Automatic configuration of devices upon introduction into a networked environment

The present invention generally relates to setting the device at the time of introduction into the network environment, and more specifically, automatically setting the wireless device at the time of introduction into the network environment.

Today, if you want to add devices to your network environment, such as wireless devices to your wireless network, and you don't want to expose your network to infringers, WEP (Wired Equivalent Privacy, or sometimes Wired) It is necessary to thoroughly investigate the mechanism of security systems such as security systems based on Ake Valency Protocol), WPA (Wi-Fi Protected Access), EAP (Extensible Authentication Protocol), IEEE (Institute of Electrical and Electronics Engineers) 802.11i, etc. Will be.

However, it is difficult and error-prone to establish proper credentials for both wireless devices and their associated access points. Also, in general, proof of ownership and / or control of the device at the time of introduction of the device into the network environment must be performed manually. That is, for example, if you want the device to operate in the open state first (as is done in some consumer products), the device is vulnerable to breaches before it is put into a safe state. As a result, the user who installs the device may mistakenly associate the device with an incorrect network environment.

The features and advantages of the present invention will become apparent from the following detailed description of the present invention.

<figref num="1">It is a figure which shows the exemplary system which consists of a plurality of devices which can operate according to the principle of embodiment disclosed in this application.</figref>

<figref num="2">It is a figure which shows the method by one Embodiment for setting the apparatus to be introduced in the system of FIG.</figref>

<figref num="3">It is a figure which shows the method by one Embodiment for setting a wireless device to be introduced in the network environment including an access point.</figref>

<figref num="4">FIG. 5 illustrates a method according to one embodiment for access points and other devices to configure the wireless device of FIG. 3 to be installed in a network environment.</figref>

<figref num="5">It is a figure which shows the suitable computer environment in which a specific feature of this invention can be carried out.</figref>

The illustrated embodiment of the present invention allows the device to be safely set up when the device is introduced into a network environment. Further, in various embodiments, the installation and configuration techniques described herein provide access to the equipment, control of the equipment, and / or ownership of the equipment before the equipment is automatically embedded and installed in the network environment. Provide to confirm. Such access, control, and / or ownership checks can prevent new equipment from being accidentally installed in an incorrect network environment. The problem of being accidentally installed in an incorrect network environment can occur when there are many "digital office" or "digital home" environments close to each other.

For example, suppose that many tenants in an apartment building purchase equipment that is configured to operate as described in this application, one user's equipment is automatically configured and another user's network environment. It is inconvenient if it is made to work with. This can happen if there is a potential overlap in the network environment. For example, see Wireless Network Environment and / or HomePlug Powerline Alliance (Internet Uniform Resource Locator (URL) www-homeplug-org (note that the above URL is for the purpose of avoiding hyperlink settings). The period is replaced with a hyphen))), which can occur in a wired environment. In both of these network environments, the equipment to be embedded can be made accessible by more different people and / or equipment than expected.

To avoid such problems, as mentioned above, auto-installation first engages in some task of accessing equipment, controlling equipment, and / or demonstrating ownership of equipment configured in the network environment. Adapted to do. Different embodiments may use different techniques to provide such proof. This can be done, for example, by displaying a special identifier (ID), personal identification number (PIN), or other data on the device, on a label attached to the device, in a bar code, or by RFID ( Radio frequency identification) Markers or other dedicated narrow-range communication (DSRC) devices that supply IDs, PINs, etc., or dongle that is incorporated into short-range transmitters and receivers such as Bluetooth transmitters or USB-based portable memory devices. Alternatively, transfer of ID, PIN, etc. by a portable flash memory storage device is included.

It should be noted that these are at least partially used to prove access to the device, control of the device, and / or ownership of the device, and at the same time to set up the device at least initially for use in a network environment. It will be understood that they are only some exemplary techniques for supplying possible data. In the detailed description and claims, the term "configuration key" is used to collectively refer to these and other methods in which certification as described above can be provided with data that facilitates the configuration of the device. To do.

In the embodiments described, the configuration keys are wired and wireless without the need for any special hardware for the device or the access points, routers, hubs, and other devices to which the device is connected. Can be used in a network environment. That is, embodiments of the present invention may be implemented entirely in software or via instructions loaded on general purpose hardware.

