Mesh network commissioning

Cross-reference with related applications This application claims priority under 35 USC 119 (e) of US Provisional Patent Application Serial No. 62 / 016,450 filed June 24, 2014. The application also claims priority to US Provisional Patent Application Serial No. 62 / 063,135, filed October 13, 2014. The application also claims the priority of US Provisional Patent Application Serial No. 62 / 115,601 filed on February 12, 2015. The application also claims the priority of US Provisional Patent Application Serial No. 62 / 141,853 filed April 2, 2015.

background The use of wireless mesh networking to connect devices to each other and to cloud-based services is becoming more and more popular for sensing environmental conditions, controlling devices, and providing information and alerts to users. .. However, many devices on mesh networks are designed to operate on battery power for extended periods of time, which limits the computation, user interface, and wireless resources available on the device. In addition, to ensure the security of the mesh network, the identities of the devices that join and operate on the mesh network are authenticated, and the communication within the mesh network is encrypted based on the credentials commissioned by the device. However, as the ubiquity and scale of mesh networks increases, commissioning techniques include the quality of the user experience for commissioning, the participation of devices in the correct mesh network during commissioning, the safe injection of credentials into the device, and the device. And limit the accuracy with which application-specific information is provisioned to the device.

<p> Overview This overview is provided to introduce a simplified concept of mesh network commissioning. The simplified concept is further explained in the detailed description below. This summary is not intended to identify the essential features of the claimed subject matter, nor is it intended to be used in defining the scope of the claimed subject matter.</p><p> Mesh network commissioning is generally described for joining nodes to a mesh network. In an embodiment, the joiner router can receive a beacon request from the participating device and then send the beacon from the joiner router to the participating device, which indicates that the mesh network is available for participation. provide. The transmitted beacon also allows the participating device to establish a local link between the participating device and the joiner router. The joiner router receives a message from a participating device requesting to join the mesh network. The message received from the participating device can include a device identifier that can be used to authenticate the participating device, and the participating device will have a Password Authenticated Key Exchange by Juggling. Authenticated using Juggling: J-PAKE) or any other suitable cipher suite, authentication is effective in establishing a secure communication session between the commissioning device and the participating device. The joiner router forwards the received message to the commissioning device in the mesh network, which forwards the received message through one or more routers in the mesh network in the communication path between the joiner router and the commissioning device. Can include that. In the implementation example, one of the routers may be a border router that connects the mesh network to the external network, and the commissioning device is attached to the external network. The joiner router then receives authentication from the commissioning device for the participating device to join the mesh network, the joiner router sends network information to the participating device, and the network information is that the participating device joins the mesh network. To enable.</p><p> Mesh network commissioning is generally described for joining nodes to a mesh network. In an embodiment, the joiner router can receive a beacon request from the participating device and then send the beacon from the joiner router to the participating device, which indicates that the mesh network is available for participation. provide. The transmitted beacon also allows the participating device to establish a local link between the participating device and the joiner router. The joiner router relays the DTLS-ClientHello message with the DTLS relay reception notification message from the participating device requesting to join the mesh network, and it is sent to the commissioning device of the mesh network. The joiner router receives the DTLS relay transmission notification message from the commissioning device and sends the content of the DTLS relay transmission notification message to the participating device, which allows the participating device to join the mesh network and joins with the commissioning device. This is useful for establishing a secure communication session with the device. The joiner router receives an indication from the commissioning device that the participating device should be entrusted with receiving network credentials for the mesh network, and the key encryption key shared between the commissioning device and the participating device ( Key Encryption Key: KEK) is received. The joiner router then encrypts the message at the Media Access Control (MAC) layer and uses KEK to authenticate and securely communicate the network credentials, and the network credentials and network credentials from the joiner router to the participating devices. Send other essential network parameters. A secure communication session can be used to provision participating devices.</p><p> Mesh network commissioning is generally described for establishing commissioning sessions. In an embodiment, the border router receives an application from the commissioning device to become a commissioner for a device participating in the mesh network. Border routers advertise the availability of mesh networks for commissioning devices. In response to receiving the advertisement, the commissioner receives the application in response to the commissioning device receiving the advertisement. The border router sends the received application to the leader device of the mesh network, receives the response to the application from the reader device, and the response indicates the acceptance or rejection of the application. The border router sends an indication of acceptance or rejection of the application to the commissioning device. Acceptance of applications by the reader device authorizes the commissioning device to become a commissioner for the mesh network, establishing a secure commissioning session. Acceptance of applications is also a set that allows the reader device to update the internal state of tracking the active commissioner for the mesh network, allow participation across the mesh network, and allow participation in the mesh network. Allows you to communicate devices and propagate commissioning datasets within a mesh network.</p><p> In other aspects of mesh network commissioning, border routers also include providing enhanced (eg, cryptographically hashed) commissioning credentials to border routers to establish secure commissioning communication sessions. , The identity of the commissioning device can be registered, and the enhanced commissioning credentials are derived from the commissioning credential passphrase entered by the user into the commissioning device. Border routers include a copy of the encrypted commissioning credentials that can be used to authenticate the commissioning device to the mesh network, and the copy of the encrypted commissioning credentials was previously derived from the commissioning credentials. .. The commissioning credentials were injected into the leader device of the mesh network from which the copy of the encrypted commissioning credentials was derived, and the reader device securely communicated the copy of the encrypted commissioning credentials to the border router.</p><p> Mesh network commissioning is generally described for establishing commissioning sessions. In an embodiment, the mesh network leader device receives an application to accept the commissioning device as a commissioner for commissioning the participating devices to join the mesh network. The reader device can determine whether to accept or reject the received application and send a response to the commissioning device with an indication as to whether to accept or reject the received application. The decision to accept or reject an application received from a commissioning device may include ensuring that there is one active commissioner for the mesh network. In response to the decision to accept the received application, the reader device can update the internal state of tracking the active commissioner for the mesh network.</p><p> In another aspect of mesh network commissioning, the reader device can receive commands from the commissioning device to initiate a join mode for the mesh network and propagate the commissioning dataset within the mesh network. Enhanced commissioning credentials can be derived from the commissioning credentials injected into the leader device during the commissioning of the leader device . The reader device can send a copy of the encrypted commissioning credentials to the border router, allowing the border router to authenticate the commissioning device to the mesh network.</p><p> Mesh network commissioning is described, which generally relates to managing multiple commissioning sessions. In an embodiment, the commissioning device secures a network communication session between the commissioning device of the mesh network and the border router in order to securely join one or more participating devices in the mesh network. To establish. A secure commissioning communication session sends an application to the mesh network leader device and receives an indication of application acceptance from the leader device in order to request acceptance of the commissioning device as an active commissioner for the mesh network. , Used by commissioning devices. The commissioning device can activate the join for the mesh network and receive a request from the joining device to join the mesh network. To activate the join for the mesh network, the commissioning device can initiate a join mode that causes the router in the mesh network to advertise that the mesh network is accepting join requests.</p><p> In another aspect of mesh network commissioning, the commissioning device can also send a management message to the reader device to make the mesh network joinable, and the management message allows the reader device to update the network data for the mesh network. Allows you to. The management message may include steering data indicating participating devices that are allowed to join the mesh network. The network data is then propagated to the router devices in the mesh network, and the network data includes an indication that the mesh network is available for participation. Participating devices establish a secure joiner communication session with the commissioning device. The commissioning device is a Pre-Shared Key for the device for participating devices. Authenticate the participating devices using Device: PSKd) and join the participating devices to the mesh network. The commissioning device determines from the copy of the device identifier received as input from the user to the commissioning device that the encrypted device identifier received from the participating device is consistent with the encrypted device identifier derived by the commissioning device. However, a secure joiner communication session can be established by using the encrypted device identifier as a shared secret to secure the joiner communication session.</p><p> Requests to join the mesh network from the participating device can be received via the joiner router, and the commissioning device is shared by the participating device with the network credentials for the mesh network and between the commissioning device and the participating device. Sends an indication to the joiner router that it should be commissioned to receive the key encryption key (KEK) to be received. Sending to a participating device through the joiner router is to allow the joiner router to securely send network credentials to the participating device using the received KEK and commission the participating device to the mesh network. It is valid. The request received from the participating device can include the encrypted device identifier of the participating device, and the encrypted device identifier participates using password-authenticated key exchange (J-PAKE) by juggling. Derived from the device identifier of the device.</p><p> Mesh network commissioning is generally described for provisioning participating devices. In embodiments, the commissioning device can establish a commissioning communication session between the commissioning device and the border router of the mesh network, as well as a joiner communication session between the participating device and the commissioning device. The commissioning device then sends the commissioning information to the participating device, which is available to the participating device to join the mesh network. The commissioning device receives a display of the position of the commissioner application from the participating device, utilizes the received display to search for the commissioner application, and executes the commissioner application to provision the participating device.</p><p> Mesh network commissioning for searching and steering in general is described. In an embodiment, the mesh network commissioning device can obtain steering data for the mesh network, which is a representation of the device identifier associated with a device that is allowed to participate in the mesh network. The commissioning device can then propagate steering data from the commissioning device for the mesh network to one or more routers in the mesh network, and the steering data indicates that the commissioner is active on the mesh network. Propagation of steering data by the commissioning device allows one or more routers to send steering data in beacon messages, where the steering data is associated with the device identifier and the device joins the mesh network. It is effective to make it possible to identify that is permitted. In the implementation example, the steering data is an IEEE 64-bit extended unique identifier (Extended). A 16-bit Cyclic Redundancy Check (CRC16) for a device identifier that is a Unique Identifier (EUI-64). The commissioning device can obtain the steering data for the mesh network by obtaining the steering data for the additional device identifier associated with the additional device that is allowed to join the mesh network. Propagation of steering data by the commissioning device is useful to allow the device to distinguish between mesh networks and other networks, which are IEEE 802.15.4 networks.</p><p> Mesh network commissioning for searching and steering in general is described. In an embodiment, the mesh network commissioning device can obtain steering data for the mesh network, which includes and displays a device identifier associated with a device that is allowed to join the mesh network. Is represented as a set of values in a Bloom filter that represents a device identifier. The commissioning device can then propagate steering data from the commissioning device for the mesh network to one or more routers in the mesh network. Propagating the steering data allows the router to transmit the steering data in a beacon message, where the device associated with the device identifier has the device determined a set of values in the Bloom filter. Compared to a set of values of 2, the device can be identified as being allowed to join the mesh network.</p><p> In another aspect of mesh network commissioning, the commissioning device applies a first hash function to the device identifier to generate a first hash value and a second hash function to generate a second hash value. Is applied to the device identifier to obtain steering data. The device identifier may be an IEEE 64-bit extended unique identifier (EUI-64), and the device identifier is the least significant 24 bits of EUI-64. In the implementation example, the first and second hash functions are Cyclic Redundancy Checks (CRC), the first hash function is CRC16-CCITT, and the second hash function is CRC16-ANSI. The commissioning device then performs a modulo operation on the first hash value to determine the first bitfield position in the Bloom filter and a second bitfield position in the Bloom filter. Performs modulo operation on the hash value. The divisor for modulo arithmetic can be the length of the Bloom filter bit array. The commissioning device can set the value at the first bitfield position of the Bloom filter to 1 and the value at the second bitfield position of the Bloom filter to 1. The commissioning device can set all of the bitfield values in the steering data to a value of 1 to indicate that the mesh network can participate for any device. Alternatively, the commissioning device can set the bitfield value of the steering data to a value of 0 that disables participation for the mesh network.</p><p> Mesh network commissioning is generally described for splitting nodes in a mesh network. In an embodiment, a node device in a mesh network receives a commissioning dataset and compares the time stamp in the received commissioning dataset with the time stamp stored in the commissioning dataset stored in the node. The node device can determine from the comparison that the stored time stamp is more recent than the received time stamp and can send a message to the leader device of the mesh network accordingly. Contains the stored commissioning dataset. The reader device accepts the stored commissioning dataset as the most recent commissioning dataset for the mesh network and propagates the stored commissioning dataset to the mesh network. Instead, the node device determines that the time stamp received is more recent than the stored time stamp and, in response to the judgment, is stored to be consistent with the commissioning dataset received. You can update the commissioning dataset.</p><p> In another aspect of mesh network commissioning, the commissioning dataset received is a security that indicates the time stamp received, the commissioning credentials, the network name of the mesh network, and which security-related actions are allowed on the mesh network. Including policies. The received time stamp is the time value and the time value is Coordinated Universal Time (Coordinated Universal Time). Includes indication that it is traceable up to Time: UTC). In the implementation example, the node device and reader device were previously commissioned to the mesh network, and the previous commissioning stored the same commissioning dataset on the node and reader devices. The stored commissioning dataset in the node device can be updated after the mesh network splits to stop communication between the node device and the reader device on the mesh network. The split separates the mesh network, the first partition of the mesh network contains the leader device, and the second partition of the mesh network contains the node devices. The node device can receive the commissioning dataset after the merger of the first and second partitions of the mesh network, and the merger reestablishes the communication path between the node device and the reader device on the mesh network.</p><p> Brief Description of Drawings An embodiment of mesh network commissioning will be described with reference to the following drawings. The same numbers are used throughout the drawing to refer to similar features and components.</p>

<figref num="1">FIG. 5 illustrates an exemplary mesh network system in which various embodiments of mesh network commissioning can be realized.</figref><figref num="2">FIG. 5 illustrates an exemplary environment in which various embodiments of mesh network commissioning can be realized.</figref><figref num="3A">FIG. 5 illustrates a simplified version of an exemplary mesh network environment with devices implemented according to a mesh network commissioning embodiment.</figref><figref num="3B">FIG. 5 illustrates a simplified version of an exemplary mesh network environment with devices implemented according to a mesh network commissioning embodiment.</figref><figref num="3C">FIG. 5 illustrates a simplified version of an exemplary mesh network environment with devices implemented according to a mesh network commissioning embodiment.</figref><figref num="3D">FIG. 5 illustrates a simplified version of an exemplary mesh network environment with devices implemented according to a mesh network commissioning embodiment.</figref><figref num="4">It is a figure which shows the example of the data transaction between devices in the mesh network environment according to the embodiment of mesh network commissioning.</figref><figref num="5">It is a figure which shows the example of the commissioning environment which has the established commissioner session and the established joiner session according to the embodiment of mesh network commissioning.</figref><figref num="6">It is a figure which shows the example of the data transaction between devices in the mesh network environment for establishing a commissioner session according to the embodiment of mesh network commissioning.</figref><figref num="7">It is a figure which shows the example of the data transaction between devices in the mesh network environment for establishing a joiner session according to the embodiment of mesh network commissioning.</figref><figref num="8">FIG. 5 shows an example of steering data generated using a Bloom filter to encode a device identifier for a participating device according to an embodiment of mesh network commissioning.</figref><figref num="9">It is a figure which shows the example of dividing a mesh network according to the embodiment of mesh network commissioning.</figref><figref num="10">FIG. 5 illustrates an exemplary method of mesh network commissioning, generally relating to the participation of nodes in a mesh network, according to embodiments of the techniques described herein.</figref><figref num="11">FIG. 5 illustrates another exemplary method of mesh network commissioning, generally relating to the participation of nodes in a mesh network, according to embodiments of the techniques described herein.</figref><figref num="12">FIG. 5 illustrates an exemplary method of mesh network commissioning, generally relating to establishing a commissioning session in a mesh network, according to an embodiment of the method described herein.</figref><figref num="13">FIG. 5 illustrates another exemplary method of mesh network commissioning, generally relating to establishing a commissioning session in a mesh network, according to an embodiment of the method described herein.</figref><figref num="14">FIG. 5 illustrates an exemplary method of mesh network commissioning, generally relating to managing multiple commissioning sessions in a mesh network, according to embodiments of the techniques described herein.</figref><figref num="15">FIG. 5 illustrates an exemplary method of mesh network commissioning, generally relating to provisioning participating devices in a mesh network, according to embodiments of the techniques described herein.</figref><figref num="16">FIG. 5 illustrates an exemplary method of mesh network commissioning, such as for searching and steering, generally in a mesh network, according to embodiments of the techniques described herein.</figref><figref num="17">FIG. 5 illustrates another exemplary method of mesh network commissioning, such as with respect to searching and steering, generally in a mesh network, according to embodiments of the techniques described herein.</figref><figref num="18">FIG. 5 illustrates an exemplary method of mesh network commissioning, generally relating to partitioning nodes in a mesh network, according to embodiments of the techniques described herein.</figref><figref num="19">FIG. 5 illustrates an exemplary environment in which a mesh network can be realized according to an embodiment of the method described herein.</figref><figref num="20">It is a figure which shows the exemplary mesh network device which can be realized in the mesh network environment according to the embodiment of the method described herein.</figref><figref num="21">It is a figure which shows the exemplary system which has the exemplary device which can realize the embodiment of mesh network commissioning.</figref>

Detailed Description A wireless mesh network is a communication network with wireless nodes connected in a mesh topology that provides a reliable and redundant communication path for traffic within the mesh network. A wireless mesh network uses multiple wireless links, or hops, to forward traffic between devices within the mesh network. This provides coverage of areas larger than the area covered by a single wireless link.

