System and method for securely connecting network devices

• US 10,291,595 B2
• Filed: 11/28/2017
• Issued: 05/14/2019
• Est. Priority Date: 12/18/2014
• Status: Active Grant

• Current Assignee: Afero, Inc.
• Original Assignee: Afero, Inc.
• Inventors: Britt, Joe, Matsumura, Shin, Forood, Houman, Zimmerman, Scott, Myles, Phillip, Zawicki, Sean, Kutami, Daisuke, Holland, Shannon
• Primary Examiner(s): Plecha, Thaddeus J
• Application Number:
  US15/824,173
• Publication Number:
  US 20180152420A1
• Time in Patent Office: 532 Days
• CPC Class Codes: H04L 12/2854 Wide area networks, e.g. public data networks
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 12/77 Graphical identity
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A platform, apparatus and method for Internet of Things Implementations. For example, one embodiment of a system comprises: an Internet of Things (IoT) hub comprising a network interface to couple the IoT hub to an IoT service over a wide area network (WAN), and programming logic to program an identification device with one or more encryption keys usable to establish encrypted communication with an IoT device; and at least one IoT device interfacing with the identification device following programming of the identification device by the IoT hub; wherein once the identification device is programmed and interfaced with the IoT device, the IoT device uses the one or more keys to establish a secure communication channel with the IoT hub and/or the IoT service.

Claims

1. An internet of things (IoT) hub comprising:

programming logic to generate an IoT device public/private key pair for an IoT device and to store the IoT device private key on an identification device of the IoT device, the IoT device public/private key pair usable for secure communication with the IoT device;

a secure hardware storage to store the IoT device public key and an IoT hub private key of an IoT hub public/private key pair; and

a network interface to communicatively couple the IoT hub to an IoT service over a wide area network (WAN), the IoT hub securely forwarding the IoT device public key and the IoT hub public key to the IoT service over the network interface;

wherein the IoT hub receives a first network packet from the IoT service, the first network packet comprising an IoT hub packet encrypted with the IoT hub public key;

wherein the IoT hub decrypts the first network packet using the IoT hub private key to generate an IoT device packet, the IoT device packet comprising a command/data encrypted with the IoT device public key; and

wherein the IoT hub forwards the IoT device packet to the IoT device, the IoT device packet to be decrypted by the IoT device using the IoT device private key.

2. The IoT hub of claim 1, wherein the programming logic is further to store the IoT hub public key on the identification device of the IoT device.

3. The IoT hub of claim 1, wherein the identification device is a subscriber identity module (SIM).

4. The IoT hub of claim 1, wherein the identification device comprises a secure key storage for storing a private key provided by the programming logic.

5. The IoT hub of claim 1, wherein the identification device is attached to the IoT device.

6. A method implemented in an IoT hub, the method comprising:

generating an IoT device public/private key pair usable for secure communication with an IoT device;

generating an IoT hub public/private key pair usable for secure communication with the IoT hub;

storing the IoT device private key on an identification device of the IoT device;

storing the IoT device public key and the IoT hub private key in a secure hardware storage;

forwarding the IoT device public key and the IoT hub public key to an IoT service over a wide area network (WAN);

receiving a first network packet from the IoT service, the first network packet comprising an IoT hub packet encrypted with the IoT hub public key;

decrypting the first network packet using the IoT hub private key to generate an IoT device packet, the IoT device packet comprising a command/data encrypted with the IoT device public key; and

forwarding the IoT device packet to the IoT device, the IoT device packet to be decrypted by the IoT device using the IoT device private key.

7. The method of claim 6, further comprising storing the IoT hub public key on the identification device of the IoT device.

8. The method of claim 6, wherein the identification device is a subscriber identity module (SIM).

9. The method of claim 6, wherein the identification device comprises a secure key storage for storing a private key.

10. The method of claim 6, wherein the identification device is attached to the IoT device.