FIG. 1 shows an exemplary system 100 consisting of a plurality of devices capable of operating according to the principles of the embodiments disclosed herein. Although network 102 is shown, it can be any type of wired and / or wireless network. If we consider a wired network to be standard, we would refer to a wireless access point 104 (ie, a "base station"). This is, for example, a device that communicatively connects a wired network and a wireless network. Well-known wireless systems include wireless systems based on the IEEE 802.11x family of specifications recommended by the Institute of Electrical and Electronics Engineers (IEEE) for LAN (Local Area Network) technology. IEEE802.11 provides an over-the-air interface between the wireless device 106 and the access point ("infrastructure" communication mode) and communication between two or more wireless clients ("ad hoc" communication mode). Define the specifications of.

The wireless device 106 is a music player designed to receive music streamed over the network 102, which is an existing audiovisual processing device 108 (eg, stereo, video processor, television receiver, projector). , Amplifiers, media processors / modifiers / switches, etc.), and it is assumed that it will be installed in the system 100 in the hope that it will supply music output via the existing wireless speaker 110. The network may further include other devices such as a computer 112 system, a DVR (digital video recorder) 114, and other devices not shown. Wireless networks, homeplug networks, and traditional wired networks can operate on it and also have many possible devices that are interconnected within System 100 to perform a variety of desired tasks. Will be understood.

As mentioned above, when the wireless music device 106 is installed in the system 100, it proves access to the device 106, control of the device 106, and / or ownership of the device 106, and at the same time accidentally to the wrong network. It is assumed that the device is turned on and put into auto-configuration mode for the purpose of preventing any association or intentional attack on the device. In this automatic setting mode, as described above, the data used for setting the device is presented to the user of the device. Access / control / ownership is considered proven by having access to the data presented during autoconfiguration. In this application, the success / failure of automatic setting will not be described in detail. If the automatic configuration fails and / or is aborted, the prior art may of course be used to configure the new device to be introduced into the system 100. The device settings will be described in more detail with respect to the drawings below.

FIG. 2 shows a method according to an embodiment that is installed in the network system 100 of FIG. 1, for example, for setting up device 106.

In the illustrated embodiment, the device is powered on (202) and enters auto-configuration mode (204) by default. In auto-configuration mode, the device supplies a configuration key that can be used to configure the device (206). In one embodiment, the setting key is provided by displaying the setting key on a screen (eg, LCD (liquid crystal display), TFT (thin film transistor), LED (light emitting diode) array, or other output). In one embodiment, the set key is randomly generated. Therefore, it allows devices that are essentially identical to be manufactured and shipped worldwide. In one embodiment, the settings are automatically generated in response to a power-on of the device until the device is set automatically or manually, or until the automatic setting is disabled. In another embodiment, as described above, the configuration key may be some permanent identifier or other feature of the device such as a serial number, MAC (medium access control) address, or may be based on them. Can be supplied in different ways.

When a configuration key is supplied (206), it can be entered in a second device involved in the configuration of the device (208). The assumption that the network environment in which the device is installed may not be secure in the sense that an unexpected intruder may have access to packets transmitted over a network such as a wireless network or a wired network based on a home plug. I want to remember. Therefore, when equipment is introduced, existing equipment in the network environment is expected to be involved in the configuration of new equipment. This can be any current device on the network. In a wireless network, the device involved in the configuration may generally be, for example, a wireless access point, through which the device is connected to the network. The network environment can operate in a secure (encrypted) mode or a non-secure (non-encrypted) mode. It is also assumed that the second device in the network communicates with the new device regardless of the secure state of the network.

After entering the key in the second device (208), a temporary secure communication channel is established (210). This security is considered to be weak. This is because the configuration key does not present too much data and gains temporary security from this data. That is, a relatively short key consisting of several characters for the purpose of making the configuration key easily manageable by the user (eg, what the user sees and remembers for input to the second device (208)). (206), but the downside from a cryptographic point of view of such user convenience is that a short key becomes a less secure cryptographic key. However, the goal is to create a secure communication channel that is unrealistically secure, if not impossible, to break the security of the temporarily secured channel. For example, a 3-character set key can be used to determine a 40-bit encryption key by repeating one or more characters of the key. In one embodiment, a surplus digit key can be created as a checksum of the set key for the purpose of making it possible to check the accuracy of the PIN input (208) in the second device. It will be appreciated that any key length can be obtained from a key character depending on the number of bits essentially represented by the character and / or via a key character repeat or function as input. ..