Wireless mesh networks can be based on proprietary or standards-based technologies. For example, a wireless mesh network may be based on the IEEE 802.15.4 standard, which is a feature of the physical (PHY) and media access control (MAC) layers and for use by applications at the upper layers of the mesh networking stack. Prescribe services. Upper layer applications use the services specified by these standards to provide secure application-level communications (eg, encryption and authentication) across the mesh network.

While standards-based technologies for mesh networks provide services for secure communications, these technologies do not provide a complete solution for secure commissioning of mesh networks. A standards-based solution may assume that the device is commissioned outside the bandwidth of a secure mesh network and left to be designed by the application developer. For example, out-of-band commissioning solutions include injecting network credentials through a wired connection before participating devices attempt a wireless-based connection to a mesh network. Instead, when a mesh network arises, network credentials are transmitted over an insecure wireless link.

Securely commissioning participating devices through a mesh network eliminates the need for specialized commissioning tools and additional interfaces on the participating devices for credential injection, and the risk of transmitting credentials through insecure communication links. Various embodiments provide mesh network commissioning techniques for improving the commissioning of devices participating in the mesh network.

The authentication method used in networks connected to the Internet may rely on the use of certificates issued by certification authorities. The certificate can be validated to authenticate the identity of another device on the network. Unlike devices on the Internet, devices in a mesh network do not have to access a certificate-based authentication connected to the Internet to authenticate the device for commissioning. A mesh network commissioning technique is described that provides secure authentication of commissioning and participating devices to a mesh network without the need for an external certification authority.

Standards for mesh networks provide services to secure communication within mesh networks, such as defining network keys (network master keys) and MAC layer encryption techniques for communication between devices in mesh networks. .. However, inserting credentials such as network keys into devices participating in a mesh network is outside the scope of PHY and MAC services specified by the standard. Out-of-band techniques are often used to first load the credentials onto the participating device before the participating device attempts to connect to the mesh network. A mesh network commissioning technique is described that securely communicates network credentials to participating devices through a mesh network during commissioning.

Many devices designed for mesh networks have limited or no user interface capabilities. Due to the restricted user interface on mesh network devices, entering information such as passphrases, device identifiers and / or device addresses for participating devices can be tedious and error-prone for users. A mesh network commissioning technique is described that enhances user efficiency and data entry accuracy during commissioning of participating devices in the mesh network.

As systems that use mesh networking become more and more ubiquitous, it may be necessary to add more participating devices during mesh network commissioning. The limited resources and user interface of many mesh network devices result in long and costly commissioning, especially when a large number of participating devices must be commissioned or recommitted. A mesh network commissioning technique that enhances the scalability of commissioning participating devices to a mesh network is described.

Wireless mesh networks may use radio spectra that are licensed or unlicensed (also known as license exempt or license free). Standards such as IEEE802.15.4 specify the use of unlicensed radio spectra such as channel frequency, channel bandwidth, data rate, modulation, access techniques, etc., which are the use of unlicensed spectra. Allows multiple mesh networks to operate within the band. A mesh network commissioning technique is described that allows participating devices to securely participate in the correct mesh network in an environment where multiple mesh networks share the same radio spectrum and / or basic industry standard networking protocol.

In addition to inserting network credentials into the participating device during commissioning, additional provisioning may be required for the participating device to update or configure the participating device for use in a mesh network. This provisioning may require secure communication of information, such as linking participating devices to cloud service user accounts. A mesh network commissioning technique for securely provisioning participating devices during commissioning is described.

The features and concepts of the described systems and methods for mesh network commissioning can be realized in any number of different environments, systems, devices, and / or different configurations, but embodiments of mesh network commissioning are described below. Explained in the context of exemplary devices, systems, and configurations.

FIG. 1 shows an exemplary mesh network system 100 in which various embodiments of mesh network commissioning can be realized. The mesh network 100 is a wireless mesh network that includes a router 102, a router qualified end device 104, and an end device 106. The router 102, router-qualified end device 104, and end device 106 each include a mesh network interface for communication over the mesh network. Router 102 sends and receives packet data through the mesh network interface. Router 102 also routes traffic across the mesh network 100. The router 102 and the router qualified end device 104 can undertake various roles and combinations of roles for commissioning within the mesh network 100, as described below.

Router-eligible end device 104 is located at a leaf node in the mesh network topology and is not actively routing traffic to other nodes in the mesh network 100. When the router-eligible device 104 is connected to an additional device, the router-eligible device 104 can become the router 102. The end device 106 is a device that can communicate using the mesh network 100, but is not capable of routing traffic in the mesh network 100 beyond mere forwarding to its parent router 102.

Router 102, router-eligible end device 104, and end device 106 include network credentials used to authenticate the identities of these devices as members of mesh network 100. Router 102, router-eligible end device 104, and end device 106 also use network credentials to encrypt communications in the mesh network.

FIG. 2 shows an exemplary environment 200 in which various embodiments of the mesh networking commissioning technique can be realized. Environment 200 includes mesh network 100, where several routers 102 play a specific role in mesh network 100. Devices within the mesh network 100, as indicated by the dashed lines, use network credentials to securely communicate through the mesh network 100. Devices shown outside of mesh network 100 do not have a copy of the network credentials for mesh network 100 and cannot use mesh network layer security to communicate securely.

Border router 202 (also known as gateway and / or edge router) is one of router 102. The border router 202 includes a second interface for communication with an external network outside the mesh network 100. The border router 202 connects to the access point 204 through an external network. For example, the access point 204 may be an Ethernet® router, a Wi-Fi® access point, or any other suitable device for bridging different types of networks. The access point 204 connects to a communication network 206 such as the Internet. The cloud service 208 connected via the communication network 206 provides services related to and / or uses the devices in the mesh network 100. As an example, but not limited to, cloud service 208 connects end-user devices such as smartphones and tablets to devices in mesh network 100, processes data obtained in mesh network 100 and presents it to end users, 1 Provides applications that include linking devices in one or more mesh networks 100 to user accounts in cloud service 208, provisioning and updating devices in mesh network 100, and more.

A user who chooses to commission a new device to join the mesh network 100 can use the commissioning device 210, which is a border router 202 via the external network technology of the access point 204 to commission the new device. Connect to. The commissioning device 210 is any computing device, such as a smartphone, tablet, notebook computer, that has a suitable user interface and communication capabilities to act as a commissioner for joining the device to the mesh network 100. You may. To become a commissioner for the mesh network 100, the commissioning device 210 applies to become a commissioner, as described in detail below.

Participating device 212 is any router-eligible end device 104 or end device 106 that the user chooses to join the mesh network 100. Prior to commissioning, participating device 212 has not received network credentials for mesh network 100 and cannot be authenticated to mesh network 100 or communicate securely through mesh network 100. During commissioning, the participating device 212 acts as a joiner (ie, participating device), as described in detail below.

During commissioning of the participating device 212 to join the mesh network 100, one of the routers 102 acts as the joiner router 214. The role of joiner router 214 may be played by any router 102 within one wireless link of participating device 212. Joiner router 214 provides a local-only wireless link to participating device 212 for joiner sessions, as described in detail below.

One of the routers 102 acts as the reader 216 for the mesh network 100. Reader 216 manages router identifier assignments, and Reader 216 is the primary arbiter of network configuration information for mesh network 100. Reader 216 also controls at any given time which commissioning device 210 is accepted as the only active commissioner for the mesh network 100.

Environment 200, as shown in FIG. 2, indicates that the device plays only a single role among the various roles described above. Figures 3A-3D, as shown and described below, show other variances of the commissioning role for mesh network commissioning techniques as an example, but not a limitation.

FIG. 3A shows a simplified version 300 of an exemplary environment 200, showing only devices that have a specific role in commissioning for clarity. In this example, each device in FIG. 3A has a single commissioning role in the mesh network commissioning embodiment. Figure 3A also shows the communication links used during the commissioning process. A secure mesh communication link 302 is used between the devices participating in the mesh network 100. An insecure local-only wireless link 304 is established to connect the participating device 212 to the joiner router 214 in order to commission the participating device 212 to the mesh network 100. The external network 306 has a communication link on the external network, such as a point-to-point link 308 between the border router 202 and the commissioning device 210.

FIG. 3B also shows a simplified version 320 of an exemplary environment 200, showing a border / joiner router 322, which is a border router 202 that additionally plays the role of joiner router 214. Figure 3C also shows a simplified version 340 of the exemplary environment 200, showing the commissioner / border router 342, which is the border router 202 that additionally plays the role of the commissioning device 210. In this example, the commissioner / border router 342 includes a mesh network interface. The commissioner / border router 342 may also be referred to as an on-mesh commissioner because the commissioner / border router 342 is connected to the mesh network 100.

Figure 3D also shows a simplified version 360 of the exemplary environment 200, showing the commissioner / border router / joiner router 362, which is the border router 202 that additionally plays the roles of the joiner router 214 and the commissioning device 210. Figures 3A-3D show a sample of possible combinations of mesh network commissioning roles in which any router-eligible end device 104 can perform multiple roles (except for the role of participating device 212).

FIG. 4 illustrates the commissioning process 400 by showing transactions between devices in the mesh network 100, which perform various mesh network commissioning roles. The commissioning process 400 begins when the commissioning device 210, for example a mobile phone, discovers that the mesh network 100 is available for the commissioner from the advertisement 402 from the border router 202. The commissioning device 210 is then pre-shared key for the commissioner. Use Commissioner: PSKc) to establish a secure socket connection with the border router 202. This secure connection establishes a commissioning session (404). Since there can only be one active commissioner at a time, the commissioning device 210 sends an application to border router 202 (406), which is then forwarded to reader 216 by border router 202 as an application (408). Apply to reader 216 to become the active commissioning device 210 for mesh network 100.

When the reader 216 accepts the commissioning device 210 as the active commissioner, the reader sends an application response 410 to the border router 202, which in turn forwards the application response 412 to the commissioning device. Reader 216 also indicates to devices on mesh network 100 that there is an active commissioner by propagating updated network data through mesh network 100 (414).

Once activated as a commissioner, the commissioning device 210 allows participation for the mesh network 100. Optionally, the commissioning device 210 provides steering data indicating the device identifier of the participating device 212 that is expected to join the mesh network 100. The commissioning device 210 may also query and set network parameters such as network name and security configuration.

Participating device 212 sends a request to establish a joiner session to joiner router 214 (416), which in turn relays the request from participating device 212 to border router 202 (418). Note that the relay request 418 may be forwarded between the joiner router 214 and the border router 202 by any number of routers 102 in the mesh network. Border router 202 forwards the request to establish a joiner session to commissioning device 210 (420). The commissioning device 210 sends a response to the request for the joiner session to the border router 202 (422), which in turn relays the response to the joiner router 214 (424). At 426, joiner router 214 ends the establishment of the joiner session. The establishment of the joiner session in Figure 4 is shown in a simplified form for clarity, with additional relayed DTLS messages being exchanged as part of the DTLS handshake to establish the joiner session. May be done.

As shown by 416 to 426, the participating device 212 and the commissioning device 210 are Datagram Transport Layer Security (DTLS) or transport using the device pre-shared key (PSKd) for the participating device 212. Transport Layer Use Security: TLS) to perform a handshake. The handshake is performed on the relay through the mesh network 100, as described in detail below. The commissioning device 210 is from a participating device credential received out of band on the mesh network 100, typically entered through the user interface of the commissioning device 210, such as by scanning a QR code® or barcode. Derivation of PSKd. Once the handshake is complete, the shared secret generated from PSKd is used to establish a joiner session and pass network credentials for mesh network 100 from joiner router 214 to participating device 212. Optionally, in addition to passing network credentials for mesh network 100, commissioner and joiner sessions may be used to provision joiners, as shown in 428.

FIG. 5 shows a commissioning environment 500 with an established commissioner session and an established joiner session. Commissioner session 502 is a secure communication tunnel from the commissioning device 210 to the border router 202. Joiner session 504 is a secure communication tunnel from commissioning device 210 to participating device 212. For clarity, other mesh communication links and external network communication links are omitted.

First device pairing In order to join the device to the mesh network 100, the first device has the commissioning credentials for the commissioning device to join the mesh network 100 and the network for the safe operation of the mesh network 100. Commissioned to establish credentials. The commissioning device 210 connects to a first device that can be any router-eligible end device 104. The first device is commissioned outside the bandwidth of mesh network 100. Any suitable connection, such as USB, ad hoc Wi-Fi, Bluetooth®, point-to-point IEEE 802.15.4, may be used to connect the first device to the commissioning device 210.

Once the commissioning device 210 connects to the first device, the commissioning device programs the PSKc and network name for the mesh network 100 into the first device. PSKc is used to authenticate the commissioning device 210 to the mesh network 100 to establish a commissioning session, as described in detail below. The network name has a human-readable form, similar to the Service Set Identifier (SSID) in a Wi-Fi network. Once the first device is commissioned, the first device becomes the leader 216 of the mesh network 100. The first device forms the mesh network 100, with a unique Personal Area Network Identifier (PAN ID) and a unique extended PAN ID (XPAN ID) for the mesh network 100, and a unique extended PAN ID (XPAN ID) for the mesh network 100. Includes determining the network key.

PSKc is derived from the commissioning credentials, which is a human-scale passphrase entered into the commissioning device 210 by the user managing the mesh network 100. The commissioning credentials are enhanced (eg, by cryptographic hashing multiple times) to derive the PSKc stored by the reader 216 and the commissioning device 210. Any suitable cryptographic hashing method may be used to derive PSKc.

