Method for configuring access for a limited user interface (UI) device
A method operable by a computing device for configuring access for a limited user interface (UI) device to a network service via a local network access point is disclosed. The method comprises the steps of: obtaining from the limited UI device a device identifier via a first out-of-band channel. The device identifier is provided to the network service via a secure network link. A zero knowledge proof (ZKP) challenge is received from the network service. Configuration information is provided to the limited-UI device via a second out-of-band channel, the configuration information including information sufficient to enable the limited-UI device to connect to the local network access point. The ZKP challenge is provided to the limited-UI device via the second out-of-band channel. A secure channel key is received from the network service indicating a successful response from the limited-UI device to the ZKP challenge; and provided to the limited-UI device enabling the limited-UI device to access the network service.
1. A method comprising:
receiving, by a first electronic device, a device identifier from a second electronic device;
sending, by the first electronic device, the device identifier to a remote system;
sending, by the first electronic device, configuration information to the second electronic device, the configuration information associated with establishing a connection with a network;
receiving, by the first electronic device, a zero-knowledge protocol challenge from the remote system via a first in-band network channel;
sending, by the first electronic device, the zero-knowledge protocol challenge to the second electronic device via a second out-of-band network channel;
receiving, by the first electronic device, a key from the remote system, the key associated with accessing the remote system; and
sending, by the first electronic device, the key to the second electronic device.
2. The method as recited in claim 1 , further comprising:
establishing, by the first electronic device, a secure network link with the remote system,
wherein at least one of receiving the zero-knowledge protocol challenge from the remote system or receiving the key from the remote system is via the secure network link.
3. The method as recited in claim 1 , wherein:
receiving the device identifier from the second electronic device is via the second out-of-band network channel; and
sending the device identifier to the remote system is via a secure network link.
4. The method as recited in claim 1 , wherein:
receiving the zero-knowledge protocol challenge from the remote system is via a secure network link.
5. The method as recited in claim 1 , wherein:
receiving the key from the remote system is via a secure network link; and
sending the key to the second electronic device is via the second out-of-band network channel.
6. The method as recited in claim 1 , wherein:
receiving the device identifier from the second electronic device is via a third out-of-band network channel; and
the third out-of-band network channel is different than the second out-of-band network channel.
7. The method as recited in claim 1 , further comprising sending, by the first electronic device, an address to the second electronic device, the address associated with sending a response for the zero-knowledge protocol challenge to the remote system.
8. The method as recited in claim 1 , wherein the zero-knowledge protocol challenge is based at least in part on the device identifier.
9. A non-transitory computer-readable media storing computer executable instructions that, when executed by the first electronic device, cause the first electronic device to perform the method of claim 1 .
10. A method comprising:
receiving, by a first limited user interface (UI) device, configuration information from a second computing device, wherein the first limited UI device lacks at least one of an input interface or a display interface;
establishing, by the first limited UI device, a connection to a network using the configuration information;
receiving, by the first limited UI device, a zero-knowledge protocol challenge from the second computing device via a first out-of-band network channel;
sending, by the first limited UI device and via the network, a response for the zero-knowledge protocol challenge to a remote system via a second in-band network channel;
based at least in part on sending the response, receiving, by the first limited UI device, a key from the second computing device; and
establishing, by the first limited UI device and using the key, a secure network link with the remote system.
11. The method as recited in claim 10 , further comprising receiving, by the first limited UI device and via the secure network link, additional configuration information from the remote system.
12. The method as recited in claim 10 , wherein the zero-knowledge protocol challenge is associated with a device identifier of the first limited UI device, and wherein the method further comprises generating, by the first limited UI device, the response for the zero-knowledge protocol challenge using data stored on the first limited UI device.
13. The method as recited in claim 10 , wherein at least one of receiving the configuration information from the second computing device or receiving the key from the second computing device is via the first out-of-band channel.
14. The method as recited in claim 10 , wherein:
receiving the configuration information from the second computing device is via the first out-of-band network channel; and
receiving the key from the second computing device is via a third out-of-band network channel, the third out-of-band network channel being different than the first out-of-band network channel.
15. The method as recited in claim 10 , further comprising:
sending, by the first limited UI device, a device identifier to the second computing device,
wherein the zero-knowledge protocol challenge is based at least in part on the device identifier.
16. The method as recited in claim 10 , further comprising:
receiving, by the first limited UI device, an address from the second computing device,
wherein sending the response to the remote system comprises sending, by the first limited UI device, the response to the remote system using the address.
17. A non-transitory computer-readable media storing computer executable instructions that, when executed by the first limited UI device, cause the first limited UI device to perform the method of claim 10 .
18. A computing device, comprising:
one or more processors coupled to memory; and
one or more computer-readable media storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
receiving a device identifier from a limited user interface (UI) electronic device;
sending the device identifier to a remote system;
sending configuration information to the limited UI electronic device, the configuration information associated with establishing a connection with a network;
receiving a zero-knowledge protocol challenge from the remote system via a first in-band network channel;
sending the zero-knowledge protocol challenge to the limited UI electronic device via a second out-of-band network channel;
receiving a key from the remote system, the key associated with accessing the remote system; and
sending the key to the limited UI electronic device.
19. The computing device of claim 18 , wherein:
receiving the device identifier from the limited UI electronic device is via the second out-of-band network channel; and
sending the device identifier to the remote system is via a secure network link.
20. The computing device of claim 18 , the operations further comprising:
sending a network address of the remote system to the limited UI electronic device, the network address associated with a response to the zero-knowledge protocol challenge.