# US 2016/0366111 A1 · System, Apparatus and Method for Managing Lifecycle of Secure Publish-Subscribe System > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366111 A1 - Document ID: US20160366111A1 - Status: Published application - Kind: A1 - Application number: 14/864,957 - Filed: 2015-09-25 - Published: 2016-12-15 - Earliest claimed: 2015-06-09 - Assignees: Intel Corporation - Applicants: Intel Corporation - Inventors: NED M. SMITH; NATHAN HELDT-SHELLER - Web page: https://patentgrep.com/patent/US20160366111A1 ## CPC - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/065: {for group communications (cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/102: {Entity profiles} - H04L 67/125: involving control of end-device applications over a network - H04L 67/562: Brokering proxy services - H04L 69/03: {Protocol definition or specification (protocol conformance testing H04L1/244)} - H04W 4/80: Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication - H04W 12/041: Key generation or derivation - H04W 12/0433: Key management protocols - H04W 84/18: Self-organising networks, e.g. ad-hoc networks or sensor networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract In one embodiment, a method includes: request enrollment of the device with an identity provider, the enrollment including at least one role for the device for a publish-subscribe protocol of a distributed network; receiving a device identity credential from the identity provider and store the device identity credential in the device; receiving a ticket credential for a first topic associated with a first publisher, the ticket credential including the at least one role for the device; receiving a group key from a key manager for a group associated with the publish-subscribe protocol; and receiving content for the first topic in the device, the content protected by the group key. ## Claims ### Claim 1 At least one computer readable storage medium comprising instructions that when executed enable a system to: receive a first request, for a first security ticket, from a first device, wherein the first request includes: (a)(i) a first device identity credential corresponding to a role for the first device with a publish-subscribe protocol of a distributed network, and (a)(ii) a first filter element associated with the a publish-subscribe protocol; send the first security ticket, which is restricted to the first filter element and includes a first key, to the first device; receive a second request, for a second security ticket, from a second device that is a publisher for the first filter element, wherein the second request includes the first filter element; and send the second security ticket to the second device, the second security ticket being restricted to the first filter element and including a second key that is a symmetric group key. ### Claim 2 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to: receive a third request, for a third security ticket, from a third device, wherein the third request includes: (b)(i) a third device identity credential corresponding to a role for the third device with the publish-subscribe protocol, and (b)(ii) the first filter element; and send the third security ticket, which is restricted to the first filter element and includes a third key, to the third device. ### Claim 3 (depends on 2) The at least one computer readable storage medium of claim 2, wherein the first device is one of a subscriber and a broker for the first filter element and the third device is another of a subscriber and a broker for the first filter element. ### Claim 4 (depends on 2) The at least one computer readable storage medium of claim 2, wherein the role for the first device corresponds to a first set of publish-subscribe protocol privileges and the role for the third device corresponds to another set of publish-subscribe protocol privileges unequal to the first set of publish-subscribe protocol privileges. ### Claim 5 (depends on 2) The at least one computer readable storage medium of claim 2, wherein the first security ticket includes the first device identity credential, which corresponds to a first set of publish-subscribe protocol privileges. ### Claim 6 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to: receive an additional first request, for an additional first security ticket, from the first device, wherein the additional first request includes an additional first device identity credential corresponding to an additional role for the first device with the publish-subscribe protocol; and send the additional first security ticket, which includes an additional first key, to the first device; wherein the role is unequal to the additional role. ### Claim 7 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to: receive an additional first request, for an additional first security ticket, from the first device, wherein the additional first request includes: (a)(i) an additional first device identity credential corresponding to an additional role for the first device with the publish-subscribe protocol, and (a)(ii) an additional first filter element associated with the publish-subscribe protocol; send the additional first security ticket, which is restricted to the additional first filter element and includes an additional first key, to the first device; wherein the role is unequal to the additional role and the first filter element is unequal to the additional first filter element. ### Claim 8 (depends on 7) The at least one computer readable storage medium of claim 7, wherein the role is one of publisher and subscriber and the additional role is another of publisher and subscriber. ### Claim 9 (depends on 1) The at least one computer readable storage medium of claim 1, wherein the first identity credential includes a certificate from a certificate authority that attests to the role for the first device. ### Claim 10 (depends on 1) The at least one computer readable storage medium of claim 1, wherein the first filter element includes one of a topic for a topic-based publish-subscribe protocol and a defined constraint for a content-based publish-subscribe protocol. ### Claim 11 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to: receive the first request from the first device via an unsecure public internet domain; send the first security ticket to the first device via the unsecure public internet domain; receive the second request from the second device via the unsecure public internet domain; and send the second security ticket to the second device via the unsecure public internet domain. ### Claim 12 (depends on 1) The at least one