Attaching a sensor to a WSAN

• US 9,154,476 B2
• Filed: 04/07/2009
• Issued: 10/06/2015
• Est. Priority Date: 04/07/2009
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Tsiatsis, Vlasios, Johansson, Mattias
• Primary Examiner(s): TURCHEN, JAMES R
• Application Number:
  US13/260,826
• Publication Number:
  US 20120023564A1
• Time in Patent Office: 2,373 Days
• Field of Search: 726/7, 726/4, 726/6
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

Methods and arrangements in a WSAN Gateway (15), a WSAN Manager (16) and a WSAN sensor for attaching an additional sensor (39) to a WSAN (12) comprising at least one existing WSAN sensor (33). The additional sensor emits an indication of its private identity after insertion in the WSAN, and the indication is received by the existing sensors in the WSAN and forwarded to the WSAN Gateway, after an eligibility check. Thereafter, the WSAN Gateway sends an authentication request to the WSAN Manager, which computes an authentication vector and transmits to the WSAN Gateway for the authentication of the new sensor.

Claims

1. A method, performed by an existing wireless or wired sensor and actuator network (WSAN) sensor, for attaching an additional sensor to a WSAN, comprising:

receiving and storing, by the WSAN sensor, an indication of a private identity of a potential additional sensor from a WSAN gateway;

receiving, by the WSAN sensor, from an additional sensor, a beacon comprising an indication of a private identity of the additional sensor when the additional sensor has been inserted in the WSAN;

determining, by the WSAN sensor, whether the additional sensor is eligible for attachment to the WSAN by comparing the indication of the private identity received in the beacon with the stored indication of the private identity of the potential additional sensor; and

sending, by the WSAN sensor, a notification of the insertion of an eligible additional sensor to the WSAN gateway, the notification comprising the indication of the private identity of the inserted eligible additional sensor.

2. The method of claim 1, wherein the step of determining whether the additional sensor is eligible for attachment further comprises checking that an activation time interval of the additional sensor has not expired, the activation time interval received and stored in connection with the indication of the private identity of the additional sensor.

3. The method of claim 1, further comprising receiving, by the existing WSAN sensor, a listening request from the WSAN gateway, the listening request indicating a listening status for the detection of a beacon from an additional sensor.

4. The method of claim 1, wherein the additional sensor performs the following steps after insertion in the WSAN:

transmitting the indication of its private identity in a beacon to existing WSAN sensors;

performing authentication with the WSAN gateway based on an authentication vector computed by a WSAN Manager.

5. The method of claim 4, wherein the authentication comprises establishment of a key shared between the additional sensor and the WSAN gateway based on said authentication vector.

6. The method according to claim 4, wherein the authentication is performed according to the AKA protocol.

7. The method of claim 1, wherein a private identity, ID_S and a secret sensor key of a sensor is pre-stored in a sensor database by the manufacturer, in connection with pointers to a software database.

36. The method of claim 1, wherein the indication of the private identity of the potential additional sensor is received from the WSAN gateway before the beacon is received from the additional sensor.

8. A method for attaching an additional sensor to a wireless or wired sensor and actuator network (WSAN) comprising at least one existing WSAN sensor, the additional sensor transmitting an indication of its private identity to the at least one existing WSAN sensor after insertion in the WSAN, the method comprising:

receiving, by the WSAN gateway, the indication of the private identity of the additional sensor from a WSAN Manager;

transmitting, by the WSAN gateway, said received indication of the private identity of the additional sensor to the at least one existing WSAN sensor;

receiving, by the WSAN gateway, a notification from the at least one existing WSAN sensor that the additional sensor is eligible for insertion in the WSAN after receiving the indication of the private identity of the additional sensor from the WSAN manager and said transmitting the received indication of the private identity to the at least one existing WSAN sensor, the notification comprising the indication of the private identity of the inserted eligible additional sensor; and

performing, by the WSAN gateway, authentication of the inserted additional eligible sensor based on authentication information received from the WSAN Manager.

