Method and system for provisioning an electronic device

• US 9,009,805 B1
• Filed: 10/08/2014
• Issued: 04/14/2015
• Est. Priority Date: 09/30/2014
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Mitsuji, Hiro, Kirkby, Ronald L., Sherry, Eden, Neal, Lawrence W.
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US14/510,023
• Time in Patent Office: 188 Days
• Field of Search: 726/7, 726/9, 726/4, 726/5, 709/203
• US Class Current: 726/7
• CPC Class Codes: G06F 16/447 Temporal browsing, e.g. timeline
• CPC Class Codes: G06F 3/048 Interaction techniques based on graphical user interfaces [GUI]
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 3/0482 Interaction with lists of selectable items, e.g. menus
• CPC Class Codes: G06F 3/04842 Selection of displayed objects or displayed text elements G06F3/0482 takes precedence
• CPC Class Codes: G06F 3/04845 for image manipulation, e.g. dragging, rotation, expansion or change of colour
• CPC Class Codes: G06F 3/04847 Interaction techniques to control parameter settings, e.g. interaction with sliders or dials
• CPC Class Codes: G06F 3/0485 Scrolling or panning
• CPC Class Codes: G06F 3/04855 Interaction with scrollbars
• CPC Class Codes: G06F 3/0488 using a touch-screen or digitiser, e.g. input of commands through traced gestures
• CPC Class Codes: G06F 3/04883 for inputting data by handwriting, e.g. gesture or text
• CPC Class Codes: G06T 2207/10016 Video; Image sequence
• CPC Class Codes: G06T 2207/30232 Surveillance
• CPC Class Codes: G06T 7/20 Analysis of motion motion estimation for coding, decoding, compressing or decompressing digital video signals H04N19/43, H04N19/51
• CPC Class Codes: G06V 20/40 in video content extracting overlay text G06V20/62; video retrieval G06F16/70; processing of video elementary streams in video servers H04N21/234; processing of video elementary streams in video clients H04N21/44
• CPC Class Codes: G06V 20/41 Higher-level, semantic clustering, classification or understanding of video scenes, e.g. detection, labelling or Markovian modelling of sport events or news items segmenting video sequences G06V20/49
• CPC Class Codes: G06V 20/44 Event detection
• CPC Class Codes: G06V 20/49 Segmenting video sequences, i.e. computational techniques such as parsing or cutting the sequence, low-level clustering or determining units such as shots or scenes
• CPC Class Codes: G06V 20/52 Surveillance or monitoring of activities, e.g. for recognising suspicious objects recognising microscopic objects G06V20/69
• CPC Class Codes: G08B 13/194 using image scanning and comparing systems
• CPC Class Codes: G08B 13/196 : using television cameras
• CPC Class Codes: G08B 13/19604 : involving reference image or background adaptation with time to compensate for changing conditions, e.g. reference image update on detection of light level change
• CPC Class Codes: G08B 13/19606 : Discriminating between target movement or movement in an area of interest and other non-signicative movements, e.g. target movements induced by camera shake or movements of pets, falling leaves, rotating fan
• CPC Class Codes: G08B 13/19613 : Recognition of a predetermined image pattern or behaviour pattern indicating theft or intrusion
• CPC Class Codes: G08B 13/19615 : wherein said pattern is defined by the user
• CPC Class Codes: G08B 13/19676 : Temporary storage, e.g. cyclic memory, buffer storage on pre-alarm
• CPC Class Codes: G08B 13/19682 : Graphic User Interface [GUI] presenting system data to the user, e.g. information on a screen helping a user interacting with an alarm system
• CPC Class Codes: G08B 13/19684 : Portable terminal, e.g. mobile phone, used for viewing video remotely
• CPC Class Codes: G11B 27/005 : Reproducing at a different information rate from the information rate of recording for television signals H04N5/783
• CPC Class Codes: G11B 27/028 : with computer assistance
• CPC Class Codes: G11B 27/031 : Electronic editing of digitised analogue information signals, e.g. audio or video signals
• CPC Class Codes: G11B 27/105 : of operating discs
• CPC Class Codes: G11B 27/30 : on the same track as the main recording
• CPC Class Codes: G11B 27/34 : Indicating arrangements indicating means incorporated in magazine or cassette G11B23/046 and G11B23/0875; indicating measured values in general G01D
• CPC Class Codes: H04L 2209/80 : Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 2463/062 : applying encryption of the keys cryptographic mechanisms or cryptographic arrangements for key distribution using key encryption key H04L9/0822
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/083 : using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 9/0822 : using key encryption key
• CPC Class Codes: H04L 9/085 : Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0869 : involving random numbers or seeds
• CPC Class Codes: H04N 21/2187 : Live feed
• CPC Class Codes: H04N 21/2347 : involving video stream encryption
