Secure tunnels for the internet of things

• US 10,097,517 B2
• Filed: 09/01/2016
• Issued: 10/09/2018
• Est. Priority Date: 09/01/2016
• Status: Active Grant

• Current Assignee: Zitovault, Inc.
• Original Assignee: CyberSight Inc.
• Inventors: McElwee, Timothy, Ding, Gang, Keidar, Ron
• Primary Examiner(s): Rahman, Mahfuzur
• Application Number:
  US15/254,368
• Publication Number:
  US 20180063079A1
• Time in Patent Office: 768 Days
• CPC Class Codes: H04L 12/2854 Wide area networks, e.g. public data networks
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2898 Subscriber equipments DSL modems H04M11/062; cable modems H04L12/2801
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/14 using software, i.e. software packages network security related monitoring H04L63/1408
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation

Abstract

A system for the maintenance and creation of security tunnels between IoT devices and IoT cloud servers, comprising the steps of receiving one or more packets from one or more IoT devices in a smart router, routing the one or more packets to an agent within the router, the agent performing one or more services on the one or more packets, routing the one or more packets to a WAN port of the router, and sending the one or more packets by a cloud secure tunnel to one or more IoT cloud servers. The system may have secure tunnels that are formed between the IoT devices using a unique password for each IoT device. The additional step of selectively stopping communication between the IoT devices and the router, wherein when the communication of one IoT device to the router is compromised, the remaining tunnels with unique passwords are integral.

Claims

1. A method for the maintenance and creation of security tunnels between IoT devices and IoT cloud servers, comprising the steps of:

a. receiving one or more packets from one or more IoT devices;

b. decrypting the one or more packets with a first protocol;

c. re-encrypting the one or more packets with a second protocol;

d. sending the one or more packets by a cloud secure tunnel to one or more IoT cloud servers; and

e. receiving configuration information,

wherein secure tunnels are formed between the one or more IoT devices and a smart router using a unique password for each IoT device, and

wherein the router uses a look-up table to find the password for an IoT device based on its MAC address, and to attribute the communication to the IoT device.

2. The method of claim 1, further comprising the step of selectively stopping communication between the IoT devices and the smart router in connection with the communication of one IoT device to the router being compromised.

3. The method of claim 1, wherein the router uses a look-up table to find the password for an IoT device based on its MAC address, and to attribute the communication to the IoT device.

4. The method of claim 1, further comprising a step of performing a second authorization.

5. The method of claim 1, wherein the router filters the one or more packets incoming from the IoT devices by network addresses, ports connection state, or application level filtering.

6. A device for the maintenance and creation of security tunnels between IoT devices and IoT cloud servers, comprising:

a. a router comprising;

i. an IoT port adapted to wirelessly connect to one or more IoT devices;

ii. a WAN port adapted to connect to one or more IoT cloud servers;

iii. a filter separating packets passing through the router from IoT cloud packets that have a destination address of at least one IoT cloud server;

iv. an agent means for providing one or more services to be administered to a packet entering the agent;

v. a direct line to the WAN port for the packets passing through;

vi. a first active service path connected between the IoT filter and the agent;

vii. a second active service path connected between the agent and the WAN filter, the paths adapted for transmission of the IoT cloud packets;

viii. a WAN port connected to the WAN filter, adapted to forward the IoT packets; and

b. a configuration agent securely connected to the router, adapted to securely provide configuration information from the IoT cloud to the router,

wherein the one or more services comprise at least decrypting the packet with a first protocol and re-encrypting the packet with a second protocol.

7. The device of claim 6 wherein the decrypting the packet uses a first cryptographic algorithm, and wherein the encrypting the packet uses a second cryptographic algorithm.

8. A smart router having a processor for communication with one or more IoT devices, the processor comprising:

a. an IoT port adapted to wirelessly connect to the one or more IoT devices;

b. a WAN port adapted to connect to one or more IoT cloud servers;

c. an agent providing one or more services to be administered to a packet entering the agent;

d. an IoT filter separating packets passing through the router from one of the one or more IoT devices that have a destination address of another of the one or more IoT devices;

e. a first active service path connected between the IoT filter and the agent;

f. a WAN filter separating packets passing through the router from IoT cloud packets that have a destination address of at least one IoT cloud server;

g. a direct line to the WAN port for the packets passing through; and

h. a secure connection to a configuration agent to provide configuration information to the agent of the smart router,

wherein the one or more services to be administered by the agent comprises at least decrypting the packet and re-encrypting the packet.

9. The smart router of claim 8, further comprising a second active service path connected between the IoT filter and the agent.