Intelligent door lock system with encryption
An intelligent door lock system is provided at a dwelling by a designated dwelling user. An intelligent door lock system has a remotely operable lock at a dwelling accessible by a user. A server is in communication with the intelligent door lock system. The server has a handshake key (Kh) with a key exchange that provides for a communication session between a mobile device and the intelligent door lock system, wherein the mobile device does not have the (Kh). A user mobile device is in communication with the server and uses a cipher to provide a secured communication between the mobile device and the intelligent door lock system.
1. A system that provides for locking or unlocking a lock at a remotely operable lock of a door of an intelligent door lock system at a dwelling by a designated dwelling user, comprising:
the intelligent door lock system with the remotely operable lock at the dwelling accessible by a user, the intelligent door lock system including a sensor at the dwelling, the sensor being coupled to a drive shaft of a lock device to assist in locking and unlocking a lock of a lock device at a door, the sensor configured to know its current position even if it has been moved since it has been turned off to provide that the position sensor will always know its current position relative to the lock device;
a server in communication with the intelligent door lock system, the server having a handshake key (Kh) with a key exchange that provides for a communication session between a mobile device and the intelligent door lock system, wherein the mobile device does not have the (Kh), and
the mobile device is in communication with the server and uses a cipher to provide a secured communication between the mobile device and the intelligent door lock system.
2. The system of claim 1 , wherein a cipher block chaining is utilized to provide encryption for the secured communication.
3. The system of claim 1 , wherein communication is initialized by generating a session nonce (Ns) on the mobile device.
4. The system of claim 3 , wherein the session nonce is encrypted using a handshake key (Kh) that is at the server.
5. The system of claim 4 , wherein the (Kh) is a shared secret known to intelligent door lock system and to an entity encrypting the nonce that includes the server.
6. The system of claim 5 , wherein the intelligent door lock system modifies the nonce and returns a modified value to the mobile device.
7. The system of claim 6 , wherein an entity with the server has the (Kh) decrypts a session key and the mobile device uses that to encrypt subsequent communication, wherein the intelligent door lock system generates the session key and provide for an unlocking of a lock at the intelligent door lock system.
8. The system of claim 7 , wherein when the intelligent door lock system is assembled, and a random number is provisioned on the mobile device.
9. The system of claim 8 , wherein the key can be common to all locks of a given lock model.
10. The system of claim 9 , wherein the key is a shared secret between the server and all locks of a model class.
11. The system of claim 9 , wherein the key is exchanged for a unit-specific unit key (Kh).
12. The system of claim 11 , wherein the (Kh) is a random number.
13. The system of claim 12 , wherein the server associates the (Kh) with a unique identification of a lock of the intelligent door lock system.
14. The system of claim 13 , wherein the service responds to the mobile device with a unit key encrypted using an open block cipher.
15. The system of claim 14 , wherein the sends the (Kh) to the lock and the lock stores it in a non-volatile memory, with the (Ku) used as a handshake key.
16. The system of claim 15 , wherein the mobile device generates two random numbers that are communicated with the server to create one/half of the (Kh), and in response the server generates one or more random numbers to create a second half of the (Kh), wherein for each of a session the server creates a different set of one or more numbers for the second half of the (Kh).
17. The system of claim 16 , wherein in response to the server creating the second half of the (Kh) the mobile device functions without having the (Kh).
18. The system of claim 17 , wherein the mobile device generates a checksum.
19. The system of claim 17 , wherein the mobile device creates a request for a private communication and in response the server creates a second half of the (Kh) without the mobile device having the (Kh).
20. The system of claim 19 , wherein in response to transmission of the (Kh) a session is initiated that provides for unlocking of the door.
21. The system of claim 17 , wherein a production of half of the (Kh) by the mobile device is an initiation of a request for packet for a private communication and thereafter a validation of a source is conducted.
22. The system of claim 17 , wherein a third party mobile device never has on its mobile device an encryption for the intelligent door lock system.
23. A method for locking or unlocking a lock at a door of an intelligent door lock system at a dwelling by a designated dwelling user, comprising:
providing an intelligent door lock system with a remotely operable lock at the dwelling accessible by a user, the intelligent door lock system including a sensor at the dwelling, the sensor being coupled to a drive shaft of a lock device to assist in locking and unlocking a lock of a lock device at a door, the sensor configured to know its current position even if it has been moved since it has been turned off to provide that the position sensor will always know its current position relative to the lock device;
using a server to communicate with the intelligent door lock system, the server having a handshake key (Kh) with a key exchange that provides for a communication session between a mobile device and the intelligent door lock system, wherein the mobile device does not have the (Kh);
using a cipher to provide a secured communication between the mobile device and the intelligent door lock system.
24. The method of claim 23 , further comprising:
utilizing cipher block chaining to provide the secured communication.
25. The method of claim 23 , further comprising:
completing an initialization when the intelligent door lock system and/or the lock is created.
26. The method of claim 23 , further comprising:
initialized communication by generating a session nonce (Ns) on the mobile device.
27. The method of claim 26 , further comprising:
encrypting the session nonce using a handshake key (Kh) that is at the server.
28. The method of claim 27 , wherein the (Kh) is a shared secret known to intelligent door lock system and to an entity encrypting the nonce that includes the server.
29. The method of claim 28 , further comprising:
modifying the nonce and returning a modified value to the mobile device.
30. The method of claim 29 , wherein an entity with the server has the (Kh) decrypt a session key and the mobile device uses that to encrypt subsequent communication, wherein the intelligent door lock system generates the session key and provide for an unlocking of a lock at the intelligent door lock system.
31. The method of claim 30 , wherein when the intelligent door lock system is assembled, and a random number is provisioned on the mobile device.
32. The method of claim 31 , wherein the key can be common to all locks of a given lock model.
33. The method of claim 32 , wherein the key is a shared secret between the server and all locks of a model class.
34. The method of claim 32 , wherein the key is exchanged for a unit-specific unit key (Kh).
35. The method of claim 23 , wherein the (Kh) is a random number.
36. The method of claim 35 , wherein the server associates the (Kh) with a unique identification of a lock of the intelligent door lock system.
37. The method of claim 36 , wherein the service responds to the mobile device with a unit key encrypted using an open block cipher.
38. The method of claim 23 , wherein the server sends the (Kh) to the lock and the lock stores it in a non-volatile memory, with the (Kh) used as a handshake key.
39. The method of claim 23 , wherein the mobile device generates two random numbers that are communicated with the server to create one/half of the (Kh), and in response the server generates one or more random numbers to create a second half of the (Kh), wherein for each of a session the server creates a different set of one or more numbers for the second half of the (Kh).
40. The method of claim 39 , wherein in response to the server creating the second half of the (Kh) the mobile device functions without having the (Kh).
41. The method of claim 23 , wherein the mobile device generates a checksum.
42. The method of claim 23 , wherein the mobile device creates a request for a private communication and in response the server creates a second half of the (Kh) without the mobile device having the (Kh).
43. The method of claim 23 , wherein in response to transmission of the (Kh) a session is initiated that provides for unlocking of the door.
44. The method of claim 43 , wherein a production of half of the (Kh) by the mobile device is an initiation of a request for packet for a private communication and thereafter a validation of a source is conducted.
45. The method of claim 43 , wherein a third party mobile device never has on its mobile device an encryption for the intelligent door lock system.