Securing internet of things communications across multiple vendors

Patent metadata

Field	Value
Publication number	US-9485231-B1
Application number	US-201514722064-A
Country	US
Kind code	B1
Filing date	May 26, 2015
Priority date	May 26, 2015
Publication date	Nov 1, 2016
Grant date	Nov 1, 2016

Abstract

A secure connection between a user mobile device and a “Internet-of-Things” network-connected device (e.g., a home appliance or a vehicle) may be provided using an internet gateway residing in the public internet and a local gateway residing in a private network behind a firewall. The user device may receive an input through a software application and may generate an electronic instruction based on the input. The user device may then encrypt the electronic instruction and send the encrypted electronic instruction to the internet gateway over a secure connection (e.g., SSH, TLS). The internet gateway then sends the encrypted electronic instruction to the local gateway, which decrypts the encrypted electronic instruction, interprets it, and generates and transmits a device instruction to communicate with the network-connected device, either directly or through an intermediary device such as a third-party bridge or hub. Only the user device and local gateway have encryption/decryption keys.

First claim

What is claimed is:

1. A method for secure communication, the method comprising:
receiving an encrypted electronic instruction at a local gateway from an internet gateway passing through a firewall, wherein the encrypted electronic instruction transmitted from a user device to the internet gateway over a secure session connection is an electronic instruction generated by the user device and then encrypted by the user device based on a first security key stored in a user memory of the user device;
decrypting the encrypted electronic instruction at the local gateway using a second security key stored in a local memory of the local gateway, wherein the internet gateway stores neither the first security key nor the second security key; and
transmitting a device instruction from the local gateway to a specified network-connected device, the device instruction based on the electronic instruction decrypted by the local gateway using the second security key, the device instruction to trigger the specified network-connected device to perform a device action.

2. The method of claim 1 , further comprising initially generating both the first security key and the second security key at one of the local gateway or the user device.

3. The method of claim 1 , further comprising:
initially generating the first security key at the local gateway;
initially generating the second security key at the user device; and
sharing public security data between the user device and the local gateway.

4. The method of claim 1 , wherein the first security key and the second security key include identical data.

5. The method of claim 1 , wherein the encrypted electronic instruction was received by the internet gateway from the user device using a secure protocol, the secure protocol using one of a Secure Sockets Layer (SSL) protection or a Transport Layer Security (TLS) protection.

6. The method of claim 1 , wherein the encrypted electronic instruction is received at the local gateway after having passed through a firewall.

7. The method of claim 1 , wherein the local gateway includes a discovery protocol and an application programming interface (API) conforming to Representational State Transfer (REST) constraints.

8. The method of claim 1 , wherein the network-connected device is one of a home appliance or a vehicle.

9. The method of claim 1 , wherein transmitting the device instruction from the local gateway to a specified network-connected device is done via a direct network transmission.

10. The method of claim 1 , wherein transmitting the device instruction from the local gateway to a specified network-connected device includes transmitting the device instruction from the local gateway through one or more secondary network devices until at least one of the one or more secondary network devices directly transmits the device instruction to the specified network-connected device.

11. The method of claim 1 , wherein the encrypted electronic instruction includes an identifying signature previously generated by the local gateway.

12. A system for secure communication, comprising:
an internet gateway device that receives an encrypted electronic instruction from a user device over a secure session connection, wherein the encrypted electronic instruction is an electronic instruction generated by the user device and then encrypted by the user device based on a first security key stored in a user memory of the user device; and
a local gateway device that:
receives the encrypted electronic instruction from the internet gateway device based on the encrypted electronic instruction first passing through a firewall,
decrypts the encrypted electronic instruction using a second security key stored in a local memory of the local gateway, wherein the internet gateway stores neither the first security key nor the second security key, and
transmits a device instruction from the local gateway to a specified network-connected device, the device instruction based on the electronic instruction decrypted by the local gateway using the second security key, the device instruction to trigger the specified network-connected device to perform a device action.

13. The system of claim 12 , wherein the local gateway is directly communicatively coupled to the network-connected device through a direct network connection.

14. The system of claim 12 , wherein the local gateway is indirectly communicatively coupled to the network-connected device through a network connection that first passes through one or more secondary network devices, wherein at least one of the one or more secondary network devices has a direct network connection to the local gateway, and wherein the one or more secondary network devices includes at least one of a router, a bridge device, or a secondary gateway device.

15. The system of claim 12 , wherein the first security key and the second security key were both previously generated by the local gateway, and wherein the local gateway provided the first security key to the user device.

16. The system of claim 12 , wherein the first security key and the second security key were both previously generated by the user device, and wherein the user device provided the second security key to the local gateway.

17. The system of claim 12 , wherein the first security key and the second security key include identical data.

18. The system of claim 12 , wherein the secure connection uses one of a Secure Sockets Layer (SSL) protection or a Transport Layer Security (TLS) protection.

19. The system of claim 12 , wherein the network-connected device is one of a home appliance or a vehicle.

20. A non-transitory computer-readable storage medium, having embodied thereon a program executable by a processor to perform a method for secure connections, the method comprising:
receiving an encrypted electronic instruction at a local gateway from an internet gateway passing through a firewall, the encrypted electronic instruction transmitted from a user device to the internet gateway over a secure session connection is an electronic instruction generated by the user device and encrypted by the user device based on a first security key stored in a user memory of the user device;
decrypting the encrypted electronic instruction at the local gateway using a second security key stored in a local memory of the local gateway, wherein the internet gateway stores neither the first security key nor the second security key; and
transmitting a device instruction from the local gateway to a specified network-connected device, the device instruction based on the electronic instruction decrypted by the local gateway using the second security key, the device instruction to trigger the specified network-connected device to perform a device action.

Assignees

• Dell Software Inc

Inventors

• Reese George Edward

Classifications

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/168

  above the transport layer · CPC title

• H04L63/166

  at the transport layer · CPC title