SYSTEM AND METHOD FOR ESTABLISHING A SECONDARY COMMUNICATION CHANNEL TO CONTROL AN INTERNET OF THINGS (IOT) DEVICE

• US 20170171747A1
• Filed: 12/14/2015
• Published: 06/15/2017
• Est. Priority Date: 12/14/2015
• Status: Active Grant

• Current Assignee: Afero, Inc.
• Original Assignee: Afero, Inc.
• Inventors: ZIMMERMAN, SCOTT, HOLLAND, SHANNON, BRITT, JOE
• Granted Patent: US 10,091,242 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04W 12/037 of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 12/77 Graphical identity
• CPC Class Codes: H04W 76/15 Setup of multiple wireless link connections

Abstract

A system and method are described for establishing a secondary communication channel between an IoT device and a client device. For example, one embodiment of a method comprises: establishing a primary secure communication channel between the IoT device and an IoT service using a primary set of keys; performing a secondary key exchange using the primary secure communication channel, the client device and the IoT device each being provided with a secondary set of keys following the secondary key exchange; detecting that the primary secure communication channel is inoperative; and responsively establishing a secondary secure wireless connection between the client device and the IoT device using the secondary set of keys, the client device being provided with access to data and functions made available by the IoT device over the secondary secure wireless connection.

Claims

1. A method to establish a secondary communication channel between an Internet of Things (IoT) device and a client device comprising:

establishing a primary secure communication channel between the IoT device and an IoT service using a primary set of keys;

performing a secondary key exchange using the primary secure communication channel, the client device and the IoT device each being provided with a secondary set of keys following the secondary key exchange;

detecting that the primary secure communication channel is inoperative; and

responsively establishing a secondary secure wireless connection between the client device and the IoT device using the secondary set of keys, the client device being provided with access to data and/or functions made available by the IoT device over the secondary secure wireless connection.

2. The method as in claim 1 wherein the access to data and/or functions over the secondary secure wireless connection comprises more limited access to the data and/or functions than when connected over the primary secure communication channel.

3. The method as in claim 1 further comprising:

storing a passcode on the IoT device;

requesting a user to enter the passcode from the client device; and

providing access to the data and/or functions of the IoT device only if the user enters the correct passcode from the wireless device.

4. The method as in claim 3 further comprising:

initially receiving the passcode from an app on the client device prior to storing the passcode on the IoT device, the user choosing the passcode and the passcode being transmitted to the IoT device over the primary secure communication channel.

5. The method as in claim 4 further comprising:

executing the app on the client device to prompt the user to enter the passcode upon establishing the secondary secure wireless connection, the passcode being transmitted from the app to the IoT device prior to the IoT device providing access to the data and/or functions.

6. The method as in claim 5 wherein the IoT device comprises a wireless door lock and wherein at least one function to be accessed over the secondary secure communication channel comprises unlocking the door lock.

7. The method as in claim 1 wherein establishing a primary secure communication channel between the IoT device and an IoT service using a primary set of keys comprises:

establishing communication between the IoT service and the IoT device through an IoT hub or a client device;

generating a service public key and a service private key by key generation logic of a first encryption engine on the IoT service;

generating a device public key and a device private key by key generation logic of a second encryption engine on the IoT device;

transmitting the service public key from the first encryption engine to the second encryption engine and transmitting the device public key from the second encryption engine to the first encryption engine;

generating a secret using the device public key and the service private key;

generating the same secret using the service public key and the device private key; and

encrypting and decrypting data packets transmitted between the first encryption engine and the second encryption engine using the secret or using data structures derived from the secret.

8. The method as in claim 7 wherein the key generation logic comprises a hardware security module (HSM).

9. The method as in claim 8 wherein the data structures derived from the secret comprise a first key stream generated by the first encryption engine and a second key stream generated by the second encryption engine.

