Managing device ownership and commissioning in public-key encrypted wireless networks

• US 10,419,928 B2
• Filed: 03/03/2017
• Issued: 09/17/2019
• Est. Priority Date: 08/12/2011
• Status: Active Grant

• Current Assignee: Tridonic GmbH & Co. KG (Zumtobel Group AG)
• Original Assignee: Tridonic GmbH & Co. KG (Zumtobel Group AG)
• Inventors: Holleis, Edgar
• Primary Examiner(s): Patel, Ashokkumar B
• Assistant Examiner(s): Farooqui, Quazi
• Application Number:
  US15/448,868
• Publication Number:
  US 20170180985A1
• Time in Patent Office: 928 Days
• Field of Search: 713150, 713153, 713168-176, 713182-186, 713202, 380 28- 30, 380 44- 47, 380255-287, 726 1- 33, 709206, 709225, 709229, 709249, 709389
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

A mobile commissioning device for assisting in the commissioning of wireless public-key encrypted networks, the device being provided with:

• • means for reading the public key from a network node to be integrated in the wireless network, the channel for reading the public key being physically different to the wireless network channel for which the node is to be commissioned,
  • means for at least temporarily storing the read public key in the device,
  • means for transferring a public key of the commissioning device to the network node to be commissioned, the channel for transferring the public key preferably being the wireless channel for which the node is to be commissioned, and
  • means for transferring the read public key to a trust center.

Claims

1. A mobile commissioning device (CD) for commissioning of a wireless lighting network, the CD comprising:

a sensor configured for acquiring an unencrypted public key (NWN-PUB-KEY), using a first wireless communications channel, from a lighting network node (NWN) to be integrated in the wireless lighting network;

a memory configured for storing the NWN-PUB-KEY, wherein the memory is at least one of an internal memory or external memory of the CD, wherein the memory is also configured for storing an ownership transfer record (OTR) acquired from the NWN, and wherein the OTR is at least one of a certificate, a signed data record, or a nonce;

a communications interface configured for transferring cryptographically a provisional first public key (CD-PUB-KEY) of the CD to the NWN using a second wireless communications channel and the stored NWN-PUB-KEY, wherein the first wireless communications channel does not operate on the wireless lighting network, and wherein the second wireless communications channel operates on the wireless lighting network; and

the communications interface also configured for instructing the NWN on the second wireless communications channel to activate a lighting means, an operating device for the lighting means, or a sensor of the NWN, then transferring the NWN-PUB-KEY and the OTR to a trust center (TC) after instructing the NWN to activate the lighting means, an operating device for the lighting means, or a sensor of the NWN.

2. The CD of claim 1, wherein the sensor is active or passive, and selected from the group comprising of:

a barcode-reader, a QR code an RFID-reader, NFC-interface, a smartcard-reader, or an optical and acoustical sensor.

3. The CD of claim 1, further comprising a GPS configured for determining the location of the CD at the time of receiving the OTR, and the memory further configured for storing the location with the OTR.

4. The CD of claim 1 wherein the communications interface is further configured for receiving the OTR using the first wireless communications channel.

5. The CD of claim 1, further comprising a GPS configured for determining a location of the CD at the time of communicating with the NWN via the first wireless communication channel, and transferring the location to the NWN via the first wireless communication channel.

6. A lighting network node (NWN) for use in a wireless lighting network, the NWN comprising:

a communication element for providing an unencrypted public key (NWN-PUB-KEY) of the NWN on a first wireless communications channel, wherein the first wireless communications channel does not operate on the wireless lighting network;

a communication interface configured for receiving a provisional first public key (CD-PUB-KEY) from a commissioning device (CD) using the NWN-PUB-KEY for a cryptographic key exchange over a second wireless communications channel, wherein the CD-PUB-KEY is encrypted with the NWN-PUB-KEY before the exchange, and the second wireless communications channel operates on the wireless lighting network;

a memory configured for storing the CD-PUB-KEY transferred the NWN from the CD over the second wireless communications channel used for communication on the wireless lighting network for which the NWN is to be commissioned; and

the communications interface also configured for receiving instructions to activate a lighting means, an operating device for the lighting means, or a sensor of the NWN, then receiving a permanent public key (TC-PUB-KEY) from a trust center (TC), where the memory is further configured for storing the TC-PUB-KEY after the NWN verifies an ownership transfer record (OTR), wherein the OTR is a certificate, signed data record, or a nonce.

7. The NWN of claim 6, wherein the communication element for providing the NWN-PUB-KEY is further configured to provide the NWN -PUB-KEY in an actively or passively readable form for a sensor of the CD.

8. The NWN of claim 7, wherein the communication element providing is at least one of a barcode, QR code, RFID-tag, NFC interface, smartcard, a LED interface, or an acoustic interface.

9. The NWN of claim 6, wherein the TC-PUB-KEY invalidates and/or replaces the CD-PUB-KEY.

10. The NWN of claim 6, wherein the providing means provides, in addition to the NWN-PUB-KEY, an identifier of the NWN.

11. The NWN of claim 6, wherein the communication interface receives a location with the OTR.

12. The NWN of claim 6, wherein the OTR is generated by the NWN and the communications interface sends the OTR to the CD using the first wireless communications channel.

13. A method for commissioning nodes for a wireless lighting network performed by a commissioning device (CD), the method comprising:

acquiring an unencrypted public key (NWN-PUB-KEY) of a network node (NWN) over a first wireless channel, wherein the NWN is at least one of a lighting means, an operating device for the lighting means, an operating device for the lighting means, or a sensor;

storing the NWN-PUB-KEY to a memory of the CD;

transferring a provisional first public key (CD-PUB-KEY) to the NWN using a second wireless channel, wherein the second wireless channel operates on the wireless lighting network, and the first wireless channel does not operate on the wireless lighting network, wherein the CD encrypts the CD-PUB-KEY using the NWN-PUB-KEY before the transfer;

wherein the first wireless channel and the second wireless channel use different communication technologies; and

instructing the NWN on the second wireless channel to activate the lighting means, an operating device for the lighting means, or a sensor;

transferring, after instructing the NWN, the NWN-PUB-KEY and an ownership transfer record (OTR) from the CD to a trust center (TC), wherein the OTR is one of a certificate, signed data record or a nonce.

14. The method of claim 13, wherein the OTR is jointly negotiated by the NWN and the CD.

15. The method of claim 13, further comprising determining the location of the CD by a GPS at the time of receiving the OTR, and the memory further configured for storing the location with the OTR.

16. The method of claim 13, further comprising receiving the OTR using the first wireless communications channel.

17. The method of claim 13, further comprising determining a location of the CD at the time of communicating with the NWN via the first wireless channel, and transferring the location to the NWN using the first wireless channel.

18. A trust center network management unit (TC) in a wireless lighting network, the TC comprising:

a communication interface, for communicating on the wireless lighting network configured to receive at least one public key (NWN-PUB-KEY) from a commissioning device (CD) of at least one network node (NWN) over a wireless channel of the wireless lighting network; and

the communication interface further configured to transfer a permanent second public key (TC-PUB-KEY) to the at least one NWN on the wireless lighting network after a lighting means, an operating device for the lighting means, or a sensor of the NWN has been activated by the CD, wherein the TC-PUB-KEY is securely transferred with an ownership transfer record (OTR), and the OTR is one of a certificate, signed data record, and/or a nonce.