System and method for securely connecting network devices

• US 9,832,173 B2
• Filed: 12/18/2014
• Issued: 11/28/2017
• Est. Priority Date: 12/18/2014
• Status: Active Grant

• Current Assignee: Afero, Inc.
• Original Assignee: Afero, Inc.
• Inventors: Britt, Joe, Matsumura, Shin, Forood, Houman, Zimmerman, Scott, Myles, Phillip, Zawicki, Sean, Kutami, Daisuke, Holland, Shannon
• Primary Examiner(s): PLECHA, THADDEUS J
• Application Number:
  US14/575,463
• Publication Number:
  US 20160182459A1
• Time in Patent Office: 1,076 Days
• CPC Class Codes: H04L 12/2809 indicating that an appliance service is present in a home automation network monitoring functionality H04L43/0817; discovery or management thereof, e.g. service location protocol [SLP] or web services, H04L67/51
• CPC Class Codes: H04L 12/2834 Switching of information between an external network and a home network access arrangements H04L12/2856
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04M 15/751 Card based account, e.g. smart card, SIM card or USIM
• CPC Class Codes: H04M 17/103 using SIMs (USIMs) or calling cards
• CPC Class Codes: H04M 2215/7209 Card based, e.g. smart card, SIM card or USIM
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 12/77 Graphical identity
• CPC Class Codes: H04W 4/24 Accounting or billing
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 8/205 Transfer to or from user equipment or user record carrier
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A platform, apparatus and method for Internet of Things Implementations. For example, one embodiment of a system comprises: an Internet of Things (IoT) hub comprising a network interface to couple the IoT hub to an IoT service over a wide area network (WAN), and programming logic to program an identification device with one or more encryption keys usable to establish encrypted communication with an IoT device; and at least one IoT device interfacing with the identification device following programming of the identification device by the IoT hub; wherein once the identification device is programmed and interfaced with the IoT device, the IoT device uses the one or more keys to establish a secure communication channel with the IoT hub and/or the IoT service.

Claims

1. A system comprising:

a hardware Internet of Things (IoT) hub comprising a network interface to couple the IoT hub to an IoT service over a wide area network (WAN), and

programming logic of the IoT hub to program an identification device with one or more encryption keys usable to establish encrypted communication with an IoT device; and

the IoT device interfacing with the identification device following the programming of the identification device by the IoT hub;

wherein once the identification device is programmed and interfaced with the IoT device, the IoT device uses the one or more keys to establish a secure communication channel with the IoT hub and the IoT service;

wherein the programming of the identification device by the IoT hub comprises generating a public/private key pair and storing at least the private key of the public/private key pair on the identification device;

wherein the programming of the identification device further comprises storing at least the public key in a secure storage on the IoT hub;

the IoT hub securely forwarding the public key with a corresponding signature to the IoT service over the network interface and further securely forwarding an IoT hub public key with a corresponding signature associated with the IoT hub and corresponding to an IoT hub private key; and

wherein to securely transmit a command or data to the IoT device, the IoT service encrypts the command or data and generates a first signature using the public key to generate an IoT device packet and then encrypts the IoT device packet and generates a second signature using the IoT hub public key to generate an IoT hub packet.

2. The system as in claim 1 wherein the identification device comprises a subscriber identity module (SIM).

3. The system as in claim 1 wherein the identification device is attached to the IoT device.

4. The system as in claim 1 wherein the IoT hub decrypts the IoT hub packet and validates the second signature using the IoT hub private key to generate the IoT device packet and forwards the IoT device packet to the IoT device, the IoT device using the private key to validate the first signature and decrypt the IoT device packet.

5. The system as in claim 1 wherein the identification device comprises a secure key storage for storing the private key.

6. A system comprising:

a hardware Internet of Things (IoT) hub comprising a network interface to couple the IoT hub to an IoT service over a wide area network (WAN), and

a local interface on the IoT hub to receive one or more encryption keys usable to establish a secure communication channel with an IoT device;

wherein once the IoT hub has received the one or more encryption keys, the IoT hub and the IoT service use the one or more encryption keys to establish the secure communication channel with the IoT device; and

wherein a first public/private key pair is associated with the IoT device and wherein the IoT hub receives at least the public key of the first public/private key pair and forwards the public key to the IoT service;

wherein a second public/private key pair is associated with the IoT hub, and wherein the IoT hub provides at least the public key of the second public/private key pair to the IoT device and the IoT service;

wherein the IoT device uses the public key of the second public/private key pair to encrypt communications directed to the IoT hub and wherein the IoT hub and the IoT service use the public key of the first public/private key pair to encrypt communications directed to the IoT device; and

wherein to securely transmit a command or data to the IoT device, the IoT service encrypts the command or data and generates a first signature using the public key to generate an IoT device packet and then encrypts the IoT device packet and generates a second signature using the IoT hub public key to generate an IoT hub packet.

7. The system as in claim 6 wherein the local interface comprises a barcode or QR code reader for reading a barcode or QR code identifying the one or more encryption keys.

8. The system as in claim 6 wherein the IoT hub securely forwards the public keys of the first and second public/private key pairs to the IoT service.

9. The system as in claim 6 wherein the IoT service generates a signature to be transmitted with each command or data using the public key of the first public/private key pair and wherein the IoT device verifies the signature using the private key of the first public/private key pair.

10. The system as in claim 6 wherein the IoT service includes a sequence number or nonce with each command or data transmitted to the IoT device, the IoT device to verify the sequence number or nonce.

11. The system as in claim 6 wherein the IoT hub decrypts the IoT hub packet using the private key of the second public/private key pair to generate the IoT device packet and forwards the IoT device packet to the IoT device, wherein the IoT device uses the private key of the first public/private key pair to decrypt the IoT device packet.

12. The system as in claim 6 wherein the local interface comprises a BLUETOOTH Low Energy (LE) communication channel or a WIFI communication channel.

13. A method comprising:

providing an Internet of Things (IoT) hub comprising a network interface to couple the IoT hub to an IoT service over a wide area network (WAN), and

programming an identification device by the IoT hub to include one or more encryption keys usable to establish encrypted communication with an IoT device; and

interfacing the IoT device with the identification device following the programming of the identification device by the IoT hub;

wherein once the identification device is programmed and interfaced with the IoT device, the IoT device uses the one or more keys to establish a secure communication channel with the IoT hub and the IoT service;

wherein the programming of the identification device by the IoT hub comprises generating a public/private key pair and storing at least the private key of the public/private key pair on the identification device;

wherein the programming of the identification device further comprises storing at least the public key in a secure storage on the IoT hub;

the IoT hub securely forwarding the public key with a corresponding signature to the IoT service over the network interface and further securely forwarding an IoT hub public key with a corresponding signature associated with the IoT hub and corresponding to an IoT hub private key; and

wherein to securely transmit a command or data to the IoT device, the IoT service encrypts the command or data and generates a first signature using the public key to generate an IoT device packet and then encrypts the IoT device packet and generates a second signature using the IoT hub public key to generate an IoT hub packet.

14. The method as in claim 13 wherein the identification device comprises a subscriber identity module (SIM).

15. The method as in claim 13 wherein the identification device is attached to the IoT device.