Network node security using short range communication

• US 9,742,810 B2
• Filed: 10/10/2016
• Issued: 08/22/2017
• Est. Priority Date: 03/28/2014
• Status: Active Grant

• Current Assignee: Sensormatic Electronics LLC (Johnson Controls International plc)
• Original Assignee: Tyco Fire & Security GmbH (Johnson Controls International plc)
• Inventors: Rasband, Paul B., Mohiuddin, Mohammad, Hall, Stewart E.
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): KAPLAN, BENJAMIN A
• Application Number:
  US15/289,728
• Publication Number:
  US 20170034218A1
• Time in Patent Office: 316 Days
• Field of Search: 726 1
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 4/38 for collecting sensor information
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/80 Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks
• CPC Class Codes: H04W 88/06 adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Abstract

Systems (100) and methods for network node security configuration. The methods involve: performing operations by a mobile communication device (104) to obtain a unique identifier from a network node (108) to be installed at a customer facility (102) via a first short range communication link (110); communicating a signal comprising the unique identifier from the mobile communication device to a remote server (118) via a first long range communication link (112); verifying by the remote server that a correct type of network node is being installed at a first location within the customer facility according to a respective work order; and communicating security information, useful for configuring security functions of the network node, from the remote server to the network node via the mobile communication device, without presenting the security information to a user of the mobile communication device or storing the security information in the mobile communication device.

Claims

1. A method for network node security configuration, comprising:

transmitting a unique identifier for and from a network node installed at a customer facility via a wireless short range communication link, the unique identifier uniquely identifying the network node;

receiving at the network node via the wireless short range communication link a security configuration based on the unique identifier, without permitting access to the security configuration by a person installing the security configuration, wherein the security configuration is needed to configure security functions of the network node for secure communications with other network nodes at the customer facility, and serves as verification that the network node is correct for the installed location in the customer facility in accordance with a work order; and

using the security configuration at the network node to facilitate the secure communications with other network nodes.

2. The method according to claim 1, wherein the security configuration information is received at the network node in an encrypted form.

3. The method according to claim 1, further comprising storing the security configuration information in a short range communication device of the network node.

4. The method according to claim 3, further comprising transferring the security configuration information from the short range communication device to a processor of the network node after the network node is turned on.

5. The method according to claim 4, further comprising configuring the security functions of the network node in accordance with the security configuration information which was transferred to the processor.

6. The method according to claim 5, further comprising outputting an indicator from the network node indicating successful security enablement thereof.

7. The method according to claim 6, further comprising performing operations by the network node to join a network using the security functions configured in accordance with the security configuration information.

8. A network node, comprising:

a memory in which is stored a unique identifier which uniquely identifies the network security node;

a wireless short range communication device configured to

receive a request for the unique identifier,

transmit the unique identifier in response to the request, and

receive a security configuration based on the unique identifier, without permitting access to the security configuration by a person installing the security configuration,

a processor configured to use the security configuration to configure security functions of the network node for secure communications with other network nodes; and

wherein said security configuration received at the network node further comprises a verification that the network node is correct for the installed location in the customer facility in accordance with a work order.

9. The network node according to claim 8, wherein the security configuration information is encrypted.

10. The network node according to claim 9, wherein the short range communication device is configured to store the encrypted security configuration information.

11. The network node according to claim 10, further comprising a memory device, accessible to the processor, wherein said network node is configured to transfer the security configuration information to the memory device after the network node is turned on.

12. The network node according to claim 11, wherein the processor is configured to utilize the security configuration to configure security functions of the network node.

13. The network node according to claim 12, further comprising an indicator responsive to the processor which generates an output from the network node indicating successful security enablement thereof.

14. The network node according to claim 13, wherein the processor is configured to cause the network node to join a network using the security functions.