To improve the security of PSKc, cryptographic techniques may be applied to increase the entropy of the derived commissioning credentials in PSKc compared to the equivalent human-scale commissioning credential passphrase entered by the user. .. By using key stretching, the derived key can be safely stored on an embedded node that can be physically compromised, and the user's passphrase will not be compromised. This is useful because users often reuse passphrases for multiple websites and accounts. Any suitable cryptographic technique, such as applying a cryptographic hash multiple times, is used to stretch the key. For example, Advanced Encryption Standard-Cipher-based Message Authentication Code-Pseudo-Random Password-Based Key Derivation Function 2: PBKDF2 can be used to apply Function-128: AES-CMAC-PRF-128). For example, PSKc can be derived as shown in Equation 1:

<maths num="1"><img file="JP6759405B2_D0001.tif" /></maths>

In the formula, PRF is a kind of pseudo-random function to be used by PBKDF2, P is the commissioning credentials, and S is the salt for the cryptographic function (for example, a string such as the network type concatenated with the network name). , C is the number of PRF iterations, and dkLen is the desired length of the derived key (PSKc).

Establishing a Commissioner Session Figure 6 shows the process 600 of establishing a commissioner session by showing the transaction between the commissioning device 210, the border router 202, and the reader 216. The mesh network 100 may have a limited number of active commissioning devices 210, but may have multiple potential commissioning devices 210 that can act as commissioners. Reader 216 is responsible for ensuring that there is only a finite set of active commissioners for the mesh network 100. As an example, but not a limitation, a finite set of active commissioners may be limited to a single active commissioner. To become an active commissioner, the commissioning device 210 applies to leader 216 to become a commissioner for the mesh network.

At 602, the border router 202 advertises that the mesh network 100 is available for the commissioning device 210 on the external network interface. The border router 202 may create an advertisement in response to a multicast request (ie, scan or query) within the service discovery protocol. For example, advertisement 602 may be made using any suitable service discovery, such as Multicast Domain Name Service (mDNS). Specifically, for wireless networks, the border router 202 uses DNS Service Discovery (DNS-SD) via a Uniform Resource Locator (URL) to advertise commissioning services. The lookup server will then respond using all the different wireless networks accessible, the network name of the mesh network 100, and the commissioning port.

The commissioning device 210 responds to advertisements from the border router 202 by requesting a secure connection between the commissioning device 210 and the border router 202 for a commissioning session (604). For example, the commissioning session can be established in any preferred manner, such as using PSKc to establish the commissioning session using DTLS or TLS. As a non-limiting example, the commissioning device 210 and the border router 202 identify the commissioning device and authenticate to the mesh network 100, and to establish a secure connection for the commissioner session, DTLS messages 606-616. To exchange.

The commissioning session uses any suitable network port, such as the User Datagram Protocol (UDP) port or the Transmission Control Protocol TCP port, as both the source and destination ports for the commissioning session. You may. For example, a commissioning session uses a commissioning port discovered during network discovery. Each border router 202 can assign a commissioning port or use a default commissioning port.

To become the active commissioner for the mesh network 100, the commissioning device 210 applies to leader 216 to request that it become a commissioner (618). Using a commissioning session, commissioning device 210 sends a request to border router 202 to become an active commissioner for mesh network 100 (620). Border router 202 forwards the application to reader 216 (622). For example, after the commissioning device 210 is authenticated and identified, the border router 202 unicasts the commissioner request request message 620 (eg, COMM_PET.req) to the reader 216. The commissioner request is forwarded by the border router 202 to the reader 216 as a request 622 (eg, as LEAD_PET.req) requiring the commissioning device 210 to be accepted as the active commissioning device 210 for the mesh network 100. For example, a commissioner request request message containing a commissioner identification string is securely sent through mesh network 100.

Reader 216 determines if there is an active commissioner for mesh network 100. If there is an active commissioner, the leader rejects the application from the commissioning device 210. If there is no active commissioner for the mesh network 100, the reader 216 accepts the application from the commissioning device 210. Reader 216 updates its copy of the commissioning dataset to reflect the existence of an active commissioner and the identity of the commissioning device 210. Reader 216 truly sets the join permission flag for mesh network 100. Reader 216 then propagates the network data and the updated commissioning dataset to mesh network 100 (624), which indicates that mesh network 100 is ready to participate.

For example, the reader 216 will respond to the commissioner request request message by accepting or rejecting the commissioning device 210 as the active commissioner for the mesh network 100. When accepting, Reader 216 updates its copy of the network data with new commissioner information, sets the join permission flag to true, and Multicast Protocol for Low Power and Lossy Networks. The updated network data and commissioning dataset will be propagated through the mesh network 100 using any suitable protocol such as: MPL) or by multicasting MLE-UPDATE messages.

The potential joiner router 214 (ie, router 102 and router qualified end device 104) stores updated network information and commissioning datasets propagated by reader 216. The updated network information and commissioning dataset allows direct communication with the commissioning device 210 for use when commissioning any participating device 212. The commissioning dataset includes a router locator (RLOC) that allows any device to send messages to the currently active border router 202, which acts as a proxy for the active commissioner.

After deciding whether to accept or reject the application from the commissioning device 210, the reader 216 responds to the border router 202 with an indication of that decision (626). The border router 202 sends a response to the commissioning device 210, including an indication by the reader 216 of the decision to accept or reject the application (628). For example, the reader 216 sends a reader request response message (eg LEAD_PET.rsp) to the border router 202 indicating the leader 216's decision to accept or reject the commissioning device 210 as the active commissioner for the mesh network 100. Send. In response to receiving a leader request response message from reader 216, the border router 202 indicates a commissioner request response indicating the leader 216's decision to accept or reject the commissioning device 210 as the active commissioner for the mesh network 100. A message (for example, COMM_PET.rsp) will be sent to the commissioning device 210.

Instead, as shown in 630, the leader 216 sets the join permission flag to true after accepting the request for the commissioning device 210 to become the active commissioner, but the leader 216 is an updated network. Wait to receive a management data request configuration message 632 (for example, MGMT_SET.req) containing a display from the commissioning device 210 to allow the data to propagate to the mesh network 100. Reader 216 responds to the commissioning device with a management data response configuration message 634 (eg, MGMT_SET.rsp) to accept and confirm the request to propagate the updated network data. Reader 216 propagates network data and updated commissioning datasets to mesh network 100 (636), which indicates that mesh network 100 is ready to participate.

Before the commissioning device 210 sends a management data request configuration message to allow the reader 216 to propagate the updated network information, the commissioning device 210 does not allow the mesh network 100 to join the device. You may manage the mesh network 100 by configuring, changing network settings, and so on. The commissioning dataset includes a commissioner session identifier, a commissioning dataset time stamp, and a PSKc. If the commissioning device 210 is the active commissioner on the mesh network 100, the commissioning data set also includes the location of the border router 202. If the mesh network 100 is available, the commissioning dataset also includes steering data indicating which participating devices 212 are allowed to join the mesh network 100. If the mesh network 100 is available, the router 102 in the mesh network 100 includes the join permission flag and steering data in the beacon transmitted by the router 102.

The commissioning device 210 may include a mesh network interface that allows the commissioning device 210 to act as a native commissioner on the mesh network 100. If a unique commissioner bit is set in the beacon and the commissioning device 210 includes a mesh network interface, the commissioning device 210 may apply to the reader 216 to be the active commissioner for the mesh network 100.

Once accepted as the active commissioner, the commissioning device 210 manages the network by using the management data request configuration message and the management data response capture message to acquire and configure the network parameters of the mesh network 100. Good. The network parameters are PSKc for mesh network 100, network name, network key, network key sequence number, network PAN ID, network extension PAN ID, and network unique local address (Unique Local). Address: ULA), and / or includes wireless channels. Additional management capabilities are possible, such as the ability to eject previously joined devices from the mesh network 100. The management data request setting message and the management data response acquisition message are relayed to the reader 216 via the border router 202 through the commissioning session. The message for acquiring and setting the network parameter command affects the state of the entire global network, so the message is forwarded to the reader 216 and stored by the reader 216. Any device can address the request to retrieve network information directly to the reader 216, avoiding multi-hop addressing.

Establishment of Joiner Session A joiner session is established between the commissioning device 210 and the participating device 212 in order to securely commission new devices to the mesh network 100. A joiner session is a communication tunnel through a mesh network 100 between a commissioning device 210 and a participating device 212. Participating device credentials are human-scale passphrases used to authenticate that participating device 212 is eligible to participate in mesh network 100. Participating device credentials are communicated between the participating device 212 and the commissioning device 210 by any suitable out-of-band mechanism. For example, the participating device credential may enter the serial number of the participating device 212 into the user interface of the commissioning device 210 by scanning the QR code or barcode located on the participating device 212 with the camera included in the commissioning device 210. , And so on.

FIG. 7 shows process 700 establishing a joiner session by showing transactions between commissioning device 210, border router 202, joiner router 214, and participating device 212. In some embodiments, the establishment of a joiner session begins when the participating device 212 scans a radio channel, such as a channel specified in the IEEE 802.15.4 specification, to find a potential mesh network 100 to join. .. Participating device 212 will issue a beacon request to each mesh network 100 found during the channel scan (702), to which all mesh networks 100 will respond.

For example, participating device 212 performs an active scan by sending an 802.15.4 MAC-BEACON. Request on all channels. In response to receiving a beacon request, joiner router 214 sends a beacon response containing steering data to help the participating device 212 discover the correct mesh network 100 to join (704). Joiner router 214 sends an 802.15.4 MAC-BEACON. Response with steering data in the payload of the 802.15.4 MAC-BEACON. Response. Details of generating, transmitting and using steering data are described in more detail below. Once the participating device 212 finds the mesh network 100 to which it should participate, the participating device 212 establishes a local-only wireless link to the joiner router 214, which is an insecure point-to-point communication link.

For example, participating device 212 establishes a local-only radio link to joiner router 214 by configuring MAC layer network parameters (eg, channel, PAN ID, etc.) collected from beacons received from channel scans. (706). Participating device 212 sends a packet to a joiner port (eg, UDP port) (eg, port number 5864 ": coaps") on the insecure interface of joiner router 214 to establish a local-only wireless link. The joiner port is also communicated on the beacon. If the joiner port is not found, the default port will be used by the participating device 212.

The joining device 212 sends a request to join the joiner router 214 to join the mesh network 100. Upon receiving the request to join the mesh network 100, the joiner router 214 sends a request to the commissioning device 210 for the authority to join. Joiner router 214 forwards all traffic transmitted by participating device 212 on the insecure joiner port. Joiner router 214 does not process or understand the content of the DTLS handshake understood by commissioning device 210. In some embodiments, the joiner router 214 stores in its memory the location of the commissioning device 210, or the location of the border router 202, which is a proxy for the commissioning device 210, and another device (eg, reader 216, or border router). You may search for the location of the commissioning device 210 from 202), or you may search for any other location (eg, a remote service). PSKd is used to authenticate the participating device 212 to the mesh network 100 and to secure the joiner session between the commissioning device 210 and the participating device 212. PSKd is derived from participating device credentials.

In some embodiments, the joiner session is DTLS, as well as password-authenticated key exchange by juggling (J-PAKE), Secure Remote Password (SRP) protocol, and / or any other suitable password. It may be established using an authentication protocol such as an authenticated key exchange protocol. For example, J-PAKE's elliptic curve transformation (EC-JPAKE) using the NIST P-256 elliptic curve may be used for authentication and key matching. Using J-PAKE with PSKd proves that the user commissioning the participating device 212 physically owns the participating device 212, and the commissioning device 210 is the correct participating device 212 throughout the joiner session. Prove that you are connected to.

The joiner router 214 forwards the request to join the mesh network 100 received from the joining device 212 through the joiner session to the commissioning device 210. Once the commissioning device 210 is authenticated to join the mesh network 100, the network key is securely transferred to the participating device 212 using the joiner session.

For example, the participating device 212 may send a joiner identification message to the joining router 214 to provide a human readable name for the participating device 212. The joiner router 214 encapsulates the information in the joiner identification message in the relay message and forwards the relay message to the border router 202 using the commissioner prefix, anycast address, or border router locator. Upon receiving the relay message, the border router 202 attaches the source address (in this case, the address of the joiner router 214) to the list of relay addresses next to the end of the relay message and forwards the relay message through the joiner session.

For example, participating device 212 uses DTLS and UDP to send a handshake message to joiner router 214 (708). Joiner router 214 relays the DTLS handshake message to border router 202 for delivery to commissioning device 210 (710). Joiner router 214 is unaware of the content of the relayed DTLS handshake message. Joiner router 214 filters incoming DTLS handshake messages received from participating device 212 through an insecure local-only radio link based on the matched above-mentioned Joiner UDP port. Joiner router 214 relays all messages received on the identified joiner UDP port. Joiner router 214 may speed up the transfer of insecure messages to prevent denial of service (DOS) attacks on mesh network 100.

As a further example, the participating device 212 first proposes itself to the commissioning device 210 by sending a DTLS-ClientHello message to the joiner router 214. This first DTLS-ClientHello is intended to allow the commissioning device 210 to assign the participating device 212 a DTLS cookie for use during the rest of the commissioning exchange. Joiner router 214 encapsulates the DTLS-ClientHello UDP payload in a DTLS relay reception notification message (for example, RLY_RX.ntf) and the source address of the encapsulated packet, in this case the 64-bit link-local address of the participating device 212. Is added as a relay hop. The DTLS cookie is sent to the participating device 212, which in turn returns it to the commissioning device 210 to ensure that the participating device 212 is genuine.

Joiner router 214 also adds that address as a relay point to the DTLS relay reception notification message. Joiner router 214 sends a DTLS relay reception notification message to border router 202. Upon receiving the DTLS relay reception notification message, the border router 202 forwards the DTLS relay reception notification message to the commissioning device 210 through the commissioning session (712).

Based on the joiner identification message received from the participating device 212, the commissioning device 210 uses the joiner identification message to initiate the DTLS-HelloVerify message based on PSKd. At 714, a DTLS-HelloVerify message and a DTLS relay transmission notification message (for example, RLY_TX.ntf) are sent to the border router 202. At 716, the border router 202 relays the DTLS-HelloVerify message and the DTLS relay transmission notification message to the joiner router 214. At 718, joiner router 214 sends a DTLS-HelloVerify message to participating device 212.

Alternatively, the commissioning device 210 may have information about a plurality of participating devices 212 to be commissioned. When the commissioning device 210 receives a DTLS-ClientHello message from a particular one of the multiple participating devices 212, it looks up the IEEE 64-bit extended unique identifier (EUI-64) address of the participating device 212 that sent the DTLS-ClientHello message. .. The commissioning device 210 looks for PSKd in the information about the plurality of participating devices 212 to be commissioned in order to continue the DTLS handshake for the particular participating device 212. The commissioning device 210 relays the combined DTLS-ServerHello, DTLS-ServerKeyEx, and DTLS-ServerHelloDone back to the participating device 212 via the joiner router 214. When this DTLS handshake is complete, the joiner session is complete.

Once the commissioning device 210 authenticates the participating device 212, the commissioning device 210 entrusts the participating device 212 with network credentials for the mesh network 100. For example, the commissioning device 210 requests a network credential from the border router 202 and transmits the network credential to the participating device 212 in a joiner consignment message through the joiner session transmitted by a DTLS relay transmission notification message through the commissioning session. Instead, the commissioning device 210 uses the key exchange key (KEK) as a shared secret between the commissioning device 210 and the participating device 212 to join the network credentials for the mesh network 100. Entrust to 212. The KEK is sent to the joiner router 214 for the participating device 212 and is used to encrypt the network credentials for transmission over a local-only wireless link.

Participating device provisioning If the participating device 212 joins the mesh network 100, the participating device 212 may also need provisioning. Provisioning involves updating the firmware on the participating device 212, configuring the participating device 212, providing local configurations related to other devices on the mesh network 100, and providing the participating device 212 to the user on the cloud service 208. It may include linking to an account, linking the participating device 212 to a cloud-based application server, and so on. Although still established, commissioner and joiner sessions are intended to provide a secure connection to provision the participating device 212 before the participating device 212 uses the network credentials to join the mesh network 100. used.