9. The method according to claim 8, wherein the WSAN gateway further transmits a listening request to the at least one existing WSAN sensor, the listening request indicating a listening status for detecting a beacon from the additional sensor.

10. The method according to claim 8, wherein the WSAN gateway further receives an activation time interval for the additional sensor from the WSAN manager and forwards the activation time interval to the at least one existing WSAN sensor, in connection with the transmission of the indication of the private identity of the additional sensor.

11. The method according to claim 8, wherein the WSAN gateway further transmits an authentication request comprising the private identity of the additional sensor to the WSAN Manager, after receiving the notification of the insertion of the additional eligible sensor in the WSAN.

12. The method according to claim 8, wherein the WSAN gateway receives a sensor description and sensor related software from the WSAN Manager, together with the authentication information.

13. The method according to claim 8, wherein the WSAN gateway performs the steps of:

updating a WSAN ontology based on the received sensor description in response to determining that the sensor node description comprises an WSAN sensor ontology;

storing the sensor related software in a local software database repository.

38. The method of claim 8, wherein the notification is based on a comparison between the indication of the private identity of the additional sensor and an indication of a private identity that the at least one existing WSAN sensor received in a beacon from a new sensor inserted in the WSAN.

14. A method, performed by a wireless or wired sensor and actuator network (WSAN) manager, for attaching an additional sensor to a WSAN comprising at least one existing WSAN sensor, the method comprising:

registering, by the WSAN manager, the additional sensor;

retrieving, by the WSAN manager, a private identity and a secret sensor key of the additional sensor from a sensor database;

transmitting, by the WSAN manager, an indication of the private identity of the additional sensor to a WSAN gateway;

computing, by the WSAN manager, an authentication vector for authentication of the additional sensor, based on the secret sensor key, after receiving an authentication request from the WSAN gateway, the request comprising the private identity of the additional sensor; and

transmitting, by the WSAN manager, the authentication vector to the WSAN gateway.

15. The method according to claim 14, wherein the WSAN manager determines an activation time interval for the additional sensor, and transmits the activation time interval to the WSAN gateway, together with the indication of the private identity of the additional sensor.

16. The method according to claim 14, wherein the WSAN manager sets up a secure communication channel to the WSAN gateway, after receiving the private identity of the additional sensor.

17. The method according to claim 14, wherein the WSAN manager retrieves a sensor description and sensor related software from a software database of the manufacturer, after receiving a request from the WSAN gateway.

18. The method according to claim 17, wherein the WSAN manager transmits the sensor description and the sensor related software to the WSAN gateway, together with the authentication vector.

19. A wireless or wired sensor and actuator network (WSAN) sensor adapted to communicate with a WSAN gateway and comprising an arrangement for attaching an additional sensor to a WSAN, the arrangement comprising a processing circuit configured to:

receive and store, in the WSAN sensor, an indication of a private identity of a potential additional sensor from the WSAN gateway;

receive, in the WSAN sensor, a beacon comprising an indication of a private identity of an additional sensor, the beacon emitted by the additional sensor after insertion in the WSAN;

determine, in the WSAN sensor, whether the additional sensor is eligible for attachment to the WSAN by comparing the indication of the private identity received in the beacon with the stored indication, and

send, from the WSAN sensor, a notification of the insertion of the eligible additional sensor to the WSAN gateway, the notification comprising the indication of the private identity of the eligible additional sensor.

20. The WSAN sensor according to claim 19, wherein the processing circuit is further configured to determine whether the additional sensor is eligible is by checking that an activation time interval of the additional sensor has not expired, the activation time interval received and stored in connection with the indication of the private identity of the additional sensor.

21. The WSAN sensor according to claim 19, wherein the processing circuit is further configured to activate a listening status depending on a listening request received from the WSAN gateway.

22. The WSAN sensor according to claim 19, wherein the processing circuit is further configured to:

transmit the indication of the private identity in a beacon to existing WSAN sensors, after insertion into the WSAN; and

perform an authentication with the WSAN gateway, based on an authentication vector from a WSAN Manager.