• CPC Class Codes: H04N 21/239 : Interfacing the upstream path of the transmission network, e.g. prioritizing client content requests hybrid fiber coaxial [HFC] networks for upstream channel allocation for video distribution H04L12/2801; flow control in data networks H04L47/10; real-time communication protocols in data switching networks H04L65/00; scheduling or organising the servicing of application requests H04L67/60
• CPC Class Codes: H04N 21/2393 : involving handling client requests scheduling or organising the servicing of application requests H04L67/60
• CPC Class Codes: H04N 21/2541 : Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/2743 : Video hosting of uploaded data from client
• CPC Class Codes: H04N 21/42204 : User interfaces specially adapted for controlling a client device through a remote control device; Remote control devices therefor constructive details of casings for the remote control device H01H9/0235; user interfaces for controlling a tuning device of a television receiver through a remote control H03J9/00; remote control of peripheral devices connected to a television receiver through the remote control device of the television receiver H04B1/205
• CPC Class Codes: H04N 21/4222 : Remote control device emulator integrated into a non-television apparatus, e.g. a PDA, media center or smart toy remote control device for a television receiver integrated into a mobile phone H04M1/72415
• CPC Class Codes: H04N 21/431 : Generation of visual interfaces for content selection or interaction; Content or additional data rendering
• CPC Class Codes: H04N 21/4312 : involving specific graphical features, e.g. screen layout, special fonts or colors, blinking icons, highlights or animations
• CPC Class Codes: H04N 21/4314 : for fitting data in a restricted space on the screen, e.g. EPG data in a rectangular grid
• CPC Class Codes: H04N 21/4316 : for displaying supplemental content in a region of the screen, e.g. an advertisement in a separate window
• CPC Class Codes: H04N 21/4334 : Recording operations recording of a television signal H04N5/76; arrangements for recording or accumulating broadcast information or broadcast-related information H04H60/27
• CPC Class Codes: H04N 21/4335 : Housekeeping operations, e.g. prioritizing content for deletion because of storage space restrictions storage management, e.g. defragmentation G06F3/0604; unloading stored programs G06F9/445; storage management in file systems G06F16/10; buffering arrangements in a network node or in an end terminal in packet networks H04L49/90
• CPC Class Codes: H04N 21/4408 : involving video stream encryption, e.g. re-encrypting a decrypted video stream for redistribution in a home network
• CPC Class Codes: H04N 21/4438 : Window management, e.g. event handling following interaction with the user interface
• CPC Class Codes: H04N 21/4622 : Retrieving content or additional data from different sources, e.g. from a broadcast channel and the Internet web site content organization and management for information retrieval from the Internet G06F16/958; transmission by internet of broadcast information H04H60/82; stock exchange data over packet-switching network H04L12/1804; push services including data channel over packet-switching network H04L12/1859
• CPC Class Codes: H04N 21/4627 : Rights management associated to the content security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/4753 : for user identification, e.g. by entering a PIN or password cryptographic authentication protocols H04L9/32; networks authentication protocols H04L63/08
• CPC Class Codes: H04N 23/65 : Control of camera operation in relation to power supply
• CPC Class Codes: H04N 23/651 : for reducing power consumption by affecting camera operations, e.g. sleep mode, hibernation mode or power off of selective parts of the camera
• CPC Class Codes: H04N 23/6811 : based on the image signal
• CPC Class Codes: H04N 23/6815 : by distinguishing pan or tilt from motion
• CPC Class Codes: H04N 5/144 : Movement detection for video coding H04N19/503; analysis of motion in general G06T7/20
• CPC Class Codes: H04N 5/93 : Regeneration of the television signal or of selected parts thereof
• CPC Class Codes: H04N 7/18 : Closed-circuit television [CCTV] systems, i.e. systems in which the video signal is not broadcast
• CPC Class Codes: H04N 7/183 : for receiving images from a single remote source
• CPC Class Codes: H04N 7/185 : from a mobile camera, e.g. for remote control
• CPC Class Codes: H04N 7/186 : Video door telephones
• CPC Class Codes: H04N 9/87 : Regeneration of colour television signals H04N9/80 takes precedence
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 : of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/04 : Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 12/50 : Secure pairing of devices
• CPC Class Codes: H04W 4/80 : Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 84/12 : WLAN [Wireless Local Area Networks]