Participating device 212 sends a location indication about the commissioner application to be run by commissioning device 210 to provision participating device 212. The location display may be used to find the commissioner application in the memory of the commissioning device 210, or may be used by the commissioning device 210 to retrieve the commissioner application from the cloud service 208. The display may be in any suitable form, such as a uniform resource locator (URL). When the participating device 212 has been provisioned, the participating device 212 terminates the joiner session and the local-only wireless link. Participating device 212 uses network credentials to participate in mesh network 100.

Steering data wireless mesh networks may share radio spectra. Standards such as IEEE 802.15.4 specify multiple channels, which allow multiple networks to operate within the band of the radio spectrum. In addition, if the mesh network 100 has a lot of devices to commission, many participating devices will use the steering data in the beacon to help the participating device 212 find the correct mesh network 100 to join. It is desirable to efficiently communicate multiple device identifiers for 212. A mesh network commissioning technique is described that securely joins multiple participating devices 212 to the correct mesh network 100 in an environment where multiple mesh networks share the same radio spectrum and / or basic industry standard networking protocol.

When the commissioning device 210 obtains the PSKd and EUI-64 MAC addresses for the desired participating device 212, the commissioning device 210 will signal the desired participating device 212 which mesh network 100 to join with steering data. To construct. Steering data is some way to distinguish the mesh network 100 from other 802.15.4-based networks, how to communicate with or without an active commissioner on the mesh network 100, and which participating device 212 is currently It will include a way to determine if you are allowed to join the mesh network 100.

Steering data is obtained by the commissioning device 210 and indicates the device identifier of one or more participating devices 212 that are allowed to participate in the mesh network 100. The commissioning device 210 propagates the steering data to the router 102 in the mesh network 100. Router 102 then includes the steering data in the beacon for the mesh network 100 and transmits the beacon to provide the steering data to the potential participating device 212. The beacon is transmitted with an indication that the mesh network 100 is available and that potential participating devices 212 are allowed to join the mesh network 100. For example, the commissioning device 210 obtains the PSKd and EUI-64 MAC addresses for the desired participating device 212, as described above. From this EUI-64, the commissioning device 210 builds steering data to signal the desired participating device 212 that the desired participating device 212 is allowed to join the mesh network 100.

In a further example, the steering data may include a list of 16-bit cyclic redundancy check (CRC16) coded EUI-64 addresses of participating devices 212 that are allowed to participate in the mesh network 100. CRC16 provides a compact representation of EUI-64 addresses with a low likelihood of collisions between two different EUI-64 addresses at CRC16 coded addresses. The use of CRC16 reduces the size of the beacon payload required for the device identifier of the participating device 212 so that the appropriate participating device 212 can participate in the correct mesh network while efficiently using the resources of the mesh network 100. Allows you to find 100 efficiently.

If more than one mesh network 100 has an active commissioner, the participating device 212 searches for the correct mesh network 100 by collecting beacons from the active scan. Participating device 212 has collected beacons from non-mesh networks, beacons with the wrong protocol, beacons with the wrong version, beacons with the wrong XPANID, beacons with the wrong network name, and / or invalid participation. Truncate the beacon that has the beacon. Participating device 212 prioritizes the collected beacon that perfectly matches the device identifier of participating device 212 in the steering data of the collected beacon, and then prioritizes the matched collected beacon in the order of best signal strength. Until the participating device 212 successfully joins the mesh network 100, the participating device 212 attempts to join the preferred network one at a time (as described above). If the participating device runs out of the network priority list without successfully joining the mesh network 100, the participating device 212 is active immediately or after a delay period to start the search for the mesh network 100 again. You may scan.

The steering data guides which participating device 212 may or may not attempt to join the mesh network 100. In addition, all bits in the steering data may be set to a value of 0 to indicate that mesh network 100 is not available for participation. Alternatively, all bits in the steering data may be set to a value of 1 to indicate that the mesh network 100 is available for participation by any participating device 212.

Some commissioning devices 210 may lack the resources to extract the EUI-64 and participating device credentials by easily scanning the QR code. In this case, the least significant 24 bits of EUI-64 are used as the device identifier for the participating device 212 when obtaining the steering data. The S bit in the beacon indicates whether a short or long device identifier for the participating device 212 is used to obtain steering data. If EUI-64 is used as the device identifier for obtaining steering data, the S bit is set to a value of 0. If the least significant 24 bits of EUI-64 are used as the device identifier for obtaining steering data, the S bit is set to a value of 1.

FIG. 8 shows example 800 of steering data generated using a Bloom filter, which is used to encode the device identifier for the participating device 212 into steering data. Bloom filters provide efficient coding of device identifiers with a low probability of collisions between the coded values of different device identifiers. Each device identifier 802 to be included in the steering data is encoded by the first hash function 804 to generate the first hash value and by the second hash function 806 to generate the second hash value. To be converted. For example, the first hash function 804 is CRC16-CCITT and the second hash function 806 is CRC16-ANSI. Device identifier 802 is EUI-64 of participating device 212. Instead, the least significant 24 bits of EUI-64 are used as the device identifier 802.

Modulo operation 808 is performed on the first hash value and the second hash value. The divisor for modulo arithmetic is the length of the Bloom filter bit array 810 (bit positions in the bit array 810 are indicated by 812 and bit values are indicated by 814). Before finding the steering data, each bit in the bit array is initialized to a value of 0. The result of each modulo operation is the position in the bit array. The values at the two solicited positions in the bit array are set to a value of 1, and the two solicited bitfields provide a mapping to the device identifier.

For example, for the virtual device identifier 802, performing the modulo operation 808 on the result of the first hash function 804 yields a value of 3 for the device identifier 802. Performing the modulo operation 808 on the result of the second hash function 806 yields a value of 6 for the device identifier 802. The values at bit positions 3 and 6 are set to a value of 1 to indicate the bloom filtered value of the virtual device identifier 802.

Participating device 212 also calculates the Bloom filter bit position representing the device identifier of participating device 212. Participating device 212 determines whether both calculated bit positions contain a value of 1 in the steering data in the collected beacon. A positive judgment indicates to the participating device 212 that the participating device 212 is allowed to participate in the mesh network 100. All bit values in the Bloom filter bit array may be set to a value of 1 to indicate that any participating device 212 is allowed to join the mesh network 100. Setting all bits in the Bloom filter bit array to a value of 0 indicates that there is no active commissioner for mesh network 100 and that mesh network 100 is not available for participation. Bloom filters are appropriate participating devices with a low probability of false positives indicating that a particular participating device is allowed to join the mesh network 100 if it is not allowed to join the mesh network 100. It provides a compact representation with anonymity for device identifiers, while allowing the 212 to efficiently find the correct mesh network 100 to join.

The parameters for the Bloom filter are the number k of hash functions used to hash the device identifier, the number of bits m in the Bloom filter bit array, and the number n of participating devices 212 represented in the steering data. As an example, but not a limitation, the parameter k is set to 2 to show that two hash functions are used, CRC16-CCITT with polynomial 0x1021 and CRC16-ANSI with polynomial 0x8005. Other possible values are k, hash functions, and polynomials.

The collision probability p for the Bloom filter can be calculated as follows.

<maths num="2"><img file="JP6759405B2_D0002.tif" /></maths>

The commissioning device 212 may optionally set the bit array length m to obtain a reasonably low collision probability in the steering data. The use of Bloom filters allows steering data to scale to support the participation of a large number of participating devices 212 into the mesh network 100 while maintaining a low collision probability. The table below shows the various values of n and the collision probability p for m = 127 (ie 16 bytes).

<tables num="1"><img file="JP6759405B2_D0003.tif" /></tables>

In order to involve a large number of participating devices 212 (eg 1000), the commissioning device 210 moves the larger pair to the smaller pair so that each smaller pair has a lower collision probability (misjudgment) in the steering data. May be disassembled.

Management of Commissioning Data Beyond the Mesh Network Partition Figure 9 shows the mesh network 100 in the event of a split or split of the mesh network 100. For example, one of routers 102 may fail, resulting in a split of mesh network 100 that prevents one partition or fragment of mesh network 100 from communicating with another. On the other hand, radio interference may block communication in a part of the mesh network 100, resulting in a split of the mesh network 100. If the mesh network 100 splits into two network fragments 902 and 904, the network fragment 904 will choose the reader for the fragment 904. It may also accept a commissioner for fragment 904 that is different from the commissioner for fragment 902. Either or both of the fragments may update their network credentials during the split.

The mesh network 100 can be neatly and reliably divided into two different pieces, which are fully functional networks when the connectivity between the two compartments is broken. These compartments can continue any incomplete communication well contained within the uninterrupted compartment and can be continued with normal key rotation. Two mesh network partitions, formerly part of a single mesh network 100, can autonomously merge once the connectivity between the two partitions is restored.

If the commissioning credentials are changed in the network fragment 902 during the split, the changes in the commissioning credentials will be propagated to the devices in the network fragment 904 when connectivity is restored between the network fragments 902 and 904. .. In other words, in some embodiments, the commissioning credentials are updated with the most recently adopted credentials. However, if both network fragments 902 and 904 authorize separate commissioners and receive separate new commissioning credentials during the split, it may be more difficult to determine the most recent credentials.

The resolution of the commissioning credentials between any two mesh network fragments that were previously fragmented but are currently merged propagates the most recently modified commissioning dataset to the device in mesh network 100. If there is a change in fragment 902, the user considers that he is changing the commissioning credentials throughout the mesh network 100, but is effectively changing the credentials only in fragment 902 due to the split. At some time later, fragments 902 and 904 merge. After fragmentation, the credentials in fragment 902 were changed, but the original credentials in fragment 904 remained unchanged, so the merged fragments assume that new credentials were established in fragment 902 during fragmentation. .. If there are changes to the commissioning credentials in fragment 904 during the split, the changes made to fragment 904 will be propagated to the device in fragment 902 after the merger.

If two users change their commissioning credentials in their two fragments 902 and 904 during the split, each of the two users considers that they are changing their commissioning credentials throughout the mesh network 100. However, because the mesh network 100 is fragmented, both users can establish themselves as network commissioners and change their commissioning credentials in their respective network fragments. Fragments 902 and 904 will merge at some later point, but it may not be known which leader from the two fragments predominates as the leader for the merged mesh network. The predominant leader may not have a copy of the most recently modified commissioning credentials. Since the commissioning credentials have been modified independently in the two fragments, the fragment with the most recently updated commissioning credentials gains an advantage.

To determine which of the two network credentials is the most recent, the commissioning dataset contains the time stamp information and the commissioning credentials, and the differences between the commissioning credentials when the mesh networks merge. Solve. The time stamp information indicates that the node in mesh network 100 determines the most recent update to the commissioning credentials in any fragment and synchronizes the commissioning dataset in the device in mesh network 100 with the most recently updated commissioning credentials. to enable.

The time stamp information includes a time stamp and an indication as to whether the time stamp is traceable to Coordinated Universal Time (UTC) or relative time-based within the mesh network 100. For example, the commissioning device 210 has access to network time, such as using Network Time Protocol (NTP), access to time provided through a cellular network, and the Global Positioning System (GPS). For devices such as smartphones or computers that have timing information from the receiver etc., the time stamp is traceable to UTC. As an example, but not a limitation, if the timestamp is traceable to UTC, then the timestamp will be, for example, 2 since the start of UNIX® time.^-15Even known epochs, such as seconds, are expressed in traceable seconds. If the time stamp is UTC traceable time, the display, such as the U bit, is set to indicate that the time stamp is traceable to UTC.

If the commissioning device 210 is an embedded system, such as a unique commissioner, that does not have access to UTC traceable time, the time stamp contains a relative time value. The relative time value uses the previous value of the time stamp as provided by reader 216 and adds a clock tick increment to the previous time stamp to generate a time stamp for the updated commissioning dataset. Required by that. As an example, but not a limitation, a time tick may be a 15-bit representation of a time tick of less than 1 second derived from the 32kHz clock of the Proprietary Commissioner. If the time stamp is relative time, the display, such as the U bit, is set to a value of 0 to indicate that the time stamp is represented as relative time. Timestamp increments for relative time allow changes to the commissioning data to be detected. When parcels merge, if one of the commissioning timestamps is traceable to UTC and the second timestamp is relative time, the commissioning data with the UTC traceable timestamp is given higher priority. Will.

If the time stamps are the same between the commissioning credentials that were updated separately during the split, alternative means may be used to break the connection between the time stamps. In some embodiments, lexicographic comparison (eg, memcmp) may be performed to determine which credentials are more recent. In some embodiments, if there is a connection between the time stamps, the network fragment may be preferred so that changes to the commissioning credentials in one network fragment are adopted. For example, if network fragments 902 and 904 each receive a commissioning credential change that contains the same time stamp, the change in network fragment 902 is adopted if the time stamp values in the two pieces' commissioning datasets are the same. As such, the network fragment with the border router 202 may be considered as the highest priority fragment.

Illustrative methods 1000-1800 are described with reference to their respective FIGS. 10-18, according to one or more embodiments of mesh network commissioning. In general, any of the components, modules, methods, and behaviors described herein can be achieved using software, firmware, hardware (eg, fixed logic circuits), manual processing, or any combination thereof. obtain. Some operations of the exemplary method may be described and realized in the general context of executable instructions stored in computer-readable storage memory local to and / or remote to the computer processing system. Examples may include software applications, programs, functions, and the like. Alternatively or additionally, any of the functionality described herein is a Field-programmable Gate Array (FPGA), an application-specific integrated. Circuit: ASIC, Application-specific Standard Product (ASSP), System-on-a-chip system (SoC), Complex Programmable Logic Device: It can be done at least partially by one or more hardware logic components, including but not limited to CPLDs) and the like.

FIG. 10 shows an exemplary method 1000 of mesh network commissioning, such as for generally joining nodes to a mesh network. The order in which the method blocks are described is not intended to be construed as limiting, and any number of described method blocks may be combined in any order to achieve a method or alternative method. be able to.

At block 1002, a beacon request is received from the participating device, at block 1004, a beacon is sent from the joiner router to the participating device, and the beacon provides an indication that the mesh network is available for participation. For example, joiner router 214 in mesh network 100 receives a beacon request from participating device 212 and then sends a beacon to participating device, which provides an indication that mesh network 100 is available for participation. To do. The transmitted beacon is useful to allow the participating device 212 to establish a local link between the participating device and the joiner router.

At block 1006, a message is received from a participating device requesting to join the mesh network. For example, joiner router 214 in mesh network 100 receives a message from a participating device 212 requesting to join the mesh network. The message received from the participating device 212 may include an encrypted device identifier that can be used to authenticate the participating device. Participating devices are authenticated using password-authenticated key exchange (J-PAKE) by juggling, and authentication is effective in establishing a secure communication session between the commissioning device 210 of mesh network 100 and the participating devices. Is.

At block 1008, the received message is forwarded to the commissioning device on the mesh network. For example, joiner router 214 forwards received messages from participating device 212 to commissioning device 210 on mesh network 100. In the implementation example, the message can be received and forwarded using Datagram Transport Layer Security (DTLS) or User Datagram Protocol (UDP). In addition, the joiner router 214, which forwards the received message to the commissioning device 210, sends the received message through one or more routers of the mesh network 100 in the communication path between the joiner router 214 and the commissioning device 210. May include transferring. In the implementation example, one of the routers may be a border router 202 that connects the mesh network 100 to an external network, and the commissioning device is attached to the external network.

