Anti-takeover systems and methods for network attached peripherals
View Patent ↗Methods, systems, and devices are described for the prevention of network peripheral takeover activity. Peripheral devices may implement an anti-takeover mechanism limiting the number of available device command classes when certain handshake and verification requirements are not met. Anti-takeover peripheral devices with protection enabled may be relocated within a controller network, or in certain cases, from one controller network to another controller network when certain conditions are met. That same device may be hobbled when removed from a controller network and may remain hobbled when connected to another network that fails to meet certain conditions. Unprotection and unhobbling of a device may occur through an algorithmic mechanism using values stored on the peripheral device and the controller device for one or more of anti-takeover code generation, anti-takeover code comparison, network identification value comparison, and manufacturer identification value comparison.
1. An automated anti-takeover method, the method comprising:
identifying a data session between a peripheral device and a network;
detecting an inclusion event associated with the peripheral device attempting to join the network;
requesting a node information message from the peripheral device;
parsing the node information message to obtain a current protection state value for the peripheral device;
determining that the peripheral device is an anti-takeover device;
determining that the anti-takeover device is in an unprotected state;
retrieving a manufacturer associated network identification value;
retrieving a shared secret version number from the parsed node information message;
generating a random value; and
combining the network identification value, shared secret version number, and random value to generate a hint package;
generating an anti-takeover code; and
unhobbling the peripheral device based at least in part on the generated hint package and the generated anti-takeover code.
2. The method of claim 1 , wherein generating the anti-takeover code comprises:
retrieving the hint package;
retrieving a shared secret;
seeding a one-way hash algorithm with the hint package and the shared secret; and
obtaining a set of bytes from the one-way hash algorithm.
3. The method of claim 1 , further comprising:
determining that the anti-takeover device is not in an unprotected state; and
comparing the manufacturer associated network identification value with a controller manufacturer associated network identification value, wherein the manufacturer associated network identification value and the controller manufacturer associated network identification value comprise an associated shared secret.
4. The method of claim 3 , further comprising:
determining that the manufacturer associated network identification value is not a match with the controller manufacturer associated network identification value, based at least in part on the comparing; and
maintaining the peripheral device in a hobbled state.
5. The method of claim 3 , further comprising:
determining that the manufacturer associated network identification value is a match with the controller manufacturer associated network identification value, based at least in part on the comparing;
retrieving a network identification value associated with the peripheral device from the parsed node information message; and
comparing the received network identification value with the controller manufacturer associated network identification value.
6. The method of claim 5 , further comprising:
determining that the received network identification value is a match with the controller manufacturer associated network identification value, based at least in part on the comparing;
generating the hint package;
generating the anti-takeover code; and
unhobbling the peripheral device.
7. The method of claim 5 , further comprising:
determining that the received network identification value is not a match with the controller manufacturer associated network identification value, based at least in part on the comparing; and
maintaining the peripheral device in a hobbled state.
8. The method of claim 1 , further comprising:
storing a first shared secret value at a controller;
establishing the data session between the controller and the network;
generating the anti-takeover code, the anti-takeover code derived, at least in part, from a calculation seeded with the shared secret value;
generating the first hint package at the controller; and
transmitting the anti-takeover code and the first hint package.
9. The method of claim 8 , further comprising:
generating a random number wherein the calculation is seeded with the random number.
10. The method of claim 8 , wherein the node information message comprises a second hint package.
11. The method of claim 10 , wherein the second hint package further comprises at least one from the group of a randomly generated value, a shared secret version value, and a network identification value.
12. The method of claim 8 , wherein generating the anti-takeover code comprises performing a one-way function calculation.
13. The method of claim 12 , wherein performing the one-way function calculation comprises seeding a hash function with one or more hint package values and the first shared secret value.
14. The method of claim 11 , wherein the first shared secret value is associated with at least one from the group of a manufacturer identification value and the network identification value.
15. The method of claim 8 , further comprising:
storing a second shared secret value.
16. A controller device for a security and/or automation system, comprising:
at least one processor and a memory configured to:
identify a data session between a peripheral device and a network;
detect an inclusion event associated with the peripheral device attempting to join the network;
request a node information message from the peripheral device;
parse the node information message to obtain a current protection state value for the peripheral device;
determine that the peripheral device is an anti-takeover device;
determine that the anti-takeover device is in an unprotected state;
retrieve a manufacturer associated network identification value;
retrieve a shared secret version number from the parsed node information message;
generate a random value; and
combine the network identification value, shared secret version number, and random value to generate a hint package;
generate an anti-takeover code; and
unhobble the peripheral device based at least in part on the generated hint package and the generated anti-takeover code.
17. The controller device of claim 16 , wherein the at least one processor is further configured to:
retrieve the hint package;
retrieve a shared secret;
seed a one-way hash algorithm with the hint package and the shared secret; and
obtain a set of bytes from the one-way hash algorithm.
18. The controller device of claim 17 , wherein the at least one processor is further configured to:
store a first shared secret value at the controller;
establish the data session between the controller and the network;
generate the anti-takeover code, the anti-takeover code derived, at least in part, from a calculation seeded with the shared secret value;
generate a first hint package at the controller; and
transmit the anti-takeover code and the first hint package.