Secure device onboarding techniques
Various systems and methods for establishing network connectivity and onboarding for Internet of Things (IoT) devices and trusted platforms, including in Open Connectivity Foundation (OCF) specification device deployments, are discussed. In an example, a zero touch owner transfer method includes operations of: receiving a first request from a new device for network access to begin an onboarding procedure with a network platform; transmitting credentials of a first network to the new device, the first network used to access a rendezvous server and obtain onboarding information associated with the network platform; receiving a second request from the new device for network access to continue the onboarding procedure; and transmitting credentials of a second network to the new device, as the new device uses the second network to access the onboarding server of the network platform and perform or complete the onboarding procedure with the network platform.
1 . A device, comprising:
processing circuitry; and
a storage device including instructions embodied thereon, wherein the instructions, which when executed by the processing circuitry, cause the device to perform operations to:
invoke an onboarding procedure to enable the device to join a network platform;
transmit a unique identifier of the device from the device to a rendezvous service associated with the network platform;
receive onboarding information from the rendezvous service, based on the unique identifier, wherein the rendezvous service verifies the unique identifier before providing the onboarding information to the device;
transmit a first set of credentials to an onboarding service, wherein the onboarding service is identified by using the onboarding information, wherein the onboarding service enables the device to connect to the network platform based on the first set of credentials, and wherein the first set of credentials includes the unique identifier and a value based on a cryptographic key embedded in the device by a manufacturer of the device;
receive a second set of credentials based on accessing the onboarding service; and
perform secure communications with the network platform, based on use of the second set of credentials.
2 . The device of claim 1 , wherein the onboarding information includes an address of the onboarding service.
3 . The device of claim 1 , wherein messages exchanged between the device and the onboarding service are encrypted.
4 . The device of claim 1 , wherein the operations to transmit and receive occur via one or more wireless networks operating according to an IEEE 802.11 standards family.
5 . The device of claim 1 , wherein the onboarding procedure is autonomously invoked by the device based on a network access attempt.
6 . The device of claim 1 , further comprising a battery to provide a power source of the device.
7 . The device of claim 1 , wherein the device is an Internet of Things (IoT) device that includes one or more: accelerometers, level sensors, flow sensors, optical light sensors, camera sensors, temperature sensors, a global positioning system (GPS) sensors, or pressure sensors.
8 . A method performed by a device, comprising:
invoking an onboarding procedure to enable the device to join a network platform;
transmitting a unique identifier of the device from the device to a rendezvous service associated with the network platform;
receiving onboarding information from the rendezvous service, based on the unique identifier, wherein the rendezvous service verifies the unique identifier before providing the onboarding information to the device;
transmitting a first set of credentials to an onboarding service, wherein the onboarding service is identified by using the onboarding information, wherein the onboarding service enables the device to connect to the network platform based on the first set of credentials, and wherein the first set of credentials includes the unique identifier and a value based on a cryptographic key embedded in the device by a manufacturer of the device;
receiving a second set of credentials based on accessing the onboarding service; and
performing secure communications with the network platform, based on use of the second set of credentials.
9 . The method of claim 8 , wherein the onboarding information includes an address of the onboarding service.
10 . The method of claim 8 , wherein messages exchanged between the device and the onboarding service are encrypted.
11 . The method of claim 8 , wherein the transmitting and the receiving occurs via one or more wireless networks operating according to an IEEE 802.11 standards family.
12 . The method of claim 8 , wherein the onboarding procedure is autonomously invoked by the device.
13 . The method of claim 8 , wherein the device is an Internet of Things (IoT) device, and wherein the method further comprises performing sensing operations with one or more: accelerometers, level sensors, flow sensors, optical light sensors, camera sensors, temperature sensors, a global positioning system (GPS) sensors, or pressure sensors.
14 . A device, comprising:
means for invoking an onboarding procedure to enable the device to join a network platform;
communication means for:
transmitting a unique identifier of the device from the device to a rendezvous service associated with the network platform;
receiving onboarding information from the rendezvous service, based on the unique identifier, wherein the rendezvous service verifies the unique identifier before providing the onboarding information to the device;
transmitting a first set of credentials to an onboarding service, wherein the onboarding service is identified by using the onboarding information, wherein the onboarding service enables the device to connect to the network platform based on the first set of credentials, and wherein the first set of credentials includes the unique identifier and a value based on a cryptographic key embedded in the device by a manufacturer of the device; and
receiving a second set of credentials based on accessing the onboarding service; and
processing means for coordinating operations with the network platform, based on secure communications established by using the second set of credentials.
15 . The device of claim 14 , wherein the onboarding information includes an address of the onboarding service.
16 . The device of claim 14 , wherein messages exchanged between the device and the onboarding service are encrypted.
17 . The device of claim 14 , wherein the transmitting and the receiving occurs via one or more wireless networks operating according to an IEEE 802.11 standards family.