System and method for automatically and securely registering an internet of things device
A mechanism for automatically registering Internet-of-Things (IoT) devices to an end-user account of an Internet-based resource, using a gateway that the end-user previously registered to the account. Various security alternatives are described that help avoid masquerading and other attacks on the home network of the end-user.
1. A method comprising:
in a gateway device configurable to operate as a wireless access point and as a wireless network station:
registering the gateway device to an end user account of an Internet based service using a set of credentials received from the end user;
while the gateway device is operating as a wireless access point, periodically operating as a wireless network station and scanning a certain portion of radio frequency spectrum to detect any beacons transmitted by wireless access points;
responsive to detection of one of said beacons, determining whether the detected beacon originated from a terminal device of the end-user operating as a soft access point, by comparing an identifier portion of the beacon with a predefined data value;
upon determining that the beacon originated from the terminal device of the end-user, operating the gateway device as a wireless network station to enable it to associate with the terminal device operating as a soft access point, and to enable it to securely send to the terminal device, one or more parameters that enable the terminal device to associate with the gateway device while the gateway device is operating as a wireless access point and the terminal device is operating as a wireless network station; and
acting as a proxy for the end user by automatically registering the terminal device to the end user account of the Internet based service without additional end user involvement, using the one or more parameters and the set of credentials.
2. The method according to claim 1 , wherein the gateway device is operable to function as the wireless network station and the wireless access point in accordance with the IEEE 802.11 family of standards.
3. The method according to claim 1 , wherein the determining whether the beacon originated from the terminal device of the end-user comprises determining whether the beacon comprises a service set identifier (SSID) containing an alphanumeric value associated, in memory of the gateway device, with terminal devices that support a soft access point mode.
4. The method according to claim 1 , wherein the determining whether the beacon originated from the terminal device of the end-user operating as a soft access point comprises calculating a security hash.
5. The method according to claim 4 , wherein the security hash is based, at least in part, on a service set identifier (SSID) information element of the beacon.
6. The method according to claim 1 , wherein the certain portion of radio frequency spectrum comprises a license free band.
7. The method according to claim 1 , further comprising:
while operating as the wireless access point, wirelessly associating with the terminal device upon receiving the one or more parameters from the terminal device.
8. The method according to claim 7 , further comprising:
receiving, from the terminal device, identity information for two or more gateway devices and corresponding signal strength information; and
evaluating the received signal strength information for the two or more gateway devices.
9. A non-transitory computer readable medium having stored thereon a plurality of code sections, each code section comprising a plurality of instructions executable by one or more processors to cause the one or more processors to perform steps of a method for operating a gateway device, the steps comprising:
in a gateway device configurable to operate as a wireless access point and as a wireless network station:
registering the gateway device to an end user account of an Internet based service using a set of credentials received from the end user;
while the gateway device is operating as a wireless access point, periodically operating as a wireless network station and scanning a certain portion of radio frequency spectrum to detect any beacons transmitted by wireless access points;
responsive to detection of one of said beacons, determining whether the detected beacon originated from a terminal device of the end-user operating as a soft access point, by comparing an identifier portion of the beacon with a predefined data value;
upon determining that the beacon originated from the terminal device of the end-user, operating the gateway device as a wireless network station to enable it to associate with the terminal device operating as a soft access point, and to enable it securely send to the terminal device, one or more parameters that enable the terminal device to associate with the gateway device while the gateway device is operating as a wireless access point and the terminal device is operating as a wireless network station; and
acting as a proxy for the end user by automatically registering the terminal device to the end user account of the Internet based service without additional end user involvement, using the one or more parameters and the set of credentials.
10. The non-transitory computer readable medium according to claim 9 , wherein the gateway device is operable to function as the wireless network station and the wireless access point in accordance with the IEEE 802.11 family of standards.
11. The non-transitory computer readable medium according to claim 9 , wherein the determining whether the beacon originated from the terminal device of the end-user operating as a soft access point comprises determining whether the beacon comprises a service set identifier (SSID) containing an alphanumeric value associated, in memory of the gateway device, with terminal devices that support a soft access point mode.
12. The non-transitory computer readable medium according to claim 11 , wherein the determining whether the beacon originated from the terminal device of the end-user comprises calculating a security hash.
13. The non-transitory computer readable medium according to claim 9 , wherein the security hash is based, at least in part, on a service set identifier (SSID) information element in the beacon.
14. The non-transitory computer readable medium according to claim 9 , wherein the certain portion of radio frequency spectrum comprises a license free band.
15. The non-transitory computer readable medium according to claim 9 , further comprising:
while operating as the wireless access point, wirelessly associating with the terminal device upon receiving the one or more parameters from the terminal device.
16. The non-transitory computer readable medium according to claim 15 , further comprising:
receiving, from the terminal device, identity information for two or more gateway devices and corresponding signal strength information; and
evaluating the received signal strength information for the two or more gateway devices.
17. A system comprising:
a gateway device that comprises circuitry configured to operate as a wireless access point and as a wireless network station, and that is operable to, at least:
1. register itself to an end user account of an Internet based service using a set of credentials received from the end user;
2. while the gateway device is operating as a wireless access point, periodically operate as a wireless network station and scan a certain portion of radio frequency spectrum to detect any beacons transmitted by wireless access points;
3. responsive to detection of one of said beacons, determine whether the detected beacon originated from a terminal device of the end-user operating as a soft access point, by comparison of an identifier portion of the beacon with a predefined data value;
4. upon a determination that the beacon originated from the terminal device of the end-user, operate the gateway device as a wireless network station to enable it to associate with the terminal device operating as a soft access point, and to enable it to securely send to the terminal device, one or more parameters that enable the terminal device to associate with the gateway device while the gateway device is operating as a wireless access point and the terminal device is operating as a wireless network station; and
5. act as a proxy for the end user to perform automatic registration of the terminal device to the end user account of the Internet based service without additional end user involvement, using the one or more parameters and the set of credentials.
18. The system according to claim 17 , wherein the gateway device is operable to function as the wireless network station and the wireless access point in accordance with the IEEE 802.11 family of standards.
19. The system according to claim 17 , wherein the determination of whether the beacon originated from the terminal device of the end-user operating as a soft access point comprises a determination of whether the beacon comprises a service set identifier (SSID) containing an alphanumeric value associated, in memory of the gateway device, with terminal devices that support a soft access point mode.
20. The system according to claim 19 , wherein the determination of whether the beacon originated from the terminal device of the end-user comprises calculation of a security hash.
21. The system according to claim 20 , wherein the security hash is based, at least in part, on a service set identifier (SSID) information element of the beacon.
22. The system according to claim 17 , wherein the certain portion of radio frequency spectrum comprises a license free band.
23. The system according to claim 17 , wherein the gateway device is operable to:
while operating as a wireless access point, wirelessly associate with the terminal device upon reception of the one or more parameters from the terminal device.
24. The system according to claim 23 , wherein the gateway device is operable to:
receive, from the terminal device, identity information for two or more gateway devices and corresponding signal strength information; and
evaluate the received signal strength information for the two or more gateway devices.