Secure PKI communications for “machine-to-machine” modules, including key derivation by modules and authenticating public keys

A method for a server to receive a sensor measurement through a local area network (LAN) interface, the server including at least one computer processor for performing the steps of the method, the method comprising:

• recording (i) a module identity for a module and (ii) a shared secret key;
• sending via the LAN interface (i) a set of parameters for deriving a module public key and a module private key, (ii) a first security token, and (iii) a first server digital signature, wherein the set of parameters includes a value for an elliptic curve and a key length, wherein the first server digital signature uses the first security token as a first nonce;
• receiving via the LAN interface a first message from a module that includes the module identity, the module public key derived from the set of parameters, and the first security token, wherein the server uses the module identity to select the shared secret key from a database, and wherein the first message is authenticated using the selected shared secret key;
• receiving at a port number with the LAN interface a second message from the module that includes the module identity, a module encrypted data, a second security token, and a module digital signature, wherein the module encrypted data (i) includes the sensor measurement and (ii) is decrypted using a private key for the server, wherein the module digital signature uses the second security token as a second nonce;
• using the module identity received in the second message to select the module public key, wherein the module digital signature is verified using the selected module public key;
• encrypting a module instruction using the selected module public key;
• and,
• sending from the port number with the LAN interface to the module a response to the second message, wherein the response includes a server encrypted data and a second server digital signature, wherein the server encrypted data includes the encrypted module instruction, and wherein the second server digital signature uses the second security token.

A method for a hardware module with a radio to use a public key and a private key, the method performed by the hardware module, the method comprising:

• receiving a set of parameters, wherein the set of parameters includes a value for an elliptic curve and a key length;
• deriving the private key and the public key using (i) a key pair generation algorithm with the received set of parameters, wherein the hardware module records the derived private key in a nonvolatile memory, wherein the derived private key is used at least, in part, for processing a module digital signature, and wherein the hardware module authenticates with the module digital signature;
• reading (i) an identity for the module using a read-only address in the hardware module, and (ii) a shared secret key from the nonvolatile memory;
• transmitting via the radio a first message, wherein the first message includes the identity and a first module encrypted data, wherein the first module encrypted data includes the public key, and wherein the first module encrypted data is encrypted using (a) a symmetric ciphering algorithm and (b) the shared secret key;
• transmitting via the radio a second message from an interne protocol address and port (IP:port) number, wherein the second message includes a second module encrypted data and the module identity, wherein the second module encrypted data (i) includes a sensor measurement and (ii) is encrypted using a symmetric key, wherein the public key is used to process the symmetric key;
• and,
• receiving via the radio a response at the IP:port number, wherein the response includes a server encrypted data, and wherein the server encrypted data includes a module instruction, and wherein the server encrypted data is decrypted using the symmetric key.