Securing internet of things communications across multiple vendors
A secure connection between a user mobile device and a “Internet-of-Things” network-connected device (e.g., a home appliance or a vehicle) may be provided using an internet gateway residing in the public internet and a local gateway residing in a private network behind a firewall. The user device may receive an input through a software application and may generate an electronic instruction based on the input. The user device may then encrypt the electronic instruction and send the encrypted electronic instruction to the internet gateway over a secure connection (e.g., SSH, TLS). The internet gateway then sends the encrypted electronic instruction to the local gateway, which decrypts the encrypted electronic instruction, interprets it, and generates and transmits a device instruction to communicate with the network-connected device, either directly or through an intermediary device such as a third-party bridge or hub. Only the user device and local gateway have encryption/decryption keys.
1. A method for managing secure computer communications, the method comprising:
storing information in a memory of a local gateway that cross-references a first user device with a first security key and a first set of privileges associated with a network-connected device;
storing information in the memory of the local gateway that cross-references a second user device with a second security key and a second set of privileges associated with the network-connected device;
receiving at the local gateway a first encrypted message transmitted by the first user device via a network interface via an internet gateway, wherein the internet gateway does not store the cross-reference information;
decrypting by the local gateway the first encrypted message using the received first security key, wherein the decrypted first message includes a command from the first user device to securely control the network-connected device associated with the local gateway;
forwarding, from the local gateway, the command from the first user device to the network-connected device for execution in response to identifying that the command from the first user device is consistent with the first set of privileges cross-referenced to the first user device;
receiving at the local gateway a second encrypted message transmitted by the second user device via the network interface;
decrypting by the local gateway the second encrypted message using the received second security key to identify that the decrypted second message includes a command from the second user device to securely control the network-connected device associated with the local gateway; and
preventing forwarding of the command from the second user device to the network-connected device in response to identifying that the command from the second user device is not consistent with the second set of privileges cross-referenced to the second user device.
2. The method of claim 1 , further comprising the local gateway:
generating the first security key;
storing the first security key in a database, and
sending the first security key to the first user device, wherein the first security key is stored at a local gateway device and at the first user device.
3. The method of claim 2 , wherein the first security key is associated with at least one of the first user device or a first user of the first user device.
4. The method of claim 2 , further comprising the local gateway:
generating the second security key;
storing the second security key in a database; and
sending the second security key to the second user device, wherein the second security key is stored at the local gateway device and at the second user device.
5. The method of claim 4 , wherein the second security key is associated with at least one of the second user device or a second user of the second user device.
6. The method of claim 1 , further comprising the local gateway:
receiving an encrypted message from an intermediary computing device between the first user device and the local gateway, wherein the intermediary computing device had received an initial version of the encrypted message and further encrypted the initial version to generate the encrypted message, and wherein the received encrypted message from the intermediary computing devices comprises a plurality of encryption levels; and
identifying that at least a first level of decryption is to be performed on the received encrypted message, wherein the decryption of the received encrypted message includes decrypting at the least two levels of encryption.
7. The method of claim 1 , wherein the network-connected device controls at least one of a home appliance, lights, or a vehicle.
8. A non-transitory computer-readable storage medium having embodied thereon a program executable by a hardware processor for performing a method for managing secure computer communications, the method comprising:
storing information in a memory of a local gateway that cross-references a first user device with a first security key and a first set of privileges associated with a network-connected device;
storing information in the memory of the local gateway that cross-references a second user device with a second security key and a second set of privileges associated with the network-connected device;
receiving at the local gateway a first encrypted message from the first user device via a network interface via an internet gateway, wherein the internet gateway does not store the cross reference information;
decrypting by the local gateway the first encrypted message using the received first security key, wherein the decrypted first message includes a command from the first user device to securely control the network-connected device associated with the local gateway;
forwarding, from the local gateway, the command from the first user device to the network-connected device for execution in response to identifying that the command from the first user device is consistent with the first set of privileges cross-referenced to the first user device;
receiving at the local gateway a second encrypted message from the second user device via the network interface;
decrypting by the local gateway the second encrypted message using the received second security key to identify that the decrypted second message includes a command from the second user device to securely control the network-connected device associated with the local gateway; and
preventing forwarding of the command from the second user device to the network-connected device in response to identifying that the command from the second user device is not consistent with the second set of privileges cross-referenced to the second user device.
9. The non-transitory computer-readable storage medium of claim 8 , further comprising instructions executable for:
generating the first security key;
storing the first security key in a database, and
sending the first security key to the first user device, wherein the first security key is stored at a local gateway device and at the first user device.
10. The non-transitory computer-readable storage medium of claim 9 , wherein the first security key is associated with at least one of the first user device or a first user of the first user device.
11. The non-transitory computer-readable storage medium of claim 9 , further comprising instructions executable for:
generating the second security key;
storing the second security key in a database; and
sending the second security key to the second user device, wherein the second security key is stored at the local gateway device and at the second user device.
12. The non-transitory computer-readable storage medium of claim 11 , wherein the second security key is associated with at least one of the second user device or a second user of the second user device.
13. The non-transitory computer-readable storage medium of claim 8 , further comprising instructions executable for:
receiving an encrypted message from an intermediary computing device between the first user device and a local gateway device, wherein the intermediary computing device had received an initial version of the encrypted message and further encrypted the initial version to generate the encrypted message, and wherein the received encrypted message from the intermediary computing devices comprises a plurality of encryption levels; and
identifying that at least a first level of decryption is to be performed on the received encrypted message, wherein the decryption of the received encrypted message includes decrypting at the least two levels of encryption.
14. The non-transitory computer-readable storage medium of claim 8 , wherein the network-connected device controls at least one of a home appliance, lights, or a vehicle.
15. An apparatus for managing secure computer communications, the apparatus comprising a local gateway that includes:
a memory that stores:
information that cross-references a first user device with a first security key and a first set of privileges associated with a network-connected device, and
information that cross-references a second user device with a second security key and a second set of privileges associated with the network-connected device;
a network interface that:
receives a first encrypted message from the first user device, and receives a second encrypted message from the second user device via an internet gateway, wherein the internet gateway does not store the cross reference information;
a hardware processor that executes instructions stored in memory, wherein execution of the instructions by the hardware processor;
decrypts the first encrypted message using the received first security key, wherein the decrypted first message includes a command from the first user device to securely control the network-connected device associated with the local gateway;
forwards the command from the first user device to the network-connected device via the network interface for execution in response to identifying that the command from the first user device is consistent with the first set of privileges cross-referenced to the first user device;
decrypts the second encrypted message using the received second security key to identify that the decrypted second message includes a command from the second user device to securely control the network-connected device associated with the local gateway; and
prevents forwarding of the command from the second user device to the network-connected device in response to identifying that the command from the second user device is not consistent with the second set of privileges cross-referenced to the second user.
16. The apparatus of claim 15 , wherein the processor executes further instructions for generating the first security key, the memory further stores the first security key, and the network interface sends the first security key to the first user device.
17. The apparatus of claim 16 , wherein the first security key is associated with at least one of the first user device or a first user of the first user device.
18. The apparatus of claim 16 , wherein the processor executes further instructions for generating the second security key, the memory further stores the second security key, and the network interface sends the second security key to the second user device.
19. The apparatus of claim 15 , wherein the second security key is associated with at least one of the second user device or a second user of the second user device.