Apparatus and method for securely tracking event attendees using IOT devices

• US 10,015,766 B2
• Filed: 07/14/2015
• Issued: 07/03/2018
• Est. Priority Date: 07/14/2015
• Status: Active Grant

• Current Assignee: Afero, Inc.
• Original Assignee: Afero, Inc.
• Inventors: Britt, Joe
• Primary Examiner(s): Henning, Matthew T
• Application Number:
  US14/799,436
• Publication Number:
  US 20170019873A1
• Time in Patent Office: 1,085 Days
• Field of Search: 713175
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06Q 30/0261 based on user location
• CPC Class Codes: G06Q 30/0267 Wireless devices
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0656 Pseudorandom key sequence combined element-for-element with data sequence, e.g. one-time-pad [OTP] or Vernam's cipher
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/043 using a trusted network node as an anchor
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/02 Services making use of location information
• CPC Class Codes: H04W 4/029 Location-based management or tracking services
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 76/14 Direct-mode setup

Abstract

Associating each of a plurality of an Internet of Things (IoT) devices with a different attendee at an event, the IoT devices configured to form local wireless connections with one or more IoT hubs or client devices; as a first attendee moves around the event, periodically establishing a local wireless connection between a first IoT device associated with the first attendee and the IoT hubs or client devices within range of the first IoT device; transmitting one or more data packets from the IoT hubs or client devices to an IoT service over the Internet, the data packets including data identifying the first attendee, the first IoT device, and the IoT hubs or client devices to which the first IoT device establishes the local wireless connections, the IoT service storing the data in a database and using the data to determine portions of the event visited by the first attendee.

Claims

1. A method comprising:

associating each of a plurality of an Internet of Things (IoT) devices with a different attendee at an event, the IoT devices configured to form local wireless connections with one or more IoT hubs or client devices, each of the one or more IoT hubs and client devices having an event location associated therewith, at least some event locations associated with the IoT hubs or client devices are determined dynamically using Global Positioning System (GPS) circuitry integrated within the IoT hubs or client devices;

as a first attendee moves around the event, periodically establishing a local wireless connection between a first IoT device associated with the first attendee and one or more IoT hubs or client devices within range of the first IoT device;

transmitting one or more data packets from the one or more IoT hubs or client devices to an IoT service over the Internet, the data packets including data identifying the first attendee, the first IoT device, and one or more IoT hubs or client devices to which the first IoT device establishes the local wireless connections and their associated event locations, the IoT service storing the data from the data packets in a database; and

using the data stored in the database to determine portions of the event visited by the first attendee.

2. The method as in claim 1, further comprising using the event locations associated with the IoT hubs or client devices to determine the portions of the event visited by the first attendee.

3. The method as in claim 2 wherein at least some event locations associated with the IoT hubs or client devices are determined prior to the event, based on where the IoT hubs or client devices are positioned within the event.

4. The method as in claim 1 wherein the local wireless connection between the first IoT device and the one or more IoT hubs or client devices comprises a connection using a low-power wireless communication technology.

5. The method as in claim 4 wherein the one or more IoT hubs or client devices include local wireless network or cellular data network interfaces to communicatively couple the IoT hubs or client devices to the IoT service over the Internet.

6. The method as in claim 1 wherein the data packets further include times at which the IoT device established the local wireless connections with the IoT hubs or client devices.

7. The method as in claim 1 wherein a secure communication channel is established between the IoT service and the first IoT device through the IoT hubs or client devices by performing the operations of:

generating a service public key and a service private key by key generation logic of a first encryption engine on the IoT service;

generating a device public key and a device private key by key generation logic of a second encryption engine on the IoT device;

transmitting the service public key from the first encryption engine to the second encryption engine and transmitting the device public key from the second encryption engine to the first encryption engine;

generating a secret using the device public key and the service private key;

generating the same secret using the service public key and the device private key; and

encrypting and decrypting data packets transmitted between the first encryption engine and the second encryption engine using the secret or using data structures derived from the secret.

8. The method as in claim 7 wherein the key generation logic comprises a hardware security module (HSM).

9. The method as in claim 7 wherein the data structures derived from the secret comprise a first key stream generated by the first encryption engine and a second key stream generated by the second encryption engine.

10. The method as in claim 9 wherein a first counter is associated with the first encryption engine and a second counter is associated with the second encryption engine, the first encryption engine incrementing the first counter responsive to each data packet transmitted to the second encryption engine and the second encryption engine incrementing the second counter responsive to each data packet transmitted to the first encryption engine.

11. The method as in claim 10 wherein the first encryption engine generates the first key stream using a current counter value of the first counter and the secret and the second encryption engine generates the second key stream using a current counter value of the second counter and the secret.

12. The method as in claim 11 wherein the first encryption engine comprises an elliptic curve method (ECM) module to generate the first key stream using the first counter value and the secret and the second encryption engine comprises an ECM module to generate the second key stream using the first counter value and the first secret.

