Systems and methods for “machine-to-machine” (M2M) communications between modules, servers, and an application using public key infrastructure (PKI)

A method for supporting machine-to-machine communications, the method performed by a server, the method comprising:

• authenticating a first message, wherein the first message includes a first module public key and a module identity that comprises a first string, wherein the server sends a first security token before receiving the first message, and wherein the server uses the first module public key to authenticate a second message;
• receiving the second message, wherein the second message includes (i) the module identity, (ii) a module encrypted data, and (iii) a first source Internet Protocol address and port (IP:port) number, wherein the module encrypted data includes a sensor measurement and the first security token, wherein the module identity in the second message comprises a second string, and wherein the first string and the second string are associated with a serial number of a module;
• reading the sensor measurement by decrypting the module encrypted data using a first server private key;
• using a secure connection and a second server private key to send the sensor measurement and the module identity to an application server;
• sending a response, wherein the response includes a key generation command and a set of parameters for a public key infrastructure (PKI) key pair generation algorithm;
• authenticating a third message using the authenticated first module public key, wherein the third message includes (i) a second module public key, (ii) the module identity, (iii) a module public key identity, and (iv) a second source IP:port number, wherein the first source IP:port number and the second source IP:port number differ from one another, wherein the first module public key and the second module public key differ from one another, and wherein the second module public key is formatted with the set of parameters;
• and,
• authenticating a fourth message using the authenticated second module public key, wherein the fourth message includes the module public key identity, the module identity, and a second security token.

A system for supporting machine-to-machine communications, the system comprising:

• a memory for recording a set of cryptographic algorithms, wherein the cryptographic algorithms (i) use a first server private key associated with a first set of parameters, (ii) use a second server private key associated with a second set of parameters, and (iii) authenticate a first message, wherein the first message includes a module public key and a module identity that comprises a first string;
• a hardware processor for:
• receiving at a destination Internet Protocol address and port (IP:port) number a first security token in a second message, wherein the second message further includes the module identity, wherein the module identity in the second message comprises a second string, and wherein the first string and the second string are associated with a serial number of a module,
• sending (i) a server digital signature for the first security token using the first server private key and (ii) a second security token,
• receiving a module encrypted data and the module identity, wherein the module encrypted data includes a sensor measurement and the second security token,
• deriving a symmetric ciphering key using the first server private key and the authenticated module public key,
• using the derived symmetric ciphering key to decrypt the module encrypted data,
• ciphering a module instruction within a server encrypted data, wherein the module instruction is ciphered using the derived symmetric ciphering key, and,
• after (a) receiving a third message which includes (i) the module identity, (ii) a source IP:port number, and (iii) the destination IP:port number, then (b) sending the ciphered module instruction to the source IP:port number from the destination IP:port number;
• and,
• a physical interface for establishing a secure connection with an application using the second server private key and the second set of parameters, for sending the sensor measurement and the module identity to the application via the secure connection, and for receiving the module instruction from the application.