Range constrained device configuration
Disclosed in some examples are methods, systems, and machine readable mediums for secure, low end-user effort computing device configuration. In some examples the IoT device is configured via a user's computing device over a short range wireless link of a first type. This short range wireless communication may use a connection establishment that does not require end-user input. For example, the end user will not have to enter, or confirm a PIN number or other authentication information such as usernames and/or passwords. This allows configuration to involve less user input. In some examples, to prevent man-in-the-middle attacks, the power of a transmitter in the IoT device that transmits the short range wireless link is reduced during a configuration procedure so that the range of the transmissions to and from the user's computing device are reduced to a short distance.
1. A network connected computing device comprising:
a processor;
a memory communicatively coupled to the processor, the memory comprising instructions, the instructions, when performed by the processor cause the computing device to perform operations to:
identify, during a determination and setup phase, an unconfigured state of the device, by determining that the network connected computing device requires a set of credentials to securely connect to a network; and
reduce an output transmission power of the network connected computing device of a first wireless connection of a first wireless connection type, responsive to determining that the network connected computing device is in the unconfigured state;
advertise, during a configuration information acquisition phase, a configuration service, the configuration service adapted to receive information from a configuration computing device;
establish, during the configuration information acquisition phase, a secure short range wireless session with the configuring computing device, the secure session established without a user input;
receive, responsive to establishing the secure short range wireless connection with the computing device, configuration information of the network connected computing device via the configuration service;
apply, during a configuration information application phase, the configuration information to the network connected computing device, the configuration specifying one or more parameters of a second wireless connection type; and
establish, responsive to applying the configuration information to the network connected computing device, a second wireless connection of the second wireless connection type according to the one or more parameters.
2. The network connected computing device of claim 1 , wherein the operations to establish the secure short range wireless session comprises operations to:
establish an insecure short range wireless session;
utilize a key exchange protocol to exchange a cryptographic key; and
utilize the cryptographic key to engage in encrypted communications with the configuring computing device.
3. The network connected computing device of claim 2 , wherein the operations to establish an insecure short range wireless session comprises pairing using a pairing process not requiring user input.
4. The network connected computing device of claim 3 , wherein the pairing process is a JUST WORKS BLUETOOTH LOW ENERGY pairing process.
5. The network connected computing device of claim 2 , wherein the key exchange protocol is a Diffie Hellman key exchange protocol.
6. The network connected computing device of claim 1 , wherein the first wireless connection type is a BLUETOOTH LOW ENERGY wireless connection type.
7. The network connected computing device of claim 6 , wherein the second wireless connection type is a Wireless Local Area Network (WLAN) according to an Institute for Electrical and Electronics Engineers (IEEE) 802.11 family of standards.
8. The network connected computing device of claim 1 , wherein the operations to reduce an output transmission power of the network connected computing device of a first wireless connection of a first wireless connection type comprises operations to:
send a power control command to a transmitter.
9. At least one non-transitory machine readable medium, comprising instructions, which when executed by a machine, causes the machine to perform operations for configuration of a network connected computing device, the operations comprising:
identifying, during a determination and setup phase, an unconfigured state of the device, by determining that the network connected computing device requires a set of credentials to securely connect to a network;
determining, during the determination and setup phase, that the network connected computing device is in an unconfigured state; and
reducing an output transmission power of the network connected computing device of a first wireless connection of a first wireless connection type, responsive to the determination that the network connected computing device is in the unconfigured state;
advertising, during a configuration information acquisition phase, a configuration service, the configuration service adapted to receive information from a configuration computing device;
establishing, during the configuration information acquisition phase, a secure short range wireless session with the configuring computing device, the secure session established without a user input; and
receiving, responsive to establishing the secure short range wireless connection with the computing device, configuration information of the network connected computing device via the configuration service;
applying, in a configuration information application phase, the configuration information to the network connected computing device, the configuration specifying one or more parameters of a second wireless connection type; and
establishing, responsive to applying the configuration information to the network connected computing device, a second wireless connection of the second wireless connection type according to the one or more parameters.
10. The at least one machine readable medium of claim 9 , wherein establishing the secure short range wireless session comprises:
establishing an insecure short range wireless session;
utilizing a key exchange protocol to exchange a cryptographic key; and
utilizing the cryptographic key to engage in encrypted communications with the configuring computing device.
11. The at least one machine readable medium of claim 10 , wherein the operations of establishing an insecure short range wireless session comprises pairing using a pairing process not requiring user input.
12. The at least one machine readable medium of claim 11 , wherein the pairing process is a JUST WORKS BLUETOOTH LOW ENERGY pairing process.
13. The at least one machine readable medium of claim 10 , wherein the key exchange protocol is a Diffie Hellman key exchange protocol.
14. The at least one machine readable medium of claim 9 , wherein the first wireless connection type is a BLUETOOTH LOW ENERGY wireless connection type.
15. The at least one machine readable medium of claim 14 , wherein the second wireless connection type is a Wireless Local Area Network (WLAN) according to an Institute for Electrical and Electronics Engineers (IEEE) 802.11 family of standards.
16. The at least one machine readable medium of claim 9 , wherein the operations of reducing an output transmission power of the network connected computing device of a first wireless connection of a first wireless connection type comprises:
sending a power control command to a transmitter.
17. A method for configuration of a network connected computing device, the method comprising:
identifying, during a determination and setup phase, an unconfigured state of the device, by determining that the network connected computing device requires a set of credentials to securely connect to a network;
determining, during the determination and setup phase, that the network connected computing device is in an unconfigured state; and
reducing an output transmission power of the network connected computing device of a first wireless connection of a first wireless connection type, responsive to determining that the network connected computing device is in the unconfigured state;
advertising, in a configuration information acquisition phase, a configuration service, configuration service adapted to receive information from a configuration computing device;
establishing, during the configuration information acquisition phase, a secure short range wireless session with the configuring computing device, the secure session established without a user input; and
receiving, responsive to establishing the secure short range wireless connection with the computing device during the configuration information acquisition phase, configuration information of the network connected computing device;
applying, during a configuration information application phase, the configuration information to the network connected computing device, the configuration specifying one or more parameters of a second wireless connection type; and
establishing, responsive to applying the configuration information to the network connected computing device during the configuration information phase, a second wireless connection of the second wireless connection type according to the one or more parameters.
18. The method of claim 17 , wherein establishing the secure short range wireless session comprises:
establishing an insecure short range wireless session;
utilizing a key exchange protocol to exchange a cryptographic key; and
utilizing the cryptographic key to engage in encrypted communications with the configuring computing device.
19. The method of claim 18 , wherein establishing an insecure short range wireless session comprises pairing using a pairing process not requiring user input.
20. The method of claim 19 , wherein the pairing process is a JUST WORKS BLUETOOTH LOW ENERGY pairing process.
21. The method of claim 18 , wherein the key exchange protocol is a Diffie Hellman key exchange protocol.
22. The method of claim 17 , wherein the first wireless connection type is a BLUETOOTH LOW ENERGY wireless connection type.
23. The method of claim 22 , wherein the second wireless connection type is a Wireless Local Area Network (WLAN) according to an Institute for Electrical and Electronics Engineers (IEEE) 802.11 family of standards.
24. The method of claim 17 , wherein reducing an output transmission power of the network connected computing device of a first wireless connection of a first wireless connection type comprises:
sending a power control command to a transmitter.