At block 1010, authentication is received for the participating device to join the mesh network, at block 1012 network information is sent to the participating device, and the network information allows the participating device to join the mesh network 100. It is effective for. For example, the joiner router 214 receives authentication from the commissioning device 210 for the participating device 212 to join the mesh network 100, the joiner router 214 sends network information to the participating devices, and the network information is the participating device 212. Is useful to allow you to join the mesh network.

FIG. 11 shows an exemplary method 1100 of mesh network commissioning, such as for generally joining nodes to a mesh network. The order in which the method blocks are described is not intended to be construed as limiting, and any number of described method blocks may be combined in any order to achieve a method or alternative method. be able to.

At block 1102, a beacon request is received from the participating device, at block 1104, a beacon is sent from the joiner router to the participating device, and the beacon provides an indication that the mesh network is available for participation. For example, joiner router 214 in mesh network 100 receives a beacon request from participating device 212 and then sends a beacon to participating device, which provides an indication that mesh network 100 is available for participation. To do. The beacon contains the network name of the mesh network 100 and steering data indicating one or more participating devices 212 that are allowed to join the mesh network. The transmitted beacon is useful to allow the participating device to establish a local link between the participating device and the joiner router.

At block 1106, a DTLS-ClientHello message is received from a participating device requesting to join the mesh network, and at block 1108, the received DTLS-ClientHello message is encapsulated within a DTLS relay reception notification message. For example, the joiner router receives a DTLS-ClientHello message from a participating device 212 requesting to join the mesh network 100 and encapsulates the received DTLS-ClientHello message in a DTLS relay reception notification message. The DTLS-ClientHello message can be received from the participating device 212 using the User Datagram Protocol (UDP), and the DTLS relay reception notification message is received with the address of the participating device 212 and the address of the joiner router 214. Includes DTLS-ClientHello message.

At block 1110, the DTLS relay reception notification message is sent to the mesh network commissioning device. For example, the joiner router sends a DTLS relay reception notification message to the commissioning device 210 of the mesh network 100. In the implementation example, the joiner router may apply a speed limit to the transmission of the DTLS relay reception notification message sent from the participating device to the commissioning device 210.

At block 1112, the commissioning device receives the DTLS relay transmission notification message, and at block 1114, the content of the DTLS relay transmission notification message is transmitted to the participating device, which allows the participating device to join the mesh network. To do. For example, the joiner router receives a DTLS relay transmission notification message from the commissioning device 210 and sends the content of the DTLS relay transmission notification message to the participating device 212, which allows the participating device to join the mesh network 100. The content is useful for establishing a secure communication session between the commissioning device 210 and the participating devices. The DTLS relay transmission notification message includes the address of the participating device 212, the address of the joiner router 214, and the DTLS-HelloVerify message.

At block 1116, the commissioning device receives an indication that the participating device should be entrusted with receiving network credentials for the mesh network, and at block 1118, the key shared between the commissioning device and the participating device. The encryption key (KEK) is received. For example, the joiner router 214 receives an indication from the commissioning device 210 that the participating device 212 should be entrusted with receiving network credentials for the mesh network 100, and between the commissioning device 210 and the participating device. Receive the key encryption key (KEK) shared by.

At block 1120, the network credentials are sent to the participating devices using the KEK to secure the communication of the network credentials. For example, the joiner router uses the KEK to secure the communication of the network credentials to send the network credentials containing the network master key to the participating device 212, and the secure communication session to provision the participating devices. Can be used for.

FIG. 12 shows an exemplary method 1200 of mesh network commissioning, generally relating to establishing a commissioning session in a mesh network. The order in which the method blocks are described is not intended to be construed as limiting, and any number of described method blocks may be combined in any order to achieve a method or alternative method. be able to.

At block 1202, the availability of the mesh network for the commissioning device is advertised, and at block 1204, an application to become a commissioner for the mesh network is received from the commissioning device. For example, the border router 202 of the mesh network 100 advertises the availability of the mesh network for the commissioning device and receives an application from the commissioning device 210 to become a commissioner for the mesh network. The application may be received from the commissioning device 210 in response to advertising the availability of the mesh network. The commissioning device 210 can also require a secure connection to the border router 202, and a secure connection is established using Datagram Transport Layer Security (DTLS). In addition, the commissioning device 210 and the border router 202 can communicate through networks other than mesh networks, such as Wi-Fi networks or Ethernet® networks.

At block 1206, the received application is sent to the mesh network leader device, at block 1208, a response to the application is received from the reader device, and the response indicates acceptance or rejection of the application. For example, the border router 202 sends the received application from the commissioning device 210 to the reader device 216 of the mesh network 100, then receives the response to the application from the reader device 216, and the response accepts or rejects the application. indicate. Advertising can be done using the service discovery protocol, which is a Multicast Domain Name System (mDNS).

At block 1210, an indication of acceptance or rejection of the application is sent to the commissioning device. For example, the border router 202 sends an acceptance or rejection indication of the application to the commissioning device 210, and acceptance of the application by the reader device 216 authorizes the commissioning device 210 to become a commissioner for the mesh network. Acceptance of the application establishes a secure commissioning session, and acceptance of the application truly updates the internal state of the reader device 216 to track the active commissioner for the mesh network and sets the allow participation flag for the mesh network. Allows you to configure and propagate commissioning datasets within your mesh network.

At block 1212, the identity of the commissioning device is registered with the border router to establish a secure commissioning communication session. For example, the border router 202 registers the identity of the commissioning device 210 with the border router 202 in order to establish a secure commissioning communication session. Registering the identity of the commissioning device 210 involves providing an encrypted commissioning credential to the border router 202, and the encrypted commissioning credential is derived from the commissioning credential entered into the commissioning device 210 by the user. It is a router. The border router 202 includes a copy of the encrypted commissioning credentials that can be used to authenticate the commissioning device 210 to the mesh network 100, and the copy of the encrypted commissioning credentials was previously derived from the commissioning credentials. The commissioning credentials were injected into the reader device 216 of the mesh network 100 from which the copy of the encrypted commissioning credentials was derived, which securely communicated the encrypted copy of the commissioning credentials to the border router.

FIG. 13 shows an exemplary method 1300 of mesh network commissioning, generally relating to establishing a commissioning session in a mesh network. The order in which the method blocks are described is not intended to be construed as limiting, and any number of described method blocks may be combined in any order to achieve a method or alternative method. be able to.

At block 1302, an application is received to accept the commissioning device as a commissioner for commissioning the participating device to join the mesh network. For example, the leader device 216 of the mesh network 100 receives an application to accept the commissioning device 210 as a commissioner to commission the participating device 212 to join the mesh network. The application is received from the border router 202 connected to the reader device 216 through a mesh network, and the commissioning device 210 is connected to the border router 202 through another network such as a Wi-Fi network or an Ethernet® network. The application is also received using a secure communication session between the border router 202 and the commissioning device 210, and the secure communication session is established using Datagram Transport Layer Security (DTLS). The reader device 216 can receive an application through the mesh network 100 from a commissioning device 210 that includes a network interface for the mesh network so that the commissioning device 210 becomes a commissioner by truly setting the unique commissioner bit in the network beacon. Apply. The commissioning device 210 can use the IEEE802.15.4 interface to communicate the application to the reader device through the Constrained Application Protocol (CoAP) port.

At block 1304, a decision is made as to whether to accept or reject the received application, and at block 1306, a response is sent to the commissioning device with an indication as to whether to accept or reject the received application. For example, the reader device 216 determines whether to accept or reject the received application and then sends a response to the commissioning device 210 with an indication as to whether to accept or reject the received application. Reader device 216 determines whether to accept or reject received applications based on ensuring that there is one active commissioner for mesh network 100.

At block 1308, the internal state of tracking the active commissioner for the mesh network is updated in response to the decision to accept the received application. For example, reader device 216 updates its internal state of tracking active commissioners for mesh networks.

At block 1310, the commissioning device receives a command to start the join mode for the mesh network, and at block 1312, the commissioning dataset is propagated within the mesh network. For example, the reader device 216 receives a command from the commissioning device 210 to initiate a join mode for the mesh network 100 and propagates the commissioning dataset within the mesh network. The commissioning dataset contains a commissioner session identifier, a commissioner timestamp, an encrypted commissioner credentials, and a security policy that indicates which security-related actions are allowed in the mesh network. If the commissioner is active on the mesh network 100, the commissioning dataset further includes the location of border router 202. When join mode is enabled in the mesh network, the commissioning dataset also includes steering data indicating which of the participating devices 212 are allowed to join the mesh network.

At block 1314, the encrypted commissioning credentials are derived from the commissioning credentials injected into the reader device 216 during the commissioning of the reader device. For example, reader device 216 derives encrypted commissioning credentials from the commissioning credentials injected into the reader device during reader device commissioning. Derivation of encrypted commissioning credentials is done by applying a key derivation function, which uses Cipher-based Message Authentication Code (CMAC) to hash multiple times. Do it. In the realization example, the commissioning credential is a human-scale passphrase, and the derivation of the encrypted commissioning credential is effective in extending the length of the commissioning credential.

At block 1316, a copy of the encrypted commissioning credentials is sent to the border router, allowing the border router to authenticate the commissioning device to the mesh network. For example, reader device 216 sends a copy of the encrypted commissioning credentials to border router 202, allowing border router 202 to authenticate commissioning device 210 to the mesh network.

FIG. 14 shows an exemplary method 1400 of mesh network commissioning, generally relating to managing multiple commissioning sessions in a mesh network. The order in which the method blocks are described is not intended to be construed as limiting, and any number of described method blocks may be combined in any order to achieve a method or alternative method. be able to.

At block 1402, a secure commissioning communication session is established between the commissioning device of the mesh network and the border router. For example, the commissioning device 210 securely commissions between the commissioning device of the mesh network 100 and the border router 202 to securely establish a network communication session to join one or more participating devices 212 to the mesh network. Establish a communication session. Commissioning device 210 active U-mesh network to request the acceptance of commissioning device 210 as Misshona, by sending a request by commissioning device to the reader device 216 of the mesh network 100, the secure commissioning communication session Once established, the commissioning device receives an indication of acceptance of the application from the reader device.

At block 1404, join for the mesh network is invoked. For example, a commissioning device invokes join for a mesh network by initiating a join mode that causes one or more routers in the mesh network to advertise that the mesh network is accepting join requests. The commissioning device 210 can also invoke join for mesh network 100 by sending a management message to leader device 216 to enable the mesh network to join, and the management message is for leader device 216 to join the mesh network. Allows you to update network data. The network data is propagated to one or more router devices in the mesh network, and the network data includes an indication that the mesh network 100 is available for participation. Network data can be broadcast by router devices via beacons, management messages include steering data indicating one or more participating devices 212, and commissioning device 210 joins one or more participating devices 212 to the mesh network. It is configured to let you.

At block 1406, one of the participating devices receives a request to join the mesh network. For example, the commissioning device 210 may receive a request from one of the participating devices 212 to join the mesh network 100, and the request may be received via the joiner router. The commissioning device 210 should be entrusted with the participating device 212 to receive the network credentials for the mesh network 100 and the key encryption key (KEK) shared between the commissioning device 210 and the participating device. Can be sent to the joiner router 214. The display sent to the joiner router 214 allows the joiner router to securely send the network credentials to the participating device 212 using the received KEK and commission the participating device to the mesh network. The request received from the participating device 212 can include the encrypted device identifier of the participating device, which uses password-authenticated key exchange (J-PAKE) by juggling. It is derived from the device identifier of the participating device.

At block 1408, a secure joiner communication session is established between the commissioning device and the participating device. For example, the commissioning device 210 establishes a secure joiner communication session between the commissioning device and the participating device 212. The commissioning device 210 is a copy of the device identifier received as input from the user to the commissioning device, from which the encrypted device identifier received from the participating device 212 is the encrypted device identifier derived by the commissioning device 210. A secure joiner communication session can be established by determining that it is consistent, and the commissioning device 210 uses the encrypted device identifier as a shared secret to secure the joiner communication session.

At block 1410, the participating device is authenticated using the encrypted device identifier, and at block 1412, the participating device joins the mesh network. For example, the commissioning device 210 uses an encrypted device identifier to authenticate the participating device 212 and join the participating device 212 to the mesh network.

FIG. 15 shows an exemplary method 1500 of mesh network commissioning, such as for provisioning participating devices in a mesh network in general. The order in which the method blocks are described is not intended to be construed as limiting, and any number of described method blocks may be combined in any order to achieve a method or alternative method. be able to.

At block 1502, a commissioning communication session is established between the commissioning device of the mesh network and the border router. For example, the commissioning device 210 of the mesh network 100 establishes a commissioning communication session between the commissioning device 210 of the mesh network and the border router 202. At block 1504, a joiner communication session is established between the participating device and the commissioning device. For example, the commissioning device 210 of the mesh network 100 establishes a joiner communication session between the participating device 212 and the commissioning device.

At block 1506, commissioning information is sent to the participating devices and the commissioning information is available to the participating devices to join the mesh network. For example, the commissioning device 210 of the mesh network 100 transmits commissioning information available to the participating device 212 to join the mesh network.

At block 1508, the participating device receives a display of the position of the commissioner application, and at 1510, the received display is used to search for the commissioner application. For example, the commissioning device 210 may receive a position display of the commissioner application from a participating device, the received position display may be a uniform resource locator (URL), and the commissioning application may transfer the commissioner application from a cloud service over the Internet. Search for. The commissioning device 210 can also use the received URL to determine if the commissioner application is stored in the commissioning device's memory.

At block 1512, the commissioner application runs to provision the participating devices. For example, the commissioning device 210 utilizes a commissioner application to provision participating devices. Provisioning of Participating Device 212 includes updating software on Participating Device, linking Participating Device to a user account on a cloud service, and / or configuring Participating Device, and the configuration is other in the mesh network. The local configuration associated with the device. At block 1514, commissioning of the participating devices ends, allowing the participating devices to join the mesh network. For example, the commissioning device 210 of the mesh network 100 terminates commissioning and allows the participating device 212 to join the mesh network.

FIG. 16 shows an exemplary method 1600 of mesh network commissioning, such as for searching and steering in a mesh network in general. The order in which the method blocks are described is not intended to be construed as limiting, and any number of described method blocks may be combined in any order to achieve a method or alternative method. be able to.

At block 1602, steering data for the mesh network is sought, and the steering data includes a display of device identifiers associated with devices that are allowed to join the mesh network. For example, the commissioning device 210 of the mesh network 100 seeks steering data for the mesh network, which includes displaying the device identifier associated with the device authorized to join the mesh network. In the implementation example, the steering data is a 16-bit cyclic redundancy check (CRC16) of the device identifier, which is an IEEE 64-bit extended unique identifier (EUI-64). The commissioning device 210 may also obtain steering data for the mesh network 100 by seeking steering data for additional device identifiers associated with additional devices that are allowed to participate in the mesh network.

At block 1604, steering data is propagated from the commissioning device for the mesh network to the routers in the mesh network. For example, the commissioning device 210 of the mesh network 100 propagates the steering data to the routers in the mesh network, and the steering data indicates that the commissioner is active on the mesh network. Propagating the steering data allows the router 102 to send the steering data in a beacon message, which states that the device associated with the device identifier is allowed to join the mesh network. It is effective to make it possible to identify. Propagation of steering data by the commissioning device 210 is useful to allow the device to distinguish between mesh networks and other networks, the other network being an IEEE 802.15.4 network.

