WIRELESS MESH NETWORK WITH SECURE AUTOMATIC KEY LOADS TO WIRELESS DEVICES

• US 20120237034A1
• Filed: 05/24/2012
• Published: 09/20/2012
• Est. Priority Date: 11/13/2007
• Status: Active Grant

• Current Assignee: Rosemount Incorporated (Emerson Electric Company)
• Original Assignee: Rosemount Incorporated (Emerson Electric Company)
• Inventors: Karschnia, Robert J., Peluso, Marcos, Carlson, Daniel, Potter, Jeffrey D.
• Granted Patent: US 10,153,898 B2
• Time in Patent Office: Days
• US Class Current: 380/270
• CPC Class Codes: G05B 19/0425 Safety, monitoring
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/083 involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A wireless mesh network provides secure communication by encrypting data using one or more encryption keys. A configuration device in communication with a security manager of the network provides a temporary secure communication path between the security manager and a new field device to be added to the mesh network. Cryptographic material and other configuration data can then be transferred between the security manager of the network and the new field device securely via the configuration device.

Claims

1. A method of loading a join key into a wireless device to allow the wireless device to operate as part of a wireless mesh network, the method comprising:

establishing a wired network connection between a configuration device and a security manager of the wireless mesh network;

establishing a secure communication connection between the configuration device and the wireless device to form a secure communication path between the security manager and the wireless device via the configuration device, wherein the secure communication connection between the configuration device and the wireless device comprises a two-wired communication bus connected between the configuration device and the wireless device;

loading the join key from the security manager to the wireless device through the secure communication path; and

joining the wireless device to the wireless mesh network by communicating wireless messages encrypted with the join key from the wireless device to neighboring wireless devices within the wireless mesh network.

2. The method of claim 1, wherein the configuration device converts messages received from the security manager over the network connection to a wireless communication protocol.

3. The method of claim 1, wherein the configuration device communicates with the wireless device over the two-wired communication bus using a control system communication protocol.

4. The method of claim 3, wherein the configuration device converts messages received from the security manager over the network connection to the control system communication protocol.

5. The method of claim 1 and further comprising:

loading configuration data in addition to the join key through the secure communication path.

6. The method of claim 1 and further comprising:

viewing a graphical user interface; and

initiating loading of the join key through the graphical user interface.

7. The method of claim 1, wherein the network connection comprises a wired digital communication network to which the configuration device is connected.

8. The method of claim 1, wherein the join key includes a key generated using a one time pad technique.

9. A configuration device for providing initial configuration data, including a join key, for a wireless device to be installed in a wireless mesh network including a gateway that interfaces the wireless network with a wired digital communication network, the configuration device comprising:

a wired connection to the wired digital communication network for receiving the initial configuration data, including the join key, from the gateway according to a wired communication protocol;

a secure communication link for communicating with the wireless device to provide the initial configuration data, including the join key to the wireless device, wherein the secure communication link comprises a two-wire communication bus connected between the configuration device and the wireless device; and

an interface for establishing a secure communication path between the gateway and the wireless device over which the join key is transferred.

10. The configuration device of claim 9, wherein the configuration data includes at least one of the join key and a network ID.

11. The configuration of claim 9, wherein the interface converts messages received from the gateway over the network connection to a wireless communication protocol.

12. The configuration device of claim 9, wherein the configuration device communicates with the wireless device over the two-wire communication bus using a control system communication protocol.

13. The configuration device of claim 12, wherein the interface converts messages received from the gateway over the network connection to the control system communication protocol.

14. A method of loading cryptographic material into a wireless device to allow the wireless device to operate as part of a wireless network, the method comprising:

establishing a network connection between a configuration device and a security manager of the wireless mesh network;

establishing a secure communication path between the security manager and the wireless device via the configuration device, wherein the secure communication link comprises a two-wire communication bus connected between the configuration device and the wireless device, wherein the two-wire communication bus ensures messages generated by the configuration device are receivable only by the wireless device; and

loading the cryptographic material from the security manager to the wireless device through the secure communication path in which the cryptographic material is receivable only by the wireless device.

15. The method of claim 14, wherein the cryptographic material includes a join key generated using a one time pad technique.