Secure device introduction with capabilities assessment

• US 20080072292A1
• Filed: 09/01/2006
• Published: 03/20/2008
• Est. Priority Date: 09/01/2006
• Status: Abandoned Application

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Narjala, Ranjit S.
• Application Number:
  US11/514,452
• Publication Number:
  US 20080072292A1
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 12/2807 Exchanging configuration information on appliance services in a home automation network arrangements for maintenance or administration involving network analysis for automatically determining the actual topology of a network H04L41/12; hardware or software tools for network management using graphical user interfaces H04L41/22; address allocation H04L61/50
• CPC Class Codes: H04L 12/2821 Avoiding conflicts related to the use of home appliances cryptographic protocols H04L9/00; protocols for network security H04L63/00
• CPC Class Codes: H04L 12/2838 Distribution of signals within a home automation network, e.g. involving splitting/multiplexing signals to/from different paths adaptations of television systems for transmission by electric cable for domestic distribution H04N7/106; hybrid transport H04L12/6418; home network arrangements specially adapted for distribution of digital video signals H04N7/24
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 65/1026 at the edge
• CPC Class Codes: H04L 65/1073 Registration or de-registration
• CPC Class Codes: H04L 65/1094 Inter-user-equipment sessions transfer or sharing
• CPC Class Codes: H04M 3/56 Arrangements for connecting several subscribers to a common circuit, i.e. affording conference facilities video conference systems H04N7/15
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

Introducing, managing and restricting devices in an environment is discussed, including how to securely introduce the devices, how to establish trust between the devices, how to manage bandwidth requirements and other resource requirements of the devices, how to aggregate resource usage when multiple devices within an environment are engaging in a common task, and how to restrict device access to environment resources. Various techniques including manual and automatic solutions are disclosed.

Claims

1. A method for introducing devices into an environment and managing introduced devices such as to establish complimentary relationships, restrict resource access, and establish peer device trust, the method comprising:

introducing a first device into the environment, the introducing comprising establishing a temporary link between the device and a nexus communicatively coupling the first device to the environment, and exchanging security credentials for establishing a secure link over the temporary link; and

determining contemporaneously with the introducing if operational restrictions or functionality aggregation should be applied to the first device.

2. The method of claim 1, further comprising:

introducing a second device into the environment;

comparing a capability of the first device with a corresponding capability of a second device communicatively coupled with the environment; and

based at least in part on the comparing, determining transcoding is required to communicatively couple said capabilities of the first and second devices.

3. The method of claim 1, wherein said operational restrictions include selectively limiting access by the first device to resources of the environment, or limiting communication by the first device.

4. The method of claim 3, wherein limiting communication by the first device comprises a selected one of:

blocking network traffic from the first device corresponding to the limited communication, or

instructing the first device to disable an operational feature corresponding to the limited communication.

5. The method of claim 1, further comprising:

providing a user interface (UI) having controls for at least configuring the assigning operational restrictions or functionality aggregation.

6. The method of claim 5, wherein the UI is automatically invoked during the introducing of the first device.

7. The method of claim 1, further comprising:

establishing a common communication task between the first device and a second and third device outside of the environment and a fourth device within the environment; and

aggregating network communication from the second, third, and fourth devices corresponding to at least the common communication task.

8. The method of claim 1, further comprising:

identifying multiple devices communicatively coupled with the first device share a common functionality with the first device; and

aggregating network communication from said multiple devices corresponding to the common functionality and routing an aggregated communication to the first device.

9. The method of claim 8, wherein the common functionality is a conferencing functionality.

10. The method of claim 9, wherein the conferencing functionality includes audiovisual conferencing, the method further comprising:

prior to said aggregating, transcoding said network communication from said multiple devices to reduce video bandwidth.

11. The method of claim 1, in which a registrar processes device introductions in the environment, the method further comprising:

introducing a second device into the environment; and

establishing trust between the first and second devices, the establishing trust including the registrar providing the first device with a credential of the second device, and the registrar providing the second device with a credential of the first device;

wherein the first and second devices trust credentials provided by the registrar.

12. A system of devices inside or outside an environment and communicatively coupled therewith, the system comprising:

at least one outside endpoint to a common communication task; and

a plurality of inside endpoints to the common communication task, the inside endpoints communicatively coupled with a media gateway device aggregating data of the inside endpoints for the common communication task and communicatively coupling the inside endpoints with the at least one outside endpoint.

13. The system of claim 12,

wherein the common communication task expects a full complement of communication links, the full complement being a communication link between one endpoint and every other endpoint to the common communication task, and

wherein the media gateway device facilitates an inside endpoint having fewer communication links than the full complement.

14. The system of claim 13, wherein the inside endpoint maintains one communication link to the media gateway device, the media gateway device operable to aggregate communication from other endpoints over the one communication link.

15. The system of claim 13, wherein outside endpoints to the communication task maintain the full complement of communication links.

16. The system of claim 12, further comprising:

a certificate authority communicatively coupled with the inside endpoints and configured to facilitate trust between at least the inside endpoints.

17. The system of claim 16, wherein the facilitated trust comprises identity verification.

18. The system of claim 16, further comprising a registrar configured to process an introduction of each one of the plurality of inside endpoints to the environment, and during said introduction, to identify device functionality of the plurality to aggregate.

19. The system of claim 18, wherein the certificate authority is disposed within the registrar.

20. A machine accessible tangible medium having associated instructions for introducing devices into an environment and managing introduced devices such as to establish complimentary relationships, restrict resource access, and establish peer device trust, the instructions, which when accessed, results in one or more machines performing:

introducing a first device into the environment, the introducing comprising establishing a temporary link between the device and a nexus communicatively coupling the first device to the environment, and exchanging security credentials for establishing a secure link over the temporary link; and

determining contemporaneously with the introducing if operational restrictions or functionality aggregation should be applied to the first device.

21. The medium of claim 20, wherein the instructions include further instructions, which when accessed, results in one or more machines performing:

introducing a second device into the environment;

comparing a capability of the first device with a corresponding capability of a second device communicatively coupled with the environment; and

based at least in part on the comparing, determining transcoding is required to communicatively couple said capabilities of the first and second devices.

22. The medium of claim 20, wherein the instructions include further instructions, which when accessed, results in one or more machines performing:

providing a user interface (UI) having controls for at least configuring the assigning operational restrictions or functionality aggregation, the UI being automatically invoked during the introducing the first device.

23. The medium of claim 20, wherein the instructions include further instructions, which when accessed, results in one or more machines performing:

establishing a common communication task between the first device and a second and third device outside of the environment and a fourth device within the environment; and

aggregating network communication from the second, third, and fourth devices corresponding to at least the common communication task.

24. The medium of claim 20, wherein the instructions include further instructions, which when accessed, results in one or more machines performing:

identifying multiple devices communicatively coupled with the first device share a common functionality with the first device; and

aggregating network communication from said multiple devices corresponding to the common functionality and routing an aggregated communication to the first device.

25. The medium of claim 24, wherein the common functionality includes audiovisual conferencing, the instructions including further instructions, which when accessed, results in one or more machines performing, prior to said aggregating, transcoding said network communication from said multiple devices to reduce data transfer requirements of said network communication.