Fragmented Updating of a Distributed Device Using Multiple Clients

• US 20180285089A1
• Filed: 04/04/2017
• Published: 10/04/2018
• Est. Priority Date: 04/04/2017
• Status: Active Grant

• Current Assignee: Openpath Security, Inc. (Motorola Solutions, Inc.)
• Original Assignee: Openpath Security, Inc. (Motorola Solutions, Inc.)
• Inventors: Khakpour, Amir Reza, Kazerani, Alexander A., Kamkar, Samy, Peters, Robert J.
• Granted Patent: US 10,452,381 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 8/65 Updates security arrangements therefor G06F21/57
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/34 involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication

Abstract

Disclosed are systems and methods for updating a distributed system device with an update that a system controller fragments and propagates to the system device by way of two or more third party clients. The system controller manages client access rights to a service accessible at different distributed system devices. The system controller has first network connectivity with which to remotely distribute different fragments of an update to different clients. Each system device controls access to the service at different a site and has (i) second network connectivity with which the different clients propagate different fragments of the update to the system device upon entering communication range with the system device, (ii) memory storing different sets of fragments for the update based on different times at which the clients propagate the fragments, and (iii) a processor applying the update once all fragments of the update to the memory.

Claims

1. A method comprising:

partitioning an update for a distributed system device into a plurality of fragments at a system controller;

distributing each fragment of the plurality of fragments from the system controller to a different remote client of a plurality of remote clients;

propagating the plurality of fragments from the plurality of remote clients to the system device in response to each remote client of plurality of remote clients entering communication range with the system device; and

performing a local update of the system device based on the system device receiving the plurality of fragments from the plurality of remote clients.

2. The method of claim 1, wherein said propagating is further in response to each remote client requesting access to a service controlled by the system device.

3. The method of claim 2 further comprising unlocking a door for a set of the plurality of remote clients with the system device in response to said system device authorizing access requests from the set of the plurality of remote clients.

4. The method of claim 1, wherein said partitioning comprises signing each fragment of the plurality of fragments with an identity of the system controller.

5. The method of claim 1, wherein said partitioning comprises assigning a different sequence number to each fragment of the plurality of fragments by the system controller.

6. The method of claim 5 further comprising reordering the plurality of fragments at the system device based on said sequence number.

7. The method of claim 6 further comprising decoding said update from the plurality of fragments after said reordering.

8. The method of claim 1, wherein said partitioning comprises assigning a particular target identifier to each fragment of the plurality of fragments by the system controller, the particular target identifier matching at least an identifier of the system device.

9. The method of claim 8 further comprising receiving at the system device from a remote client, a fragment comprising a different target identifier not matching the identifier of the system device, and dropping said fragment at the system device.

10. The method of claim 1, wherein said distributing comprises sending the plurality of fragments from the system controller to the plurality of remote clients over a first network communicably coupling the system controller to the plurality of remote clients.

11. The method of claim 10, wherein said propagating comprises sending the plurality of fragments from the plurality of remote clients to the system device over a different second network communicably coupling the system device to the plurality of remote client when the plurality of remote clients come in range of the system device, and wherein the second network is incompatible with the first network and said system device lacks connectivity for said first network.

12. An access control system comprising:

a system controller managing access rights of a plurality of clients to at least one service at a plurality of remotely distributed system devices, the system controller comprising first network connectivity with which the system controller remotely distributes different fragments of an update to different clients of the plurality of clients; and

a particular system device of the plurality of system devices controlling access to said service at a particular site, the particular system device comprising;

(i) different second network connectivity with which the different clients of the plurality of clients propagate a different fragment of the plurality of fragments to the particular system device upon entering communication range with the particular system device over the second network,

(ii) memory storing different sets of the plurality of fragments based on different times at which the plurality of clients enter said communication range and propagate the plurality of fragments to the particular system device, and

(iii) a processor applying said update in response to the different clients propagating all fragments of the plurality of fragments to said memory.

13. The system of claim 12, wherein said first network is a long-range wireless network, and said second network is a short-range wireless network, and wherein said particular system device is located a distance from the system controller preventing connectivity with the system controller over said second network.

14. The system of claim 12, wherein said memory further stores an old set of access privileges for the plurality of remote clients, said update comprises a new set of access privileges for the plurality of remote clients, and the processor applies said update by replacing the old set of access privileges in the memory with the new set of access privileges.

15. The system of claim 12, wherein said memory further stores an old operating configuration for the particular system device, said update comprises a new operating configuration, and the processor applies said update by modifying operating configuration of the system device from the old operating configuration to the new operating configuration.

16. The system of claim 12, wherein the plurality of clients are operated by a plurality of different users independent of the access control system, the plurality of clients comprising said first and second network connectivity.

17. A method comprising:

generating an update for a remote device at a system controller;

dividing said update into a plurality of fragments at the system controller;

assigning a sequence number to each fragment of the plurality of fragments at the system controller, the sequence number indicating ordering of the plurality of fragments in reconstructing said update; and

performing a distributed updating of the remote device by propagating a different fragment of the plurality of fragments to said remote device with a different client of a plurality of clients initially communicating with the system controller and subsequently communicating with the system device in response to entering communication range with the system device.

18. The method of claim 17 further comprising encrypting each fragment of the plurality of fragments with a private key.

19. The method of claim 18 further comprising updating said remote device in response to performing said distributed updating, wherein updating comprises determining all fragments of the plurality of fragments are received at the remote device, reordering the plurality of fragments based on said sequence number, reconstructing the update by decrypting the plurality of fragments with a public key corresponding to said private key, and applying said update at the remote device.

20. The method of claim 17, wherein the plurality of clients initially communicate with the system controller over a long-range first network and subsequently communicate with the system device over a short-range second network.