System and method for establishing a secondary communication channel to control an internet of things (IOT) device

• US 10,091,242 B2
• Filed: 12/14/2015
• Issued: 10/02/2018
• Est. Priority Date: 12/14/2015
• Status: Active Grant

• Current Assignee: Afero, Inc.
• Original Assignee: Afero, Inc.
• Inventors: Britt, Joe, Zimmerman, Scott, Holland, Shannon
• Primary Examiner(s): Holder, Bradley
• Application Number:
  US14/967,627
• Publication Number:
  US 20170171747A1
• Time in Patent Office: 1,023 Days
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04L 9/0877 using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]
• CPC Class Codes: H04L 9/3215 using a plurality of channels network architectures or network communication protocols using different networks H04L63/18
• CPC Class Codes: H04W 12/037 of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 12/77 Graphical identity
• CPC Class Codes: H04W 76/15 Setup of multiple wireless link connections

Abstract

A system and method are described for establishing a secondary communication channel between an IoT device and a client device. For example, one embodiment of a method comprises: establishing a primary secure communication channel between the IoT device and an IoT service using a primary set of keys; performing a secondary key exchange using the primary secure communication channel, the client device and the IoT device each being provided with a secondary set of keys following the secondary key exchange; detecting that the primary secure communication channel is inoperative; and responsively establishing a secondary secure wireless connection between the client device and the IoT device using the secondary set of keys, the client device being provided with access to data and functions made available by the IoT device over the secondary secure wireless connection.

Claims

1. A method to establish a secondary communication channel between an Internet of Things (IoT) device and a client device comprising:

establishing, by the IoT device, a primary secure communication channel between the IoT device and an IoT service using a primary set of keys;

performing, by the IoT device, a secondary key exchange using the primary secure communication channel, the client device and the IoT device each being provided with a secondary set of keys following the secondary key exchange;

receiving, by the IoT device, a passcode from an application (app) on the client device, a user of the client device choosing the passcode and the passcode being transmitted to the IoT device over the primary secure communication channel;

storing, by the IoT device, the passcode on the IoT device;

detecting, by the IoT device and/or the client device, that the primary secure communication channel is inoperative and

responsively establishing, by the IoT device and/or the client device, a secondary secure wireless connection between the client device and the IoT device using the secondary set of keys;

requesting, by the IoT device, the user to enter the passcode from the client device; and

providing, by the IoT device, the client device with access to data and/or functions made available by the IoT device over the secondary secure wireless connection only if the user enters the correct passcode from the client device.

2. The method as in claim 1 wherein the access to data and/or functions over the secondary secure wireless connection comprises more limited access to the data and/or functions than when connected over the primary secure communication channel.

3. The method as in claim 1 further comprising:

executing the app on the client device to prompt the user to enter the passcode upon establishing the secondary secure wireless connection, the passcode being transmitted from the app to the IoT device prior to the IoT device providing access to the data and/or functions.

4. The method as in claim 3 wherein the IoT device comprises a wireless door lock and wherein at least one function to be accessed over the secondary secure communication channel comprises unlocking the door lock.

5. The method as in claim 1 wherein establishing a primary secure communication channel between the IoT device and an IoT service using a primary set of keys comprises:

establishing communication between the IoT service and the IoT device through an IoT hub or the client device;

generating a service public key and a service private key by key generation logic of a first encryption engine on the IoT service;

generating a device public key and a device private key by key generation logic of a second encryption engine on the IoT device;

transmitting the service public key from the first encryption engine to the second encryption engine and transmitting the device public key from the second encryption engine to the first encryption engine;

generating a secret using the device public key and the service private key;

generating the same secret using the service public key and the device private key; and

encrypting and decrypting data packets transmitted between the first encryption engine and the second encryption engine using the secret or using data structures derived from the secret.

6. The method as in claim 5 wherein the key generation logic comprises a hardware security module (HSM).

7. The method as in claim 6 wherein the data structures derived from the secret comprise a first key stream generated by the first encryption engine and a second key stream generated by the second encryption engine.

