公开(公告)号：US10129223B1

公开(公告)日：2018-11-13

申请号：US15360862

申请日：2016-11-23

Applicant: Amazon Technologies, Inc.

Inventor： Ramkishore Bhattacharyya ,  Amit Mhatre ,  Ashutosh Thakur ,  Atulya S. Beheray ,  Rameez Loladia

IPC: H04L29/06 ,  H04L9/08 ,  H04L9/30 ,  H04L9/14 ,  H04L9/06

Abstract: A lightweight network protocol provides mutual authentication and encryption of a communication channel in environments where the amount of computing resources available to the networked devices is constrained. When a new device is added to a network, the device contacts a registration service and provides information that is published via a device directory. The network entity locates the device via information provided by the device directory, and establishes an encrypted network connection with the device. A shared secret is established between the device and the network entity using a key-exchange protocol. Consecutive messages that are sent or received are encrypted or decrypted with a sequence of cryptographic keys generated based at least in part on the shared secret. Key-exchange parameters are added to message exchanges between the device and the network entity to facilitate regenerating the shared secret.

公开(公告)号：US11128612B1

公开(公告)日：2021-09-21

申请号：US16582653

申请日：2019-09-25

Applicant: Amazon Technologies, Inc.

Inventor： Rameez Loladia ,  Ramkishore Bhattacharyya ,  Ashutosh Thakur ,  Atulya S. Beheray

IPC: H04L29/06

Abstract: Techniques are disclosed for provisioning device-specific credentials to an Internet of Things device that accesses a cloud-based IoT service. The IoT service receives, from the IoT device, a request for device-specific credentials. The request comprises a provisioning certificate including information identifying a group of devices associated with the IoT device. The provisioning certificate is authenticated by evaluating the information with expected information. The device-specific credentials are generated based, at least in part, on the information provided in the provisioning certificate. The device-specific credentials are sent to the IoT device, and the IoT device installs and activates the device-specific credentials. The device-specific credentials are associated with the IoT device in a registry of the IoT service.

公开(公告)号：US20200252396A1

公开(公告)日：2020-08-06

申请号：US16852220

申请日：2020-04-17

Applicant: Amazon Technologies, Inc.

Inventor： Ramkishore Bhattacharyya ,  Amit J. Mhatre ,  Ashutosh Thakur ,  Atulya S. Beheray ,  Rameez Loladia

IPC: H04L29/06 ,  H04L9/32 ,  H04L9/30 ,  H04L9/14

Abstract: A network protocol provides mutual authentication of network-connected devices that are parties to a communication channel in environments where the amount of memory and processing power available to the network-connected devices is constrained. When a new device is added to a network, the device contacts a registration service and provides authentication information that proves the authenticity of the device. After verifying the authenticity of the device, the registration service generates a token that can be used to by the device to authenticate with other network entities, and provides the token to the device. The registration service publishes the token using a directory service. When the device connects to another network entity, the device provides the token to the other network entity, and the other network entity authenticates the device by verifying the token using the directory service.

公开(公告)号：US10447683B1

公开(公告)日：2019-10-15

申请号：US15354869

申请日：2016-11-17

Applicant: Amazon Technologies, Inc.

Inventor： Rameez Loladia ,  Ramkishore Bhattacharyya ,  Ashutosh Thakur ,  Atulya S. Beheray

IPC: H04L29/06

Abstract: Techniques are disclosed for provisioning device-specific credentials to an Internet of Things device that accesses a cloud-based IoT service. The IoT service receives, from the IoT device, a request for device-specific credentials. The request comprises a provisioning certificate including information identifying a group of devices associated with the IoT device. The provisioning certificate is authenticated by evaluating the information with expected information. The device-specific credentials are generated based, at least in part, on the information provided in the provisioning certificate. The device-specific credentials are sent to the IoT device, and the IoT device installs and activates the device-specific credentials. The device-specific credentials are associated with the IoT device in a registry of the IoT service.

公开(公告)号：US20190097982A1

公开(公告)日：2019-03-28

申请号：US16186425

申请日：2018-11-09

Applicant: Amazon Technologies, Inc.

Inventor： Ramkishore Bhattacharyya ,  Amit J. Mhatre ,  Ashutosh Thakur ,  Atulya S. Beheray ,  Rameez Loladia

IPC: H04L29/06 ,  H04L9/08 ,  H04L9/14 ,  H04L9/06 ,  H04L9/30

CPC classification number: H04L63/0435 ,  H04L9/0841 ,  H04L9/0861 ,  H04L9/14 ,  H04L9/321 ,  H04L63/061 ,  H04L63/0869 ,  H04L2463/061

Abstract: A lightweight network protocol provides mutual authentication and encryption of a communication channel in environments where the amount of computing resources available to the networked devices is constrained. When a new device is added to a network, the device contacts a registration service and provides information that is published via a device directory. The network entity locates the device via information provided by the device directory, and establishes an encrypted network connection with the device. A shared secret is established between the device and the network entity using a key-exchange protocol. Consecutive messages that are sent or received are encrypted or decrypted with a sequence of cryptographic keys generated based at least in part on the shared secret. Key-exchange parameters are added to message exchanges between the device and the network entity to facilitate regenerating the shared secret.