Devices, Systems, And Methods For Providing Security To IoT Networks And Sensors
The disclosure is related to a method for performing secure boot for IoT sensors where the verification process is done collaboratively between the sensor and the gateway. Further, a method of performing secure updates for IoT sensors where the verification process is done on the gateway. A method of authenticating an IoT sensor with an IoT gateway in which a first method of authentication is used upon first installing a device and occasionally thereafter and a second method is used for transactional communication. Still further, a method of computing an encryption key from a seed value that utilizes information specific to the sensor to create an encryption key unique to that sensor.
1 . A method for authenticating an IoT device comprising:
establishing communication between a sensor and a gateway;
verifying a sensor ID on the gateway;
generating an authentication token on the gateway; and
receiving the authentication token by the sensor.
2 . The method of claim 1 , further comprising:
generating an encryption key seed on the gateway; and
receiving the encryption key seed by the sensor.
3 . The methods of claim 2 , further comprising computing an encryption key from the encryption key seed.
4 . A method for secure booting of an IoT device comprising:
powering on the IoT device;
computing a hash of firmware on the IoT device;
sending the hash to a gateway;
verifying the IoT device on the gateway;
retrieving a validation key and a signature on the gateway;
decrypting the signature and deriving an expected hash value; and
comparing the expected hash value to the hash.
5 . The method of claim 4 , further comprising sending an authentication token and encryption key seed to the IoT device.
6 . The method of claim 4 , further comprising reporting a security event when the expected hash value and the hash do not match.
7 . A method for performing secure updates on an IoT device comprising:
downloading new firmware and a firmware signature;
decrypting the firmware signature with a validation key to derive an expected hash value;
calculating a hash value for the new firmware; and
comparing the expected hash value to the hash value.
8 . The method of claim 7 , further comprising updating the IoT device if the expected hash value and hash value match.
9 . The method of claim 8 , further comprising reporting a security event if the expected hash value and the hash value do not match.
10 . The method of claim 1 , further comprising:
installing the sensor on a sensor network;
configuring the gateway with the sensor ID of the sensor;
sending the authentication token from the gateway to the sensor;
storing the authentication token on the sensor.
11 . The method of claim 10 , further comprising:
generating an encryption key seed on the gateway; and
receiving the encryption key seed by the sensor.
12 . The methods of claim 11 , further comprising computing an encryption key from the encryption key seed.
13 . The method of claim 12 , wherein the encryption key seed uses information specific to the sensor.
14 . The method of claim 1 , further comprising setting the gateway to installation mode.
15 . The method of claim 4 , further comprising encrypting the hash, authentication token, encryption key seed, and device ID when sending between the sensor and the gateway.
16 . The method of claim 4 , further comprising authenticating the IoT device when the expected hash value and the hash value match, and sending a new authentication token to the IoT device.
17 . The method of claim 5 , further comprising sending a device ID to the gateway.
18 . The method of claim 7 , further comprising securely booting the IoT device.
19 . The method of claim 7 , further comprising authenticating the IoT device.
20 . The method of claim 7 , further comprising receiving the new firmware by the IoT device if the expected hash value and hash value match.