13. The method as in claim 1 wherein each of the IoT hubs or client devices include first local wireless communication modules to establish local wireless communication channels with second local wireless communication modules on the IoT devices;

each of the first local wireless communication modules managing a data structure comprising a set of characteristics, each characteristic identified with an characteristic ID and having a value buffer associated therewith containing data associated with the characteristic;

the first wireless communication modules to form first network sockets using the data structure by defining a first characteristic for receiving data packets transmitted by the second local wireless communication modules and a second characteristic for transmitting outgoing data packets to the second local wireless communication modules;

wherein the incoming data packets are to be temporarily buffered in a first value buffer associated with the first characteristic and wherein the outgoing packets are to be temporarily buffered in a second value buffer associated with the second characteristic.

14. A system comprising:

a plurality of an Internet of Things (IoT) devices, each IoT device associated with a different attendee at an event location;

one or more IoT hubs or client devices at the event location, wherein the IoT devices are configured to form local wireless connections with the IoT hubs or client devices at the event, each of the one or more IoT hubs and client devices having an event location associated therewith, at least some event locations associated with the IoT hubs or client devices are determined dynamically using Global Positioning System (GPS) circuitry integrated within the IoT hubs or client devices;

a first IoT device associated with a first attendee to periodically establish local wireless connections with the IoT hubs or client devices within range of the first IoT device;

the IoT hubs or client devices to transmit one or more data packets to an IoT service over the Internet, the data packets including data identifying the first attendee, the first IoT device, and one or more IoT hubs or client devices to which the first IoT device establishes the local wireless connections and their associated event locations, the IoT service storing the data from the data packets in a database; and

the data stored in the database usable to determine portions of the event visited by the first attendee.

15. The system as in claim 14, wherein the event locations associated with the IoT hubs or client devices are used to determine the portions of the event visited by the first attendee.

16. The system as in claim 15 wherein at least some event locations associated with the IoT hubs or client devices are determined prior to the event, based on where the IoT hubs or client devices are positioned within the event.

17. The system as in claim 14 wherein the local wireless connection between the first IoT device and the one or more IoT hubs or client devices comprises a using a low-power wireless communication technology.

18. The system as in claim 17 wherein the one or more IoT hubs or client devices include local wireless network or cellular data network interfaces to communicatively couple the IoT hubs or client devices to the IoT service over the Internet.

19. The system as in claim 14 wherein the data packets further include times at which the IoT device established the local wireless connections with the IoT hubs or client devices.

20. The system as in claim 14 wherein a secure communication channel is established between each IoT device and the IoT service through the IoT hubs or client devices, the system further comprising:

a first encryption engine on the IoT service comprising key generation logic to generate a service public key and a service private key;

a second encryption engine on the IoT device comprising key generation logic to generate a device public key and a device private key;

the first encryption engine to transmit the service public key to the second encryption engine and the second encryption engine to transmit the device public key to the first encryption engine;

the first encryption engine to use the device public key and the service private key to generate a secret;

the second encryption engine to use the service public key and the device private key to generate the same secret; and

wherein once the secret is generated, the first encryption engine and the second encryption engine encrypt and decrypt data packets transmitted between the first encryption engine and the second encryption engine using the secret or using data structures derived from the secret.

21. The system as in claim 20 wherein the key generation logic comprises a hardware security module (HSM).

22. The system as in claim 20 wherein the data structures derived from the secret comprise a first key stream generated by the first encryption engine and a second key stream generated by the second encryption engine.

23. The system as in claim 22 wherein a first counter is associated with the first encryption engine and a second counter is associated with the second encryption engine, the first encryption engine incrementing the first counter responsive to each data packet transmitted to the second encryption engine and the second encryption engine incrementing the second counter responsive to each data packet transmitted to the first encryption engine.

24. The system as in claim 23 wherein the first encryption engine generates the first key stream using a current counter value of the first counter and the secret and the second encryption engine generates the second key stream using a current counter value of the second counter and the secret.

25. The system as in claim 24 wherein the first encryption engine comprises an elliptic curve method (ECM) module to generate the first key stream using the first counter value and the secret and the second encryption engine comprises an ECM module to generate the second key stream using the first counter value and the first secret.

26. The system as in claim 23 wherein each of the IoT hubs or client devices include first local wireless communication modules to establish local wireless communication channels with second local wireless communication modules on the IoT devices;

each of the first local wireless communication modules managing a data structure comprising a set of characteristics, each characteristic identified with an characteristic ID and having a value buffer associated therewith containing data associated with the characteristic;

the first wireless communication modules to form first network sockets using the data structure by defining a first characteristic for receiving data packets transmitted by the second local wireless communication modules and a second characteristic for transmitting outgoing data packets to the second local wireless communication modules;

wherein the incoming data packets are to be temporarily buffered in a first value buffer associated with the first characteristic and wherein the outgoing packets are to be temporarily buffered in a second value buffer associated with the second characteristic.