Abstract: A blockchain-based system for manages the root of trust for a swarm of deployed devices and maintains separation between the control and data planes of the device network through policies distributed from the blockchain via a message broker system and enforced in the secure processing environment of the devices. The blockchain is operated by a set of stakeholder entities that provide consensus for adding transactions to the blockchain or channels thereof, which comprise attestation data for use by the devices during onboarding, firmware installation and updates, and policy updates. Devices subscribe to message topics on a message broker system to obtain control plane and data plane messages. Access to message topics is managed by rules enforced by the secure processing environment.

Abstract: A system and method for managing a plurality of network-enabled client devices such as Internet of Things (IoT) and smart devices employs a distributed ledger or blockchain to store security-related information for each client device. Access to the distributed ledger is provided through a proxy computing system that is configured to exchange security-related messages with the client devices over a first communication path, which may be over a public network; and to engage in transactions with or query the distributed ledger on behalf of the client devices over a second communication path, which is a private channel Vendible data published by the client devices may be routed by the proxy computing system to a data broker or publishing system in a manner that removes identifying information from the vendible data.

Abstract: A system and method for managing a plurality of network-enabled client devices such as networking equipment and Internet of Things (IoT) devices which employs a distributed ledger, or blockchain, to store network configuration information for each client device. Access to the distributed ledger may be provided through a proxy computing system that is configured to exchange control messages with the client devices. Network configuration information is defined in smart contracts stored in the distributed ledger which are executed on registration of the network-enabled client device in the distributed ledger.

Abstract: A system and method of determining an attestation or identity score of a user of a communication device employs metadata stored in a plurality of client devices, such as IoT devices. A request for attestation, comprises a unique identifier associated with the communication device and an input or shared value. The unique identifier is used to identify, in a distributed ledger (blockchain), client devices that are paired with the communication device. Metadata stored in association with each of the client devices is retrieved and compared to the input or shared value, and a sub-identity score is determined based on the extent to which there is a match and the reliability of the client device. The sub-identity scores are combined to obtain an identity score reflecting a confidence level in the user and/or communication device.

Abstract: A hybrid encryption scheme links a first public key encryption (PKE) scheme with a second PKE scheme through a true random or pseudo-random element, which is used by a sender to encapsulate a symmetrically encrypted message and its associated symmetric key to generate a pair of ciphertexts for transmission to a recipient. The recipient decrypts and decapsulates the ciphertexts, retrieves the random element, and may conduct one or more verification steps to ensure that the ciphertexts were well-formed, and to detect any re-encryption or encapsulation attacks. To encrypt a message, the message and initial random value are encrypted with a symmetric key to provide an intermediate ciphertext. The symmetric key and the encrypted message-value are each encapsulated by distinct algorithms using distinct values derived from the initial random value, such as different hashes, and public keys to provide first and second ciphertexts.

Abstract: A system and method for managing a plurality of network-enabled client devices such as networking equipment and Internet of Things (IoT) devices which employs a distributed ledger, or blockchain, to store network configuration information for each client device. Access to the distributed ledger may be provided through a proxy computing system that is configured to exchange control messages with the client devices. Network configuration information is defined in smart contracts stored in the distributed ledger which are executed on registration of the network-enabled client device in the distributed ledger.

Abstract: A system and method for managing a plurality of network-enabled client devices such as Internet of Things (IoT) and smart devices employs a distributed ledger or blockchain to store security-related information for each client device. Access to the distributed ledger is provided through a proxy computing system that is configured to exchange security-related messages with the client devices over a first communication path, which may be over a public network; and to engage in transactions with or query the distributed ledger on behalf of the client devices over a second communication path, which is a private channel. Vendible data published by the client devices may be routed by the proxy computing system to a data broker or publishing system in a manner that removes identifying information from the vendible data.

Abstract: A hybrid encryption scheme links a first public key encryption (PKE) scheme with a second PKE scheme through a true random or pseudo-random element, which is used by a sender to encapsulate a symmetrically encrypted message and its associated symmetric key to generate a pair of ciphertexts for transmission to a recipient. The recipient decrypts and decapsulates the ciphertexts, retrieves the random element, and may conduct one or more verification steps to ensure that the ciphertexts were well-formed, and to detect any re-encryption or encapsulation attacks. To encrypt a message, the message and initial random value are encrypted with a symmetric key to provide an intermediate ciphertext. The symmetric key and the encrypted message-value are each encapsulated by distinct algorithms using distinct values derived from the initial random value, such as different hashes, and public keys to provide first and second ciphertexts.

Abstract: A system and method for managing a plurality of network-enabled client devices such as networking equipment and Internet of Things (IoT) devices which employs a distributed ledger, or blockchain, to store network configuration information for each client device. Access to the distributed ledger may be provided through a proxy computing system that is configured to exchange control messages with the client devices. Network configuration information is defined in smart contracts stored in the distributed ledger which are executed on registration of the network-enabled client device in the distributed ledger.

Abstract: A system and method of determining an attestation or identity score of a user of a communication device employs metadata stored in a plurality of client devices, such as IoT devices. A request for attestation, comprises a unique identifier associated with the communication device and an input or shared value. The unique identifier is used to identify, in a distributed ledger (blockchain), client devices that are paired with the communication device. Metadata stored in association with each of the client devices is retrieved and compared to the input or shared value, and a sub-identity score is determined based on the extent to which there is a match and the reliability of the client device. The sub-identity scores are combined to obtain an identity score reflecting a confidence level in the user and/or communication device.