Abstract

This application discloses a method of provisioning an electronic device. The electronic device proactively broadcasts an advertising packet that includes a device identifier associated with the electronic device. A server receives the device identifier via a client device, and issues a link approval response when it verifies that the electronic device associated with the device identifier is available for provisioning in association with a user account. In response to the link approval response, the electronic device and the client device establish communication via a short range wireless link. The client device encrypts at least a portion of network credentials of a secure wireless network using a password key generated at the server, and provides the encrypted network credentials to the electronic device. The electronic device decrypts the encrypted network credentials using a key generated at the electronic device, and accesses the secure wireless network using the decrypted network credentials.

Claims

1. A device provisioning method executed by an electronic device, a client device and a server, comprising:

logging onto a user account managed by the server from the client device;

broadcasting by the electronic device an advertising packet that includes a device identifier uniquely associated with the electronic device;

transmitting the advertising packet to the server via the client device as part of a link approval request;

in response to receiving the link approval request, verifying by the server that the electronic device associated with the device identifier is available for provisioning in association with the user account and, when verified, issuing by the server a link approval response to the client device, the link approval response indicating that the electronic device associated with the device identifier is available for provisioning in association with the user account;

in response to receiving the link approval response indicating that the electronic device associated with the device identifier is available for provisioning in association with the user account;

establishing a short range wireless link between the electronic device and the client device;

obtaining, at the client device, network credentials for accessing a secure wireless network;

encrypting, at the client device, at least a portion of the network credentials using a password key generated at the server and communicated from the server to the client device;

sending the encrypted network credentials from the client device to the electronic device over the short range wireless link;

obtaining, at the electronic device, decrypted network credentials by decrypting the encrypted network credentials using a key generated at the electronic device; and

accessing, by the electronic device, the secure wireless network using the decrypted network credentials.

2. The method of claim 1, wherein the electronic device is a camera.

3. The method of claim 1, wherein the advertising packet is broadcast using a custom data structure that is distinct from any standard data format used by a Bluetooth link.

4. The method of claim 1, wherein the electronic device is located in proximity to the client device and the short range wireless link is established based on classical Bluetooth technology or Bluetooth low energy (BLE) technology.

5. The method of claim 1, wherein the advertising packet further includes a first authentication token that is generated based on a device specific secret shared between the electronic device and the server, and the server is configured to authenticate the device identifier based on the device specific secret and the first authentication token.

6. The method of claim 1, wherein a device specific secret is predetermined and stored in a memory of the electronic device before the electronic device is shipped out of factory, and the server includes a database recording both the device identifier and the device specific secret associated with the electronic device.

7. The method of claim 1, further comprising:

in response to receiving the link approval response;

providing a random number to the server by the electronic device, wherein the random number is forwarded to the server via the client device;

generating an authentication tag and the password key by the server based on the random number; and

forwarding the authentication tag to the electronic device via the client device, wherein the electronic device verifies the authentication tag based on the random number, wherein the client device encrypts the at least a portion of the network credentials using the password key only when the electronic device verifies the authentication tag.

8. The method of claim 7, wherein the password key is encrypted by the server based on both the random number and a device secret known to the server and the electronic device.

9. The method of claim 7, wherein the random number remains valid only for a predetermined duration of time.

10. The method of claim 7, wherein the electronic device shares a device specific secret with the server, and the random number are provided to the server with a second authentication token that is generated by the electronic device based on the device specific secret, and wherein the server is configured to authenticate the random number based on the second authentication token and the device specific secret.

11. The method of claim 7, wherein the random number, the authentication tag and the encrypted network credentials are communicated between the electronic device and the client device via the short range wireless link.

12. The method of claim 1, further comprising:

identifying by the electronic device a list of available secure networks in a secure network scan; and

providing the list of available secure networks to the client device, wherein the client device is configured to determine the secure wireless network from the list of available secure networks.

13. The method of claim 12, wherein the client device determines the secure wireless network from the list of available secure networks, by displaying the list of available secure networks on a provisioning interface displayed on the client device and receiving a user selection of the secure wireless network.

14. The method of claim 1, wherein the network credentials of the secure wireless network include a network password, further comprising:

receiving, by the client device, a user input of the network password and encoding the network password using the password key provided by the server.

15. The method of claim 1, wherein the secure wireless network includes a wireless local area network (WLAN).

16. The method of claim 15, wherein the network credentials of the secure wireless network further include at least a service set identifier (SSID) and a network password for the WLAN.

17. The method of claim 1, wherein the link approval request is communicated from the client device to the server based on an encryption type selected from the group consisting of:

AES, TKIP, WEP, WPA, EAP, IEEE8021X, Cisco LEAP, WPA-PSK, and RADIUS.

18. The method of claim 1, wherein the client device communicates with the server at least partially via the secure wireless network.

19. The method of claim 1, wherein the client device communicates with the server independently of the secure wireless network.

20. A computer system, comprising:

one or more processors; and

memory having instructions stored thereon, which when executed by the one or more processors cause the processors to perform operations, comprising;

logging onto a user account managed by the server from the client device;

broadcasting by the electronic device an advertising packet that includes a device identifier uniquely associated with the electronic device;

transmitting the advertising packet to the server via the client device as part of a link approval request;

in response to receiving the link approval request, verifying by the server that the electronic device associated with the device identifier is available for provisioning in association with the user account and, when verified, issuing by the server a link approval response to the client device, the link approval response indicating that the electronic device associated with the device identifier is available for provisioning in association with the user account;

in response to receiving the link approval response indicating that the electronic device associated with the device identifier is available for provisioning in association with the user account;

establishing a short range wireless link between the electronic device and the client device;

obtaining, at the client device, network credentials for accessing a secure wireless network;

encrypting, at the client device, at least a portion of the network credentials using a password key generated at the server and communicated from the server to the client device;

sending the encrypted network credentials from the client device to the electronic device over the short range wireless link;

obtaining, at the electronic device, decrypted network credentials by decrypting the encrypted network credentials using a key generated at the electronic device; and

accessing, by the electronic device, the secure wireless network using the decrypted network credentials.