Apparatus and method for establishing secure communication channels in an internet of things (IoT) system

• US 9,699,814 B2
• Filed: 07/03/2015
• Issued: 07/04/2017
• Est. Priority Date: 07/03/2015
• Status: Active Grant

• Current Assignee: Afero, Inc.
• Original Assignee: Afero, Inc.
• Inventors: Zakaria, Omar, Britt, Joe, Zimmerman, Scott
• Primary Examiner(s): RAHIM, MONJUR
• Application Number:
  US14/791,373
• Publication Number:
  US 20170006643A1
• Time in Patent Office: 732 Days
• Field of Search: 713168
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

An apparatus and method for establishing socket-based communication between wireless communication circuits without formally pairing the wireless communication circuits. For example, if a Bluetooth® (e.g., BTLE) wireless channel is used, a BTLE data structure comprising a set of characteristics may be used to manage bi-directional communication. Each characteristic, identified with an characteristic ID, has a value buffer associated therewith. A first characteristic/value buffer is defined for incoming data traffic and a second characteristic/value buffer is defined for outgoing data traffic. A layer of encryption and other security techniques may also be applied to protect the data transmitted between the wireless communication circuits.

Claims

1. An apparatus comprising:

first local wireless communication circuitry to establish local wireless communication channels with second local wireless communication circuitry;

a data structure stored in a memory and managed by the first local wireless communication circuitry, the data structure comprising a set of characteristics, each characteristic identified with an characteristic ID and having a value buffer associated therewith containing data associated with the characteristic;

the first wireless communication circuitry comprising socket management logic to form a first network socket using the data structure by defining a first characteristic for receiving data packets transmitted by the second local wireless communication module and a second characteristic for transmitting outgoing data packets to the second local wireless communication modules, the first network socket being established without formally pairing the first wireless communication circuitry with the second wireless communication circuitry;

wherein the socket management logic of the first wireless communication circuitry is to temporarily buffer incoming data packets in a first value buffer associated with the first characteristic and temporarily buffer the outgoing packets in a second value buffer associated with the second characteristic.

2. The apparatus as in claim 1 wherein the data structure comprises a table indexed by a characteristic ID and comprising a value field to identify each value buffer including the first value buffer associated with the first characteristic and the second value buffer associated with the second characteristic.

3. The apparatus as in claim 1 wherein the first and second value buffers each have a size of N bits.

4. The apparatus as in claim 3 wherein N=20.

5. The apparatus as in claim 1 wherein the wireless communication module comprises a Bluetooth®

Low Energy (BTLE) communication module and wherein the data structure comprises a Generic Attribute Profile (GATT) data structure.

6. The apparatus as in claim 3 further comprising application logic to transmit a first data packet to the second wireless communication module by writing the first data packet, N bits at a time, to the second value buffer associated with the second characteristic.

7. The apparatus as in claim 6 wherein the second wireless communication module is to read the first data packet, N bits at a time, from the second value buffer associated with the second characteristic.

8. The apparatus as in claim 7 wherein to read the first data packet, the second wireless communication module is to transmit a first command to the first wireless communication module including the characteristic ID of the second characteristic.

9. The apparatus as in claim 6 wherein the application logic is to receive a second data packet from the second wireless communication module by reading the second data packet, N bits at a time, from the first value buffer.

10. The apparatus as in claim 9 wherein to write the second data packet to the first value buffer, the second wireless communication module is to transmit a first command to the first wireless communication module including the characteristic ID of the first characteristic.

11. The apparatus as in claim 10 wherein to establish a secure communication channel over the first network socket, the first and second local wireless communication modules are to initially open a second network socket comprising a third value buffer identified by a third characteristic ID within the data structure for messages transmitted from the first wireless communication module to the second wireless communication module and a fourth value buffer identified by a fourth characteristic ID within the data structure for messages transmitted from the second wireless communication module to the first wireless communication module.

12. The apparatus as in claim 11 wherein using the first wireless communication module is to receive a public key of the second wireless communication module through the fourth value buffer and to transmit its own public key to the second wireless communication module through the third value buffer.

13. The apparatus as in claim 12 wherein the first wireless communication module is to generate a secret using the public key of the second wireless communication module and the private key of the first wireless communication module.

14. The apparatus as in claim 13 further comprising:

a counter to increment upon the transmission of each data packet to the second wireless communication module.

15. The apparatus as in claim 14 wherein the first communication module comprises key stream generation logic to generate a first key stream using a current counter value and the secret, the first communication module further comprising encryption logic to encrypt each data packet using the first key stream.

16. The apparatus as in claim 15 wherein the first wireless communication module is to receive an encrypted data packet from the second wireless communication module and to generate a second key stream to decrypt the encrypted data packet using a counter value received from the second wireless communication module and the secret.

17. The apparatus as in claim 6 wherein the first local wireless communication module is integrated within an Internet of Things (IoT) device and wherein the second local wireless communication module is integrated within an IoT hub or a mobile user device.

18. The apparatus as in claim 17 wherein the IoT device comprises at least one sensor for taking a measurement and providing the measurement to the application logic, the application logic to encapsulate the measurement in the first data packet transmitted to the second wireless communication module.

19. The apparatus as in claim 9 wherein the wherein the first local wireless communication module is integrated within an Internet of Things (IoT) device and wherein the second local wireless communication module is integrated within an IoT hub or a mobile user device, wherein the second data packet comprises a command to be processed by the application logic on the IoT device.

20. The apparatus as in claim 19 wherein the command comprises an operation to power on or power off the IoT device.

21. The apparatus as in claim 1 a processor coupled to the first local wireless communication circuitry, the processor to execute an application to read values from the first value buffer received from the second wireless communication circuitry and write values to the second value buffer to be sent to the second wireless communication circuitry.

22. The apparatus as in claim 21 wherein the second wireless communication circuitry and first wireless communication circuitry are to exchange a plurality of commands including a SET command transmitted by the second wireless communication circuitry causing the application to set an application-specific value and an UPDATE command transmitted by the first wireless communication circuitry to notify the second wireless communication circuitry of the application-specific value.

23. The apparatus as in claim 22 further comprising:

a GET command transmitted by the second wireless communication circuitry to cause the application to retrieve an application-specific value and cause the first wireless communication circuitry to transmit the application-specific value to the second wireless communication circuitry.