Secure device rejoining for mesh network devices
Securing device rejoining for a mesh network of a wireless lighting control system is disclosed. A potential security weakness of a mesh network protocol is that a proprietary link key may be discovered by close, expert examination of a device, potentially facilitating the joining of a “rogue” device to the network. Requiring subsequent rejoins of any device that had previously joined the network to use a current randomly generated link key, rather than the proprietary link key, prevents rogue devices only having the proprietary link key from joining.
1. A lighting control system having a wireless mesh network, the system comprising:
at least one proprietary link key;
a gateway including a communications module acting as a coordinator of the network, the coordinator storing and providing a current network key, the at least one proprietary link key, and an updated link key; and,
a plurality of devices each including a device radio module and data storage storing the at least one proprietary link key; and,
wherein the communications module initially joins to the mesh network one of the plurality of devices by:
receiving a join request from a device radio module;
sending to the device radio module a current network key encrypted by the proprietary link key; and
generating, storing, and sending to the device radio module an updated link key encrypted by the current network key, the joining one of a plurality of devices storing the updated link key; and,
wherein the communications module rejoins to the mesh network one of the plurality of devices by:
receiving a join request from a device radio module; and
sending to the device radio module the current network key encrypted by the updated link key.
2. The lighting control system of claim 1 , wherein the gateway periodically rotates the current network key.
3. The lighting control system of claim 1 , wherein the gateway periodically rotates the updated link key.
4. The lighting control system of claim 1 , wherein the communications module only sends a current network key encrypted by the proprietary link key for a scheduled time period during which at least one of the plurality of devices are expected to initially join the mesh network without an updated link key, thereby preventing a rogue device with the proprietary link key from joining the mesh network during times outside of the scheduled time period.
5. The lighting control system of claim 1 , wherein the communications module includes a radio transceiver and a processor.
6. The lighting control system of claim 5 , wherein at least one of the devices is a controller having an output module selectively powering a lighting fixture.
7. The lighting control system of claim 5 , wherein at least one of the devices is an occupancy sensor.
8. The lighting control system of claim 5 , wherein at least one of the devices is a daylight harvester.
9. The lighting control system of claim 5 , wherein at least one of the devices is a controller having an input module detecting the state of a third party device.
10. The lighting control system of claim 5 , wherein at least one of the devices includes a user site device.
11. A system having a wireless mesh network, the system comprising:
a coordinator including a communications module, the coordinator storing and providing a current network key, at least one proprietary link key, and an updated link key; and,
a plurality of devices each including a device radio module and data storage storing the at least one proprietary link key; and,
wherein the communications module initially joins to the mesh network one of the plurality of devices by:
receiving a join request from a device radio module;
sending to the device radio module a current network key encrypted by the proprietary link key; and
generating, storing, and sending to the device radio module an updated link key encrypted by the current network key, the joining one of a plurality of devices storing the updated link key.
12. The system of claim 11 , wherein the communications module rejoins to the mesh network one of the plurality of devices by:
receiving a join request from a device radio module; and
sending to the device radio module the current network key encrypted by the updated link key.
13. The system of claim 12 , wherein the coordinator periodically rotates the current network key.
14. The system of claim 12 , wherein the coordinator periodically rotates the updated link key.
15. The system of claim 12 , wherein the communications module only sends a current network key encrypted by the proprietary link key for a scheduled time period during which at least one of the plurality of devices are expected to initially join the mesh network without an updated link key, thereby preventing a rogue device with the proprietary link key from joining the mesh network during times outside of the scheduled time period.
16. The system of claim 12 , wherein the communications module includes a radio transceiver and a processor.
17. The system of claim 12 , wherein:
the system is a lighting control system; and
at least one of the devices is a controller having an output module selectively powering a lighting fixture.
18. A method of securely joining and rejoining a device to a wireless mesh network, comprising:
receiving at a coordinator a join request from a plurality of devices each having a proprietary link key;
sending from the coordinator to the plurality of devices a first network key encrypted by a proprietary link key;
generating and sending to the plurality of devices an updated link key encrypted by the first network key;
receiving and storing the updated link key at each of the plurality devices;
rotating from the first network key to a second network key;
sending the current network key to at least one presently joined device of the plurality of devices;
receiving at the coordinator a join request sent from a sleepy device of the plurality of devices, the sleepy device having the first network key and not having the second network key; and
sending from the coordinator to the sleepy device the second network key encrypted by the updated link key.
19. The method of claim 18 , further comprising the step of scheduling a time period during which at least one of the plurality of devices are expected to initially join the wireless mesh network without an updated link key; and wherein the step of sending from the coordinator to the plurality of devices a first network key encrypted by a proprietary link key is only completed by the coordinator during the scheduled time period, thereby preventing a rogue device with the proprietary link key from joining the mesh network during times outside of the scheduled time period.