# US 2016/0366102 A1 · Self-Configuring Key Management System For an Internet of Things Network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366102 A1 - Document ID: US20160366102A1 - Status: Published application - Kind: A1 - Application number: 14/968,125 - Filed: 2015-12-14 - Published: 2016-12-15 - Earliest claimed: 2015-06-09 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: Ned M. Smith - Web page: https://patentgrep.com/patent/US20160366102A1 ## CPC - H04L 9/0822: {using key encryption key} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/0841: {involving Diffie-Hellman or related key agreement protocols} - H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 63/045: {wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04W 12/041: Key generation or derivation - H04W 12/0431: Key distribution or pre-distribution; Key agreement - H04W 12/0433: Key management protocols - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 84/18: Self-organising networks, e.g. ad-hoc networks or sensor networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract In one embodiment, a method includes receiving, in a first device, at least one of a first symmetric key and a first asymmetric key in a common key management structure, the common key management structure to accommodate asymmetric keys and symmetric keys, and further including security policy information to enable communication between the first device of a first domain of an Internet of Things (IoT) network and a second device of a second domain of the IoT network according to an inter-domain security policy; and sending a first message directly from the first device to the second device according to the security policy information of the common key management structure. Other embodiments are described and claimed. ## Claims ### Claim 1 At least one computer readable storage medium comprising instructions that when executed enable a system to: receive, in a first device, at least one of a first symmetric key and a first asymmetric key in a common key management structure, the common key management structure to accommodate asymmetric keys and symmetric keys, and further including security policy information to enable communication between the first device of a first domain of an Internet of Things (IoT) network and a second device of a second domain of the IoT network according to an inter-domain security policy; and send a first message directly from the first device to the second device according to the security policy information of the common key management structure. ### Claim 2 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to dynamically scale the IoT network by dynamically instantiating at least one zone controller for a first zone of the IoT network, the first zone including the first device. ### Claim 3 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to dynamically scale the IoT network by dynamically instantiating at least one domain controller for the first domain, which includes the first device. ### Claim 4 (depends on 3) The at least one computer readable storage medium of claim 3, wherein the at least one domain controller comprises a key management system. ### Claim 5 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to dynamically instantiate the first device as at least one of a domain controller for the first domain, a zone controller for a first zone of the first domain, and a client of the first domain. ### Claim 6 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the first device to dynamically instantiate a third device as at least one of a zone controller of the first domain and a client of the first domain. ### Claim 7 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to, in response to the first device receiving at an additional instance of the common key management structure, dynamically instantiate the first device as at least one of a domain controller for the first domain, a zone controller for a first zone of the first domain, and a client of the first domain. ### Claim 8 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to: for a first publication-subscription topic, dynamically instantiate the first device as at least one of a domain controller for the first domain, a zone controller for a first zone of the first domain, and a client of the first domain; and for a second publication-subscription topic, dynamically instantiate the first device as at least one of a domain controller for at least one of the first domain and an additional domain, a zone controller for at least one of the first zone and an additional zone of the additional domain, and a client for at least one of the first domain and the additional domain. ### Claim 9 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to: receive a second message in the first device directly from the second device; and enforce, in the first device, the inter-domain security policy with regard to the second message. ### Claim 10 (depends on 9) The at least one computer readable storage medium of claim 9, further comprising instructions that when executed enable the system to: receive a third message in the first device directly from a third device; and enforce, in the first device, an intra-domain security policy with regard to the third message; wherein (a) the intra-domain and inter-domain policies are not equal to each other; and (b) the first and third devices, but not the second device, are included in a first domain. ### Claim 11 (depends on 10) The at least one computer readable storage medium of claim 10, wherein the inter-domain policy corresponds to at least one of data filtering, malware screening, and bandwidth reservations. ### Claim 12 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to receive the common key management structure from a first zone controller, the first zone controller dynamically assigned a key management role from an initial key management system of the IoT network. ### Claim 13 (depends on 12) The at least one computer readable storage medium of claim 12, wherein the first zone controller and the first device are both included in the first domain, which does not include the second device. ### Claim 14 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to: encrypt, in the first device, the first message using the first symmetric key; and send, directly from the first device to the second device, an additional instance of the first symmetric key; wherein (a) the additional instance of the first symmetric key is encrypted based on keys shared between the second device and a third device but not the first device; and (b) the second and third devices are each included in the second domain, which does not include the first device. ### Claim 15 (depends on 14) The at least one computer readable storage medium of claim 14, wherein (a) the first domain is a logical collection of devices, including the first device, under a common administrative control administered by at least one of the collection of devices, and (b) a zone is a logical subset of the devices under a common administrative control administered by at least one of the subset of the devices. ### Claim 16 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to receive the common key management structure from a key management system responsive to a request from the first device to interact with the second device. ### Claim 17 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to cause the common key management structure to expire according to expiration information of the common key management structure, and thereafter prevent interaction between the first device and the second device. ### Claim 18 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to: receive, in the first device, the first symmetric key in the common key management structure included in a first communication; and receive, in the first device, the first asymmetric key in the common key management structure included in a second communication. ### Claim 19 (depends on 18) The at least one computer readable storage medium of claim 18, wherein the first symmetric key corresponds to a first encryption protocol and the first asymmetric key corresponds to a second encryption protocol unequal to the first encryption protocol. ### Claim 20 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to receive, in the first device, the first symmetric key and the first asymmetric key in the common key management structure. ### Claim 21 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to: receive, in the first device, the first asymmetric key in the common key management structure; and. encrypt, in the first device, the first message using the first asymmetric key. ### Claim 22 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to send the first message in a data portion of a second common key management structure. ### Claim 23 A first device comprising: at least one hardware processor to execute instructions; at least one network interface to enable the at least one hardware processor to communicate with second and third computing nodes coupled in an Internet of Things (IoT); at least one non-transitory storage medium having instructions stored thereon for causing the at least one hardware processor of the first device to: receive at least one of a first symmetric key and a first asymmetric key in a common key management structure, the common key management structure to accommodate asymmetric keys and symmetric keys, wherein the common key management structure includes security policy information to enable communication between the first device of a first domain of an Internet of Things (IoT) network and a second device of a second domain of the IoT network according to an inter-domain security policy; and send a first message directly to the second device according to the security policy information of the common key management structure. ### Claim 24 (depends on 23) The first device of claim 23, the at least one medium further comprising instructions that when executed enable the first device to dynamically instantiate at least one zone controller for a first zone of the IoT network, the first zone including the first device.