Auto-provisioning for internet-of-things devices

Patent metadata

Field	Value
Publication number	US-9538311-B2
Application number	US-201514611397-A
Country	US
Kind code	B2
Filing date	Feb 2, 2015
Priority date	Feb 4, 2014
Publication date	Jan 3, 2017
Grant date	Jan 3, 2017

Abstract

A connectivity device includes a microcontroller, a network interface coupled to the microcontroller, and a non-transitory storage device coupled to the microcontroller. The non-transitory storage device includes a token usable for authentication and including executable code. The token includes a unique device identifier (UDID) that uniquely identifies the authentication device and a private key. The executable code is to cause the microcontroller to initiate a registration process with an internet-of-things (IoT) server to register the token with the IoT server. Token creation and activation procedures are also described.

First claim

What is claimed is:

1. A connectivity device, comprising:
a microcontroller;
a network interface coupled to the microcontroller; and
a non-transitory storage device coupled to the microcontroller, the non-transitory storage device including a token usable for authentication and including executable code;
in which the token includes a unique device identifier (UDID) that uniquely identifies the authentication device and a private key; and
in which the executable code is to cause the microcontroller to initiate a registration process with an internet-of-things (IoT) server to register the token with the IoT server;
in which powering up the connectivity device causes the executable code to cause the microcontroller to generate a public key from the private key and to sign the UDID using the private key to form a signed UDID;
in which the network interface is to receive a temporary public/private key pair and chained certificate which includes a plurality of certificates; and
in which, upon execution of the executable code, the microcontroller opens a secure connection to the IoT server, causes the network interface to transmit the chained certificate to the IoT server, authenticates the IoT server, and causes the network interface to transmit a register token command to the IoT server along with the UDID, a signed UDID, and the public key.

2. The connectivity device of claim 1 in which the executable code is to cause the microcontroller to initiate an activation process with the IoT server to activate the connectivity device to begin accessing web services during operation of a product in which the connectivity device is installable.

3. The connectivity device of claim 2 in which the executable code is to cause the microcontroller to generate a product certificate including a usage field that indicates that the authentication device can cause the activation process to occur, and to sign the product certificate with the private key.

4. The connectivity device of claim 3 in which the executable code is to cause the microcontroller to open a secure connection to the IoT server using the product certificate, to authenticate the IoT server, to cause the network interface to transmit an activate command to the IoT server, and to receive an activation success message from the IoT server.

5. A server system, comprising:
a processor;
a network interface coupled to the processor; and
non-volatile storage accessible to the processor and containing executable code;
in which, when executed, the executable code causes the processor to:
receive a token command, a unique device identifier (UDID), and a signed UDID from a connectivity device;
determine whether a token has already been created with the same received UDID;

add an entry to a list of tokens, the added entry including the received UDID and set a state for the entry to CREATE; and
cause a success message to be transmitted to the connectivity device;
in which, when executed, the executable code causes the processor to change the state from CREATE to REGISTER upon receipt of a register command; and
in which, when executed, the executable code causes the processor to add product usage information to the entry associated with the UDID, the product including the connectivity device.

6. The server system of claim 5 in which, when executed, the executable code causes the processor to receive a public key from the connectivity device and to authenticate the signed UDID using the public key.

7. The server system of claim 6 in which, after authenticating the signed UDID, the executable code causes the processor to discard the signed UDID and not save the signed UDID.

8. The server system of claim 5 in which, when executed, the executable code causes the processor to change the state from REGISTER to ACTIVATE upon receipt of an activate command.

9. The server system of claim 8 in which, when executed, the executable code causes the processor to confirm usage field for product containing the authentication code permits the connectivity device to be activated.

10. A method, comprising:
receiving the UDID, the signed UDID, and a public key from a connectivity device;
authenticating the signed UDID using the public key;
receiving a token create command form the connectivity device;
updating a list of tokens to include a token entry containing the received UDID;
setting a status of the token entry to “CREATE”;
sending a token create success message to the connectivity device;
receiving a credential from a manufacturer of a product to include the connectivity device;
authenticating the credential;
receiving a token registration command form the manufacturer;
setting the status of the token entry to “REGISTER”; and
sending a token register success message to the manufacturer.

11. The method of claim 10 including:
receiving a credential from the product to include the authentication device;
authenticating the credential;
receiving a device activation command from the product;
setting the status of the token entry to “ACTIVATE”; and
sending a device activation success message to the product.

Assignees

• Texas Instruments Inc

Inventors

• Baum Avraham
• Zarmi Ilan
• Reiter Gil
• Ayun Amir

Classifications

• H04W4/005 Primary

  Electricity · mapped topic

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/0807

  using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213) · CPC title

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04W4/70 Primary

  Services for machine-to-machine communication [M2M] or machine type communication [MTC] · CPC title