# US 11,909,730 B2 · Authentication of networked devices having low computational capacity

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,909,730 B2
- Document ID: US11909730B2
- Status: Granted
- Kind: B2
- Application number: 17/963,411
- Filed: 2022-10-11
- Published: 2023-02-02
- Granted: 2024-02-20
- Earliest claimed: 2015-08-28
- Assignees: Texas Instruments Incorporated
- Applicants: Texas Instruments Incorporated
- Inventors: Kumaran Vijayasankar; Oliver Shih; Arvind K. Raghu; Ramanuja Vedantham; Xiaolin Lu
- Web page: https://patentgrep.com/patent/US11909730B2

## CPC

- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)}
- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)}
- H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity}
- Y04S 40/20: Information technology specific aspects, e.g. CAD, simulation, modelling, system security
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- Y04S: SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS

## Abstract

Authentication of a networked device with limited computational resources for secure communications over a network. Authentication of the device begins with the supplicant node transmitting a signed digital certificate with its authentication credentials to a proxy node. Upon verifying the certificate, the proxy node then authenticates the supplicant's credentials with an authentication server accessible over the network, acting as a proxy for the supplicant node. Typically, this verification includes decryption according to a public/private key scheme. Upon successful authentication, the authentication server creates a session key for the supplicant node and communicates it to the proxy node. The proxy node encrypts the session key with a symmetric key, and transmits the encrypted session key to the supplicant node which, after decryption, uses the session key for secure communications. In some embodiments, the authentication server encrypts the session key with the symmetric key.

## Claims

### Claim 1

A method comprising:
receiving, by a first device, a digital certificate, wherein the digital certificate includes an authentication credential associated with a second device;
verifying, by the first device, the digital certificate using asymmetric key cryptography;
in response to the verifying, transmitting the authentication credential;
after transmitting the authentication credential, receiving, by the first device, a session key associated with the second device; and
transmitting, by the first device, the session key using symmetric key cryptography.

### Claim 2 (depends on 1)

The method of claim 1, wherein the digital certificate comprises a symmetric encryption key, the method further comprising:
encrypting the session key with the symmetric encryption key.

### Claim 3 (depends on 2)

The method of claim 2, further comprising:
receiving, by the first device and with the digital certificate, a nonce.

### Claim 4 (depends on 3)

The method of claim 3, wherein:
the nonce comprises a pseudo-random number.

### Claim 5 (depends on 3)

The method of claim 3, further comprising:
in response to verifying the digital certificate, storing the symmetric encryption key and the nonce in the first device.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
transmitting, by the first device, the authentication credential and an identifier of the second device extracted from the digital certificate to an authentication device.

### Claim 7 (depends on 6)

The method of claim 6, further comprising:
prior to transmitting the authentication credential and the identifier to the authentication device, determining a protocol for authentication.

### Claim 8 (depends on 6)

The method of claim 6, further comprising:
transmitting a protocol code to the authentication device, wherein the protocol code identifies a protocol for authentication.

### Claim 9 (depends on 1)

The method of claim 1, where verifying the digital certificate comprises computing a hash of a first portion of the digital certificate.

### Claim 10 (depends on 1)

The method of claim 1, wherein the digital certificate comprises a first portion and a second portion, the second portion including the authentication credential and a symmetric encryption key.

### Claim 11 (depends on 10)

The method of claim 10, wherein the second portion further includes an identifier of the second device, and a certificate authority identifier.

### Claim 12 (depends on 10)

The method of claim 10, wherein verifying the digital certificate comprises decrypting the second portion using an asymmetric key to extract the symmetric encryption key, the method further comprising:
after decrypting the second portion using the asymmetric key, storing the extracted symmetric encryption key in the first device; and
after receiving the session key, encrypting, by the first device, the session key using the stored symmetric encryption key, wherein transmitting the session key comprises transmitting the encrypted session key.

### Claim 13 (depends on 12)

The method of claim 12, further comprising:
receiving, by the first device, a public key corresponding to a private key, wherein decrypting the second portion comprises using the received public key.

### Claim 14 (depends on 10)

The method of claim 10, wherein verifying the digital certificate comprises comparing the first portion with the second portion.

### Claim 15 (depends on 1)

The method of claim 1, wherein receiving the digital certificate by the first device comprises receiving the digital certificate from the second device.

### Claim 16 (depends on 1)

The method of claim 1, wherein receiving the session key by the first device comprises receiving the session key from a third device.

### Claim 17 (depends on 1)

The method of claim 1, wherein receiving the session key comprises receiving the session key encrypted by symmetric encryption, and wherein transmitting the session key comprises forwarding the encrypted session key.

### Claim 18

A network device comprising:
a transceiver; and
a processor configured to:
receive a digital certificate, the digital certificate includes an authentication credential associated with a first device;
verify the digital certificate using asymmetric key cryptography;
in response to the verifying, transmit the authentication;
after transmitting the authentication credential, receive a session key associated with the first device; and
transmit the session key using symmetric key cryptography.

### Claim 19 (depends on 18)

The network device of claim 18, wherein the digital certificate comprises a symmetric encryption key, wherein the processor is configured to encrypt the session key with the symmetric encryption key to produce an encrypted session key, and wherein transmitting the session key using symmetric key cryptography comprises transmitting the encrypted session key.

### Claim 20 (depends on 19)

The network device of claim 19, wherein the processor is configured to receive with the digital certificate a nonce.

### Claim 21 (depends on 20)

The network device of claim 20, wherein:
the nonce comprises a pseudo-random number.

### Claim 22 (depends on 20)

The network device of claim 20, wherein the processor is configured to, in response to verifying the digital certificate, store the symmetric encryption key and the nonce.

### Claim 23 (depends on 18)

The network device of claim 18, wherein verifying the digital certificate comprises comparing a first portion of the digital certificate with a second portion of the digital certificate using a hash of the first portion.