Network security systems and methods

Patent metadata

Field	Value
Publication number	US-11683344-B2
Application number	US-202017121192-A
Country	US
Kind code	B2
Filing date	Dec 14, 2020
Priority date	Feb 14, 2014
Publication date	Jun 20, 2023
Grant date	Jun 20, 2023

Abstract

This disclosure relates to systems and methods for managing connected devices and associated network connections. In certain embodiments, trust, privacy, safety, and/or security of information communicated between connected devices may be established in part through use of security associations and/or shared group tokens. In some embodiments, these security associations may be used to form an explicit private network associated with the user. A user may add and/or manage devices included in the explicit private network through management of various security associations associated with the network's constituent devices.

First claim

What is claimed is:

1. A method of controlling operation of connected devices comprising:
receiving, by a trusted service from a first connected device, a request to perform a composite service, the composite service comprising one or more control actions performed by a plurality of second connected devices;
accessing, using information included in the request, explicit private network state information associated with the plurality of second connected devices;
determining, based on the explicit private network state information associated with the plurality of second connected devices, that the first connected device may control the operation of the plurality of second connected devices in accordance with the request;
generating, based on the determination, one or more command messages configured to control the operation of the plurality of second connected devices in accordance with the request; and
transmitting the one or more command messages to the plurality of second connected devices.

2. The method of claim 1 , wherein accessing the explicit private network state information associated with the plurality of second devices comprises accessing explicit private network state information associated with the plurality of second connected devices based on identification information associated with the plurality of second connected devices included in the request.

3. The method of claim 2 , wherein the identification information is further included in the explicit private network state information associated with the plurality of second connected devices.

4. The method of claim 2 , wherein the identification information is uniquely associated with at least one connected device of the plurality of second connected devices.

5. The method of claim 4 , wherein the identification information comprises at least one of a device universally unique identifier and Internet protocol identification information.

6. The method of claim 2 , wherein the identification information comprises a name assigned to at least one connected device of the plurality of second connected devices by an associated entity.

7. The method of claim 1 , wherein the explicit private network state information associated with the plurality of second connected devices comprises information relating to one or more acceptable commands associated with at least one connected device of the plurality of second connected devices.

8. The method of claim 7 , wherein determining that the first connected device may control the operation of the plurality of second connected devices in accordance with the request comprises determining that the request is associated with at least one acceptable command of the one or more acceptable commands associated with the at least one connected device of the plurality of second connected devices.

9. The method of claim 7 , wherein generating the command message comprises generating the command message based, at least in part, on the information relating to at least one acceptable command of the one or more acceptable commands associated with the at least one connected device of the plurality of second connected devices.

10. The method of claim 1 , wherein the explicit private network state information associated with the plurality of connected devices comprises information relating to acceptable data that may be communicated to at least one connected device of the plurality of second connected devices.

11. The method of claim 10 , wherein generating the command message comprises generating the command message based, at least in part, on the information relating to acceptable data that may be communicated to the at least one connected device of the plurality of second connected devices.

12. The method of claim 1 , wherein the method further comprises:
receiving, by the trusted service, a response message from at least one connected device of the plurality of second devices generated by the at least one connected device in response to the one or more command messages.

13. The method of claim 12 , wherein the method further comprises:
updating the explicit private network state information associated with the plurality of second connected devices based, at least in part, on the response message.

14. The method of claim 1 , wherein accessing the explicit private network state information associated with the plurality of second connected devices comprises accessing the explicit private network state information associated with the plurality of second connected devices from storage of the first connected device.

15. The method of claim 1 , wherein accessing the explicit private network state information associated with the plurality of second connected devices comprises accessing the explicit private network state information associated with the plurality of second connected devices from a remote trusted service.

16. The method of claim 1 , wherein the request to control the operation of the plurality of second connected devices is received from a user interface of the first connected device.

17. The method of claim 1 , wherein the request to control the operation of the plurality of second connected devices is received via a communications interface of the first connected device from a third connected device.

18. The method of claim 1 , wherein the first connected device comprises at least one of a smartphone, a tablet computer system, a desktop computer system, a laptop computer system, a wearable computing device, a connected vehicle, a telematics system, a security system, a home automation system, a connected thermostat, a connected heating system, a connected cooling system, a utility meter, a medical device, a gaming system, a network infrastructure system, a television, a speaker, and a digital camera.

19. The method of claim 1 , wherein at least one connected device of the plurality of second connected devices comprises at least one of a smartphone, a tablet computer system, a desktop computer system, a laptop computer system, a wearable computing device, a connected vehicle, a telematics system, a security system, a home automation system, a connected thermostat, a connected heating system, a connected cooling system, a utility meter, a medical device, a gaming system, a network infrastructure system, a television, a speaker, and a digital camera.

Assignees

• Intertrust Tech Corp

Inventors

• Maher David P
• Boccon-Gibod Gilles

Classifications

• H04L63/065

  for group communications (cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833) · CPC title

• G06F2221/2149

  Restricted operating environment · CPC title

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04W12/08

  Access security · CPC title

• H04L67/51

  Discovery or management thereof, e.g. service location protocol [SLP] or web services · CPC title