8. The method as in claim 7 wherein a first counter is associated with the first encryption engine and a second counter is associated with the second encryption engine, the first encryption engine incrementing the first counter responsive to each data packet transmitted to the second encryption engine and the second encryption engine incrementing the second counter responsive to each data packet transmitted to the first encryption engine.

9. The method as in claim 8 wherein the first encryption engine generates the first key stream using a current counter value of the first counter and the secret and the second encryption engine generates the second key stream using a current counter value of the second counter and the secret.

10. The method as in claim 9 wherein the first encryption engine comprises an elliptic curve method (ECM) module to generate the first key stream using the first counter value and the secret and the second encryption engine comprises an ECM module to generate the second key stream using the first counter value and the secret.

11. The method as in claim 9 wherein the first encryption engine encrypts a first data packet using the first key stream to generate a first encrypted data packet and transmits the first encrypted data packet to the second encryption engine along with a current counter value of the first counter.

12. The method as in claim 11 wherein the second encryption engine uses the current counter value of the first counter and the secret to generate the first key stream and uses the first key stream to decrypt the first encrypted data packet.

13. A system to establish a secondary communication channel between an Internet of Things (IoT) logic device and a client device, the system comprising:

the IoT logic device to establish a primary secure communication channel with an IoT service using a primary set of keys;

the IoT logic device to perform a secondary key exchange using the primary secure communication channel;

the client device and the IoT logic device each being provided with a secondary set of keys following the secondary key exchange;

an authenticator circuitry to store a passcode on the IoT logic device, wherein the passcode is initially received from an application (app) on the client device prior to the authenticator circuitry storing the passcode on the IoT logic device, a user of the client device choosing the passcode and the passcode being transmitted to the IoT logic device over the primary secure communication channel;

the authenticator circuitry storing the passcode on the IoT logic device;

the IoT logic device and/or the client device to detect that the primary secure communication channel is inoperative;

the IoT logic device and/or the client device to responsively establish a secondary secure wireless connection between the client device and the IoT logic device using the secondary set of keys;

the authenticator circuitry to prompt the user to enter the passcode from the client device; and

the IoT logic device to provide the client device with access to data and/or functions made available by the IoT logic device over the secondary secure wireless connection only if the user enters the correct passcode from the client device.

14. The system as in claim 13 wherein the access to data and/or functions over the secondary secure wireless connection comprises more limited access to the data and/or functions than when connected over the primary secure communication channel.

15. The system as in claim 13 further comprising:

the app executed on the client device to prompt the user to enter the passcode upon establishing the secondary secure wireless connection, the passcode being transmitted from the app to the IoT logic device prior to the IoT logic device providing access to the data and/or functions.

16. The system as in claim 15 wherein the IoT logic device comprises a wireless door lock and wherein at least one function to be accessed over the secondary secure communication channel comprises locking or unlocking the wireless door lock.

17. The system as in claim 13 wherein to establishing a primary secure communication channel between the IoT logic device and the IoT service using a primary set of keys comprises:

the IoT logic device establishes communication with the IoT service through an IoT hub or the client device;

a first encryption engine on the IoT service comprising key generation logic to generate a service public key and a service private key;

a second encryption engine on the IoT logic device comprising key generation logic to generate a device public key and a device private key;

the first encryption engine to transmit the service public key to the second encryption engine and the second encryption engine to transmit the device public key to the first encryption engine;

the first encryption engine to use the device public key and the service private key to generate a secret;

the second encryption engine to use the service public key and the device private key to generate the same secret; and

wherein once the secret is generated, the first encryption engine and the second encryption engine encrypt and decrypt data packets transmitted between the first encryption engine and the second encryption engine using the secret or using data structures derived from the secret.

18. The system as in claim 17 wherein the key generation logic comprises a hardware security module (HSM).

19. The system as in claim 18 wherein the data structures derived from the secret comprise a first key stream generated by the first encryption engine and a second key stream generated by the second encryption engine.

20. The system as in claim 19 further comprising a first counter associated with the first encryption engine and a second counter associated with the second encryption engine, the first encryption engine incrementing the first counter responsive to each data packet transmitted to the second encryption engine and the second encryption engine incrementing the second counter responsive to each data packet transmitted to the first encryption engine.