Key negotiation and provisioning for devices in a network
The present disclosure proposes method and systems for establishing secure communication session(s) between a first device and a second device, where the first device operates in a user network and implements a first key exchange protocol for secure communication. The second device is capable of communicating with the first device over a wireless communication network. The second device implements a second key exchange protocol that is different to the first key exchange protocol for secure communication. A proxy entity configured for implementing the first and the second key exchange protocols for secure communication is provided. The proxy entity is configured for generating and/or provisioning one or more session keys for the first and the second devices using the key exchange protocols specific to each device for establishing secure communication between the first and second device based on the generated session key(s).
1. A method for secure communication, the method comprising:
negotiating, using a first key-exchange protocol, a first device key for a high-order device to securely communicate with a proxy entity;
receiving, at the proxy entity, an encrypted data packet from the high-order device, wherein the encrypted data packet is encrypted using the first device key;
decrypting, at the proxy entity, the encrypted data packet using the first device key to obtain a data packet;
negotiating, using a second key-exchange protocol, a second device key for a low-order device to securely communicate with the proxy entity;
encrypting, at the proxy entity, the data packet using the second device key to obtain a reencrypted data packet; and
transmitting, from the proxy entity, the reencrypted data packet to the low-order device.
2. The method of claim 1 , wherein the high-order device is configured to communicate with the low-order device using a wireless communication network.
3. The method of claim 1 , wherein the encrypted data packet comprises a first encrypted data packet, the data packet comprises a first data packet, and the reencrypted data packet comprises a first reencrypted data packet, the method further comprising:
receiving, at the proxy entity, a second encrypted data packet from the high-order device, wherein the second encrypted data packet is encrypted using the second device key;
decrypting, at the proxy entity, the second encrypted data packet using the second device key to obtain a second data packet;
encrypting, at the proxy entity, the second data packet using the first device key to obtain a second reencrypted data packet; and
transmitting, from the proxy entity, the second reencrypted data packet to the low-order device.
4. The method of claim 1 , wherein the low-order device is configured to operate in a user network and wherein the high-order device is configured to operate outside the user network.
5. The method of claim 1 , wherein the proxy entity is integrated within a user network.
6. The method of claim 1 , wherein the proxy entity is configured to operate outside a user network.
7. The method of claim 1 , wherein first key exchange protocol is a lightweight cryptographic protocol comprising one or more of a stream cipher, a block cipher or a hash function.
8. The method of claim 1 , wherein the low-order device comprises an internet-of-things (IoT) device.
9. An apparatus for secure communication, the apparatus comprising:
at least one memory storing instructions; and
at least one processor coupled to the at least one memory and configured to execute the instructions to:
negotiate, using a first key-exchange protocol, a first device key for a high-order device to securely communicate with a proxy entity;
receive, at the proxy entity, an encrypted data packet from the high-order device, wherein the encrypted data packet is encrypted using the first device key;
decrypt, at the proxy entity, the encrypted data packet using the first device key to obtain a data packet;
negotiate, using a second key-exchange protocol, a second device key for a low-order device to securely communicate with the proxy entity;
encrypt, at the proxy entity, the data packet using the second device key to obtain a reencrypted data packet; and
transmit, from the proxy entity, the reencrypted data packet to the low-order device.
10. The apparatus of claim 9 , wherein the high-order device is configured to communicate with the low-order device using a wireless communication network.
11. The apparatus of claim 9 , wherein the encrypted data packet comprises a first encrypted data packet, the data packet comprises a first data packet, and the reencrypted data packet comprises a first reencrypted data packet, wherein the at least one processor is configured to:
receive, at the proxy entity, a second encrypted data packet from the high-order device, wherein the second encrypted data packet is encrypted using the second device key;
decrypt, at the proxy entity, the second encrypted data packet using the second device key to obtain a second data packet;
encrypt, at the proxy entity, the second data packet using the first device key to obtain a second reencrypted data packet; and
transmit, from the proxy entity, the second reencrypted data packet to the low-order device.
12. The apparatus of claim 9 , wherein the low-order device is configured to operate in a user network and wherein the high-order device is configured to operate outside the user network.
13. The apparatus of claim 9 , wherein the proxy entity is integrated within a user network.
14. The apparatus of claim 9 , wherein the proxy entity is configured to operate outside a user network.
15. The apparatus of claim 9 , wherein first key exchange protocol is a lightweight cryptographic protocol comprising one or more of a stream cipher, a block cipher or a hash function.
16. The apparatus of claim 9 , wherein the low-order device comprises an internet-of-things (IoT) device.
17. A non-transitory computer-readable storage medium having stored thereon instructions that, when executed by at least one processor, cause the at least one processor to:
negotiate, using a first key-exchange protocol, a first device key for a high-order device to securely communicate with a proxy entity;
receive, at the proxy entity, an encrypted data packet from the high-order device, wherein the encrypted data packet is encrypted using the first device key;
decrypt, at the proxy entity, the encrypted data packet using the first device key to obtain a data packet;
negotiate, using a second key-exchange protocol, a second device key for a low-order device to securely communicate with the proxy entity;
encrypt, at the proxy entity, the data packet using the second device key to obtain a reencrypted data packet; and
transmit, from the proxy entity, the reencrypted data packet to the low-order device.
18. The non-transitory computer-readable storage medium of claim 17 , wherein the high-order device is configured to communicate with the low-order device using a wireless communication network.
19. The non-transitory computer-readable storage medium of claim 17 , wherein the encrypted data packet comprises a first encrypted data packet, the data packet comprises a first data packet, and the reencrypted data packet comprises a first reencrypted data packet, wherein the instructions, when executed by at least one processor, cause the at least one processor to:
receive, at the proxy entity, a second encrypted data packet from the high-order device, wherein the second encrypted data packet is encrypted using the second device key;
decrypt, at the proxy entity, the second encrypted data packet using the second device key to obtain a second data packet;
encrypt, at the proxy entity, the second data packet using the first device key to obtain a second reencrypted data packet; and
transmit, from the proxy entity, the second reencrypted data packet to the low-order device.
20. The non-transitory computer-readable storage medium of claim 17 , wherein the low-order device is configured to operate in a user network and wherein the high-order device is configured to operate outside the user network.