Range constrained device configuration
Disclosed in some examples are methods, systems, and machine readable mediums for secure, low end-user effort computing device configuration. In some examples the IoT device is configured via a user's computing device over a short range wireless link of a first type. This short range wireless communication may use a connection establishment that does not require end-user input. For example, the end user will not have to enter, or confirm a PIN number or other authentication information such as usernames and/or passwords. This allows configuration to involve less user input. In some examples, to prevent man-in-the-middle attacks, the power of a transmitter in the IoT device that transmits the short range wireless link is reduced during a configuration procedure so that the range of the transmissions to and from the user's computing device are reduced to a short distance.
1. An enrollee computing device comprising:
a processor; and
a memory communicatively coupled to the processor, the memory comprising instructions, the instructions, when performed by the processor cause the enrollee computing device to perform operations to:
identify an unconfigured state of the enrollee computing device, by determining that the enrollee computing device requires a set of credentials to securely connect to a network;
advertise a configuration service, the configuration service to receive information from a configurator, wherein the configurator is a configuration computing device to provision the enrollee computing device with the set of credentials to securely connect to the network;
receive a broadcast, responsive to the advertising of the configuration service, of a device provisioning protocol from the configurator;
establish a secure short-range wireless session with the configurator, the secure short-range wireless session established without a user input and performed using a low-power connection;
receive, responsive to establishing the secure short-range wireless session between the configurator and the enrollee computing device, configuration information of the enrollee computing device via the configuration service;
implement the configuration information, the configuration information specifying one or more parameters of a wireless connection type; and
establish, responsive to implementing the configuration information, a wireless connection according to the one or more parameters.
2. The enrollee computing device of claim 1 , wherein to implement the configuration information, the enrollee computing device is to apply the one or more parameters using the configurator.
3. The enrollee computing device of claim 1 , wherein the operations to establish the secure short-range wireless session cause the enrollee computing device to:
reduce a power of the enrollee computing device used to perform the low-power connection;
establish an insecure short-range wireless session;
utilize a key exchange protocol to exchange a cryptographic key; and
utilize the cryptographic key to engage in encrypted communications with the configurator.
4. The enrollee computing device of claim 3 , wherein the operations to establish the insecure short-range wireless session cause the enrollee computing device to pair using a pairing process not requiring user input.
5. The enrollee computing device of claim 4 , wherein the pairing process is a JUST WORKS BLUETOOTH LOW ENERGY pairing process.
6. The enrollee computing device of claim 3 , wherein the key exchange protocol is a Diffie Hellman key exchange protocol.
7. The enrollee computing device of claim 1 , wherein wireless connection includes a Wireless Local Area Network (WLAN) connection established according to an Institute for Electrical and Electronics Engineers (IEEE) 802.11 family of standards.
8. The enrollee computing device of claim 1 , wherein the configuration information of the enrollee computing device is communicated using a Generic Attribute Profile.
9. At least one non-transitory machine readable medium, comprising instructions that, when executed by a machine, causes the machine to at least:
identify an unconfigured state of an enrollee computing device, by determining that the enrollee computing device requires a set of credentials to securely connect to a network;
advertise a configuration service, the configuration service adapted to receive information from a configurator, wherein the configurator is a configuration computing device to provision the enrollee computing device with the set of credentials to securely connect to the network;
receive a broadcast, responsive to the advertising of the configuration service, of a device provisioning protocol from the configurator;
establish a secure short-range wireless session with the configurator, the secure short-range wireless session established without a user input and performed using a low-power connection;
receive, responsive to establishing the secure short-range wireless session between the configurator and the enrollee computing device, configuration information of the enrollee computing device via the configuration service;
implement the configuration information, the configuration information specifying one or more parameters of a wireless connection type; and
establish, responsive to implementing the configuration information, a wireless connection according to the one or more parameters.
10. The at least one machine readable medium of claim 9 , wherein the instructions, when executed, cause the machine to:
reduce power of the enrollee computing device used to perform the low-power connection;
establish an insecure short-range wireless session;
utilize a key exchange protocol to exchange a cryptographic key; and
utilize the cryptographic key to engage in encrypted communications with the configurator.
11. The at least one machine readable medium of claim 10 , wherein the instructions, when executed, cause the machine to establish the insecure short-range wireless session using a pairing process not requiring user input.
12. The at least one machine readable medium of claim 11 , wherein the pairing process is a JUST WORKS BLUETOOTH LOW ENERGY pairing process.
13. The at least one machine readable medium of claim 10 , wherein the key exchange protocol is a Diffie Hellman key exchange protocol.
14. The at least one machine readable medium of claim 9 , wherein the wireless connection includes a Wireless Local Area Network (WLAN) implemented according to an Institute for Electrical and Electronics Engineers (IEEE) 802.11 family of standards.
15. The at least one machine readable medium of claim 9 , wherein the configuration information of the enrollee computing device is communicated using a Generic Attribute Profile.
16. A method for configuration of an enrollee computing device, the method comprising:
identifying an unconfigured state of the enrollee computing device, by determining that the enrollee computing device requires a set of credentials to securely connect to a network;
advertising a configuration service, the configuration service adapted to receive information from a configurator, wherein the configurator is a configuration computing device to provision the enrollee device with the set of credentials to securely connect to the network;
receiving a broadcast, responsive to the advertising of the configuration service, of a device provisioning protocol from the configurator;
establishing a secure short-range wireless session with the configurator, the secure short-range wireless session established without a user input and performed using a low-power connection;
receiving, responsive to establishing the secure short-range wireless session between the configurator and the enrollee computing device, configuration information of the enrollee computing device via the configuration service;
implementing the configuration information, the configuration information specifying one or more parameters of a wireless connection type; and
establishing, responsive to implementing the configuration information, a wireless connection according to the one or more parameters.
17. The method of claim 16 , wherein the implementing of the configuration information includes applying the one or more parameters using the configurator.
18. The method of claim 17 , wherein establishing the secure short-range wireless session includes:
reducing power of the enrollee computing device used to perform the low-power connection;
establishing an insecure short-range wireless session;
utilizing a key exchange protocol to exchange a cryptographic key; and
utilizing the cryptographic key to engage in encrypted communications with the configurator.
19. The method of claim 18 , wherein the establishing of the insecure short-range wireless session is implemented using a pairing process not requiring user input.
20. The method of claim 19 , wherein the pairing process is a JUST WORKS BLUETOOTH LOW ENERGY pairing process.
21. The method of claim 18 , wherein the key exchange protocol is a Diffie Hellman key exchange protocol.
22. The method of claim 16 , wherein the wireless connection includes a Wireless Local Area Network (WLAN) according to an Institute for Electrical and Electronics Engineers (IEEE) 802.11 family of standards.