Secure discovery and connection to internet of things devices in a wireless local-area network

1. An apparatus of a station, the apparatus comprising: memory; and, processing circuitry coupled to the memory, the processing circuitry configured to:

encode a first packet to indicate to an access point to start discovery of Internet of Things (IoT) devices;

configure the station to transmit the first packet to the access point;

decode a second packet from the access point, wherein the second packet comprises one or more identifications of IoT devices, wherein the IoT devices corresponding to the one or more identifications of IoT devices are unauthenticated with the access point, and wherein the second packet is in response to the first packet;

receive a selection from an application of the station of one of the one or more identifications of the IoT devices;

encode a third packet comprising the selected one of the one or more identifications of the IoT devices and an indication that the access point is to request establishment of a secure session with the IoT device corresponding to the selected one of the one or more identifications of the IoT devices;

decode a fourth packet that initiates an establishment of a secure session between the station and the IoT device corresponding to the one of the one or more identifications of the IoT devices, wherein the fourth packet is received from the IoT device; and

encode a response to the fourth packet to establish the secure session between the station and the IoT device.

2. The apparatus of claim 1 , wherein the processing circuitry is further configured to:

decode a fourth packet with an indication that the access point has established a secure session with the IoT device corresponding to the one of the one or more identifications of the IoT devices.

3. The apparatus of claim 1 , wherein the fourth packet comprises Diffie-Hellman (DH) parameters signed by a private key of the IoT device corresponding to the one of the one or more identifications of the IoT devices.

4. The apparatus of claim 1 , wherein the processing circuitry is further configured to:

encode the first packet to indicate to the access point to start discovery of IoT devices with a type that matches a group type.

5. The apparatus of claim 4 , wherein the group type is one of the following group: a temperature type, a home sensor type, a video type, a security type, a home security type, and a home monitoring type.

6. The apparatus of claim 1 , wherein the processing circuitry is further configured to:

encode a fourth packet to associate with the access point; and

encode one or more additional packets to establish a secure connection with the access point.

7. The apparatus of claim 6 , wherein the processing circuitry is further configured to:

decode a notification from the access point, wherein the notification is from the IoT device corresponding to the one of the one or more identifications of the IoT devices, and wherein the notification is encrypted with a key established with the access point.

8. The apparatus of claim 6 , wherein the processing circuitry is further configured to:

decode a notification from the access point, wherein the notification is from the IoT device corresponding to the one of the one or more identifications of the IoT devices, and wherein the notification is encrypted with a key established with the IoT device corresponding to the one of the one or more identifications of the IoT devices.

9. The apparatus of claim 6 , wherein the processing circuitry is further configured to:

encode a command, wherein the command is for the IoT device corresponding to the one of the one or more identifications of the IoT devices, and wherein the command is encrypted with a key established with the IoT device corresponding to the one of the one or more identifications of the IoT devices.

10. The apparatus of claim 1 , wherein the IoT devices are configured to transmit packets only on sub-channels less than 20 MHz.

11. The apparatus of claim 1 , wherein the station and the access point are each one from the following group: an Institute of Electrical and Electronic Engineers (IEEE) 802.11ax access point, an IEEE 802.11ax station, an IEEE 802.11 access point, and an IEEE 802.11 station.

12. The apparatus of claim 1 , further comprising one or more antennas coupled to the processing circuitry.

13. The apparatus of claim 12 , wherein the processing circuitry is further configured to:

transmit the first packet to the access point.

14. A non-transitory computer-readable storage medium that stores instructions for execution by one or more processors of an apparatus of a station, the instructions to configure the one or more processors to:

encode a first packet to indicate to an access point to start discovery of Internet of Things (IoT) devices;

configure the station to transmit the first packet to the access point;

decode a second packet from the access point, wherein the second packet comprises one or more identifications of IoT devices, wherein the IoT devices corresponding to the one or more identifications of IoT devices are unauthenticated with the access point, and wherein the second packet is in response to the first packet;

receive a selection from an application of the station of one of the one or more identifications of the IoT devices;

encode a third packet comprising the selected one of the one or more identifications of the IoT devices and an indication that the access point is to request establishment of a secure session with the IoT device with the one of the one or more identifications corresponding to the one of the one or more identifications of the IoT devices; and

decode a fourth packet that initiates an establishment of a secure session between the station and the IoT device corresponding to the one of the one or more identifications of the IoT devices, wherein the fourth packet is received from the IoT device; and

encode a response to the fourth packet to establish the secure session between the station and the IoT device.

15. The non-transitory computer-readable storage medium of claim 14 , wherein the instructions to further configure the one or more processors to cause the station to:

decode a fifth packet with an indication that the access point has established a secure session with the IoT device corresponding to the one of the one or more identifications of the IoT devices.

16. The non-transitory computer-readable storage medium of claim 14 , wherein the fourth packet comprises Diffie-Hellman (DH) parameters signed by a private key of the IoT device corresponding to the one of the one or more identifications of the IoT devices.

17. An apparatus of an access point comprising memory and processing circuitry coupled to the memory, the processing circuitry configured to:

decode a first packet from a station, wherein the first packet indicates that the access point is to start discovery of Internet of Things (IoT) devices;

decode one or more advertisement packets from an IoT device, the advertisement packets comprising an identification of the corresponding IoT device;

encode a second packet to the station, wherein the second packet comprises one or more identifications of IoT devices, wherein the IoT devices corresponding to the one or more identifications of IoT devices are unauthenticated with the access point, and wherein the second packet is in response to the first packet;

decode a third packet from the station, wherein the third packet comprises one of the one or more identifications of the IoT devices;

encode a fourth packet, the fourth packet comprising a request to establish a secure session with the IoT device corresponding to the one of the one or more identifications of the IoT devices; and

encode a fifth packet that initiates an establishment of a secure session between the station and the IoT device corresponding to the one of the one or more identifications of the IoT devices.

18. The apparatus of claim 17 , wherein the processing circuitry is further configured to:

encode a sixth packet with an indication that the access point has established a secure session with the IoT device corresponding to the one of the one or more identifications of the IoT devices.

19. The apparatus of claim 17 , wherein the fifth packet comprises Diffie-Hellman (DH) parameters signed by a private key of the access point.

20. The apparatus of claim 17 , further comprising: transceiver circuitry coupled to the processing circuitry; and, one or more antennas coupled to the transceiver circuitry.

21. A method performed by an apparatus of a station, the method comprising:

encoding a first packet to indicate to an access point to start discovery of Internet of Things (IoT) devices;

configuring the station to transmit the first packet to the access point;

decoding a second packet from the access point, wherein the second packet comprises one or more identifications of IoT devices, wherein the IoT devices corresponding to the one or more identifications of IoT devices are unauthenticated with the access point, and wherein the second packet is in response to the first packet;

receiving a selection from an application of the station of one of the one or more identifications of the IoT devices;

encoding a third packet comprising the selected one of the one or more identifications of the IoT devices and an indication that the access point is to request establishment of a secure session with the IoT device with the one of the one or more identifications corresponding to the one of the one or more identifications of the IoT devices;

decode a fourth packet that initiates an establishment of a secure session between the station and the IoT device corresponding to the one of the one or more identifications of the IoT devices, wherein the fourth packet is received from the IoT device; and

encode a response to the fourth packet to establish the secure session between the station and the IoT device.

22. The method of claim 21 , the method further comprising:

decoding a fifth packet with an indication that the access point has established a secure session with the IoT device corresponding to the one of the one or more identifications of the IoT devices.