| CPC H04L 9/085 (2013.01) [G06F 21/602 (2013.01); H04L 9/08 (2013.01); H04L 9/0819 (2013.01); H04L 9/083 (2013.01); H04L 9/088 (2013.01); H04L 9/0891 (2013.01); H04L 9/321 (2013.01); H04L 9/3242 (2013.01); H04L 9/3247 (2013.01); H04L 9/3268 (2013.01); H04L 63/0853 (2013.01); H04W 12/0431 (2021.01); H04W 12/069 (2021.01); H04W 12/35 (2021.01); H04W 12/73 (2021.01)] | 25 Claims |
|
1. A method of generating, distributing, and managing a lifecycle of symmetric pre-shared keys (PSKs) used in certificate-less keyed hash message authentication code (HMAC) based content signing for supply chain tamper resistance, for use between applications executing on distributed devices including a broker application executing on a broker device, a consumer application executing respectively on a consumer device, a key distribution service (KDS), a KDS proxy, a KDS interface, a symmetric KDS member M-PSK, a M-PSK identity hint, a tenant identifier, a device group identifier associated with the tenant identifier, a member domain associated with the group identifier, an application identifier associated with the group identifier, a key record, a dynamic host configuration protocol (DHCP) server, and a domain name system (DNS) server, the method comprising:
authenticating, with the KDS, by the broker application executing on the broker device, using the tenant identifier, the symmetric KDS member PSK (M-PSK) and the M-PSK identity hint, wherein the broker device is registered by a DNS hostname on the DNS server configured with the KDS or the KDS proxy, and configured as a first member of a device group on the KDS;
receiving, by the broker application, signed digital content and an associated signature manifest;
creating, by the broker application, an additional pre-shared key on the KDS;
signing, by the broker application, the received signed digital content using the created pre-shared key to generate an extended signed digital content;
appending, by the broker application, the tenant identifier, the group identifier, an additional digital signature, and an additional associated pre-shared key identity hint to the received signature manifest to generate an extended signature manifest;
sending, by the broker application to the consumer application, the extended signed digital content and an associated extended signature manifest;
authenticating, with the KDS, by the consumer application executing respectively on the consumer device, using the tenant identifier, the symmetric KDS member PSK (M-PSK) and the M-PSK identity hint, wherein the consumer device is registered by a DNS hostname on the DNS server, configured with the KDS or the KDS proxy, and is configured as a second member of the device group on the KDS;
receiving, by the consumer application, the extended signed digital content and the associated extended signature manifest with the tenant identifiers, the group identifiers, digital signatures, and pre-shared key identity hints;
retrieving, by the consumer application from the KDS, using at least the tenant identifier, the group identifier, and the pre-shared key identity hint, the pre-shared keys for the pre-shared key identity hints in the received extended signature manifest; and
verifying, by the consumer application, the received extended signed digital content using the retrieved pre-shared keys to regenerate the digital signatures and to compare for a match with respective digital signatures associated with respective identity hints in the received extended signature manifest.
|