a shared symmetric key, by the server using the key derivation function which utilizes:
(i) the first server public key and the module public key, and
(ii) a key exchange for the ECDH algorithm including
(1) the server private key and
(2) the cryptographic parameters;
e) encrypting, by the server utilizing the shared symmetric key and the symmetric ciphering algorithm:
(i) a module instruction which includes a second server public key, and
(ii) a server digital signature generated by the server,
to generate server encrypted data; and
f) sending, by the server, a response including the server encrypted data to the user module,
wherein the server encrypted data is decrypted by the user module using the shared symmetric key derived by the user module to provide the second server public key and the server digital signature, and
wherein the server digital signature is verified by the user module to confirm an identity of the server.
2. The method of claim 1 , wherein the cryptographic parameters further specify a base point G.
3. The method of claim 1 , wherein the response further includes a security token comprising a random number, and wherein the message further includes the security token.
4. The method of claim 1 , wherein the server encrypted data further includes the identity of the server.
5. The method of claim 1 , wherein the server digital signature further comprises a secure hash signature of at least the identity of the server.
6. The method of claim 1 , wherein the message further includes module identification information comprising a session identifier.
7. The method of claim 1 , wherein the module public key and a corresponding module private key are derived by the user module using the cryptographic parameters and the elliptic curve.
8. The method of claim 7 , wherein the symmetric ciphering key is mutually derived by the user module using (i) the ECDH algorithm with at least the module private key and the first server public key, and (ii) the module public key.
9. The method of claim 7 , wherein the module public key and the corresponding module private key are derived by the user module using a seed for a random number generator, wherein the user module utilizes data from at least one of a sensor, a radio, a bus, a physical interface, a memory and a clock in order to generate the seed.
10. A non-transitory computer program product comprising instructions to support secure machine to machine communications, wherein the instructions, when executed by a server, cause the server to carry out the steps of:
a) storing (i) a key derivation function, wherein the key derivation function uses an elliptic curve Diffie-Hellman (ECDH) algorithm, and (ii) a symmetric ciphering algorithm;
b) deriving a server private key and a first server public key using cryptographic parameters;
c) receiving a message from a user module, wherein the message includes (i) a module public key, and (ii) the cryptographic parameters for the module public key, wherein the cryptographic parameters include an elliptic curve;
d) deriving a shared symmetric key using the key derivation function which utilizes:
(i) the first server public key and the module public key, and
(ii) a key exchange for the ECDH algorithm including
(1) the server private key and
(2) the cryptographic parameters;
e) encrypting by the server utilizing the shared symmetric key and the symmetric ciphering algorithm:
(i) a module instruction which includes a second server public key, and
(ii) a server digital signature generated by the server,
to generate server encrypted data; and
f) sending a response including the server encrypted data to the user module,
wherein the server encrypted data is decrypted by the user module using the shared symmetric key derived by the user module to provide the second server public key and the server digital signature generated by the server, and
wherein the user module uses the server digital signature generated by the server to verify an identity of the server.
11. The computer program product of claim 10 , wherein the cryptographic parameters further specify a base point G.
12. The computer program product of claim 10 , wherein the response further includes a security token comprising a random number, and wherein the message further includes the security token.
13. The computer program product of claim 10 , wherein the server encrypted data further includes the identity of the server.
14. The computer program product of claim 10 , wherein the server digital signature further comprises a secure hash signature of at least the identity of the server identity.
15. The computer program product of claim 10 , wherein the message further includes module identification information comprising a session identifier.
16. The computer program product of claim 10 , wherein the module public key and a corresponding module private key are derived by the user module using the cryptographic parameters and the elliptic curve.
17. The computer program product of claim 16 , wherein the symmetric ciphering key is mutually derived by the user module using (i) the ECDH algorithm with at least the module private key and the first server public key, and (ii) the module public key.
18. The computer program product of claim 16 , wherein the module public key and the corresponding module private key are derived by the user module using a seed for a random number generator, wherein the user module utilizes data from at least one of a sensor, a radio, a bus, a physical interface, a memory and a clock in order to generate the seed.