Secure simple enrollment
Methods, systems, and apparatus are disclosed for generating one or more device identifiers based on a public key associated with a respective device. Various embodiments include condensing and/or hashing a device public key to generate the corresponding device identifier. By using the relationship between a device public key and its device identifier, public key exchanges are implemented to verify this relationship and facilitate device enrollment into one or more networks. The embodiments further describe enrolling one or more devices into networks and/or authorizing devices to enroll one more devices into networks based on public key exchanges and verification that the one or more device identifiers match the respective public keys. Embodiments for authorizing other devices describe a first device enrolling a second device in a first network and authorizing a third device to enroll the second device in a second network using an exchange of public keys and/or messages.
1. A method, comprising:
receiving, at a first device having a first public key, an identifier associated with the first device, the identifier received from a second device;
receiving, at the first device, a second public key associated with the second device;
generating, at the first device, a session key based on a combination of the first public key and the second public key;
authenticating, at the first device, the second device using the session key;
determining, at the first device, whether the identifier received from the second device corresponds to the first public key; and
enrolling, using the first device, the second device in a network including the first device based on determining that the identifier received from the second device corresponds to the first public key.
2. The method of claim 1 , wherein authenticating the second device comprises:
sending, by the first device, a first message encrypted with the session key to the second device; and
receiving, at the first device, a second message sent from the second device in response to the first message being successfully decrypted at the second device with the session key.
3. The method of claim 2 , wherein authenticating the second device further comprises:
decrypting the second message; and
verifying that the decrypted message conforms to a predetermined message format.
4. The method of claim 1 , wherein determining whether the identifier received from the second device corresponds to the first public key comprises:
applying, at the first device, a hash function to the first public key to provide a regenerated identifier; and
comparing, at the first device, the regenerated identifier with the identifier received from the second device.
5. The method of claim 1 , further comprising:
capturing, at the second device, an image representative of the identifier, and wherein the act of receiving the identifier comprises:
receiving, at the first device, the identifier from the second device based on the image.
6. The method of claim 1 , wherein determining whether the identifier received from the second device corresponds to the first public key comprises:
rehashing the first public key to provide a rehashed first public key; and
determining whether the identifier maps to the rehashed first public key.
7. The method of claim 1 , further comprising:
sending, by the first device, security information to the second device to facilitate the enrollment of the second device in the network based on determining that the identifier received from the second device corresponds to the first public key.
8. The method of claim 1 , further comprising:
updating, by the first device, the identifier after the second device is enrolled in the network to facilitate subsequent enrollment of a third device.
9. A first device, comprising:
a network interface configured to receive (i) an identifier associated with the first device, the identifier received from a second device, and (ii) a second public key associated with the second device; and
a controller configured to:
(i) generate a session key based on a combination of a first public key associated with the first device and the second public key,
(ii) authenticate the second device using the session key;
(iii) determine whether the identifier received from the second device corresponds to the first public key, and
(iv) enroll the second device in a network including the first device based on based on determining that the identifier received from the second device corresponds to the first public key.
10. The first device of claim 9 , wherein:
the network interface is further configured to (i) send a first message encrypted with the session key to the second device, and (ii) receive a second message, sent from the second device, in response to the first message being successfully decrypted at the second device with the session key.
11. The first device of claim 9 , wherein the controller is further configured to (i) decrypt the second message, and (ii) verify that the decrypted message conforms to a predetermined message format.
12. The first device of claim 9 , wherein the controller is further configured to:
apply a hash function to the first public key to provide a regenerated identifier; and
compare the regenerated identifier with the identifier received from the second device.
13. The first device of claim 9 , wherein the second device includes an image capture device configured to capture an image representative of the identifier, and wherein the network interface is further configured to receive the identifier based on the image.
14. The first device of claim 9 , wherein the controller is further configured to (i) rehash the first public key to provide a rehashed first public key, and (ii) determine whether the identifier maps to the rehashed first public key.
15. The first device of claim 9 , wherein the network interface is further configured to send network security information to the second device to facilitate the enrollment of the second device in the network based on determining that the identifier corresponds to the first public key.
16. The first device of claim 9 , wherein the controller is further configured to update the identifier with another value after the second device is enrolled in the network to facilitate subsequent enrollment of a third device.