Proximity based communication with embedded system

• US 9,426,185 B1
• Filed: 06/03/2013
• Issued: 08/23/2016
• Est. Priority Date: 06/03/2013
• Status: Active Grant

• Current Assignee: Ayla Networks, Inc.
• Original Assignee: Ayla Networks, Inc.
• Inventors: Vora, Jigar, Kiiskila, Marko, Myers, Daniel, Eykholt, Joseph R., Caceres, Adrian
• Primary Examiner(s): Etienne, Ario
• Assistant Examiner(s): Halim, Sahera
• Application Number:
  US13/908,971
• Time in Patent Office: 1,177 Days
• Field of Search: 709/227, 709/239
• US Class Current: 1/1
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 9/085 Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying

Abstract

A computing device connects to a local area network (LAN) and determines whether a device comprising an embedded system is also connected to the LAN. Responsive to determining that the device is connected to the LAN, the computing device establishes a first session with the embedded system of the device over the LAN and then communicates with the embedded system of the device via the first session.

Claims

1. A method comprising:

establishing, by a computing device, a first session with a wide area network (WAN) accessible service using a first wireless communication standard, wherein the WAN accessible service has a second session with an embedded system in a device;

communicating, by the computing device, with the embedded system of the device via the first session by using the WAN accessible service as a proxy;

connecting, by the computing device, to a local area network (LAN) using at least one of the first wireless communication standard or a second wireless communication standard;

determining, by the computing device, that the device comprising the embedded system is also connected to the LAN; and

responsive to determining that the device is connected to the LAN, performing the following comprising;

establishing a third session with the embedded system of the device over the LAN; and

communicating with the embedded system of the device via the third session instead of the first session.

2. The method of claim 1, further comprising:

determining that the computing device is no longer connected to the LAN; and

responsive to determining that the computing device is no longer connected to the LAN, performing the following comprising;

terminating the third session; and

communicating with the embedded system of the device via the first session using the WAN accessible service as a proxy.

3. The method of claim 1, further comprising:

receiving, from the WAN accessible service, a shared key and a key identifier (ID) associated with the shared key; and

storing the shared key and the associated key ID, wherein the shared key is also stored by the embedded system;

wherein establishing the third session comprises;

determining whether the computing device and the embedded system each have a copy of the shared key based on the associated key ID; and

establishing a session key for the third session using the shared key responsive to determining that the computing device and the embedded system each have a copy of the shared key.

4. The method of claim 3, further comprising:

determining that the shared key has been revoked;

receiving a new shared key and a new associated key ID from the WAN accessible service, wherein the new shared key and the new key ID are also sent to the embedded system by the WAN accessible service;

using the new shared key to establish a new session key for a new session with the embedded system; and

encrypting communications to the embedded system using the new session key.

5. The method of claim 3, further comprising:

performing registration of the computing device to the embedded system using the WAN accessible service; and

receiving the shared key and the associated key ID from the WAN accessible service responsive to completing the registration.

6. The method of claim 1, further comprising:

receiving an internet protocol (IP) address of the device, wherein determining whether the device is also connected to the LAN comprises sending a message to the IP address responsive to connecting to the LAN.

7. The method of claim 1, wherein determining whether the device is also connected to the LAN comprises:

using a multicast domain name system (mDNS) to locate the device on the LAN.

8. The method of claim 1, wherein communicating with the embedded system comprises:

sending a notification to the embedded system, the notification indicating that the computing device has a message for the embedded system;

receiving a request for the message from the embedded system; and

sending the message to the embedded system, wherein the message comprises a command to update a state of the embedded system.

9. The method of claim 1, further comprising:

after a state of the embedded system changes, receiving an update from at least one of a) the embedded system via the third session if the computing device and the embedded system are both connected to the LAN, or b) a wide area network (WAN) accessible service if at least one of the computing device or the embedded system are not connected to the LAN.

10. A non-transitory computer readable storage medium having instructions that, when executed by a computing device, cause the computing device to perform operations comprising:

establishing a first session with a wide area network (WAN) accessible service, wherein the WAN accessible service has a second session with an embedded system in a device;

communicating with the embedded system of the device via the first session by using the WAN accessible service as a proxy;

connecting to a local area network (LAN);

determining whether a device comprising the embedded system is also connected to the LAN; and

responsive to determining that the device is connected to the LAN, performing the following by the computing device;

establishing a third session with the embedded system of the device over the LAN; and

communicating with the embedded system of the device via the third session instead of the first session.

