NETWORK NODE SECURITY USING SHORT RANGE COMMUNICATION

• US 20150281280A1
• Filed: 03/28/2014
• Published: 10/01/2015
• Est. Priority Date: 03/28/2014
• Status: Active Grant

• Current Assignee: Sensormatic Electronics LLC (Johnson Controls International plc)
• Original Assignee: Tyco Fire & Security GmbH (Johnson Controls International plc)
• Inventors: Rasband, Paul B., Mohiuddin, Mohammad, Hall, Stewart E.
• Granted Patent: US 9,477,841 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 4/38 for collecting sensor information
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks
• CPC Class Codes: H04W 88/06 adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Abstract

Systems (100) and methods for network node security configuration. The methods involve: performing operations by a mobile communication device (104) to obtain a unique identifier from a network node (108) to be installed at a customer facility (102) via a first short range communication link (110); communicating a signal comprising the unique identifier from the mobile communication device to a remote server (118) via a first long range communication link (112); verifying by the remote server that a correct type of network node is being installed at a first location within the customer facility according to a respective work order; and communicating security information, useful for configuring security functions of the network node, from the remote server to the network node via the mobile communication device, without presenting the security information to a user of the mobile communication device or storing the security information in the mobile communication device.

Claims

1. A method for network node security configuration, comprising:

performing operations by a mobile communication device to obtain a unique identifier from a network node to be installed at a customer facility via a first short range communication link;

communicating a signal comprising the unique identifier from the mobile communication device to a remote server via a first long range communication link;

verifying by the remote server that a correct type of network node is being installed at a first location within the customer facility according to a respective work order; and

communicating security information, useful for configuring security functions of the network node, from the remote server to the network node via the mobile communication device, without presenting the security information to a user of the mobile communication device or storing the security information in the mobile communication device.

2. The method according to claim 1, wherein the signal further comprises information specifying at least one of a location within the customer facility at which the network node is to be installed, a particular work order selected by a user of the mobile communication device, and a node type for the network node.

3. The method according to claim 1, further comprising identifying by the remote server what security information is to be sent to the network node based at least in part on information obtained by the mobile communication device from the network node via a short range communication link.

4. The method according to claim 1, further comprising retrieving the security information identified by the remote server from a datastore located in a provider facility remotely located from the customer facility.

5. The method according to claim 1, wherein the security information is communicated from the remote server in an encrypted form.

6. The method according to claim 1, further comprising storing the security information in a short range communication device of the network node.

7. The method according to claim 6, further comprising transferring the security information from the short range communication device to a processor of the network node after the network node is turned on.

8. The method according to claim 7, further comprising configuring the security functions of the network node in accordance with the security information which was transferred to the processor.

9. The method according to claim 8, further comprising outputting an indicator from the network node indicating successful security enablement thereof.

10. The method according to claim 9, further comprising performing operations by the network node to join a network using the security functions configured in accordance with the security information.

11. A system, comprising:

at least one network node comprising a unique identifier which is communicated to a mobile communication device via a short range communication link when being installed at a customer facility; and

a remote server (1) receiving a signal comprising the unique identifier from the mobile communication device via a first long range communication link, (2) verifying that a correct type of network node is being installed at a first location within the customer facility according to a respective work order, and (3) communicating security information to the network node via the mobile communication device, without presenting the security information to a user of the mobile communication device or storing the security information in the mobile communication device.

12. The system according to claim 11, wherein the signal further comprises information specifying at least one of a location within the customer facility at which the network node is to be installed, a particular work order selected by a user of the mobile communication device, and a node type for the network node.

13. The system according to claim 11, wherein the remote server further identifies what security information is to be sent to the network node based at least in part on information obtained by the mobile communication device from the network node via a short range communication link.

14. The system according to claim 11, wherein the remote server further retrieves the security information which was previously identified thereby from a datastore located in a provider facility remotely located from the customer facility.

15. The system according to claim 11, wherein the security information is communicated from the remote server in an encrypted form.

16. The system according to claim 11, wherein the network node stores the security information in a short range communication device thereof.

17. The system according to claim 16, wherein the security information is transferred from the short range communication device to a processor of the network node after the network node is turned on.

18. The system according to claim 17, wherein the security functions of the network node are configured in accordance with the security information which was transferred to the processor.

19. The system according to claim 18, wherein an indicator is output from the network node indicating successful security enablement thereof.

20. The system according to claim 19, wherein the network node joins a network using the security functions configured in accordance with the security information.