System and method for automatic wireless network authentication in an internet of things (IOT) system

Patent metadata

Field	Value
Publication number	US-10044674-B2
Application number	US-201614987253-A
Country	US
Kind code	B2
Filing date	Jan 4, 2016
Priority date	Jan 4, 2016
Publication date	Aug 7, 2018
Grant date	Aug 7, 2018

Abstract

A system, apparatus, and method are described for a secure IoT wireless network configuration. For example, one embodiment of an Internet of Things (IoT) hub comprises: a local wireless communication interface to establish local wireless connections with one or more IoT devices and/or IoT extender hubs; a network router to establish network connections over the Internet on behalf of the IoT devices and/or IoT extender hubs; an authentication module pre-configured with a passphrase and a hidden service set identifier (SSID), the authentication module to receive a connection requests from the IoT devices and/or an IoT extender hubs and to grant the connection requests when the IoT devices and/or IoT extender hubs use the pre-configured passphrase and hidden SSID; and a firewall of the IoT hub to block all outgoing and incoming connection requests other than those directed to designated servers of an IoT service with known host names.

First claim

What is claimed is:

1. A system comprising:
an IoT service comprising a secure storage to store data associated with IoT device accounts of a plurality of users including a first user;
a plurality of IoT devices and/or IoT extender hubs to attempt to connect with the IoT service over the Internet, the plurality of IoT devices including a first IoT device and a second IoT device of the first user, the second IoT device comprising a new IoT device not initially associated with an account of the first user;
an Internet of Things (IoT) hub comprising:
a first local wireless communication interface comprising a Bluetooth Low Energy (BTLE) interface to establish first local wireless connections with one or more of the IoT devices and/or IoT extender hubs using a BTLE communication protocol;
a WiFi communication interface to establish WiFi connections with one or more of the IoT devices, IoT extender hubs, or other WiFi devices, the WiFi communication interface pre-programmed with a hidden Service Set Identifier (SSID) matching an SSID pre-programmed in the new IoT device;
a network router to establish network connections over the Internet on behalf of all or a subset of the IoT devices and/or IoT extender hubs;
an authentication module to receive connection requests from the IoT devices and/or an IoT extender hubs and to grant the connection requests when the IoT devices and/or IoT extender hubs use proper authentication including a designated WiFi passcode for those IoT devices or IoT extender hubs connecting to the WiFi interface; and
a firewall of the IoT hub to block outgoing and incoming connection requests other than those directed to designated servers of the IoT service with authorized host names, the firewall comprising a whitelist remotely updateable by the IoT service to include the authorized host names, the IoT service to automatically update the whitelist as new servers with new host names are added to the IoT service;

the first IoT device or an IoT application (IoT app) installed on a mobile device of the first user to establish a secure communication channel with the IoT service and to securely transmit to the IoT service a first WiFi passcode associated with the WiFi interface of the IoT hub, the first WiFi passcode usable to securely connect to the WiFi interface;
the new IoT device of the first user to transmit a request to register with the IoT service through the IoT hub or the IoT app installed on the mobile device of the first user, the IoT service to associate the new IoT device with the first user's account and to transmit the first WiFi passcode to the new IoT device; and
the new IoT device to use the first WiFi passcode and pre-programmed SSID to establish a secure connection on the first user's WiFi network.

2. The system as in claim 1 wherein the authentication module is further configured to deny connection requests other than those from IoT devices and/or IoT extender hubs having known medium access control (MAC) addresses.

3. The system as in claim 1 wherein the WiFi interface comprises an 802.11ac interface.

4. The system as in claim 1 wherein the authentication module is pre-configured with a first passcode, the authentication module to grant the connection requests to those IoT devices and/or IoT extender hubs which use the first passcode.

5. The system as in claim 1 wherein the second IoT device of the first user is to connect with the IoT hub or the IoT app installed on the mobile device using a Bluetooth Low Energy (BTLE) connection.

6. The system as in claim 1 wherein the secure storage comprises a secure database maintained on the IoT service to securely store WiFi passcodes for WiFi networks of different users, including the first WiFi passcode, the IoT cloud service to receive the WiFi passcodes from the IoT devices, IoT apps installed on users' mobile devices, or IoT hubs, the IoT cloud service to securely store the WiFi passcodes in the secure database.

7. The system as in claim 6 wherein the first WiFi passcode is to be encrypted using a first secret not known by the IoT service to prevent the IoT service from accessing the first WiFi passcode.

8. The system as in claim 7 further comprising:
a credentials management module on the IoT hub, first IoT device, or IoT app on the mobile device of the first user to establish a secure connection to a credentials management module on the IoT service to provide the first WiFi passcode to the IoT cloud service.

9. The system as in claim 1 wherein the whitelist further includes identification data uniquely identifying each IoT device, IoT extender hub, and/or IoT hub.

10. The system as in claim 9 wherein the identification data comprises a Medium Access Control (MAC) address.

Assignees

• Afero Inc

Inventors

• Liu Clif
• Pointer Robey
• Quinn Kerry

Classifications

• H04W4/70

  Services for machine-to-machine communication [M2M] or machine type communication [MTC] · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04W48/02

  Access restriction performed under specific conditions · CPC title

• H04W12/06

  Authentication · CPC title