Authentication method, authentication system, and controller

An authentication method for a group to which one or more devices and a first controller that are connected to a network belong, comprising:

• generating, using the first controller, a first group key;
• performing, using the first controller and each of the one or more devices, first mutual authentication between the first controller and the device;
• sharing, using the first controller, the first group key with each device for which the first mutual authentication has been successful among the one or more devices;
• selecting, in response to participation of a second controller in the group, using one of the first controller and the second controller, the first controller or the second controller as a coordinator, the coordinator being configured to manage a group key to be used in common in the group;
• wherein in response to selection of the second controller as the coordinator,
• performing, using the first controller and the second controller, second mutual authentication between the first controller and the second controller;
• generating, using the first controller, first authentication data by using the first group key from (i) a first header, (ii) a source address corresponding to the first controller, (iii) a destination address corresponding to each device and the second controller, and (iv) notification information indicating switching of the coordinator from the first controller to the second controller;
• and
• simultaneously broadcasting, using the first controller, a switching notification including (i) the first header, (ii) the source address, (iii) the destination address, (iv) the notification information, and (v) the first authentication data from the first controller to each device for which the first mutual authentication has been successful and the second controller for which the second mutual authentication has been successful;
• generating, using the second controller, a second group key;
• performing, using the second controller and each device, third mutual authentication between the second controller and the device;
• updating, by using each device for which the third mutual authentication has been successful, the first group key stored as the group key to the second group key;
• performing, using the second controller and the first controller, fourth mutual authentication between the second controller and the first controller;
• and
• updating, using the first controller, the first group key stored as the group key to the second group key when the fourth mutual authentication for the first controller is successful.

A controller connected to a network, the controller belonging to a group to which one or more devices and one or more other controllers that are connected to the network belong, the controller comprising:

• a memory;
• and
• a processor that executes instructions stored on the memory,
• wherein the processor
• selects a coordinator that manages a group key to be used in common in the group from among the controller and the one or more other controllers, and
• in response to selection of the controller as the coordinator,
• generates the group key,
• performs first mutual authentication with each of the one or more devices,
• shares the group key with each device for which the first mutual authentication has been successful among the one or more devices,
• performs second mutual authentication with each of the one or more other controllers,
• shares the group key with each controller for which the second mutual authentication has been successful among the one or more other controllers,
• encrypts transmission data by using the group key to generate encrypted data,
• generates authentication data by using the group key from (i) a header, (ii) a source address corresponding to the controller, (iii) a destination address corresponding to each device and each controller, and (iv) the transmission data, and
• simultaneously broadcasts a message including (i) the header, (ii) the source address, (iii) the destination address, (iv) the encrypted data, and (v) the authentication data to each device for which the first mutual authentication has been successful and each controller for which the second mutual authentication has been successful.

A controller connected to a network, the controller belonging to a group to which one or more devices and one or more other controllers that are connected to the network belong, one controller among the one or more other controllers having generated a first group key and having performed first mutual authentication with the one or more devices, the controller being connected to one device among the one or more devices for which the first mutual authentication has been successful, the controller comprising:

• a memory;
• a processor that executes instructions stored on the memory;
• and
• a communicator,
• wherein the processor performs second mutual authentication with the one controller,
• wherein when the second mutual authentication is successful,
• the communicator receives the first group key,
• the processor
• encrypts first transmission data by using the first group key to generate first encrypted data, and
• generates first authentication data by using the first group key from (i) a first header, (ii) a source address corresponding to the controller, (iii) a destination address corresponding to each device and each of other controllers, and (iv) the first transmission data, and
• the communicator simultaneously broadcasts a message including (i) the first header, (ii) the source address, (iii) the destination address, (iv) the first encrypted data, and (v) the first authentication data to each device and each of other controllers,
• wherein the processor selects the controller or the one controller as a coordinator, the coordinator being configured to manage a group key to be used in common in the group,
• wherein in response to selection of the controller as the coordinator,
• the processor generates a second group key,
• the communicator receives authentication information concerning the one or more devices from the one controller,
• the processor
• performs third mutual authentication with each of the one or more devices by using the authentication information,
• causes each device for which the third mutual authentication has been successful to update the first group key stored as the group key to the second group key,
• performs fourth mutual authentication with each of the one or more other controllers by using the authentication information,
• causes each of the other controllers for which the fourth mutual authentication has been successful to update the first group key stored as the group key to the second group key,
• encrypts second transmission data by using the second group key to generate second encrypted data, and
• generates second authentication data by using the second group key from (i) a second header, (ii) the source address, (iii) the destination address, and (iv) the second transmission data, and
• wherein the communicator simultaneously broadcasts a message including (i) the second header, (ii) the source address, (iii) the destination address, (iv) the second encrypted data, and (v) the second authentication data to each device and each of other controllers.

A controller connected to a network, the controller belonging to a group to which one or more devices that are connected to the network belong, the controller comprising:

• a memory;
• a processor that executes instructions stored on the memory;
• and
• a communicator,
• wherein the processor
• generates a first group key,
• performs first mutual authentication with each of the one or more devices,
• shares the first group key with each device for which the first mutual authentication has been successful among the one or more devices,
• selects, in response to participation of another controller in the group, a coordinator from among the controller and the other controller, the coordinator being configured to manage a group key to be used in common in the group,
• performs, in response to selection of the other controller as the coordinator, second mutual authentication with the other controller,
• shares the first group key with the other controller if the second mutual authentication for the other controller is successful, and
• generates authentication data by using the first group key from (i) a header, (ii) a source address corresponding to the controller, (iii) a destination address corresponding to each device and the other controller, and (iv) notification information indicating switching of the coordinator from the controller to the other controller,
• wherein the communicator
• simultaneously broadcasts a switching notification including (i) the header, (ii) the source address, (iii) the destination address, (iv) the notification information, and (v) the authentication data to each device for which the first mutual authentication has been successful and the other controller for which the second mutual authentication has been successful, and
• transmits authentication information to the other controller,
• wherein the processor performs third mutual authentication with the other controller, and
• wherein the communicator receives a second group key generated by the other controller if the third mutual authentication is successful and updates the first group key stored as the group key to the second group key.

A system, comprising:

• one or more devices connected to a network;
• a first controller connected to the network;
• and
• one or more second controllers connected to the network, the one or more devices, the first controller, wherein the first controller includes a memory and a processor that executes instructions stored on the memory;
• and the one or more second controllers belonging to a group,
• wherein one of the first controller and the one or more second controllers selects a coordinator from among the first controller and the one or more second controllers, the coordinator being configured to manage a group key to be used in common in the group,
• wherein in response to selection of the first controller as the coordinator,
• the first controller generates the group key,
• the first controller and each of the one or more devices perform first mutual authentication between the first controller and the device, the first controller and each of the one or more second controllers perform second mutual authentication between the first controller and the second controller,
• the first controller shares the group key with each device for which the first mutual authentication has been successful among the one or more devices, and
• the first controller shares the group key with each second controller for which the second mutual authentication has been successful among the one or more second controllers,
• wherein the first controller
• encrypts transmission data by using the group key to generate encrypted data,
• generates authentication data by using the group key from (i) a header, (ii) a source address corresponding to the first controller, (iii) a destination address corresponding to each device and each second controller, and (iv) the transmission data, and
• simultaneously broadcasts a message including (i) the header, (ii) the source address, (iii) the destination address, (iv) the encrypted data, and (v) the authentication data from the first controller to each device for which the first mutual authentication has been successful and each second controller for which the second mutual authentication has been successful.