Remotely granting access to a smart environment

• US 7,493,651 B2
• Filed: 05/17/2001
• Issued: 02/17/2009
• Est. Priority Date: 05/17/2001
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Arnberg, Tommy, Vanska, Marko
• Primary Examiner(s): Moise; Emmanuel L
• Assistant Examiner(s): Abyaneh; Ali S
• Application Number:
  US10/476,497
• Publication Number:
  US 20040172396A1
• Time in Patent Office: 2,833 Days
• Field of Search: 726/2, 340/825, 380/270, 380/255, 713/150
• US Class Current: 726/2
• CPC Class Codes: G07C 2009/00412 the transmitted data signal being encrypted
• CPC Class Codes: G07C 9/00309 operated with bidirectional data transmission between data carrier and locks
• CPC Class Codes: G07C 9/00571 operated by interacting with a central unit
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04N 21/41265 having a remote control device for bidirectional communication between the remote control device and client device unidirectional remote control device H04N21/42204
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 74/00 Wireless channel access
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support

Abstract

A method and system for providing selective access to appliances by terminals in a smart environment is provided. Each terminal and appliance is assigned a unique identification code (UID). Appliances and terminals wirelessly transmit their UID and receive UIDs transmitted by other appliances and terminals. Upon receiving a terminal'"'"'s UID, an appliance queries a database to determine whether the terminal is authorized to control that appliance based on authorization information stored in the database. An owner may be notified if a terminal without authorization attempts to control an appliance or enters the environment. When a previously unauthorized user, local to the environment, desires access to the smart environment while the owner(s) is away from the environment, a request may be securely transmitted to an owner at his or her remote location. The owner may grant access to one or more appliances, and securely transmit the authorization back to the local user. Upon receipt of the authorization, the local user may control the appliance(s).

Claims

1. A method comprising:

wirelessly receiving a rejection of a control request from an appliance, wherein the rejection includes access information from the appliance, a ticket definition and a public key associated with an administrator terminal, further wherein the access information comprising address information corresponding to the administrator terminal and an authorization template corresponding to the appliance, and the ticket definition comprising one or more appliance function definitions and one or more access right levels associated with each appliance function;

in response to receiving the rejection of the control request, wirelessly sending an access request to the administrator terminal, based in part on the access information;

wirelessly receiving user input authorizing one or more access rights from the administrator terminal; and

wirelessly controlling the appliance based on the access rights authorized and the authorization template.

2. The method of claim 1, wherein sending the access request to the administrator terminal further includes:

hashing the ticket definition;

encrypting the hash using a requesting terminal private key;

encrypting the encrypted hash, the ticket definition, a requesting terminal public key, and a certificate of authority with a public key corresponding to the administrator terminal to produce a control request package; and

sending the control request package.

3. The method of claim 1, wherein the access rights authorized is a different set of rights than a set of rights requested.

4. An apparatus, comprising:

a processing unit;

a transceiver;

a memory storing computer readable instructions that, when executed by the processing unit, cause the apparatus to perform;

wirelessly receiving a rejection of a control request from an appliance, wherein the rejection includes access information from the appliance, a ticket definition and a public key associated with an administrator terminal, further wherein the access information comprising address information corresponding to the administrator terminal and an authorization template corresponding to the appliance, and the ticket definition comprising one or more appliance function definitions and one or more access right levels associated with each appliance function;

in response to receiving the rejection of the control request, wirelessly sending an access request to the administrator terminal, based in part on the access information;

wirelessly receiving user input authorizing one or more access rights from the administrator terminal; and

wirelessly controlling the appliance based on the access rights authorized and the authorization template.

5. The apparatus of claim 4, wherein the memory further stores computer readable instructions that, when executed by the processor, cause the apparatus to perform:

hashing the ticket definition;

encrypting the hash using a requesting terminal private key;

encrypting the encrypted hash, the ticket definition, a requesting terminal public key, and a certificate of authority with a public key corresponding to the administrator terminal to produce a control request package; and

sending the control request package.

6. One or more computer readable media storing computer readable instructions, that when executed by a processor, perform:

wirelessly receiving a rejection of a control request from an appliance, wherein the rejection includes access information from the appliance, a ticket definition and a public key associated with an administrator terminal, further wherein the access information comprising address information corresponding to the administrator terminal and an authorization template corresponding to the appliance and the ticket definition comprising one or more appliance function definitions and one or more access right levels associated with each appliance function;

in response to receiving the rejection of the control request, wirelessly sending an access request to the administrator terminal, based in part on the access information;

wirelessly receiving user input authorizing one or more access rights from the administrator terminal; and

wirelessly controlling the appliance based on the access rights authorized and the authorization template.

