Securing IoT devices using an out-of-band beacon

• US 10,097,358 B2
• Filed: 04/20/2016
• Issued: 10/09/2018
• Est. Priority Date: 04/20/2016
• Status: Active Grant

• Current Assignee: Dell Products LP (Dell Technologies Inc.)
• Original Assignee: Dell Products LP (Dell Technologies Inc.)
• Inventors: Robbins, Warren Wade, Hamlin, Daniel L., Robison, Charles D.
• Primary Examiner(s): Doan, Trang T
• Application Number:
  US15/133,294
• Publication Number:
  US 20170310485A1
• Time in Patent Office: 902 Days
• Field of Search: None
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/16 the keys or algorithms being changed during operation
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 4/06 Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
• CPC Class Codes: H04W 88/16 Gateway arrangements

Abstract

Systems and methods for securing network devices through the use of an out-of-band beacon are described. In some embodiments, a method may include broadcasting, by a gateway, a wireless beacon that is out-of-band with respect to communications between the gateway and a plurality of devices over a network, where the wireless beacon includes a token; receiving an encrypted packet at the gateway as part of the communications; decrypting the encrypted packet into an intermediate payload by the gateway using a public key, where the public key corresponds to a certificate provisioned to each of the plurality of devices; and decrypting the intermediate payload into a decrypted packet by the gateway using the token.

Claims

1. A method, comprising:

broadcasting, by a gateway, a wireless beacon that is out-of-band with respect to communications between the gateway and a plurality of devices over a network, wherein the wireless beacon includes a token;

receiving an encrypted packet at the gateway as part of the communications;

decrypting the encrypted packet into an intermediate payload by the gateway using a public key, wherein the public key corresponds to a certificate provisioned to each of the plurality of devices;

decrypting the intermediate payload into a decrypted packet by the gateway using the token;

after a selected amount of time, broadcasting, by the gateway, another wireless beacon that is out-of-band with respect to the communications, the other wireless beacon including a different token;

receiving another encrypted packet at the gateway as part of the communications;

decrypting the other encrypted packet into another intermediate payload by the gateway using the public key; and

in response to being unable to decrypt the other intermediate payload with the different token, marking a source of the other encrypted packet as suspicious or blocking further communications with the source.

2. The method of claim 1, wherein the communications include Internet Protocol (IP) communications, and wherein the encrypted packet includes an encrypted IP packet.

3. The method of claim 1, wherein transmitting the wireless beacon includes using a Radio Frequency (RF) transceiver that is distinct from another transceiver used in the communications.

4. The method of claim 1, wherein the wireless beacon has a range that is shorter than a communication range of the network.

5. The method of claim 1, wherein the token is encrypted by the gateway using the public key prior to the broadcasting of the beacon.

6. The method of claim 1, further comprising:

after a selected amount of time, broadcasting, by the gateway, another wireless beacon that is out-of-band with respect to the communications, the other wireless beacon including a different token;

receiving yet another encrypted packet at the gateway as part of the communications;

decrypting the yet another encrypted packet into yet another intermediate payload by the gateway using the public key; and

decrypting the yet another intermediate payload into yet another decrypted packet by the gateway using the different token.

7. The method of claim 1, further comprising:

transmitting, by the gateway as part of the communications over the network, packets encrypted with both the token and the public key.

8. A device, comprising:

a processor; and

a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the device to;

receive a wireless beacon that is out-of-band with respect to communications between a gateway and a plurality of devices over a network, wherein the wireless beacon includes a token;

encrypt an outgoing packet using the token into an intermediate payload;

encrypt the intermediate payload into an encrypted packet using a private key, wherein the private key corresponds to a certificate provisioned to each of the plurality of devices;

transmit the encrypted packet to the gateway over the network;

receive another wireless beacon that is out-of-band with respect to the communications between the gateway and the plurality of devices over the network, wherein the other wireless beacon includes a different token;

encrypt another outgoing packet using the different token into another intermediate payload;

encrypt the other intermediate payload using the private key into another encrypted packet; and

transmit the other encrypted packet to the gateway over the network.

9. The device of claim 8, wherein the communications include Internet Protocol (IP) communications, and wherein the encrypted packet includes an encrypted IP packet.

10. The device of claim 8, wherein receiving the wireless beacon includes using a Radio Frequency (RF) transceiver that is physically distinct from another transceiver used in the communications.

11. The device of claim 8, wherein the wireless beacon has a range that is shorter than a communication range of the network.

12. The device of claim 8, wherein the token within the wireless beacon is encrypted with a public key corresponding to the private key, and wherein the program instructions, upon execution by the processor, further cause the device to decrypt the token with the private key.

13. The device of claim 8, wherein the program instructions, upon execution by the processor, further cause the device to:

receive yet another encrypted packet from the gateway;

decrypt the yet another encrypted packet into yet another intermediate payload using the private key; and

decrypt the yet another intermediate payload into yet another decrypted packet using the token.

14. A memory device having program instructions stored thereon that, upon execution by a processor of a gateway, cause the gateway to:

broadcast a wireless beacon that is out-of-band with respect to communications between the gateway and a plurality of devices over a network, wherein the wireless beacon includes a first token;

receive an encrypted packet as part of the communications;

decrypt the encrypted packet into an intermediate payload using a public key, wherein the public key corresponds to a certificate provisioned to each of the plurality of devices;

decrypt the intermediate payload into a decrypted packet using the first token;

after a predetermined amount of time, broadcast another wireless beacon that is out-of-band with respect to the communications, the other wireless beacon including a second token;

receive another encrypted packet at the gateway as part of the communications;

decrypt the other encrypted packet into another intermediate payload by the gateway using the public key; and

in response to the other encrypted packet having been received within a selected time window from the predetermined amount of time, decrypt the other intermediate payload with any of the first token or the second token.

15. The memory device of claim 14, wherein the program instructions, upon execution by the processor, further cause the gateway to:

in response to the other encrypted packet having been received outside of a selected time window from the predetermined amount of time, decrypt the other intermediate payload with the second token.

16. The memory device of claim 14, wherein the program instructions, upon execution by the processor, further cause the gateway to:

in response to;

(1) the other encrypted packet having been received outside of a selected time window from the predetermined amount of time, and (2) the other intermediate payload having been encrypted with the first token, mark a source of the other encrypted packet as suspicious or block further communications with the source.