Once a temporarily secured communication channel is thus established (210), that channel can be programmed within the device (212) and is used to securely convey permanent security credentials. Will be done. Permanent credentials are long enough to provide any relatively secure channel encrypted using the perpetual credentials in traditional encryption formats. Therefore, a new device can be automatically configured upon introduction into a network environment in which some or all of it is not considered secure, while at the same time the user has appropriate access to, control, and control over the device. And / or can be deployed in a network environment by ensuring ownership (by requesting access to the supplied (206) configuration key).

FIG. 3 shows a method according to an embodiment for setting up a wireless device, for example, which is introduced in a network environment including an access point.

In the embodiments described, for example, after activating the wireless device (302) by turning on the power, pressing a setting button, etc., the device enters the automatic setting mode (304). In auto-configuration mode, the device displays the configuration keys that can be used to configure the device (306). As mentioned above, various techniques can be used to display and otherwise present the configuration key. When the key is displayed (306), a known function is used to generate an SSID (Service Set Identifier) or a similar identifier based on the configuration key, which the device uses, for example, this unique SSID. Set to use by wireless hardware of the device, such as by setting to (308). This feature is expected to be known, at a minimum, to wireless devices and second devices such as access points that program new devices with permanent security credentials.

After setting the SSID (308), another known function is used to generate the encryption key (eg WEP, WPA, etc.) and the encryption is set for use by the device (310). References to "known features" for operations 308, 310 mean that any transformation can be used to generate the SSID and WEP / WPA keys from the configuration key. As long as the new device and the second device involved in configuring the new device both use the same conversion function, it does not have to be a specific conversion. For example, an SSID can be generated by concatenating a given basic phrase such as "init" with one or more characters in the setting key, and WEP / WPA supports some or all of the characters in the setting key. / WPA Determined by converting to a hexadecimal sequence.

The device is involved in programming the device with an access point or permanent security credentials (314) after setting its SSID and WEP / WPA (308, 310), for example via infrastructure mode or ad hoc mode. A temporarily secured channel can be established with the device (312).

FIG. 4 is a diagram illustrating a method according to one embodiment for an access point or other device to configure the wireless device of FIG. 3 to be deployed in a network environment.

Assuming that steps 302 to 310 in FIG. 3 occur or are performed, an access point such as component 104 in FIG. 1 prepares to manage the new device and programs the new device with appropriate security credentials. can do. The security credentials can include not only encrypted data but also local policies, rules, service conditions, billing rates, etc. that can be communicated to the new device as applicable to the network environment in which the new device is installed. .. In the embodiments described, if necessary, the access point's current wireless settings (eg, its SSID and WEP or WPA key) are stored (402). Note that the save of settings is available to the profile manager or equivalent, and instead of exchanging the current settings, a new temporary profile with a higher priority is created based on the new device's setting key. It will be understood that it may be unnecessary in a particular environment.

After saving the current settings as needed (402), the user is prompted to enter the (306) configuration key displayed on the new device (404). As mentioned above, access to this key proves access, control, and / or ownership of the new device, ensuring that this new device should just be allowed into the network environment. To do. Complementary to the operations 308 and 310 in FIG. 3, the access point sets its SSID and WEP / WPA encryption key according to the setting key of the device (406, 408). After configuration, the access point establishes a temporarily secured channel that is complementary to operation 312 in Figure 3 (410). It should be noted that various techniques can be used to reconfigure the access point to communicate with the new device. In one embodiment, the access point may have a simple built-in user interface for entering a configuration key. In another embodiment, the software may run on a computer or other machine communicatively coupled to the access point, which computer or machine reprograms the access point for operations 406,408. ..

After establishing a temporary secure connection (312, 410), the new device can be programmed with permanent security credentials. Similar to setting up an access point, various techniques can be used to program new equipment. For example, in one embodiment, the access point may have built-in functionality to automatically extrude its permanent wireless credentials into a new device over a temporarily secured channel. Alternatively, in another embodiment, the software may be run on a computer or other machine communicatively coupled to the access point, which computer or machine is in permanent security credentials to perform arithmetic 412. Program a new device.