23. The WSAN sensor according to claim 19, wherein the processing circuit is further configured to perform authentication by arranging to establish a shared key with the WSAN gateway, based on an authentication vector.

37. The WSAN sensor of claim 19, wherein the indication of the private identity of the potential additional sensor is received from the WSAN gateway before the beacon is received from the additional sensor.

24. A wireless or wired sensor and actuator network (WSAN) gateway arranged to communicate with a WSAN Manager and WSANsensors, the WSAN gateway comprising:

a WSAN gateway arrangement for attaching an additional sensor to a WSAN comprising at least one existing WSAN sensor, the additional sensor transmitting an indication of its private identity to the at least one existing WSAN sensor after insertion in the WSAN, the WSAN gateway arrangement comprising a processing circuit configured to;

receive the indication of the private identity of the additional sensor from the WSAN Manager, and for forwarding the indication to the at least one existing WSAN sensor;

receive a notification from the at least one existing WSAN sensor that the additional sensor is eligible for insertion in the WSAN after receiving the indication of the private identity of the additional sensor from the WSAN manager and transmitting the received indication of the private identity to the at least one existing WSAN sensor; and

authenticate the inserted additional sensor, based on an authentication vector received from the WSAN Manager.

25. The WSAN gateway according to claim 24, wherein the processing circuit is further configured to transmit a listening request to the at least one existing WSAN sensor, the listening request indicating a listening status for detecting a beacon from the additional sensor.

26. The WSAN gateway according to claim 24, wherein the processing circuit is further configured to receive an activation time interval for the additional sensor from the WSAN Manager and to forward to the at least one existing WSAN sensor, in connection with the transmission of the indication of the private identity.

27. The WSAN gateway according to claim 24, wherein the processing circuit is further configured to transmit an authentication request to the WSAN Manager, after receiving the notification of the insertion of the eligible additional sensor in the WSAN.

28. The WSAN gateway according to claim 24, wherein the processing circuit is configured to authenticate by establishing a shared security key, KS, with the inserted additional sensor.

29. The WSAN gateway according to claim 24, wherein the processing circuit is further configured to receive a sensor description and sensor related software from the WSAN Manager, together with the authentication vector.

30. The WSAN gateway according to claim 29, wherein the processing circuit is further configured to:

update a WSAN ontology based on the received sensor description in response to determining that the sensor node description comprises a WSAN sensor ontology, update a WSAN ontology based on the received sensor description; and

store the sensor related software in a local software database repository.

39. The WSAN gateway of claim 24, wherein the notification is based on a comparison between the indication of the private identity of the additional sensor and an indication of a private identity that the at least one existing WSAN sensor received in a beacon from a new sensor inserted in the WSAN.

31. A wireless or wired sensor and actuator network (WSAN) manager for managing a WSAN and arranged to communicate with a WSAN gateway, the WSAN Manager comprising:

an arrangement for attaching an additional sensor to a WSAN comprising at least one existing WSAN sensor, the arrangement comprising a processing circuit configured to;

retrieve by the WSAN manager a private identity and a secret sensor key of the additional sensor from a sensor database after registering the additional sensor, and forward an indication of the private identity of the additional sensor to the WSAN gateway;

compute in the WSAN manager an authentication vector for authentication of the additional sensor based on the secret sensor key, the computing performed after receiving an authentication request from the WSAN gateway; and

forward the authentication vector to the WSAN gateway.

32. The WSAN manager according to claim 31, wherein the processing circuit is further configured to determine an activation time interval for the additional sensor, and to transmit the activation time interval to the WSAN gateway, together with the indication of the private identity.

33. The WSAN manager according to claim 31, wherein the processing circuit is further configured to pre-store the identity of a WSAN gateway associated with a user subscription.

34. The WSAN manager according to claim 31, wherein the processing circuit is further configured to retrieve a sensor description and sensor related software from a software database of the manufacturer, after receiving a request from the WSAN gateway.

35. The WSAN manager according to claim 34, wherein the processing circuit is further configured to transmit the sensor description and the sensor related software to the WSAN gateway, together with the authentication vector.