Secure pairing and pairing lock for accessory devices
Embodiments described herein provide a service to enable a user to track a variety of even when those devices are not connected to the internet by either Wi-Fi or cellular. One embodiment provides techniques to enable a pairing registration for a wireless accessory device that enables a server-mediated pairing process to be performed between the wireless accessory device and a companion device.
1 . A method for a server mediated pairing process, the method comprising:
receiving a request via an interface of a first electronic device to initiate a server-mediated pairing process with a second electronic device;
detecting an advertisement broadcast by the second electronic device;
generating a server-mediated pairing request, wherein the server-mediated pairing request includes pairing data having a first portion associated with the first electronic device and a second portion associated with the detected advertisement, wherein the first portion is generated by the first electronic device and includes an authentication token for an account associated with the first electronic device and the server-mediated pairing process is to create a pairing lock between the account associated with the first electronic device and the second electronic device, the pairing lock to limit the second electronic device to being paired with devices associated with the account;
sending the server-mediated pairing request to a server device for validation;
receiving a server-mediated pairing response from the server device;
transmitting the server-mediated pairing response to the second electronic device; and
receiving a response status from the second electronic device.
2 . The method of claim 1 , further comprising:
finalizing or aborting the server-mediated pairing process based on the server-mediated pairing response.
3 . The method of claim 1 , wherein the second portion is received from the second electronic device in response to a request to initiate the server-mediated pairing process and includes a first software token that is associated with the second electronic device.
4 . The method of claim 3 , wherein the first software token is cryptographically associated with the second electronic device and is a one-time token to authenticate the second electronic device to the server device.
5 . The method of claim 3 , wherein the first software token is cryptographically associated with the second electronic device via a hardware identifier or hardware key of the second electronic device.
6 . The method of claim 3 , further comprising:
finalizing the server-mediated pairing process based on a success response, wherein finalizing the server-mediated pairing process includes:
transmitting an encrypted blob received from the server device to the second electronic device, the second electronic device to validate the encrypted blob to verify the validity of the server device, wherein the encrypted blob includes a second software token that was generated for the second electronic device, the encrypted blob is opaque to the first electronic device, and the second software token is to replace the first software token on the second electronic device.
7 . A non-transitory machine readable medium having instructions stored thereon, the instructions to cause one or more processors of an accessory device to perform operations comprising:
receiving a request via an interface of a first electronic device to initiate a server-mediated pairing process with a second electronic device;
detecting an advertisement broadcast by the second electronic device;
generating a server-mediated pairing request, wherein the server-mediated pairing request includes pairing data having a first portion associated with the first electronic device and a second portion associated with the detected advertisement, wherein the first portion is generated by the first electronic device and includes an authentication for an account associated with the first electronic device and the server-mediated pairing process is to create a pairing lock between the account associated with the first electronic device and the second electronic device, the pairing lock to limit the second electronic device to being paired with devices associated with the account;
sending the server-mediated pairing request to a server device for validation;
receiving a server-mediated pairing response from the server device;
transmitting the server-mediated pairing response to the second electronic device; and
receiving a response status from the second electronic device.
8 . The non-transitory machine readable medium of claim 7 , the operations further comprising:
finalizing or aborting the server-mediated pairing process based on the server-mediated pairing response.
9 . The non-transitory machine readable medium of claim 7 , wherein the second portion is received from the second electronic device in response to a request to initiate the server-mediated pairing process and includes a first software token that is associated with the second electronic device.
10 . The non-transitory machine readable medium of claim 9 , wherein the first software token is cryptographically associated with the second electronic device and is a one-time token to authenticate the second electronic device to the server device.
11 . The non-transitory machine readable medium of claim 9 , wherein the first software token is cryptographically associated with the second electronic device via a hardware identifier or hardware key of the second electronic device.
12 . The non-transitory machine readable medium of claim 9 , the operations further comprising:
finalizing the server-mediated pairing process based on a success response, wherein finalizing the server-mediated pairing process includes:
transmitting an encrypted blob received from the server device to the second electronic device, the second electronic device to validate the encrypted blob to verify the validity of the server device, wherein the encrypted blob includes a second software token that was generated for the second electronic device, the encrypted blob is opaque to the first electronic device, and the second software token is to replace the first software token on the second electronic device.
13 . A device comprising:
a network interface coupled with a bus;
a memory coupled to the bus, the memory to store instructions for execution; and
one or more processors coupled with the bus, the one or more processors to execute the instructions stored in the memory, wherein the instructions to cause the one or more processors to perform a server-mediated pairing process, the one or more processors to:
receive a request via an interface of a first electronic device to initiate a server-mediated pairing process with a second electronic device;
detect an advertisement broadcast by the second electronic device;
generating a server-mediated pairing request, wherein the server-mediated pairing request includes pairing data having a first portion associated with the first electronic device and a second portion associated with the detected advertisement, wherein the first portion is generated by the first electronic device and includes an authentication token for an account associated with the first electronic device and the server-mediated pairing process is to create a pairing lock between the account associated with the first electronic device and the second electronic device, the pairing lock to limit the second electronic device to being paired with devices associated with the account;
send the server-mediated pairing request to a server device for validation;
receive a server-mediated pairing response from the server device;
transmit the server-mediated pairing response to the second electronic device; and
receive a response status from the second electronic device.
14 . The device of claim 13 , the instructions further causing the one or more processors to:
finalize or abort the server-mediated pairing process based on the server-mediated pairing response.
15 . The device of claim 13 , wherein the second portion is received from the second electronic device in response to a request to initiate the server-mediated pairing process and includes a first software token that is associated with the second electronic device.
16 . The device of claim 15 , wherein the first software token is cryptographically associated with the second electronic device and is a one-time token to authenticate the second electronic device to the server device.
17 . The device of claim 15 , wherein the first software token is cryptographically associated with the second electronic device via a hardware identifier or hardware key of the second electronic device.
18 . The device of claim 15 , the instructions further causing the one or more processors to:
finalize the server-mediated pairing process based on a success response, wherein finalizing the server-mediated pairing process includes:
transmit an encrypted blob received from the server device to the second electronic device, the second electronic device to validate the encrypted blob to verify the validity of the server device, wherein the encrypted blob includes a second software token that was generated for the second electronic device, the encrypted blob is opaque to the first electronic device, and the second software token is to replace the first software token on the second electronic device.