Zero-touch onboarding in a network

Patent metadata

Field	Value
Publication number	US-11272361-B2
Application number	US-201515558550-A
Country	US
Kind code	B2
Filing date	Mar 30, 2015
Priority date	Mar 30, 2015
Publication date	Mar 8, 2022
Grant date	Mar 8, 2022

Abstract

A technique for establishing connectivity between electronic devices is described. In particular, when an electronic device is first connected to a network, the electronic device may use a predefined location of a registrar device to request location information for a controller for the electronic device. The electronic device may provide a manufacturer certificate to the registrar device to confirm its identity. After receiving from the registrar device the location information and a registrar certificate that confirms its identity, the electronic device may use the location information to request the security information from a controller that allows the electronic device to establish connectivity with another electronic device. The electronic device may receive the security from the controller along with a controller certificate that confirms the identity of the controller. Moreover, the electronic device may establish a connection with the other electronic device based on the security information.

First claim

What is claimed is:

1. An electronic device, comprising:
a node configured to couple to an antenna;
an interface circuit, coupled to the node, configured to communicate with another electronic device, wherein the electronic device is configured to onboard to a mesh network by performing operations comprising:
discovering, via the interface circuit and using wireless communication, the other electronic device, wherein the discovering comprises a wireless scan, and wherein the other electronic device is included in the mesh network;
providing, from the interface circuit, a request for location information of a controller for the electronic device, wherein the request is intended for a registrar device, external to the mesh network, at a predefined location in a network and comprises a manufacturer certificate that confirms an identity of the electronic device, and wherein communication associated with the registrar device is further associated with the other electronic device as an intermediary and uses the wireless communication without an authenticated session between the electronic device and the other electronic device;
receiving, at the interface circuit, the location information and a registrar certificate that confirms an identity of the registrar device, wherein the location information and the registrar certificate are associated with the registrar device;
validating the registrar certificate;
receiving, at the interface circuit, mesh-network information for the mesh network that comprises the other electronic device, wherein the mesh-network information is associated with the other electronic device and comprises a mesh-network SSID and a mesh-network password;
joining, via the interface circuit, the mesh network using the mesh-network information;
providing, from the interface circuit, another request for security information to establish connectivity with the other electronic device, wherein the other request is intended for the controller and the other electronic device as an intermediary, and wherein the electronic device does not have the security information prior to requesting the security information;
receiving, at the interface circuit, the security information and a controller certificate that confirms an identity of the controller, wherein the security information and the controller certificate are associated with the controller and the other electronic device as an intermediary; and
validating the controller certificate.

2. The electronic device of claim 1 , wherein the operations comprise establishing, via the interface circuit, a connection with the other electronic device based on the security information.

3. The electronic device of claim 1 , wherein the electronic device comprises a headless electronic device without a user interface.

4. The electronic device of claim 1 , wherein the operations comprise providing the request for the location information a first time that the electronic device is connected to the network.

5. The electronic device of claim 1 , wherein the security information comprises additional provisioning information for the mesh network.

6. The electronic device of claim 5 ,
wherein the operations comprise establishing, via the interface circuit, the mesh network with a third electronic device by:
broadcasting the mesh-network SSID;
receiving, from the interface circuit, the manufacturer certificate associated with the other electronic device and the third electronic device;
validating the manufacturer certificate; and
providing, from the interface circuit, the provisioning information intended for the third electronic device.

7. The electronic device of claim 1 , wherein the security information facilitates secure communication with the other electronic device.

8. The electronic device of claim 1 , wherein the wireless communication is compatible with IEEE 802.11 public action frames.

9. The electronic device of claim 1 , wherein the other electronic device comprises an access point.

10. The electronic device of claim 1 , wherein, after discovering the other electronic device, the operations comprise:
requesting, via the interface circuit, an encryption key and a manufacturer certificate of the other electronic device; and
validating the manufacturer certificate of the other electronic device; and
wherein subsequent wireless communication via the interface circuit and intended for the other electronic device is encrypted using the encryption key of the other electronic device.

11. The electronic device of claim 1 , wherein, after discovering the other electronic device, the operations comprise providing an encryption key of the electronic device intended for the other electronic device; and
wherein subsequent wireless communication via the interface circuit and for the electronic device is encrypted using the encryption key of the electronic device.

12. The electronic device of claim 1 , wherein the electronic device further comprises:
a processor; and
a memory, coupled to the processor, which stores program instructions, wherein, when executed by the processor, the program instructions cause the electronic device to perform at least one of: the discovering, the providing the request, the receiving of the location information and the registrar certificate, the validating of the registrar certificate, the providing the other request, the receiving of the security information and the controller certificate, or the validating of the controller certificate.

13. A non-transitory computer-readable storage medium for use in conjunction with an electronic device, the computer-readable storage medium storing program instructions, wherein, when executed by the electronic device, the program instructions cause the electronic device to receive security information while onboarding to a mesh network by performing one or more operations, comprising:
discovering, via an interface circuit in the electronic device and using wireless communication, another electronic device, wherein the discovering comprises a wireless scan;
providing, from the interface circuit, a request for location information of a controller for the electronic device, wherein the request is intended for a registrar device, external to the mesh network, at a predefined location in a network and comprises a manufacturer certificate that confirms an identity of the electronic device, and wherein communication associated with the registrar device is further associated with the other electronic device as an intermediary and uses the wireless communication without an authenticated session between the electronic device and the other electronic device;
receiving, at the interface circuit, the location information and a registrar certificate that confirms an identity of the registrar device, wherein the location information and the registrar certificate are associated with the registrar device;
validating the registrar certificate;
receiving, at the interface circuit, mesh-network information for the mesh network that comprises the other electronic device, wherein the mesh-network information is associated with the other electronic device and comprises a mesh-network SSID and a mesh-network password;
joining, via the interface circuit, the mesh network using the mesh-network information;
providing, from the interface circuit, another request for the security information to establish connectivity with the other electronic device, wherein the other request is intended for the controller and the other electronic device as an intermediary, and wherein the electronic device does not have the security information prior to requesting the secu

Assignees

• Ruckus Wireless Inc
• Arris Entpr Llc

Inventors

• Stephenson David Sheldon

Classifications

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04W84/12

  WLAN [Wireless Local Area Networks] · CPC title

• H04W8/005

  Discovery of network devices, e.g. terminals · CPC title

• H04L63/083

  using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226) · CPC title

• H04W12/06 Primary

  Authentication · CPC title