Identity and authentication in a wireless network
A sensor system includes a controller and sensors, the system configured to ensure unique identity for each device. Methods are provided to generate new identities for those devices having duplicate addresses, and to transmit the new identity information to those devices.
1. A method for secure configuration of a sensor system comprising a sensor controller and a plurality of sensors, the method comprising:
generating, by the sensor controller, an old group key shared by the plurality of sensors, wherein the old group key incorporates a plurality of network identify information of the plurality of sensors for securely transmitting digital data within the sensor system;
sending, by the sensor controller, the old group key to each of the plurality of sensors;
receiving, at the sensor controller, a join request from a new sensor to join the plurality of sensors, wherein the join request comprises a first authentication means and a first network identity information identifying the new sensor, wherein the first network identity information comprises a hash of a public key with a predetermined binary value;
truncating the hash to a number of bits desired for use within the sensor system to generate a truncated hash;
determining, by the sensor controller, whether the first network identity information provided by the new sensor is already associated with a sensor among the plurality of sensors;
generating, by the sensor controller and in response to determining that the first network identity information is already associated with the sensor among the plurality of sensors, a second network identity information for identifying the new sensor, wherein the second network identity information comprises the truncated hash of the public key incremented by a predetermined amount;
generating, by the sensor controller and in response to generating the second network identity information for identifying the new sensor, a new group key shared by the plurality of sensors and the new sensor, wherein the new group key incorporates the plurality of network identify information of the plurality of sensors and the second network identify information of the new sensor for securely transmitting the digital data within the sensor system and replaces the old group key shared by the plurality of sensors without the new sensor; and
sending, by the sensor controller:
the second network identity information and the new group key to the new sensor, wherein the second network identity information replaces the first network identity information for the new sensor; and
the new group key to each of the plurality of sensors.
2. The method of claim 1 , wherein the first authentication means comprises a digital signature created using a private key associated with the new sensor.
3. The method of claim 1 , wherein the second network identity information comprises a second authentication means comprising a message authentication code using a pairwise key, wherein the pairwise key is created using a public key associated with the new sensor and a private key associated with the sensor controller.
4. The method of claim 1 , wherein the first authentication means comprises a message authentication code using a pairwise key, wherein the pairwise key is created using a private key associated with the new sensor and a public key associated with the sensor controller.
5. The method of claim 1 , wherein the second network identity information comprises a second authentication means comprising a digital signature created using a public key associated with the new sensor.
6. The method of claim 1 , wherein at least a portion of the join request is encrypted using a key derived from a pairwise key created using a private key associated with the new sensor and a public key associated with the sensor controller.
7. The method of claim 1 , wherein the new group key is shared by the plurality of sensors and the new sensor for digitally encrypting data within the sensor system.
8. A sensor system comprising:
a plurality of sensors; and
a sensor controller accessing a memory, wirelessly coupled to the plurality of sensors, and configured to:
generate an old group key shared by the plurality of sensors, wherein the old group key incorporates a plurality of network identify information of the plurality of sensors for securely transmitting digital data within the sensor system;
send the old group key to each of the plurality of sensors;
receive a join request from a new sensor to join the plurality of sensors, wherein the join request comprises a first authentication means and a first network identity information identifying the new sensor, wherein the first network identity information comprises a hash of a public key with a predetermined binary value;
truncate the hash to a number of bits desired for use within the sensor system to generate a truncated hash;
determine whether the first network identity information provided by the new sensor is already associated with a sensor among the plurality of sensors;
generate, in response to determining that the first network identity information is already associated with a sensor among the plurality of sensors, a second network identity information for identifying the new sensor, wherein the second network identity information comprises the truncated hash of the public key incremented by a predetermined amount;
generate, by the sensor controller and in response to generating the second network identity information for identifying the new sensor, a new group key shared by the plurality of sensors and the new sensor, wherein the new group key incorporates the plurality of network identify information of the plurality of sensors and the second network identify information of the new sensor for securely transmitting the digital data within the sensor system and replaces the old group key shared by the plurality of sensors without the new sensor; and
send:
the second network identity information and the new group key to the new sensor, wherein the second network identity information replaces the first network identity information for the new sensor; and
the new group key to each of the plurality of sensors.
9. The sensor system of claim 8 , wherein the first authentication means comprises a digital signature created using a private key associated with the new sensor.