FIG. 17 shows an exemplary method 1700 of mesh network commissioning, such as for searching and steering in a mesh network in general. The order in which the method blocks are described is not intended to be construed as limiting, and any number of described method blocks may be combined in any order to achieve a method or alternative method. be able to.

At block 1702, steering data for the mesh network is sought, and the steering data includes a display of device identifiers associated with devices that are allowed to join the mesh network, the display representing a device identifier, a Bloom filter. It is expressed as a set of values in. For example, the commissioning device 210 of the mesh network 100 seeks steering data for the mesh network, which includes a display represented as a set of values in a Bloom filter representing the device identifier. In the implementation example, the commissioning device 210 applies the first hash function to the device identifier to generate the first hash value and the second hash function to generate the second hash value. Steering data is obtained by applying to. The device identifier may be an IEEE 64-bit extended unique identifier (EUI-64), and the device identifier is the least significant 24 bits of EUI-64. In the implementation example, the first and second hash functions are Cyclic Redundancy Checks (CRC), the first hash function is CRC16-CCITT, and the second hash function is CRC16-ANSI.

The commissioning device 210 then performs a modulo operation on the first hash value to determine the first bitfield position in the Bloom filter and a second bitfield position in the Bloom filter. Performs a modulo operation on the hash value of. The divisor for modulo arithmetic can be the length of the Bloom filter bit array. The commissioning device 210 can set the value at the first bit field position of the Bloom filter to 1 and the value at the second bit field position of the Bloom filter to 1. The commissioning device 210 can set all of the bitfield values in the steering data to a value of 1 to indicate that the mesh network can participate for any device. Alternatively, the commissioning device 210 can set the bitfield value of the steering data to a value of 0 that disables participation for the mesh network.

At block 1704, steering data is propagated from the commissioning device for the mesh network to the routers in the mesh network. For example, the commissioning device 210 of the mesh network 100 propagates the steering data to the routers in the mesh network, and the steering data indicates that the commissioner is active on the mesh network. Propagating the steering data allowed the router 102 to transmit the steering data in a beacon message, which was determined by the device associated with the device identifier as a set of values in the Bloom filter. Compared to the second set of values, it allows the device to be identified as being allowed to join the mesh network.

FIG. 18 shows an exemplary method 1800 of mesh network commissioning, such as for partitioning nodes in a mesh network in general. The order in which the method blocks are described is not intended to be construed as limiting, and any number of described method blocks may be combined in any order to achieve a method or alternative method. be able to.

At block 1802, the commissioning dataset is received at the node device in the mesh network. For example, a node device (for example, router 102 or end device 106) on a node in mesh network 100 can have received time stamps, commissioning credentials, the network name of the mesh network, and which security-related actions are allowed in the mesh network. Receive a commissioning dataset that includes a security policy that indicates if it has been done. The time stamp received includes a time value and an indication that the time value is traceable to Coordinated Universal Time (UTC).

At block 1804, the received timestamp contained in the received commissioning dataset is compared to the stored timestamp contained in the commissioning dataset stored on the node device. For example, a node device in mesh network 100 compares a received time stamp contained in a received commissioning data set with a stored time stamp contained in a commissioning data set stored in the node device. In the implementation example, the node device and reader device were previously commissioned to the mesh network, and the previous commissioning stored the same commissioning dataset on the node and reader devices. The stored commissioning dataset in the node device can be updated after the mesh network splits to stop communication between the node device and the reader device on the mesh network. The split separates the mesh network, the first partition of the mesh network contains the leader device, and the second partition of the mesh network contains the node devices. The node device can receive the commissioning dataset after the merger of the first and second partitions of the mesh network, and the merger reestablishes the communication path between the node device and the reader device on the mesh network.

At block 1806, a decision is made as to whether the stored timestamp contained in the commissioning dataset stored on the node device is more recent than the time stamp contained in the received commissioning dataset. .. For example, based on a comparison (in block 1806), a node device has a stored timestamp contained in the commissioning dataset stored in the node device that is more recent than the time stamp contained in the received commissioning dataset. Determine if it is.

If the stored timestamp is more recent than the received timestamp (ie, "yes" in 1806), then in 1808 a message is sent to the leader device in the mesh network, and the message is the stored commissioning data. Includes set. For example, a node device in a mesh network sends a message containing a stored commissioning dataset to a leader device in the mesh network 100. The transmitted message allows the reader device to accept the stored commissioning dataset as the most recent commissioning dataset for the mesh network and propagate the stored commissioning dataset to the mesh network. Instead, if the received timestamp is more recent than the stored timestamp (ie, "no" in 1806), then at 1810, the stored commissioning dataset is the received commissioning. Updated to be consistent with the dataset. For example, a node device in a mesh network updates a stored commissioning dataset to match the received commissioning dataset.

FIG. 19 shows a mesh network 100 (as described with reference to FIG. 1), and an exemplary environment 1900 in which an embodiment of mesh network commissioning can be realized. Generally, the environment 1900 includes a mesh network 100 implemented as part of a smart home or other type of structure with any number of mesh network devices configured for communication in the mesh network. For example, mesh network devices include a thermostat 1902, a hazard detector 1904 (for example for smoke and / or carbon monoxide), a camera 1906 (for example indoors and outdoors), and a lighting unit 1908 (for example indoors and outdoors). And any other type of mesh network device 1910 implemented inside and / or outside of structure 1912 (eg, in a smart home environment). In this example, the mesh network device is also one of the devices implemented as router 102, end device 106, and / or participating device 212, as well as commissioning device 210, border router 202, joiner router 214, and so on. It may include any of the devices described above.

In Environment 1900, any number of mesh network devices can be implemented for wireless interconnection to communicate and interact wirelessly with each other. Mesh network devices are modular and intelligent multis that can seamlessly integrate with each other and / or with central servers or cloud computing systems to provide any of a variety of useful smart home objectives and implementations. It is a sensing network connection type device. An example of a mesh network device that can be implemented as any of the devices described herein is shown and described with reference to FIG.

In the implementation example, the thermostat 1902 may include a Nest® learning thermostat that detects ambient climatic characteristics (eg, temperature and / or humidity) in a smart home environment and controls the HVAC system. Learning Thermostat 1902 and other smart devices "learn" by incorporating resident settings into the device. For example, a thermostat learns preferred temperature setting points for morning and night, when a resident of a structure is sleeping or awake, and when a resident is usually out or at home.

Hazard detector 1904 can be implemented to detect the presence of harmful substances or substances that indicate harmful substances (eg smoke, fire or carbon monoxide). In the wireless interconnect example, the hazard detector 1904 may detect the presence of fire-indicating smoke in the structure, in which case the hazard detector that first detects the smoke will be on all connected mesh network devices. A low-power wake-up signal can be transmitted all at once. The other hazard detector 1904 can then receive the broadcast wake-up signal, activate a high power state for hazard detection, and receive the radio communication of the warning message. The lighting unit 1908 can also receive the broadcast wake-up signal and start in the area of the detected hazard to illuminate and identify the problem area. In another example, the lighting unit 1908 is activated with a single lighting color to indicate a problem area or area in the structure, such as a detected fire or intrusion, and an evacuation route from a safe area and / or structure. May be activated with a different illumination color to indicate.

In various configurations, the mesh network device 1910 works in concert with a networked door lock system to detect and react to a person's approach or departure from a location such as the outer door of structure 1912. Can include devices. The front door interface device can interact with other mesh network devices based on whether someone has approached or entered the smart home environment. The front door interface device can control doorbell functionality, signal the approach or departure of a person via voice or visual means, and to activate or stop the security system when a resident enters or exits. In addition, you can control the settings for the security system. The mesh network device 1910 also detects ambient lighting conditions, detects room occupancy (eg with occupancy sensors), controls the output and / or dim conditions of one or more lights, and so on. Sensors and detectors may be included. In some cases, the sensor and / or detector may also control the output state or speed of a fan, such as a ceiling fan. Sensors and / or detectors may also detect residence in a room or enclosed space and control the supply of power to an outlet or device, such as when the room or structure is unoccupied.

The mesh network device 1910 also includes connected equipment and / or controlled systems such as refrigerators, stoves and ovens, washing machines, dryers, air conditioners, pool heaters, irrigation systems, security systems, as well as televisions, entertainment systems, etc. Other electronic and computing devices such as computers, interphone systems, garage door openers, ceiling fans, control panels, etc. may be included. When plugged in, the device, device or system can inform the mesh network itself as described above and can be automatically integrated with mesh network controls and devices such as in smart homes. Note that the mesh network device 1910 may include devices that are physically located within the wireless communication range but outside the structure, such as a swimming pool heater or a device that controls an irrigation system.

As mentioned above, the mesh network 100 includes a border router 202 that interfaces for communication with an external network outside the mesh network 100. The border router 202 connects to the access point 204, which connects to a communication network 206 such as the Internet. Cloud service 208, connected via communication network 206, provides services associated with and / or using devices within mesh network 100. As an example, cloud service 208 connects end-user devices such as smartphones and tablets to devices in the mesh network, processes the data obtained in the mesh network 100 and presents it to the end user, and one or more mesh networks 100. Can include applications for linking devices in cloud service 208 to user accounts, provisioning and updating devices in mesh network 100, and so on. For example, a user can control a thermostat 1902 and other mesh network devices in a smart home environment using a network-connected computer or portable device such as a mobile phone or tablet device. The mesh network device can also communicate information to any central server or cloud computing system via the border router 202 and access point 204. Data communications use any of a variety of custom or standard wireless protocols (eg Wi-Fi, low power ZigBee®, 6LoWPAN, etc.) and / or a variety of customs. Alternatively, it can be performed by using one of the standard wired protocols (CAT6 Ethernet®, HomePlug®, etc.).

Any of the mesh network devices in the mesh network 100 can function as a low power and communication node for creating the mesh network 100 in a smart home environment. Individual low-power nodes in the network can periodically send out messages about what they are sensing, and other low-power nodes in the environment send messages in addition to sending their own messages. It can be repeated, thereby communicating messages from node to node (ie, device to device) throughout the mesh network. A mesh network device utilizes a low-power communication protocol to receive a message, translate the message into another communication protocol, and send the translated message to other nodes and / or a central server or cloud computing system. It can be realized to save power, especially when it is battery operated. For example, a resident and / or ambient light sensor not only measures ambient light, but also detects occupants in a room, if the ambient light sensor detects that the room is dark, and if someone is in the room. The light source can be activated when the sensor detects it. The sensor is also a low-power wireless communication chip that periodically sends out messages about the occupancy of the room and the amount of light in the room, including a momentary message that occurs when the occupancy sensor detects the presence of a person in the room. For example, Zigbee chips) can be included. As mentioned above, these messages are sent wirelessly from node to node (ie, device to device) and over the Internet to a central server or cloud computing system in a smart home environment using a mesh network. May be done.

In other configurations, various of the mesh network devices can act as "device lines" for alarm systems in smart home environments. For example, if the criminal evades detection by alarm sensors located at windows, doors, and other entry points in the structure or environment, alarms will still reside from one or more of the low power mesh nodes in the mesh network. Can be triggered by receiving messages such as, movement, heat, sound. In another realization example, a mesh network can be used to automatically turn on and off the lighting unit 1908 as a person moves from room to room in the structure. For example, a mesh network device can detect the movement of a person through a structure and communicate the corresponding message through a node in the mesh network. Other mesh network devices that receive the message can use the message to indicate which room is resident and start and / or stop accordingly. As mentioned above, mesh networks can also be utilized to provide exit lighting in emergencies, such as by lighting the appropriate lighting unit 1908 leading to a safe exit. The lighting unit 1908 may also be lit to indicate the direction along the exit path that a person should travel to safely exit the structure.

Various mesh network devices also communicate in an integrated manner with wearable computing devices that can be used to identify and locate occupants of the structure, adjusting temperature, lighting, acoustic systems, etc. accordingly. It may be realized as follows. Other realization examples include RFID sensing (eg, a person wearing an RFID bracelet, necklace or keyhob), synthetic vision techniques (eg, video cameras and facial recognition processors), voice techniques (eg, voice, acoustic patterns, etc.). Vibration pattern recognition), ultrasonic sensing / imaging techniques, and infrared or near-field communication (NFC) techniques (for example, a person wearing an infrared or NFC-enabled smartphone) are rule-based. Along with inference engines or artificial intelligence techniques, useful conclusions are drawn from the perceived information about the position of the resident in the structure or environment.

In other realization examples, the service robot's personal comfort area network, personal health area network, personal safety area network, and / or other such person-facing functionality achieves better performance of these functionality. It can be enhanced by logical integration with other mesh network devices and sensors in the environment, following rule-based inference or artificial intelligence techniques to do so. In the example related to the personal health area, the system is resident with pets kept at home (using either mesh network devices and sensors, for example), along with rule-based inference and artificial intelligence techniques. It is possible to detect whether or not it is moving toward the current position of. Similarly, hazard detector service robots are informed that temperature and humidity levels are rising in the kitchen, and any small increase in ambient smoke levels is probably due to cooking operations and due to truly dangerous conditions. Hazard detection thresholds, such as smoke detection thresholds, can be temporarily increased under the inference that they will not. Any service robot configured for any type of monitoring, detection, and / or servicing can be realized as a mesh node device on a mesh network according to a wireless interconnect protocol for communicating on the mesh network. Is.

The mesh network device 1910 may also include a smart alarm clock for each individual resident of the structure in a smart home environment. For example, the resident can customize and set the alarm device for wake-up time, such as the next day or the next week. Artificial intelligence can be used to examine the resident's response to an alarm when the alarm sounds and to infer over time a preferred sleep pattern. An individual resident can then be tracked in a mesh network based on that person's unique signature. Unique signatures are sought based on data obtained from sensors located on mesh network devices, such as sensors including ultrasonic sensors, passive IR sensors, and the like. The resident's unique signature can be based on a combination of patterns such as movement, voice, height, size, etc., and face recognition techniques can also be used.

In the example of wireless interconnection, an individual's wake-up time can be associated with thermostat 1902 to efficiently control the HVAC system to preheat or cool the structure to the desired sleep and wake-up temperature settings. Preferred settings can be learned over time, such as by incorporating the temperature set in the thermostat before a person goes to bed and when waking up. The data collected may also include biometric indications of the person, such as respiratory patterns, heart rate, movements, from which inferences are made between this data and data indicating when the person actually woke up. It is done based on the combination. Other mesh network devices have this to provide other smart home purposes, such as adjusting the thermostat 1902 to preheat or cool the environment to the desired settings, and turning the lights 1908 on and off. Data can be used.

In implementation examples, mesh network devices also detect running water in smart home environments and make inferences about water use based on water use and consumption algorithms and mappings, for example, acoustics, vibrations, and / Or can be used for motion sensing. It can be used to determine the signature or fingerprint of each water source in the home and is also referred to as "voice fingerprinting water use". Similarly, mesh networking devices are available to detect faint sounds, vibrations, and / or movements of unwanted pests such as mice and other rodents, as well as by termites, cockroaches and other insects. is there. The system can then notify the resident of suspicious pests in the environment, such as with warning messages, to help facilitate early detection and prevention.

FIG. 20 shows an exemplary mesh network device 2000 that can be implemented as any of the mesh network devices in a mesh network according to one or more embodiments of mesh network commissioning as described herein. Device 2000 includes electronic circuits, microprocessors, memory, input / output (I / O) logic controls, communication interfaces and components, and other hardware, firmware, and / or software for implementing devices in mesh networks. Can be integrated. Also, the mesh network device 2000 can be implemented using a variety of components, such as any number of different components and any combination thereof, as further described with reference to the exemplary device shown in FIG.

