CLOUD DEVICE IDENTIFICATION AND AUTHENTICATION
Methods and apparatuses for authentication and/or provisioning of wireless network devices, and in particular, methods and apparatuses for authentication and/or provisioning of wireless network devices that are communicating with and may be monitored and/or controlled by a remote (e.g., cloud) server.
1 . A method of provisioning a network device to a network using a handheld device, the method comprising:
identifying, by a handheld device, a network device using a unique identifier on the network device;
determining that the unique identifier corresponds to a known device from a list of known devices;
transmitting, by the handheld device, a secret string to the network device to establish a trusted session with the network device, the secret string encrypted within the unique identifier;
establishing a shared authentication key between the network device and the handheld device; and
transmitting the shared authentication key to a remote server,
wherein only limited communication is allowed between the remote server and the network device until the network device is fully provisioned.
2 . The method of claim 1 , wherein identifying the network device comprises capturing an optical code disposed on the network device, wherein the optical code includes a quick response (QR) code, a bar code, an alphanumeric code, or a combination thereof.
3 . The method of claim 2 , wherein determining that the unique identifier corresponds to a known device is based, at least in part, on the unique identifier.
4 . The method of claim 1 , wherein transmitting the secret string further comprises recovering the secret string from the unique identifier.
5 . The method of claim 4 , wherein recovering the secret string comprises decrypting the secret string from the unique identifier.
6 . The method of claim 1 , wherein the secret string includes a service set identifier (SSID) for a default access point or a password for accessing the network device.
7 . The method of claim 1 , wherein the shared authentication key is based, at least in part, on the secret string.
8 . The method of claim 1 , wherein the shared authentication key is received from the network device.
9 . The method of claim 1 , further comprising:
verifying, by the remote server, the shared authentication key from the network device with the shared authentication key from the handheld device; and
fully provisioning the network device in response to verifying the shared authentication key.
10 . The method of claim 1 , further comprising adding, by the remote server, the network device to a list of allowable devices, and generating a digital certificate to authenticate the network device to other devices.
11 . A system comprising:
a handheld device configured to:
identify a network device using a unique identifier disposed on the network device;
determine that the unique identifier corresponds to a known device from a list of known devices;
transmit a secret string to the network device to establish a trusted session with the network device, the secret string encrypted within the unique identifier;
establish a shared authentication key between the network device and the handheld device; and
transmit the shared authentication key to a remote server,
wherein only limited communication is allowed between the remote server and the network device until the network device is fully provisioned.
12 . The system of claim 11 , wherein the handheld device is further configured to capture an optical code disposed on the network device to identify the network device, and wherein the optical code includes a quick response (QR) code, a bar code, an alphanumeric code, or a combination thereof.
13 . The system of claim 12 , wherein the handheld device is further configured to determine that the unique identifier corresponds to a known device based, at least in part, on the unique identifier.
14 . The system of claim 11 , wherein the handheld device is further configured to recover the secret string from the unique identifier.
15 . The system of claim 14 , wherein the handheld device is further configured to decrypt the secret string from the unique identifier.
16 . The system of claim 11 , wherein the secret string includes a service set identifier (SSID) for a default access point or a password for accessing the network device.
17 . The system of claim 11 , wherein the shared authentication key is based, at least in part, on the secret string.
18 . The system of claim 11 , wherein the shared authentication key is received from the network device.
19 . The system of claim 11 , wherein the remote server is configured to verify the shared authentication key from the network device with the shared authentication key from the handheld device; and fully provision the network device in response to verifying the shared authentication key.
20 . The system of claim 11 , wherein the remote server is configured to add the network device to a list of allowable devices, and generate a digital certificate to authenticate the network device to other devices.