Key exchange through a trusted proxy
View Patent ↗Techniques for exchanging security keys via a trusted proxy are provided. For example, a method may include receiving, at a computing device, a communication including a unique identifier for an access device connected to a network, wherein unique identifiers include an expiration time. The method may further include using the unique identifier to determine a security key for the access device. The method may also include receiving, at the computing device, a new communication, wherein the new communication includes the unique identifier. The method may further include validating the unique identifier for the access device, wherein validating includes determining whether the unique identifier has expired, and then using the validated identifier to retrieve the security key for the access device. The method may also include transmitting the security key, wherein when the security key is received, the security key facilitates generating a signature.
1. A system, comprising:
one or more data processors; and
a non-transitory computer-readable storage medium containing instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including:
receiving a communication, wherein the communication corresponds to a request to register a network device as a trusted network device, wherein the communication includes a unique identifier for the network device, and wherein an operation of the network device is controllable by an access device;
identifying, at a computing device, a network associated with the network device, wherein identifying includes using the communication;
determining whether the network device is locally connected to the network, wherein the network is connected to a plurality of additional network devices including the network device;
determining that the network device is a trusted network device when the network device is locally connected to the network;
receiving a new communication, wherein the new communication corresponds to a request for the access device to control an operation of one or more network devices connected to the network;
determining whether the new communication is received from the trusted network device, wherein when the new communication is received from the trusted network device, an access device key is generated for the access device; and
transmitting the access device key, wherein transmitting includes using the trusted network device, wherein when the access device key is received at the access device, the access device key facilitates generating a signature for the access device, and wherein the signature enables the access device to control the operation of the one or more network devices without having to provide a login credential.
2. The system of claim 1 , further comprising instructions which when executed on the one or more data processors, cause the one or more processors to perform operations including:
receiving the signature; and
using the signature to authenticate the access device.
3. The system of claim 1 , wherein transmitting the security key includes using a trusted proxy.
4. The system of claim 1 , wherein the new communication includes an expiration time generated by the access device, and wherein the expiration time is used to validate the unique identifier.
5. The system of claim 1 , wherein the system is a cloud computing system, and wherein the instructions further comprise instructions which when executed on the one or more data processors, cause the one or more processors to implement a cloud based service configured to:
receive unique identifiers corresponding to the plurality of network devices and one or more access devices;
generate security keys corresponding to the plurality of network devices and the one or more access devices;
associate the security keys with the unique identifiers; and
store the security keys and the unique identifiers.
6. The system of claim 1 , wherein the network is a home automation network and wherein the new communication is received while the access device is not connected to the home automation network.
7. A computer-implemented method, comprising:
receiving, at a computing device, a communication, wherein the communication corresponds to a request to register a network device as a trusted network device, wherein the communication includes a unique identifier for the network device, and wherein an operation of the network device is controllable by an access device;
identifying, at the computing device, a network associated with the network device, wherein identifying includes using the communication;
determining whether the network device is locally connected to the network, wherein the network is connected to a plurality of network devices including the network device;
determining that the network device is a trusted network device when the network device is locally connected to the network;
receiving, at the computing device, a new communication, wherein the new communication corresponds to a request for the access device to control an operation of one or more network devices connected to the network;
determining whether the new communication is received from the trusted network device, wherein when the new communication is received from the trusted network device, an access device key is generated for the access device; and
transmitting the access device key, wherein transmitting includes using the trusted network device, wherein when the access device key is received at the access device, the access device key facilitates generating a signature for the access device, and wherein the signature enables the access device to control the operation of the one or more network devices without having to provide a login credential.
8. The method of claim 7 , further comprising:
receiving, at the computing device, the signature; and
using the signature to authenticate the access device.
9. The method of claim 7 , wherein transmitting the security key includes using a trusted proxy.
10. The method of claim 7 , wherein the new communication includes an expiration time generated by the access device, and wherein the expiration time is used to validate the unique identifier.
11. The method of claim 7 , wherein the computing device is a cloud server hosting a cloud based service configured to:
receive unique identifiers corresponding to the plurality of network devices and one or more access devices;
generate security keys corresponding to the plurality of network devices and the one or more access devices;
associate the security keys with the unique identifiers; and
store the security keys and the unique identifiers.
12. A computer-program product tangibly embodied in a non-transitory machine-readable storage medium, including instructions configured to cause a data processing apparatus to:
receive a communication, wherein the communication corresponds to a request to register a network device as a trusted network device, wherein the communication includes a unique identifier for the network device, and wherein an operation of the network device is controllable by an access device;
identify, at a computing device, a network associated with the network device, wherein identifying includes using the communication;
determine whether the network device is locally connected to the network, wherein the network is connected to a plurality of network devices including the network device;
determine that the network device is a trusted network device when the network device is locally connected to the network;
receive a new communication, wherein the new communication corresponds to a request for the access device to control an operation of one or more network devices connected to the network;
determine whether the new communication is received from the trusted network device, wherein when the new communication is received from the trusted network device, an access device key is generated for the access device; and
transmit the access device key, wherein transmitting includes using the trusted network device, wherein when the access device key is received at the access device, the access device key facilitates generating a signature for the access device, and wherein the signature enables the access device to control the operation of the one or more network devices without having to provide a login credential.
13. The computer-program product of claim 12 , wherein when the access device key is received by the access device, the security key facilitates generating a signature for the access device.
14. The computer-program product of claim 12 , further comprising instructions configured to cause the data processing apparatus to:
receive the signature; and
use the signature to authenticate the access device.
15. The computer-program product of claim 12 , wherein transmitting the access device key includes using a trusted proxy, and wherein the trusted proxy is a network device.
16. The computer-program product of claim 12 , wherein the new communication includes an expiration time generated by the access device, and wherein the expiration time is used to validate the unique identifier.
17. The computer-program product of claim 12 , further comprising instructions configured to cause the data processing apparatus to implement a cloud based service configured to:
receive unique identifiers corresponding to the plurality of network devices and one or more access devices;
generate security keys corresponding to the plurality of network devices and the one or more access devices;
associate the security keys with the unique identifiers; and
store the security keys and the unique identifiers.
18. The computer-program product of claim 12 , wherein the network is a home automation network and wherein the new communication is received while the access device is not connected to the home automation network.