US 11,310,243 B2Granted

Secure communication with an end device through an intermediary system

AssigneeLuna XIO, Inc.

InventorsAlan Gous, Jeffrey Bazar, Arman Maghbouleh

Life of this patent

Estimating the term…

Loading patent…

Abstract

An example intermediary system allows an owner computer system to securely identify and communicate with an end device. The end device uses master secret and time data shared with the owner computer system to generate and advertise a time-dependent device identifier and potentially an encrypted device message. The intermediary system augments the received device data with a message (e.g., an estimate of the device's location) encrypted using the time-dependent device identifier as an encryption key. Furthermore, it hashes the time-dependent device identifier for additional security. The augmented data is forwarded to a server for retrieval and processing by the owner computer system. The owner uses the shared master secret, time data and hash function to generate a hashed time-dependent device identifier used to retrieve matching augmented data from the server. The retrieved message data is decrypted using the reverse of the encryption operations.

Claims17

Dependent claims

A method to enable an end device to securely communicate with an owner computer system associated with the end device using an intermediary system intermediate the end device and the owner computer system, the method comprising:

at the intermediary system:
receiving end device advertised data comprising a time-dependent device identifier generated at the end device using a time-dependent data calculation, a shared master secret and time data comprising current time data and reference time data, the shared master secret and the reference time data shared between the end device and the owner computer system;
generating, using at least one processor, augmented data comprising:
a hashed device identifier generated by hashing the time-dependent device identifier using a hash function known to both the intermediary system and the owner computer system;
and
an encrypted message generated by encrypting a message using the time-dependent device identifier as an encryption key for a symmetric encryption/decryption method known to both the intermediary system and the owner computer system;
and
forwarding the augmented data to a server for retrieval and processing by the owner computer system to allow the owner computer system to communicate with the end device securely,
at the server:
receiving and storing the augmented data, and making the augmented data available to be retrieved and processed by the owner computer system;
at the owner computer system:
obtaining retrieval request data comprising a retrieval device identifier and a retrieval hashed device identifier;
sending the retrieval hashed device identifier to the server;
at the server:
receiving the retrieval hashed device identifier;
comparing the retrieval hashed device identifier with the hashed device identifier comprised by the augmented data stored on the server;
detecting a correspondence between the retrieval hashed device identifier and the hashed device identifier comprised by the augmented data stored on the server;
responsive to the detection of the correspondence, returning the corresponding augmented data stored on the server to the owner computer system;
and
at the owner computer system, receiving the augmented data.

17 more elements

A computing system comprising:

a plurality of processors;
and
a memory storing instructions that, when executed by the plurality of processors, configure the system to:
at an intermediary system:
receive end device advertised data comprising a time-dependent device identifier generated at the end device using a time-dependent data calculation, a shared master secret and time data comprising current time data and reference time data, the shared master secret and the reference time data shared between an end device and an owner computer system;
generate augmented data comprising:
a hashed device identifier generated by hashing the time-dependent device identifier using a hash function known to both the intermediary system, intermediate the end device and the owner computer system, and the owner computer system;
and
an encrypted message generated by encrypting a message using the time-dependent device identifier as an encryption key for a symmetric encryption/decryption method known to both the intermediary system and the owner computer system;
and
forward the augmented data to a server for retrieval and processing by the owner computer system to allow the owner computer system to communicate with the end device securely;
at the server:
receive the augmented data, and making the augmented data available to be retrieved and processed by the owner computer system;
obtain retrieval request data comprising a retrieval device identifier and a retrieval hashed device identifier;
send the retrieval hashed device identifier to the server;
receive the retrieval hashed device identifier;
compare the retrieval hashed device identifier with the hashed device identifier comprised by the augmented data stored on the server;
detect a correspondence between the retrieval hashed device identifier and the hashed device identifier comprised by the augmented data stored on the server;
responsive to the detection of the correspondence, return the corresponding augmented data stored on the server to the owner computer system;
and
at the owner computer system:
receive the augmented data.

19 more elements

A non-transitory computer-readable storage medium, the computer-readable storage medium including instructions that, when executed by a computer system, cause the computer system to:

at an intermediary system:
receive end device advertised data comprising a time-dependent device identifier generated at the end device using a time-dependent data calculation, a shared master secret and time data comprising current time data and reference time data, the shared master secret and the reference time data shared between an end device and an owner computer system;
generate augmented data comprising:
a hashed device identifier generated by hashing the time-dependent device identifier using a hash function known to both the intermediary system, intermediate the end device and the owner computer system, and the owner computer system;
and
an encrypted message generated by encrypting a message using the time-dependent device identifier as an encryption key for a symmetric encryption/decryption method known to both the intermediary system and the owner computer system;
and
forward the augmented data to a server for retrieval and processing by the owner computer system to allow the owner computer system to communicate with the end device securely;
at the server:
receive the augmented data, and making the augmented data available to be retrieved and processed by the owner computer system;
obtain retrieval request data comprising a retrieval device identifier and a retrieval hashed device identifier;
send the retrieval hashed device identifier to the server;
receive the retrieval hashed device identifier;
compare the retrieval hashed device identifier with the hashed device identifier comprised by the augmented data stored on the server;
detect a correspondence between the retrieval hashed device identifier and the hashed device identifier comprised by the augmented data stored on the server;
responsive to the detection of the correspondence, return the corresponding augmented data stored on the server to the owner computer system;
and
at the owner computer system:
receive the augmented data.

16 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/375,862Filed 14 Jul 2021 · continuation
Priority: 10 Jun 2019
Published: US 2021/0344685 A14 Nov 2021
Granted: 19 Apr 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification14 codes

H04L 63/107
For controlling access to devices or network resources: wherein the security policies are location-dependent, e.g. entities privileges depend on…
H04L 63/108
For controlling access to devices or network resources: when the policy decisions are valid for a limited amount of time
G06F 21/44
Authentication, i.e. establishing the identity or authorisation of security principals: program or device authentication
G06F 21/6245
To a system of files or objects, e.g. local or distributed file system or database: protecting personal data, e.g. for financial or medical purposes

Family

Application62/859,247Us provisional application · filed 10 Jun 2019
Application16/896,712Parent of this continuation · filed 9 Jun 2020
US 2021/0344685 A1Pre-grant publication · published 4 Nov 2021
US 11,329,994 B2Related patent
US 2020/0389465 A1Published application
US 11,310,243 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key