10. The method as in claim 9 wherein a first counter is associated with the first encryption engine and a second counter is associated with the second encryption engine, the first encryption engine incrementing the first counter responsive to each data packet transmitted to the second encryption engine and the second encryption engine incrementing the second counter responsive to each data packet transmitted to the first encryption engine.

11. The method as in claim 10 wherein the first encryption engine generates the first key stream using a current counter value of the first counter and the secret and the second encryption engine generates the second key stream using a current counter value of the second counter and the secret.

12. The method as in claim 11 wherein the first encryption engine comprises an elliptic curve method (ECM) module to generate the first key stream using the first counter value and the secret and the second encryption engine comprises an ECM module to generate the second key stream using the first counter value and the secret.

13. The method as in claim 11 wherein the first encryption engine encrypts a first data packet using the first key stream to generate a first encrypted data packet and transmits the first encrypted data packet to the second encryption engine along with a current counter value of the first counter.

14. The method as in claim 13 wherein the second encryption engine uses the current counter value of the first counter and the secret to generate the first key stream and uses the first key stream to decrypt the encrypted data packet.

15. A system comprising:

an IoT device to establish a primary secure communication channel with an IoT service using a primary set of keys;

the IoT device to perform a secondary key exchange using the primary secure communication channel;

a client device and the IoT device each being provided with a secondary set of keys following the secondary key exchange;

the IoT device and/or client device to detect that the primary secure communication channel is inoperative; and

the IoT device and/or client device to responsively establish a secondary secure wireless connection between the client device and the IoT device using the secondary set of keys;

the client device being provided with access to data and/or functions made available by the IoT device over the secondary secure wireless connection.

16. The system as in claim 15 wherein the access to data and/or functions over the secondary secure wireless connection comprises more limited access to the data and/or functions than when connected over the primary secure communication channel.

17. The system as in claim 15 further comprising:

an authentication module to store a passcode on the IoT device and to prompt a user to enter the passcode from the client device;

the authentication module providing access to the data and/or functions of the IoT device only if the user enters the correct passcode from the wireless device.

18. The system as in claim 17 wherein the passcode is initially received from an an app on the client device prior to storing the passcode on the IoT device, the user choosing the passcode and the passcode being transmitted to the IoT device over the primary secure communication channel.

19. The system as in claim 18 further comprising:

the app executed on the client device to prompt the user to enter the passcode upon establishing the secondary secure wireless connection, the passcode being transmitted from the app to the IoT device prior to the IoT device providing access to the data and/or functions.

20. The system as in claim 19 wherein the IoT device comprises a wireless door lock and wherein at least one function to be accessed over the secondary secure communication channel comprises locking or unlocking the door lock.

21. The system as in claim 15 wherein establishing a primary secure communication channel between the IoT device and an IoT service using a primary set of keys comprises:

the IoT service establishing communication with the IoT device through an IoT hub or a client device;

a first encryption engine on the IoT service comprising key generation logic to generate a service public key and a service private key;

a second encryption engine on the IoT device comprising key generation logic to generate a device public key and a device private key;

the first encryption engine to transmit the service public key to the second encryption engine and the second encryption engine to transmit the device public key to the first encryption engine;

the first encryption engine to use the device public key and the service private key to generate a secret;

the second encryption engine to use the service public key and the device private key to generate the same secret; and

wherein once the secret is generated, the first encryption engine and the second encryption engine encrypt and decrypt data packets transmitted between the first encryption engine and the second encryption engine using the secret or using data structures derived from the secret.

22. The system as in claim 21 wherein the key generation logic comprises a hardware security module (HSM).

23. The system as in claim 22 wherein the data structures derived from the secret comprise a first key stream generated by the first encryption engine and a second key stream generated by the second encryption engine.

24. The system as in claim 23 further comprising a first counter associated with the first encryption engine and a second counter associated with the second encryption engine, the first encryption engine incrementing the first counter responsive to each data packet transmitted to the second encryption engine and the second encryption engine incrementing the second counter responsive to each data packet transmitted to the first encryption engine.