Method and apparatus for device detection and multi-mode security in a control network
View Patent ↗A method and apparatus for device discovery and multi-mode security in a wired and/or wireless control network are described. A controlled device is configured with discovery-level instructions and application-level control instructions. The controlled device includes a user-configurable parameter for selecting between multiple security modes. In one or more security modes, the controlled device may ignore application-level messages until encrypted communications are established with a controller. In one mode, the encrypted communication is established with an encryption key exchange using a predetermined security key. In another mode, a specific key is manually entered into the controller by the user/administrator to facilitate the encryption key exchange. Additionally, for control applications where security is not important, an unencrypted security mode may be implemented. A driver ID provided by the controlled device facilitates loading of a preferred device driver by the controller.
1. A control network comprising: a controller; and
a controlled device, wherein said controlled device has a first level of operation and a second level of operation, and wherein said controlled device is configurable to operate in one of a plurality of security modes;
said plurality of security modes comprising: a first security mode wherein said second level of operation is always enabled;
a second security mode wherein said second level of operation is disabled until said controller and said controlled device perform an encryption key exchange using a predetermined encryption key;
and a third security mode wherein said second level of operation is disabled until said controller initiates encrypted communication using a manually entered encryption key;
wherein, in said second security mode and said third security mode, said controlled device is configured to drop encrypted application level messages; and
wherein said controlled device comprises a viewable surface comprising a text string from which said manually entered encryption key may be obtained.
2. The control network of claim 1 , wherein said control network comprises a wireless network.
3. The control network of claim 1 , wherein said first level of operation comprises one or more discovery functions.
4. The control network of claim 3 , wherein said one or more discovery functions comprise a function configured to transmit a message to said controller, said message comprising a field indicating a preferred device driver associated with said controlled device.
5. The control network of claim 1 , wherein said second level of operation comprises one or more application level functions.
6. The control network of claim 1 , wherein said first level of operation is independent of said plurality of security modes.
7. The control network of claim 1 , wherein said controlled device is hardware configurable to operate in one of said plurality of security modes.
8. The control network of claim 1 , wherein said controlled device comprises a physical surface comprising computer readable indicia from which said manually entered encryption key may be obtained.
9. The control network of claim 8 , wherein said surface comprises a housing of said controlled device.
10. The control network of claim 8 , wherein said surface comprises a key card.
11. The control network of claim 8 , wherein said computer readable indicia comprises a bar code.
12. The control network of claim 11 , wherein said controller comprises a bar code reader.
13. The control network of claim 8 , wherein said computer readable indicia comprises a magnetic stripe.
14. The control network of claim 13 , wherein said controller comprises a magnetic stripe reader.
15. A controlled device for use in a control network comprising a controller, wherein said controlled device has a first level of operation and a second level of operation, and wherein said controlled device is configurable to operate in one of a plurality of security modes, said plurality of security modes comprising: a first security mode wherein said second level of operation is always enabled;
a second security mode wherein said second level of operation is disabled until said controlled device performs an encryption key exchange with said controller using a predetermined encryption key;
and a third security mode wherein said second level of operation is disabled until said controlled device receives an encrypted communication from said controller using a manually entered encryption key;
wherein said controlled device comprises a viewable surface comprising a text string from which said manually entered encryption key may be obtained; and
wherein said controlled device comprises a physical surface comprising computer readable indicia from which said manually entered encryption key may be obtained.
16. The controlled device of claim 15 , wherein said controlled device is configured to communicate over a wireless network.
17. The controlled device of claim 15 , wherein said first level of operation comprises one or more discovery functions.
18. The controlled device of claim 17 , wherein said one or more discovery functions comprises a function configured to transmit a message to said controller, said message comprising a field indicating a preferred device driver associated with said controlled device.
19. The controlled device of claim 15 , wherein said second level of operation comprises one or more application level functions.
20. The controlled device of claim 15 , wherein said first level of operation is independent of said plurality of security modes.
21. The controlled device of claim 15 , wherein said controlled device is hardware configurable to operate in one of said plurality of security modes.
22. The controlled device of claim 15 , wherein, in said second security mode and said third security mode, said controlled device is configured to drop unencrypted application level messages.
23. The controlled device of claim 15 , wherein said surface comprises a housing of said controlled device.
24. The controlled device of claim 15 , wherein said surface comprises a key card.
25. The controlled device of claim 15 wherein said computer readable indicia comprises a bar code.
26. The controlled device of claim 25 , wherein said controller comprises a bar code reader.
27. The controlled device of claim 15 , wherein said computer readable indicia comprises a magnetic stripe.
28. The controlled device of claim 27 , wherein said controller comprises a magnetic stripe reader.