10. The sensor system of claim 8 , wherein the second network identity information comprises a second authentication means comprising a message authentication code using a pairwise key, wherein the pairwise key is created using a public key associated with the new sensor and a private key associated with the controller.
11. The sensor system of claim 8 , wherein the first authentication means comprises a message authentication code using a pairwise key, wherein the pairwise key is created using a private key associated with the new sensor and a public key associated with the controller.
12. The sensor system of claim 8 , wherein the second network identity information comprises a second authentication means comprising a digital signature created using a public key associated with the new sensor.
13. The sensor system of claim 8 , wherein at least a portion of the join request is encrypted using a key derived from a pairwise key created using a private key associated with the new sensor and a public key associated with the controller.
generating, by the sensor controller, an old group key shared by the plurality of sensors, wherein the old group key incorporates a plurality of network identify information of the plurality of sensors for securely transmitting digital data within the sensor system;
sending, by the sensor controller, the old group key to each of the plurality of sensors;
receiving, at the sensor controller, a join request from a new sensor to join the plurality of sensors, wherein the join request comprises a first authentication means and a first network identity information identifying the new sensor, wherein the first network identity information comprises a hash of a public key with a predetermined binary value;
truncating the hash to a number of bits desired for use within the sensor system to generate a truncated hash;
determining whether the first network identity information provided by the new sensor is already associated with a sensor among the plurality of sensors;
generating, in response to determining that the first network identity information is already associated with a sensor among the plurality of sensors, a second network identity information for identifying the new sensor, wherein the second network identity information comprises the truncated hash of the public key incremented by a predetermined amount;
generating, by the sensor controller and in response to generating the second network identity information for identifying the new sensor, a new group key shared by the plurality of sensors and the new sensor, wherein the new group key incorporates the plurality of network identify information of the plurality of sensors and the second network identify information of the new sensor for securely transmitting the digital data within the sensor system and replaces the old group key shared by the plurality of sensors without the new sensor; and
sending, by the sensor controller:
the second network identity information and the new group key to the new sensor, wherein the second network identity information replaces the first network identity information for the new sensor; and
the new group key to each of the plurality of sensors.
14. A non-transitory storage medium having executable code stored thereon that when executed by a computer system implements a method for secure configuration of a sensor system comprising a sensor controller and a plurality of sensors, the method comprising:
generating, by the sensor controller, an old group key shared by the plurality of sensors, wherein the old group key incorporates a plurality of network identify information of the plurality of sensors for securely transmitting digital data within the sensor system;
sending, by the sensor controller, the old group key to each of the plurality of sensors;
receiving, at the sensor controller, a join request from a new sensor to join the plurality of sensors, wherein the join request comprises a first authentication means and a first network identity information identifying the new sensor, wherein the first network identity information comprises a hash of a public key with a predetermined binary value;
truncating the hash to a number of bits desired for use within the sensor system to generate a truncated hash;
determining whether the first network identity information provided by the new sensor is already associated with a sensor among the plurality of sensors;
generating, in response to determining that the first network identity information is already associated with a sensor among the plurality of sensors, a second network identity information for identifying the new sensor, wherein the second network identity information comprises the truncated hash of the public key incremented by a predetermined amount;
generating, by the sensor controller and in response to generating the second network identity information for identifying the new sensor, a new group key shared by the plurality of sensors and the new sensor, wherein the new group key incorporates the plurality of network identify information of the plurality of sensors and the second network identify information of the new sensor for securely transmitting the digital data within the sensor system and replaces the old group key shared by the plurality of sensors without the new sensor; and
sending, by the sensor controller:
the second network identity information and the new group key to the new sensor, wherein the second network identity information replaces the first network identity information for the new sensor; and
the new group key to each of the plurality of sensors.
15. The storage medium of claim 14 , wherein the first authentication means comprises a digital signature created using a private key associated with the new sensor.
16. The storage medium of claim 14 , wherein the second network identity information comprises a second authentication means comprising a message authentication code using a pairwise key, wherein the pairwise key is created using a public key associated with the new sensor and a private key associated with the sensor controller.
17. The storage medium of claim 14 , wherein the first authentication means comprises a message authentication code using a pairwise key, wherein the pairwise key is created using a private key associated with the new sensor and a public key associated with the sensor controller.
18. The storage medium of claim 14 , wherein the second network identity information comprises a second authentication means comprising a digital signature created using a public key associated with the new sensor.