Securing IoT devices using an out-of-band beacon
Systems and methods for securing network devices through the use of an out-of-band beacon are described. In some embodiments, a method may include broadcasting, by a gateway, a wireless beacon that is out-of-band with respect to communications between the gateway and a plurality of devices over a network, where the wireless beacon includes a token; receiving an encrypted packet at the gateway as part of the communications; decrypting the encrypted packet into an intermediate payload by the gateway using a public key, where the public key corresponds to a certificate provisioned to each of the plurality of devices; and decrypting the intermediate payload into a decrypted packet by the gateway using the token.
1. A method, comprising:
broadcasting, by a gateway, a wireless beacon that is out-of-band with respect to communications between the gateway and a plurality of devices over a network, wherein the wireless beacon includes a token;
receiving an encrypted packet at the gateway as part of the communications;
decrypting the encrypted packet into an intermediate payload by the gateway using a public key, wherein the public key corresponds to a certificate provisioned to each of the plurality of devices;
decrypting the intermediate payload into a decrypted packet by the gateway using the token;
after a selected amount of time, broadcasting, by the gateway, another wireless beacon that is out-of-band with respect to the communications, the other wireless beacon including a different token;
receiving another encrypted packet at the gateway as part of the communications;
decrypting the other encrypted packet into another intermediate payload by the gateway using the public key; and
in response to being unable to decrypt the other intermediate payload with the different token, marking a source of the other encrypted packet as suspicious or blocking further communications with the source.
2. The method of claim 1 , wherein the communications include Internet Protocol (IP) communications, and wherein the encrypted packet includes an encrypted IP packet.
3. The method of claim 1 , wherein transmitting the wireless beacon includes using a Radio Frequency (RF) transceiver that is distinct from another transceiver used in the communications.
4. The method of claim 1 , wherein the wireless beacon has a range that is shorter than a communication range of the network.
5. The method of claim 1 , wherein the token is encrypted by the gateway using the public key prior to the broadcasting of the beacon.
6. The method of claim 1 , further comprising:
after a selected amount of time, broadcasting, by the gateway, another wireless beacon that is out-of-band with respect to the communications, the other wireless beacon including a different token;
receiving yet another encrypted packet at the gateway as part of the communications;
decrypting the yet another encrypted packet into yet another intermediate payload by the gateway using the public key; and
decrypting the yet another intermediate payload into yet another decrypted packet by the gateway using the different token.
7. The method of claim 1 , further comprising:
transmitting, by the gateway as part of the communications over the network, packets encrypted with both the token and the public key.
8. A device, comprising:
a processor; and
a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution by the processor, cause the device to:
receive a wireless beacon that is out-of-band with respect to communications between a gateway and a plurality of devices over a network, wherein the wireless beacon includes a token;
encrypt an outgoing packet using the token into an intermediate payload;
encrypt the intermediate payload into an encrypted packet using a private key, wherein the private key corresponds to a certificate provisioned to each of the plurality of devices;
transmit the encrypted packet to the gateway over the network;
receive another wireless beacon that is out-of-band with respect to the communications between the gateway and the plurality of devices over the network, wherein the other wireless beacon includes a different token;
encrypt another outgoing packet using the different token into another intermediate payload;
encrypt the other intermediate payload using the private key into another encrypted packet; and
transmit the other encrypted packet to the gateway over the network.
9. The device of claim 8 , wherein the communications include Internet Protocol (IP) communications, and wherein the encrypted packet includes an encrypted IP packet.
10. The device of claim 8 , wherein receiving the wireless beacon includes using a Radio Frequency (RF) transceiver that is physically distinct from another transceiver used in the communications.
11. The device of claim 8 , wherein the wireless beacon has a range that is shorter than a communication range of the network.
12. The device of claim 8 , wherein the token within the wireless beacon is encrypted with a public key corresponding to the private key, and wherein the program instructions, upon execution by the processor, further cause the device to decrypt the token with the private key.
13. The device of claim 8 , wherein the program instructions, upon execution by the processor, further cause the device to:
receive yet another encrypted packet from the gateway;
decrypt the yet another encrypted packet into yet another intermediate payload using the private key; and
decrypt the yet another intermediate payload into yet another decrypted packet using the token.
14. A memory device having program instructions stored thereon that, upon execution by a processor of a gateway, cause the gateway to:
broadcast a wireless beacon that is out-of-band with respect to communications between the gateway and a plurality of devices over a network, wherein the wireless beacon includes a first token;
receive an encrypted packet as part of the communications;
decrypt the encrypted packet into an intermediate payload using a public key, wherein the public key corresponds to a certificate provisioned to each of the plurality of devices;
decrypt the intermediate payload into a decrypted packet using the first token;
after a predetermined amount of time, broadcast another wireless beacon that is out-of-band with respect to the communications, the other wireless beacon including a second token;
receive another encrypted packet at the gateway as part of the communications;
decrypt the other encrypted packet into another intermediate payload by the gateway using the public key; and
in response to the other encrypted packet having been received within a selected time window from the predetermined amount of time, decrypt the other intermediate payload with any of the first token or the second token.
15. The memory device of claim 14 , wherein the program instructions, upon execution by the processor, further cause the gateway to:
in response to the other encrypted packet having been received outside of a selected time window from the predetermined amount of time, decrypt the other intermediate payload with the second token.
16. The memory device of claim 14 , wherein the program instructions, upon execution by the processor, further cause the gateway to:
in response to: (1) the other encrypted packet having been received outside of a selected time window from the predetermined amount of time, and (2) the other intermediate payload having been encrypted with the first token, mark a source of the other encrypted packet as suspicious or block further communications with the source.