computer readable storage medium of claim 1, further comprising instructions that when executed enable the system to: receive a third request, to delete the symmetric group key, from at least one of the first device, the second device, and a third device; and delete the symmetric group key. ### Claim 13 (depends on 1) The at least one computer readable storage medium of claim 1, wherein the symmetric group key is a temporal session key. ### Claim 14 At least one computer readable storage medium comprising instructions that when executed enable a first device to: request enrollment of the first device with an identity provider, the enrollment including a role for the first device for a publish-subscribe protocol of a distributed network; receive a first device identity credential, from the identity provider and corresponding to the role, and store the first device identity credential in a memory of the first device; send a first request, for a first security ticket, to a key manager, wherein the first request includes: (a)(i) the first device identity credential, and (a)(ii) a first filter element associated with the a publish-subscribe protocol; and receive the first security ticket, which is restricted to the first filter element and includes a first key, from the key manager. ### Claim 15 (depends on 14) The at least one computer readable storage medium of claim 14, further comprising instructions that when executed enable the first device to: send a second request, for a second security ticket, to the key manager, wherein (b)(i) the first device is a publisher for the first filter element, and (b)(ii) the second request includes the first filter element; and receive the second security ticket from the key manager, the second security ticket being restricted to the first filter element and including a second key that is a symmetric group key. ### Claim 16 (depends on 15) The at least one computer readable storage medium of claim 15, further comprising instructions that when executed enable the first device to: receive content, for the first filter element, which is encrypted by the second key; and decrypt the content with the second key. ### Claim 17 (depends on 16) The at least one computer readable storage medium of claim 16, wherein the first device is one of a subscriber and a broker for the first filter element. ### Claim 18 (depends on 16) The at least one computer readable storage medium of claim 16, wherein the first security ticket includes the first device identity credential, which corresponds to a first set of publish-subscribe protocol privileges. ### Claim 19 (depends on 14) The at least one computer readable storage medium of claim 14, further comprising instructions that when executed enable the first device to: request an additional enrollment of the first device with the identity provider, the additional enrollment including an additional role for the first device for the publish-subscribe protocol; receive an additional first device identity credential, from the identity provider and corresponding to the additional role, and store the additional first device identity credential in the memory of the first device; send an additional first request, for an additional first security ticket, to the key manager, wherein the additional first request includes the additional first device identity credential; and receive the additional first security ticket, which includes an additional first key, from the key manager; wherein the role is unequal to the additional role. ### Claim 20 (depends on 14) The at least one computer readable storage medium of claim 14, further comprising instructions that when executed enable the first device to: send an additional first request, for an additional first security ticket, to the key manager, wherein the additional first request includes: (a)(i) an additional first device identity credential corresponding to an additional role for the first device with the publish-subscribe protocol, and (a)(ii) an additional first filter element associated with the publish-subscribe protocol; receive the additional first security ticket, which is restricted to the additional first filter element and includes an additional first key, from the key manager; wherein the role is unequal to the additional role and the first filter element is unequal to the additional first filter element. ### Claim 21 (depends on 14) The at least one computer readable storage medium of claim 14, wherein the first identity credential includes a certificate from a certificate authority that attests to the role for the first device. ### Claim 22 (depends on 15) The at least one computer readable storage medium of claim 15, further comprising instructions that when executed enable the first device to send a third request to delete the symmetric group key to the key manager. ### Claim 23 An apparatus comprising: at least one memory; and at least one processor, coupled to the memory, to perform operations comprising: request at least one enrollment with at least on identity provider, the enrollment including at least one role for the apparatus for a publish-subscribe protocol of a distributed network; receive at least one first identity credential, from the at least one identity provider and corresponding to the at least on role, and store the at least one first device identity credential in the at least one memory; send at least one first request, for at least one first security ticket, to at least one key manager, wherein the at least one first request includes: (a)(i) the at least one first identity credential, and (a)(ii) at least one first filter element associated with the a publish-subscribe protocol; and receive the at least one first security ticket, restricted to the at least one first filter element and including at least one first key, from the at least one key manager. ### Claim 24 (depends on 23) The apparatus of claim 23, wherein the operations comprise: send at least one second request, for at least one second security ticket, to the at least one key manager, wherein (b)(i) the apparatus is a publisher for the at least one first filter element, and (b)(ii) the at least one second request includes the at least one first filter element; and receive the at least one second security ticket from the at least one key manager, the at least one second security ticket being restricted to the at least one first filter element and including at least one second key receive content, for the at least one first filter element, which is encrypted by the at least one second key; and decrypt the content with the at least one second key.