In this example, the mesh network device 2000 includes a low power microprocessor 2002 and a high power microprocessor 2004 (eg, a microcontroller or digital signal processor) that process executable instructions. The device also includes input / output (I / O) logic control 2006 (for example, to include electronic circuits). Microprocessors are silicon and / or memory systems such as integrated circuits, programmable logic devices, logical device components formed using one or more semiconductors, and processors and memory systems implemented as system-on-chip (SoC). It may include other implementation examples in hardware. Alternatively or additionally, the device may use any one or a combination of software, hardware, firmware, or fixed logic circuits that can be implemented using processing and control circuits. It can be realized. The low power microprocessor 2002 and the high power microprocessor 2004 can also support one or more different device functionality of the device. For example, the high-power microprocessor 2004 may perform computationally intensive operations, while the low-power microprocessor 2002 may manage less complex processes such as detecting hazards or temperatures from one or more sensors 2008. .. The low power microprocessor 2002 may also start or initialize the high power microprocessor 2004 for a compute-intensive process.

One or more sensors 2008 include acceleration, temperature, humidity, water, power supply, proximity, external motion, device motion, audio signal, ultrasonic signal, optical signal, fire, smoke, carbon monoxide, global positioning satellite ( It can be implemented to detect various characteristics such as global-positioning-satellite (GPS) signals, radio-frequency (RF), other electromagnetic signals or electromagnetic fields. Therefore, Sensor 2008 includes temperature sensors, humidity sensors, hazard related sensors, other environmental sensors, accelerometers, microphones, lower optical sensors including cameras (eg charge-coupled devices or video cameras), active or passive radiation sensors. , GPS receiver, and any one or combination of radio frequency identification detectors. In the implementation example, the mesh network device 2000 may include one or more primary sensors and one or more secondary sensors, the primary sensor sensing the core operation of the device (eg, a thermostat senses temperature). That, or the smoke detector senses the central data, while the secondary sensor senses other types of data (eg, motion, light, or sound) and they. Can be used for energy efficiency purposes or smart operation purposes.

Mesh network device 2000 includes memory device controller 2010 and memory device 2012, such as any type of non-volatile memory and / or other suitable electronic data storage device. The mesh network device 2000 may also include a variety of firmware and / or software, such as Operating System 2014, which is maintained by memory as computer-executable instructions and executed by a microprocessor. The device software may also include a commissioning application 2106 that implements an embodiment of mesh network commissioning. Mesh Network Device 2000 also includes Device Interface 2018 for interfacing with other devices or peripheral components, and includes Integrated Data Bus 2020, which combines various components of a mesh network device for data communication between components. Data buses in mesh network devices may also be implemented as any one or a combination of different bus structures and / or bus architectures.

The device interface 2018 may receive input from the user (eg, as a user interface) and / or provide information to the user, and the received input can be used to determine the configuration. Device Interface 2018 may also include mechanical or virtual components that respond to user input. For example, the user may mechanically move a sliding or rotatable component, or may detect movement along the touchpad, which corresponds to adjusting the device settings. May be good. Physical and virtual mobile user interface components can allow users to set settings along part of an apparent continuum. Device Interface 2018 may also receive input from any number of peripherals such as buttons, keypads, switches, microphones, and imaging devices (eg camera devices).

The mesh network device 2000 may include a network interface 2022, such as a mesh network interface for communication with other mesh network devices in the mesh network, and an external network interface for network communication over the Internet and the like. The mesh network device 2000 also includes a wireless system 2024 for wireless communication with other mesh network devices via a mesh network interface and for a plurality of different wireless communication systems. The wireless system 2024 may include Wi-Fi, Bluetooth®, mobile broadband, and / or point-to-point IEEE 802.15.4. Each of the different wireless systems may include wireless devices, antennas, and chipsets implemented for a particular wireless communication technology. The mesh network device 2000 also includes a power supply 2026, such as a battery, and / or for connecting the device to a line voltage. AC power may also be used to charge the device's battery.

FIG. 21 is an exemplary device including an exemplary device 2102 that may be implemented as any of the mesh network devices that implement the mesh network commissioning embodiments as described above with reference to FIGS. 1-20. Shows system 2100. The exemplary device 2102 may be any type of computing device, client device, mobile phone, tablet, communication device, entertainment device, gaming device, media playback device, and / or other type of device. The exemplary device 2102 also includes thermostats, hazard detectors, cameras, lighting units, commissioning devices, routers, border routers, joiner routers, participating devices, end devices, readers, access points, and / or other mesh network devices. It may be implemented as any other type of mesh network device configured for communication on the mesh network, such as.

The device 2102 is a wired and / or wired device data 2106 such as data communicated between devices in a mesh network, data being received, data scheduled for broadcast, data packets of data, data synchronized between devices. Or it includes a communication device 2104 that enables wireless communication. The device data can include any type of communication data and audio data, video data and / or image data generated by an application running on the device. Communication device 2104 may also include transceivers for mobile phone communication and / or network data communication.

Device 2102 is also an input / output (I / O) interface, such as a data network interface that provides connection and / or communication links between devices, data networks (eg, mesh networks, external networks, etc.), and other devices. Includes 2108. I / O interfaces can be used to connect devices to any type of component, peripheral, and / or ancillary equipment. The I / O interface also includes a data input port through which input such as any type of data, media content, and / or user input to the device can be received and of any type. Communication data and audio data, video data and / or image data can be received from any content and / or data source.

Device 2102 includes a processing system 2110 that can be at least partially implemented in hardware such as having any type of microprocessor, controller, etc. that processes executable instructions. Processing systems are silicon and / or memory systems such as integrated circuits, programmable logic devices, logic device components formed using one or more semiconductors, and processors and memory systems implemented as system-on-chip (SoC). It may include other implementation examples in hardware. Alternatively or additionally, the device may use any one or a combination of software, hardware, firmware, or fixed logic circuits that can be implemented using processing and control circuits. It can be realized. Device 2102 may further include any type of system bus or other data and command transfer system that combines the various components within the device. The system bus may include any one or a combination of different bus structures and architectures, as well as control lines and data lines.

Device 2102 is also accessible by a computing device and is a computer-readable storage memory 2112 such as a data storage device that provides persistent storage of data and executable instructions (eg, software applications, modules, programs, functions, etc.). including. The computer-readable storage memory described herein excludes propagating signals. Examples of computer-readable storage memory are volatile and non-volatile memory, fixed and removable media devices, and any suitable memory device or electronic data storage that holds data for access by computing devices. including. Computer-readable storage memory is a variety of realizations of random access memory (RAM), read-only memory (ROM), flash memory, and other types of storage memory in different memory device configurations. Examples may be included.

The computer-readable storage memory 2112 is maintained as a software application in the computer-readable storage memory and provides storage for device data 2106 and various device applications 2114, such as the operating system executed by the processing system 2110. The device application may also include a device manager, such as any form of control application, software application, signal processing and control module, code specific to a particular device, hardware abstraction layer for a particular device, and so on. .. In this example, the device application also implements a mesh network commissioning embodiment, such as when the exemplary device 2102 is implemented as one of the mesh network devices described herein. Including.

The device 2102 also includes an audio and / or video system 2118 that produces audio data for the audio device 2120 and / or display data for the display device 2122. Audio and / or display devices include any device that processes, displays, and / or otherwise represents audio data, video data, display data and / or image data, such as image content of digital photographs. .. In the implementation example, the audio and / or display device is an integrated component of the exemplary device 2102. Alternatively, the audio and / or display device is an external peripheral component of the exemplary device. In embodiments, at least some of the techniques described for mesh network commissioning may be implemented in distributed systems, eg, on platform 2126 through "cloud" 2124. Cloud 2124 includes platform 2126 for services 2128 and / or resource 2130, and / or represents platform 2126.

Platform 2126 abstracts the basic functionality of the hardware, such as server devices (for example, included in service 2128) and / or software resources (for example, included as resource 2130), with exemplary device 2102 as another. Connect to devices, servers, etc. Resource 2130 may also contain applications and / or data available while computer processing is being performed from the exemplary device 2102 to a remote server. In addition, service 2128 and / or resource 2130 may facilitate subscriber network services, such as through the Internet, cellular networks, or Wi-Fi networks. Platform 2126 also abstracts and scales resources to serve the demand for resources 2130 realized through the platform, such as in interconnected device embodiments where functionality is distributed throughout the system 2100. May function as For example, functionality may be partially achieved on the exemplary device 2102 and through platform 2126, which abstracts the functionality of Cloud 2124.

Although embodiments of mesh network commissioning have been described in terms specific to the features and / or methods, the subject of the accompanying claims is not necessarily limited to the particular features or methods described. Rather, certain features and methods are disclosed as exemplary implementations of mesh network commissioning, and other equivalent features and methods are intended to fall within the scope of the appended claims. .. It is also understood that a variety of different embodiments are described and that each described embodiment is feasible independently or in connection with one or more other described embodiments. Should be.

The safe way to join a participating device to a mesh network is to have the joiner router receive a message from the participating device requesting it to join the mesh network and forward the received message to the mesh network commissioning device. The network information includes a step, a step of receiving authentication from the commissioning device for the participating device to join the mesh network, and a step of sending network information to the participating device. It is effective to enable.

Alternatively or in addition to the methods described above, the beacon further comprises the step of receiving a beacon request from the participating device and the step of transmitting the beacon from the joiner router to the participating device, wherein the beacon is joined by a mesh network. To provide an indication that it is available for; the step of transmitting the beacon is said to be effective in allowing the participating device to establish a local link between the participating device and the joiner router. That; the step of receiving the message and the step of forwarding the received message are performed using Datagram Transport Layer Security (DTLS); the step of receiving the message and the receiving The step of forwarding a message is performed using the User Datagram Protocol (UDP); the message received from the participating device is encrypted and can be used to authenticate the participating device. The participating device, including the device identifier, is authenticated using password-authenticated key exchange (J-PAKE) by juggling, and authentication is valid to establish a secure communication session between the commissioning device and the participating device. The step of forwarding the received message to the commissioning device is the step of forwarding the received message through one or more routers in the mesh network in the communication path between the joiner router and the commissioning device. And one of one or more routers is a border router that connects the mesh network to the external network, and the commissioning device is attached to the external network. Includes one or a combination thereof.

A mesh network device realized as a joiner router, the mesh network device includes a mesh network interface configured for communication in a mesh network and a memory and processor system for implementing a commissioning application, and is a commissioning application. Receives a message from a participating device requesting to join the mesh network through the mesh network interface, forwards the received message to the commissioning device of the mesh network, and from the commissioning device, the participating device is the mesh network. It is configured to receive authentication to join and start sending network information to the participating devices, and the network information is valid to allow the participating devices to join the mesh network. ..

In place of or in addition to the mesh network device described above, or in addition to the mesh network device described above, the commissioning application receives a beacon request from the participating device via the mesh network interface and the beacon is sent from the joiner router to the participating device. Configured to start with, the beacon provides an indication that the mesh network is available for participation; the beacon establishes a local link between the participating device and the joiner router. That it is valid to enable you; the commissioning application is configured to use Datagram Transport Layer Security (DTLS) to receive messages and forward the received messages. That; the commissioning application is configured to receive messages using the User Datagram Protocol (UDP) and forward the received messages; messages received from the participating device will send the participating device. Includes an encrypted device identifier that can be used to authenticate, the participating device is authenticated using password-authenticated key exchange (J-PAKE) by juggling, and authentication is between the commissioning device and the participating device. Effective for establishing a secure communication session between; the commissioning application forwards received messages through one or more routers in the mesh network in the communication path between the joiner router and the commissioning device. And that one of the routers is a border router that connects the mesh network to the external network, and that the commissioning device is attached to the external network. Includes any one or a combination thereof.

The mesh network system includes a participating device configured to request to join the mesh network and a joiner router, which receives a message from the participating device requesting to join the mesh network. The received message is forwarded to the commissioning device of the mesh network, and the commissioning device is configured to receive the authentication for the participating device to join the mesh network and send the network information to the participating device. , Effective to allow participating devices to join the mesh network.

In place of or in addition to the mesh network system described above, or in addition to the mesh network system described above, the joiner router is configured to receive a beacon request from the participating device and send the beacon to the participating device, the beacon being configured by the mesh network. It provides an indication that it is available for participation and that the beacon is valid to allow the participating device to establish a local link between the participating device and the joiner router; from the participating device. The received message contains an encrypted device identifier that can be used to authenticate the participating device, and the participating device is authenticated and authenticated using password authenticated key exchange (J-PAKE) by juggling. Is effective in establishing a secure communication session between the commissioning device and the participating device; and the joiner router is one of the mesh networks in the communication path between the joiner router and the commissioning device. One of the above routers is configured to forward the received message to the commissioning device, and one of the routers is a border router that connects the mesh network to the external network. Or a combination thereof is included.

To safely join a participating device to the mesh network, the joiner router steps to receive a DTLS-ClientHello message from the participating device requesting to join the mesh network, and receives the received DTLS-ClientHello message via DTLS relay. The step of encapsulating in the notification message, the step of sending the DTLS relay reception notification message to the commissioning device of the mesh network, the step of receiving the DTLS relay transmission notification message from the commissioning device, and the content of the DTLS relay transmission notification message. The content is effective to allow the participating device to join the mesh network, including the step of sending the to the participating device, and the method is further from the commissioning device, the participating device is the network for the mesh network. The step of receiving the indication that the credential should be received, and the step of receiving the key encryption key (KEK) shared between the commissioning device and the participating device from the commissioning device, and the indication. In response to the receiving step, it includes the step of sending the network credential from the joiner router to the participating devices using KEK to secure the communication of the network credential.

In place of or in addition to the methods described above, the step of receiving a beacon request from the participating device and the step of transmitting the beacon from the joiner router to the participating device; , Includes steering data indicating one or more participating devices that are allowed to participate in the mesh network; the step of receiving a DTLS-ClientHello message from said participating device utilizes the User Datagram Protocol (UDP). That means that the DTLS relay reception notification message contains the address of the participating device, the address of the joiner router, and the received DTLS-ClientHello message; the DTLS relay transmission notification message contains the address of the participating device and the joiner. It contains the address of the router and the DTLS-HelloVerify message; the step of sending the content of the DTLS relay transmission notification message to the participating device is useful for establishing a secure communication session between the commissioning device and the participating device. That is; a secure communication session can be used to provision the participating device; and apply a speed limit to the sending of the DTLS relay reception notification message sent from the participating device to the commissioning device. Includes any one or a combination of those that further include steps.

A mesh network device realized as a joiner router, the mesh network device includes a mesh network interface configured for communication in a mesh network and a memory and processor system for implementing a commissioning application, and is a commissioning application. Receives a DTLS-ClientHello message from a participating device requesting to join the mesh network via the mesh network interface, encapsulates the received DTLS-ClientHello message in a DTLS relay reception notification message, and receives the DTLS relay reception. Start sending the notification message to the commissioning device of the mesh network, receive the DTLS relay transmission notification message from the commissioning device, and start sending the contents of the DTLS relay transmission notification message to the participating devices. The content is enabled to allow participating devices to join the mesh network, and the commissioning application is further commissioned by the commissioning device to receive network credentials for the participating device for the mesh network. Receives an indication that it should, receives a key encryption key (KEK) shared between the commissioning device and the participating device from the commissioning device, and responds to the indication to secure network credential communication. It is configured to use KEK to start sending network credentials from the joiner router to the participating devices.