7. The one or more computer readable media of claim 6, the instructions further performing:

hashing the ticket definition;

encrypting the hash using a requesting terminal private key;

encrypting the encrypted hash, the ticket definition, a requesting terminal public key, and a certificate of authority with a public key corresponding to the administrator terminal to produce a control request package; and

sending the control request package.

8. A method comprising:

wirelessly receiving an appliance access request for access rights from a control terminal, wherein the appliance access request was sent in response to an appliance rejecting control by the control terminal, and further wherein the rejection of control comprises a ticket definition and a public key, wherein the ticket definition includes one or more appliance function definitions and one or more access rights levels associated with each appliance function;

prompting for input based on the received access request, wherein the prompting includes providing information such that a user is able to determine whether to grant the access rights;

receiving input based on the received access request, wherein the input received corresponds to either granting or denying the request;

wirelessly sending a response to a control terminal, wherein the control terminal may accesses the appliance in accordance with the response if the response granted access to the appliance.

9. The method of claim 8, wherein the response farther includes authorization information comprising an appliance identifier matching an identifier of the appliance, rights granted, and a duration of the grant;

and wherein the fights granted in the response is a set of rights different than the fights requested in the appliance access request.

10. The method of claim 8, further comprising:

wirelessly receiving a control request package;

decrypting the control request package using an administrator terminal private key;

authenticating a control terminal public key based on a certificate of authority; and

identifying the control terminal by hashing a ticket definition and decrypting a hashed ticket definition using the control terminal public key and comparing the two hashes,

wherein the control request package comprises the hashed ticket definition, the ticket definition, the requesting terminal public key, and the certificate of authority with a public key corresponding to the administrator terminal.

11. An apparatus comprising:

a processing unit;

a transceiver;

a memory storing computer readable instructions that, when executed by the processing unit, cause the apparatus to perform;

wirelessly receiving an appliance access request for access rights from a control terminal, wherein the appliance access request was sent in response to an appliance rejecting control by the control terminal, and further wherein the rejection of control comprises a ticket definition and a public key, wherein the ticket definition includes one or more appliance function definitions and one or more access rights levels associated with each appliance function;

prompting for input based on the received access request, wherein the prompting includes providing information such that a user is able to determine whether to grant the access rights;

receiving input based on the received access request, wherein the input received corresponds to either granting or denying the request;

wirelessly sending a response to a control terminal, wherein the control terminal may accesses the appliance in accordance with the response if the response granted access to the appliance.

12. The apparatus of claim 11, wherein the response further includes authorization information comprising an appliance identifier matching an identifier of the appliance, rights granted, and a duration of the grant;

and wherein the rights granted in the response is a set of rights different than the rights requested in the appliance access request.

13. The apparatus of claim 11, wherein the memory further stores computer readable instructions that, when executed by the processor, cause the apparatus to perform:

receiving a control request package;

decrypting the control request package using an administrator terminal private key;

authenticating a control terminal public key based on a certificate of authority; and

identifying the control terminal by hashing a ticket definition and decrypting a hashed ticket definition using the control terminal public key and comparing the two hashes,

wherein the control request package comprises the hashed ticket definition, the ticket definition, the requesting terminal public key, and the certificate of authority with a public key corresponding to the administrator terminal.

14. A computer readable medium storing computer readable instructions, that when executed by a processor, perform:

wirelessly receiving an appliance access request for access rights from a control terminal, wherein the appliance access request was sent in response to an appliance rejecting control by the control terminal, and further wherein the rejection of control comprises a ticket definition and a public key, wherein the ticket definition includes one or more appliance function definitions and one or more access rights levels associated with each appliance function;

prompting for input based on the received access request, wherein the prompting includes providing information such that a user is able to determine whether to grant the access rights;

receiving input based on the received access request, wherein the input received corresponds to either granting or denying the request;

wirelessly sending a response to a control terminal, wherein the control terminal accesses the appliance in accordance with the response if the response granted access to the appliance.

15. The one or more computer readable media of claim 14, wherein the response further includes authorization information comprising an appliance identifier matching an identifier of the appliance, rights granted, and a duration of the grant;

and wherein the rights granted in the response is a set of rights different than the rights requested in the appliance access request.

16. The one or more computer readable media of claim 14, the instructions further performing:

wirelessly receiving a control request package;

decrypting the control request package using an administrator terminal private key;

authenticating a control terminal public key based on a certificate of authority; and

identifying the control terminal by hashing a ticket definition and decrypting a hashed ticket definition using the control terminal public key and comparing the two hashes,

wherein the control request package comprises the hashed ticket definition, the ticket definition, the requesting terminal public key, and the certificate of authority with a public key corresponding to the administrator terminal.