When the new device is programmed with permanent credentials, the temporary communication channel is no longer needed and the access point may revert to its usual (eg, saved (402)) wireless configuration (414). In one embodiment described above using a profile manager or equivalent, "returning" is simply deleting the temporary profile created for communication with the new device. In another embodiment, "returning" may require resetting the access point's SSID and WEP / WPA key. As mentioned above, the access point may be programmed to recover its state on its own, or it may be manipulated by an external computer or other machine.

Therefore, the new device can be automatically configured when the new device is introduced into the wireless network environment, and at the same time the user can access, control, and control the new device (by requesting access to the displayed (306) configuration key). And / or by guaranteeing ownership, it can be deployed in a wireless network environment.

FIG. 5 and the following description are intended to provide a brief and general description of a suitable environment in which the particular features of the invention described may be practiced. As used herein, the term "machine" is intended to broadly include a single machine or a system communicably coupled to multiple machines or devices operating together. Illustrative machines include personal computers, workstations, servers, portable computers, such as handheld devices such as personal digital assistants (PDAs), computing devices such as telephones and tablets, and private use such as automobiles, trains and taxis. Or it includes transportation equipment such as public transportation.

Generally, the environment is a processor 504, a memory 506 (eg, a memory 506 such as a random access memory (RAM), a read-only memory (ROM), or other state storage medium, a storage device 508, a video interface 510, and inputs and outputs. A machine 500 including a system bus 502 to which the interface port 512 connects. The machine is an instruction, virtual reality (VR) environment received by input from a conventional input device such as a keyboard, mouse, or from another machine. It can be at least partially controlled by interaction with, biometric feedback, or other input or signal.

Machines may include embedded controllers such as programmable or non-programmable logic devices or arrays, application-specific integrated circuits, embedded computers, smart cards, and the like. The machine may use, for example, one or more connections to one or more remote machines 514, 516 via network interface 518, modem 520, or other communication coupling. The machines may be interconnected via physical and / or logical networks 522 such as network 102 in FIG. 1, intranet, internet, local area network, and wide area network. We have a variety of wired and / or wireless short distances for communication with network 522, including radio (RF), satellite, microwave, IEEE (Institute of Electrical and Electronics Engineers) 802.11, Bluetooth, optics, infrared, cable, laser, etc. Or it will be understood that long-range carriers and protocols can be used.

The present invention refers to relevant data such as features, procedures, data structures, application programs, etc., which, when accessed by a machine, causes the machine to perform tasks or define abstract data types or subordinate hardware contexts, or Can be explained with relevant data. Related data includes, for example, volatile and / or non-volatile memory 506 or storage device 508 and / or conventional hard drives, floppy (registered trademark) disks, optical storage devices, tapes, flash memory, memory sticks, etc. It can be stored in associated storage media, including non-standard media such as digital video disks and other machine-accessible biological state storage storage devices. The relevant data may be supplied in the form of packets, serial data, parallel data, propagated signals, etc. via a transmission environment including network 522, and may be used in compressed or encrypted form. Relevant data may be used in a distributed environment and may be stored locally and / or remotely for access by single or multiprocessor machines. The relevant data may be used by or with the embedded controller. Thus, in the claims, the term "logic" is intended to generally refer to possible combinations of relevant data and / or embedded controllers.

Thus, for example, for the embodiments described, it is assumed that the machine 500 embodies the new device 106 of FIG. 1 and the remote machines 514 and 516 can be the access point 104 and the computer 112 of FIG. 1, respectively. Since the remote machines 514 and 516 are set in the same manner as the machine 500, it will be understood that they include many or all of the components described for the machine.

Although the principles of the invention have been described and illustrated with reference to the illustrated embodiments, it will be appreciated that the described embodiments can be modified in arrangement and detail without departing from such principles. Moreover, although the above description has focused on a specific embodiment, other configurations are also conceivable. In particular, expressions such as "in one embodiment" and "in another embodiment" are used in the present application, but these expressions generally refer to the possibilities of the embodiments and specify the invention. It is not intended to be limited to the embodiment configuration of. As used herein, these terms may refer to the same or different embodiments that can be combined with other embodiments.

Therefore, given that various alternatives to the embodiments described in the present application are possible, this detailed description is merely exemplary and should not be construed as limiting the scope of the invention. Therefore, the invention for which a patent is claimed includes all such modifications as it is included in the scope and spirit of the claims and their equivalents.