Touchless secure bootstrapping of IoT devices

Patent metadata

Field	Value
Publication number	US-10833926-B2
Application number	US-201715816694-A
Country	US
Kind code	B2
Filing date	Nov 17, 2017
Priority date	Nov 17, 2017
Publication date	Nov 10, 2020
Grant date	Nov 10, 2020

Abstract

Systems and methods for automatically and securely connecting internet of things (IoT) devices to one or more networks. The system can include a bootstrap server and a configuration database to enable configuration settings for a plurality of IoT devices to be stored and accessed. The bootstrap server can configure an appropriate digital security certificate for an IoT device requesting access to the network. The bootstrap server can then provide a bootstrapping message to the IoT device including the digital certificate and other data. A device management server can then provide a device management message to the IoT device to provide one or more of a final configuration, applications, and software or firmware updates. The system replaces the current system, which is substantially manual, with an essentially “touchless” system that requires little or no input from the user or service provider technicians.

First claim

What is claimed is:

1. A method comprising:
receiving, at a transceiver of a bootstrap server for a cellular network, data from a provisioning system of the cellular network including data associated with an internet of things (IoT) device;
retrieving, with a processor of the bootstrap server, a configuration profile for the IoT device from a configuration database;
selecting, with a processor of the bootstrap server and based on one or more capabilities of the IoT device, a certificate logic for the IoT device of a plurality of certificate logics; and
sending, with the transceiver of the bootstrap server and based on the certificate logic selected for the IoT device, a request for a digital certificate for the IoT device from a certification authority.

2. The method of claim 1 , further comprising:
sending, with a transceiver of the certification authority, the digital certificate to a subscriber identity module (SIM) management system.

3. The method of claim 1 , wherein retrieving the configuration profile for the IoT device from the configuration database comprises retrieving the configuration profile from a configuration database on a server associated with a manufacturer of the IoT device.

4. The method of claim 1 , wherein retrieving the configuration profile for the IoT device from the configuration database comprises retrieving the configuration profile from a configuration database on a server associated with a standards body associated with a certification of the IoT device.

5. The method of claim 1 , wherein the data from the provisioning system further comprises data for a SIM associated with the IoT device, the method further comprising:
comparing, with the processor of the bootstrap server, the one or more capabilities of the IoT device and one or more capabilities of the SIM prior to selecting the certificate logic; and
wherein the selecting the certificate logic for the IoT device is further based at least in part the comparing of the one or more capabilities of the IoT device and the one or more capabilities of the SIM.

6. The method of claim 5 , wherein the one or more capabilities of the IoT device comprise one or more of: voice calling, text messaging, and internet access.

7. The method of claim 1 , wherein the data associated with the IoT device comprises one or more of a model number and a version number of the IoT device;
wherein the configuration profile for the IoT device is based at least in part on the data; and
wherein the selecting the certificate logic is based at least in part on the configuration profile.

8. A method comprising:
sending, with a transceiver of an IoT device, a bootstrapping request to a bootstrap server for a cellular network;
receiving, at the transceiver of the IoT device, a bootstrapping message from the bootstrap server;
applying, with a processor of the IoT device, a digital certificate and one or more settings contained in the bootstrapping message to the IoT device, wherein a type of the digital certificate is selected from a plurality of types of digital certificates based at least in part on one or more capabilities of the IoT device; and
connecting, with the transceiver of the IoT device, to the cellular network based at least in part on the one or more settings in the bootstrapping message.

9. The method of claim 8 , wherein the bootstrapping request comprises an international mobile equipment identity (IMEI) and a current firmware version for the IoT device.

10. The method of claim 8 , wherein the bootstrapping request comprises at least one of a model number and a version number for the IoT device; and
wherein the bootstrapping message is based at least in part on one or more of the model number and version number of the IoT device.

11. The method of claim 8 , further comprising:
sending, with the transceiver of the IoT device, a registration request to a device management server for the cellular network;
receiving, with the transceiver of the IoT device, a device management message from the device management server; and
running, with a processor of the IoT device, one or more applications contained in the device management message.

12. The method of claim 11 , wherein running one or more applications contained in the device management message comprises updating a firmware for the IoT device with a firmware version provided in the device management message.

13. The method of claim 8 , wherein the bootstrapping message includes one or more security settings for the IoT device.

14. A system comprising:
a bootstrap server associated with a cellular network, the bootstrap server comprising:
one or more transceivers to send and receive one or more transmissions;
memory storing at least a configuration algorithm; and
one or more processors in communication with at least the one or more transceivers and the memory, the configuration algorithm including instructions to cause the bootstrap server to:
receive, at the one or more transceivers, data from a provisioning system of the cellular network including data associated with an internet of things (IoT) device;
retrieve, with the one or more processors, a configuration profile for the IoT device from a configuration database;
select, with the one or more processors and based on one or more capabilities of the IoT device, is a certificate logic for the IoT device of a plurality of certificate logics; and
send, with the one or more transceivers and based on the certificate logic selected for the IoT device, a request for a digital certificate for the IoT device from a certification authority.

15. The system of claim 14 , wherein the memory further comprises the configuration database comprising configuration profiles for a plurality of IoT devices.

16. The system of claim 14 , further comprising:
a device management server associated with the cellular network, the device management server comprising:
one or more transceivers to send and receive one or more transmissions;
memory storing one or more applications associated with bootstrapping IoT devices; and
one or more processors in communication with at least the one or more transceivers and the memory, the memory including instructions to cause the device management server to:
receive, at the one or more transceivers, a registration request from the IoT device;
locate, based on data included in the registration request, a first set of one or more applications associated with the IoT device; and
send, with the one or more transceivers, a device management message including the first set of one or more applications.

17. The system of claim 16 , wherein the first set of one or more applications includes a firmware update for the IoT device.

18. The system of claim 14 , wherein the selecting of the certificate logic for the IoT device is based at least in part on the configuration profile for the IoT device; and
wherein the configuration profile includes the one or more capabilities of the IoT device.

19. The system of claim 14 , wherein the configuration algorithm further includes instructions to cause the bootstrap server to:
receive, at the one or more transceivers, a bootstrap request from the IoT device;
send, with the one or more transceivers, a bootstrap message to the IoT device;
wherein the memory further stores one or more security settings associated with bootstrapping a plurality of IoT devices;
wherein the bootstrap message further comprises a set of one or more security settings to be applied to the IoT device prior to c

Assignees

• T Mobile Usa Inc

Inventors

• Ramisetty Phani
• Magadevan Poornima

Classifications

• H04W8/265 Primary

  for initial activation of new user · CPC title

• H04W12/069

  using certificates or pre-shared keys · CPC title

• H04W12/35

  Protecting application or service provisioning, e.g. securing SIM application provisioning · CPC title

• H04W12/50

  Secure pairing of devices · CPC title

• H04L63/0892

  by using authentication-authorization-accounting [AAA] servers or protocols · CPC title