Automated IoT device registration

Patent metadata

Field	Value
Publication number	US-11356440-B2
Application number	US-201816205254-A
Country	US
Kind code	B2
Filing date	Nov 30, 2018
Priority date	Nov 30, 2018
Publication date	Jun 7, 2022
Grant date	Jun 7, 2022

Abstract

Automated registration of one or more IoT devices seeking connection to one or more IoT platforms using a secure provisioning service. The secured provisioning service verifies and administers connection credentials to each IoT device, ensuring legitimate devices cannot be impersonated or controlled by unauthorized personnel. The provisioning service matches the IoT devices and metadata of each IoT device to the provisioning rules. Connection credentials and/or rules defining each IoT device's access to IoT platforms are based on the provisioning rules of the rules registry. Matching each IoT device to one or more provisioning rules offers flexibility to dynamically add, delete or amend one or more rules in a complex rules-based system, allowing for automatic updates to the connection credentials of each IoT device, wherein each IoT device can be provisioned or re-provisioned using the most up to date set of new or amended rules.

First claim

What is claimed is:

1. A computer-implemented method comprising the steps of:
receiving, by an internet-of-things (IoT) provisioning service, a registration request from an IoT device, wherein said IoT provisioning service is mediating communications between an IoT device and an IoT platform acting as middleware supporting software connecting hardware of the IoT device to an end-user application prior to registration of the IoT device;
receiving, by the IoT provisioning service, credentials and a set of metadata from the IoT device comprising geolocation of the IoT device;
verifying, by the IoT provisioning service, the credentials are authentic;
calling, by the IoT provisioning service, a rules engine of the IoT provisioning service to query a rules registry for one or more rules applicable to the IoT device;
querying, by the rules engine of the IoT provisioning service, the rules registry for one or more rules that match the set of metadata of the IoT device, wherein rules for the IoT device are triggered by the IoT device being within an established geofence having a boundary encompassing the geolocation of the IoT device provided by the set of metadata, wherein registration of the IoT device is dependent upon location of the IoT device within a specific geolocation, otherwise the registration is denied;
computing, by the rules engine of the IoT provisioning service, a rules statement in response to querying the rules registry, said rules statement expressing the rules for the IoT device that are triggered by the IoT device being within the established geofence and instructing the provisioning service how to apply the rules of the rules registry to the IoT device and provision resources to the IoT device;
registering, by IoT provisioning service, the IoT device with connection credentials, and a device ID as a function of an expression of the one or more rules, with an IoT platform operating as an IoT cloud utilizing platform-as-a-service (PaaS), enabling real-time monitoring functions and pluggable cloud services of the IoT device registered to the IoT platform;
recording to a provisioning log, by the IoT provisioning service, details regarding the registration request from the IoT device, generation of the rules statement by the rules engine, receipt of the rules statement by the provisioning service, connection credentials and device ID of the IoT device;
transmitting, by the IoT provisioning service, the connection credentials, and the device ID to the IoT device;
amending one or more rules of the rules registry to amended rules; and
automatically re-provisioning, by the IoT provisioning service, the IoT device as a function of the amended rules.

2. The computer-implemented method of claim 1 , wherein the one or more rules are dynamically updatable rules selected from the group consisting of an approved list, a banned list, password policies, callback rules and a combination thereof.

3. The computer-implemented method of claim 1 , wherein the one or more rules are dynamically updatable rules selected from the group consisting of time-based registration, delayed registration, final approval, certificate replacement and a combination thereof.

4. The computer-implemented method of claim 1 , further comprising the steps of:
transmitting, by the IoT provisioning service, a system call to the IoT platform, wherein the system call requests verified credentials and a second set of metadata stored by the IoT platform, associated with the IoT device;
matching the IoT device to the verified credentials and the second set of metadata stored by the IoT platform; and
receiving, by the IoT provisioning service, the verified credentials and the second set of metadata from the IoT platform, wherein the second set of metadata stored by the IoT platform further adds or modifies parameters of a search query being made by the rules engine using the set of metadata provided by the IoT device, said second set of metadata including additional elements describing the IoT device which construct a more detailed or expanded query of the rules registry by the rules engine.

5. The computer-implemented method of claim 4 , wherein the step of querying further comprises:
querying, by the IoT provisioning service, the rules registry for the one or more rules that match an expanded search query comprising parameters of the first set of metadata as provided by the IoT device and the second set of metadata received from the IoT platform comprising the additional elements describing the IoT device.

6. The computer-implemented method of claim 1 , wherein an element of the set of metadata is selected from the group consisting of a preregistration_ID, typeID, a callbackURL a custom rule and a combination thereof.

7. A computer system comprising:
a processor;
an internet-of-things (IoT) device placed in communication with the processor; and
a non-transitory computer-readable storage media coupled to a processor, wherein the non-transitory computer readable storage media contains program instructions executing a computer-implemented method comprising the steps of:
receiving, by an IoT provisioning service, a registration request from the IoT device, wherein said IoT provisioning service is mediating communications between an IoT device and an IoT platform acting as middleware supporting software connecting hardware of the IoT device to an end-user application prior to registration of the IoT device;
receiving by the IoT provisioning service, credentials and a set of metadata from the IoT device comprising geolocation of the IoT device;
verifying by the IoT provisioning service, the credentials are authentic;
calling, by the IoT provisioning service, a rules engine of the IoT provisioning service, query a rules registry for one or more rules applicable to the IoT device;
querying by the rules engine of the IoT provisioning service, the rules registry for one or more rules that match the set of metadata of the IoT device, wherein rules for the IoT device are triggered by the IoT device being within an established geofence having a boundary encompassing the geolocation of the IoT device provided by the set of metadata, wherein registration of the IoT device is dependent upon location of the IoT device within a specific geolocation, otherwise the registration is denied;
computing, by the rules engine of the IoT provisioning service, a rules statement in response to querying the rules registry, said rules statement expressing the rules for the IoT device that are triggered by the IoT device being within the established geofence and instructing the provisioning service how to apply the rules of the rules registry to the IoT device and provision resources to the IoT device;
registering, by the IoT provisioning service, the IoT device with connection credentials, and a device ID as a function of an expression of the one or more rules with an IoT platform operating as an IoT cloud utilizing platform-as-a-service (PaaS), enabling real-time monitoring functions and pluggable cloud services of the IoT device registered to the IoT platform;
recording to a provisioning log, by the IoT provisioning service, details regarding the registration request from the IoT device, generation of the rules statement by the rules engine, receipt of the rules statement by the provisioning service, connection credentials and device ID of the IoT device;
transmitting, by the IoT provisioning service, the connection credentials, and the device ID to the IoT device;
amending one or more rules of the rules registry to amended rules; and
automatically re-provisioning, by the IoT provisioning service, the IoT device as a function of the amended rules.

8. The computer system of claim 7 , wherein the on

Assignees

• IBM

Inventors

• Mangalvedkar Amit Mohan
• Niblett Peter David
• Gothe Mats
• Boad Jack Philip
• Sinha Swati

Classifications

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04W4/70

  Services for machine-to-machine communication [M2M] or machine type communication [MTC] · CPC title