11. The non-transitory computer readable storage medium of claim 10, the operations further comprising:

responsive to determining that the device is not connected to the LAN,

communicating with the embedded system of the device via the first session using the WAN accessible service as a proxy.

12. The non-transitory computer readable storage medium of claim 10, the operations further comprising:

receiving, from the WAN accessible service, a shared key and a key identifier (ID) associated with the shared key; and

storing the shared key and the associated key ID, wherein the shared key is also stored by the embedded system;

wherein establishing the third session comprises;

determining whether the computing device and the embedded system each have a copy of the shared key based on the associated key ID; and

establishing a session key for the third session using the shared key responsive to determining that the computing device and the embedded system each have a copy of the shared key.

13. The non-transitory computer readable storage medium of claim 12, the operations further comprising:

determining that the shared key has been revoked;

receiving a new shared key and a new associated key ID from the WAN accessible service, wherein the new shared key and the new key ID are also sent to the embedded system by the WAN accessible service;

using the new shared key to establish a new session key for a new session with the embedded system; and

encrypting communications to the embedded system using the new session key.

14. The non-transitory computer readable storage medium of claim 12, the operations further comprising:

performing registration of the computing device to the embedded system using the WAN accessible service; and

receiving the shared key and the associated key ID from the WAN accessible service responsive to completing the registration.

15. The non-transitory computer readable storage medium of claim 10, the operations further comprising:

receiving an internet protocol (IP) address of the device, wherein determining whether the device is also connected to the LAN comprises sending a message to the IP address responsive to connecting to the LAN.

16. The non-transitory computer readable storage medium of claim 10, wherein determining whether the device is also connected to the LAN comprises:

using a multicast domain name system (mDNS) to locate the device on the LAN.

17. The non-transitory computer readable storage medium of claim 10, wherein communicating with the embedded system comprises:

sending a notification to the embedded system, the notification indicating that the computing device has a message for the embedded system;

receiving a request for the message from the embedded system; and

sending the message to the embedded system, wherein the message comprises a command to update a state of the embedded system.

18. The non-transitory computer readable storage medium of claim 10, the operations further comprising:

after a state of the embedded system changes, receiving an update from at least one of a) the embedded system via the third session if the computing device and the embedded system are both connected to the LAN, or b) a wide area network (WAN) accessible service if at least one of the computing device or the embedded system are not connected to the LAN.

19. A non-transitory computer readable storage medium having instructions that, when executed by a computing device, cause the computing device to perform operations comprising:

receiving, from a wide area network (WAN) accessible service, a shared key and a key identifier (ID) associated with the shared key;

storing, by the computing device, the shared key and the associated key ID, wherein the shared key is also stored by an embedded system of a device;

determining that the shared key has been revoked;

receiving a new shared key and a new associated key ID from the WAN accessible service, wherein the new shared key and the new key ID are also sent to the embedded system by the WAN accessible service;

connecting to a local area network (LAN);

determining, by the computing device, whether the device comprising the embedded system is also connected to the LAN;

responsive to determining that the device is connected to the LAN, performing the following comprising;

establishing a first session with the embedded system of the device over the LAN, wherein establishing the first session comprises;

determining whether the computing device and the embedded system each have a copy of the new shared key based on the new key ID; and

establishing a session key for the first session using the new shared key responsive to determining that the computing device and the embedded system each have a copy of the new shared key;

encrypting communications to the embedded system using the session key; and

sending the communications to the embedded system of the device via the first session.

20. The non-transitory computer readable storage medium of claim 19, the operations further comprising:

responsive to determining that the device is not connected to the LAN, performing the following comprising;

establishing or maintaining a second session with the WAN accessible service, wherein the WAN accessible service has a third session with the embedded system; and

communicating with the embedded system of the device using the WAN accessible service as a proxy.

21. The non-transitory computer readable storage medium of claim 19, the operations further comprising:

performing registration of the computing device to the embedded system using the WAN accessible service; and

receiving the shared key and the associated key ID from the WAN accessible service responsive to completing the registration.

22. The non-transitory computer readable storage medium of claim 19, the operations further comprising:

receiving an internet protocol (IP) address of the device, wherein determining whether the device is also connected to the LAN comprises sending a message to the IP address responsive to connecting to the LAN.