Receives a beacon request from a participating device and initiates the beacon being transmitted from the joiner router to the participating device in place of or in addition to the mesh network device described above, or through the mesh network interface. That is; the commissioning application is configured to receive DTLS-Client Hello messages from participating devices using User Datagram Protocol (UDP); the DTLS relay reception notification message is the address of the participating device and The DTLS relay transmission notification message contains the address of the joiner router and the received DTLS-ClientHello message, and includes the address of the participating device, the address of the joiner router, and the DTLS-HelloVerify message; The content of the DTLS relay transmission notification message is valid to establish a secure communication session between the commissioning device and the participating device; the secure communication session is used to provision the participating device. Includes one of the things that is possible, or a combination thereof.

The mesh network system includes a joining device configured to request to join the mesh network and a joiner router, which sends a DTLS-ClientHello message from the joining device requesting to join the mesh network. The received and received DTLS-ClientHello message is encapsulated in the DTLS relay reception notification message, the DTLS relay reception notification message is sent to the commissioning device of the mesh network, and the DTLS relay transmission notification message is received from the commissioning device. The content of the DTLS relay send notification message is configured to be sent to the participating devices, the content is valid to allow the participating devices to join the mesh network, and the joiner router also joins from the commissioning device. The device receives an indication that it should be commissioned to receive network credentials for the mesh network, and receives a key encryption key (KEK) from the commissioning device that is shared between the commissioning device and the participating devices. In response to the display, the joiner router is configured to send the network credential to the participating devices using KEK to secure the communication of the network credential.

To receive a beacon request from a participating device and send a beacon from the joiner router to the participating device in place of or in addition to the mesh network system described above; the beacon is the network name and mesh network. Includes steering data indicating one or more participating devices that are allowed to participate in; joiner routers should use the User Datagram Protocol (UDP) to receive DTLS-Client Hello messages from participating devices. The DTLS relay reception notification message includes the address of the participating device, the joiner router address, and the received DTLS-ClientHello message, and the DTLS relay transmission notification message is of the participating device. Includes an address, a joiner router address, and one or a combination of the DTLS-HelloVerify messages.

A way to authorize a commissioning device to become a commissioner for commissioning one or more participating devices to join the mesh network is to receive a request from the commissioning device to become a commissioner for the mesh network at the border router. A step of sending a received application to a reader device of the mesh network, and a step of receiving a response to the application from the reader device, the response indicates acceptance or rejection of the application, the method described above. In addition, it comprises sending an indication of acceptance or rejection of the application to the commissioning device in response to the step of receiving the response.

The step of receiving the application comprises the step of advertising the availability of the mesh network for the commissioning device by the border router in place of or in addition to the method described above, wherein the commissioning device said. Responding to receiving advertisements; At the border router, further including the step of receiving a request from the commissioning device to connect securely to the border router; The secure connection is the datagram transport layer. Being established using security (DTLS); the step of sending an indication of acceptance of an application is to establish a secure commissioning session; the identity of the commissioning device to establish a secure commissioning communication session. The registration step further comprises the step of providing an encrypted commissioning credentials to the border router, the encrypted commissioning credentials being entered into the commissioning device by the user. Derived from the credential; the border router contains a copy of the encrypted commissioning credential that can be used to authenticate the commissioning device to the mesh network; and the encrypted commissioning credential. A copy of the commissioning credential was previously derived from the commissioning credential, the commissioning credential was injected into the leader device of the mesh network from which the copy of the encrypted commissioning credential was derived, and the reader device was infused with a copy of the encrypted commissioning credential. Includes secure communication with the border router, any one or a combination thereof.

A mesh network device realized as a border router, the mesh network device includes a mesh network interface configured for communication in a mesh network and a memory and processor system for implementing a commissioning application, and is a commissioning application. Receives an application from a commissioning device to become a commissioner for a mesh network to commission one or more participating devices to join the mesh network through the mesh network interface, and the received application is a mesh. It is configured to start sending to the leader device of the network and receive a response to the application from the reader device, the response displays the acceptance or rejection of the application, and the commissioning application further receives the received response to the application. In response to, the acceptance or rejection indication of the application is configured to begin to be sent to the commissioning device.

In place of or in addition to the mesh network devices described above, or in addition to the mesh network devices described above, the commissioning application advertises the availability of the mesh network for the commissioning device and the commissioning device receives the advertised availability. The availability advertised is configured to receive requests in response to that it is done using a service discovery protocol that includes a multicast domain name system (mDNS); commissioning applications are sent to border routers. The request for secure connection is configured to be received from the commissioning device, and the secure connection is established using Datagram Transport Layer Security (DTLS); acceptance of the application by the reader device is Acceptance of applications that authorize the commissioning device to become a commissioner for the mesh network and allow the reader device to update the internal state of tracking the active commissioner for the mesh network is the join permission flag for the mesh network. True to propagate the commissioning dataset within the mesh network, and the sent display of application acceptance means that a secure commissioning session is established; the commissioning application is the encryption provided to the border router. In order to establish a secure commissioning communication session, including the commissioned credentials, the commissioning device's identity is configured to register with the border router, and the encrypted commissioning credentials are entered into the commissioning device by the user. Derived from the credential, the border router contains a copy of the encrypted commissioning credential that can be used to authenticate the commissioning device to the mesh network;Either the commissioning device and the border router communicate through a network other than the mesh network; and the other network is either a Wi-Fi network or an Ethernet network. Includes one or a combination thereof.

A mesh network system includes a commissioning device configured to apply to be a commissioner for commissioning one or more participating devices to join the mesh network, and a border router, where the border router is a mesh network. It is configured to receive an application to become a commissioner for, send the received application to the leader device of the mesh network, and receive a response to the application from the reader device, the response accepting the application. Or display a refusal, and the border router is further configured to send an indication of acceptance or refusal of the application to the commissioning device.

In place of or in addition to the mesh network system described above, the border router advertises the availability of the mesh network for the commissioning device and in response to the commissioning device receiving the advertisement. It is configured to receive applications; the commissioning device and the border router communicate through other networks than the mesh network; the other network is either a Wi-Fi network or an Ethernet network. And that the border router is configured to send an indication of acceptance of the application in order to establish a secure commissioning session, any one or a combination thereof. included.

The method realized by the leader device of the mesh network is to receive the application for accepting the commissioning device as a commissioner for commissioning the participating device to join the mesh network, the step of receiving the application by the reader device, and the received application. The steps to decide whether to accept or reject, the step to send a response containing the indication of the decision, and the internal state of tracking the active commissioner for the mesh network in response to the decision being accepted. Includes steps to update.

To include, in place of or in addition to the methods described above, a step of receiving a command from the commissioning device to initiate the join mode for the mesh network; propagating the commissioning dataset within the mesh network. The commissioning dataset contains a commissioner session identifier, a commissioner time stamp, an encrypted commissioner credentials, and a security policy that indicates which security-related actions are allowed on the mesh network. That is, it further includes the step of deriving the encrypted commissioning credential from the commissioning credential injected into the reader device during the commissioning of the reader device; the derivation of the encrypted commissioning credential applies the key derivation function. By doing so, the key derivation function is to perform multiple hashings using a cryptographic-based message authentication code (CMAC); enabled to allow border routers to authenticate commissioning devices to the mesh network. It further includes the step of sending a copy of the encrypted commissioning credentials to the border router; and if the commissioner is active on the mesh network, the commissioning dataset will further include the location of the border router. That, any one of them, or a combination thereof is included.

A mesh network device realized as a leader device of a mesh network, the mesh network device includes a mesh network interface configured for communication in the mesh network and a memory and processor system for realizing a commissioning application. , The commissioning application receives an application to accept a commissioning device as a commissioner to commission a participating device to join the mesh network through the mesh network interface and accepts or rejects the received application. And start sending a response containing an indication of whether to accept or reject the received application, for the mesh network in response to the decision being the acceptance of the received application. It is configured to update the internal state of tracking the active commissioner of.

In place of or in addition to the mesh network devices described above, or in addition to the mesh network devices described above, the commissioning application is configured to receive commands from the commissioning device to initiate join mode for the mesh network. That the commissioning application is configured to propagate the commissioning dataset within the mesh network; the commissioning dataset is the commissioner session identifier, the commissioner time stamp, the encrypted commissioner credentials, and which security-related The commissioning application is further configured to derive encrypted commissioning credentials from the commissioning credentials injected into the reader device during the commissioning of the reader device, including a security policy that indicates whether the operation is allowed in the mesh network. Derivation of encrypted commissioning credentials is done by applying a key derivation function, which uses crypto-based message authentication code (CMAC) to hash multiple times; commissioning application. Is configured to send a copy of the encrypted commissioning credentials to the border router, which is valid to allow the border router to authenticate the commissioning device to the mesh network; and the commissioner. If is active on the mesh network, the commissioning dataset will include any one or a combination of those that further include the location of the border router.

The mesh network system includes a commissioning device configured to apply to be a commissioner for commissioning one or more participating devices to join the mesh network, and a leader device for the mesh network. Receives an application to accept a commissioning device as a commissioner to commission a participating device to join the mesh network, decides whether to accept or reject the received application, and accepts the received application Or it is configured to send a response containing an indication of the decision as to whether to reject and update the internal state of tracking the active commissioner for the mesh network in response to the decision being accepted.

In place of or in addition to the mesh network system described above, or in addition to the mesh network system described above, the reader device is configured to receive commands from the commissioning device to initiate join mode for the mesh network. The reader device is configured to propagate the commissioning dataset within the mesh network; the commissioning dataset is the commissioner session identifier, the commissioner time stamp, the encrypted commissioner credentials, and which security-related The reader device is further configured to derive an encrypted commissioning credentials from the commissioning credentials injected into the reader device during the commissioning of the reader device, including a security policy that indicates whether the operation is allowed in the mesh network. Derivation of encrypted commissioning credentials is done by applying a key derivation function, which uses crypto-based message authentication code (CMAC) to hash multiple times; reader device Is configured to send a copy of the encrypted commissioning credentials to the border router, which is valid to allow the border router to authenticate the commissioning device to the mesh network; and the commissioner. If is active on the mesh network, the commissioning dataset will include any one or a combination of those that further include the location of the border router.

How to securely establish a network communication session to join one or more participating devices in a mesh network is the step of establishing a secure commissioning communication session between the commissioning device of the mesh network and the border router, and the mesh network. A secure joiner communication session between the commissioning device and the joining device, with the step of invoking join for, and the step of receiving a request to join the mesh network from one of the joining devices by the commissioning device. Includes a step to establish and join the participating device to the mesh network.

Alternatively or in addition to the methods described above, the step of establishing a secure commissioning communication session is to request acceptance of the commissioning device as an active commissioner for the mesh network from the commissioning device to the mesh network. It includes the steps of sending an application to a reader device and receiving an indication of acceptance of the application from the reader device; the step of invoking participation for a mesh network is to one or more routers in the mesh network. The participation mode that advertises that the mesh network is accepting the join request includes a step that the commissioning device initiates; the step that initiates the join for the mesh network is managed to make the mesh network joinable. The management message, which includes the step of sending the message to the reader device, is to allow the reader device to update the network data for the mesh network and propagate the network data to one or more router devices in the mesh network. That it is valid and that the network data includes an indication that the mesh network is available for participation; further includes the step of authenticating the participating device using an encrypted device identifier;The step of receiving a request to join the mesh network from one of the participating devices is received via the joiner router, and the method further describes that the participating device is a network credential for the mesh network and a commissioning device. The step includes sending to the joiner router an indication that it should be entrusted to receive a key encryption key (KEK) shared with the participating devices, said step of sending by the joiner router. That it is valid to use the received KEK to securely send network credentials to the participating device and allow the participating device to commission to the mesh network; the step of receiving a request from the participating device is Including the step of receiving the encrypted device identifier of the participating device, the encrypted device identifier is said to be derived from the device identifier of the participating device using password-authenticated key exchange (J-PAKE) by juggling. That; the step of establishing a secure joiner communication session is the encryption in which the encrypted device identifier received from the participating device is derived by the commissioning device from the copy of the device identifier received as input from the user to the commissioning device. Of the steps that the commissioning device determines to be consistent with the encrypted device identifier and the step of using the encrypted device identifier as a shared secret to secure the joiner communication session. Any one or a combination thereof is included.The step of establishing a secure joiner communication session is to encrypt the encrypted device identifier received from the participating device from the copy of the device identifier received as input from the user to the commissioning device, derived by the commissioning device. Either it includes a step that the commissioning device determines to be consistent with the device identifier, and a step that uses the encrypted device identifier as a shared secret to secure the joiner communication session. Includes one or a combination thereof.The step of establishing a secure joiner communication session is to encrypt the encrypted device identifier received from the participating device from the copy of the device identifier received as input from the user to the commissioning device, derived by the commissioning device. Either it includes a step that the commissioning device determines to be consistent with the device identifier, and a step that uses the encrypted device identifier as a shared secret to secure the joiner communication session. Includes one or a combination thereof.

A mesh network device implemented as a commissioning device for joining one or more participating devices to a mesh network, which is a mesh network interface configured for communication in the mesh network and a commissioning application. The commissioning application, including the memory and processor system to achieve, establishes a secure commissioning communication session between the mesh network commissioning device and the border router, initiates participation for the mesh network, and mesh network interface. Receives a request to join the mesh network from one of the participating devices, establishes a secure joiner communication session between the commissioning device and the participating device, and joins the participating device to the mesh network. It is configured as follows.

In place of or in addition to the mesh network devices described above, or in addition to the mesh network devices described above, the commissioning application requests the acceptance of the commissioning device as an active commissioner for the mesh network from the commissioning device to the mesh network leader device. It is configured to send an application to and receive an indication of acceptance of the application from the reader device; the commissioning application indicates that the mesh network is accepting join requests to one or more routers in the mesh network. It is configured to launch a join for the mesh network by invoking the join mode to advertise; the commissioning application sends a management message to the reader device to enable the mesh network to join. By activating the join for the mesh network, the management message is that the leader device updates the network data for the mesh network and sends the network data to one or more router devices in the mesh network. Allows propagation and the network data contains an indication that the mesh network is available for participation; the request received from the participating device contains the encrypted device identifier of the participating device and contains. The encrypted device identifier is derived from the device identifier of the participating device using password authenticated key exchange (J-PAKE) by juggling;The commissioning application determines from the copy of the device identifier received as input from the user to the commissioning device that the encrypted device identifier received from the participating device is consistent with the encrypted device identifier derived by the commissioning device. And to secure the joiner communication session, it is configured to establish a secure joiner communication session, further configured to use the encrypted device identifier as a shared secret; commissioning. The application is configured to forward requests from participating devices to join the mesh network, and the requests are forwarded to the commissioning device by one or more router devices in the mesh network. Includes one or a combination thereof.

The mesh network system includes one or more participating devices configured to request participation in the mesh network and a mesh network commissioning device, which is between the commissioning device and the mesh network border router. Establish a secure commissioning communication session, launch a join for the mesh network, receive a request to join the mesh network from one of the participating devices, and secure between the commissioning device and the participating device. It is configured to establish a joiner communication session and join participating devices to the mesh network.

In place of or in addition to the mesh network system described above, or in addition to the mesh network system described above, the commissioning device requires acceptance of the commissioning device as an active commissioner for the mesh network in order to establish a secure commissioning communication session. In order to be configured to send an application from the commissioning device to the leader device of the mesh network and receive an indication of acceptance of the application from the reader device; the commissioning device is to one or more routers in the mesh network. That the mesh network is configured to activate the join for the mesh network by invoking the join mode that advertises that the mesh network is accepting the join request; the commissioning device allows the mesh network to join. The management message is configured to trigger participation for the mesh network by sending a management message to the leader device to allow the leader device to update the network data for the mesh network and the mesh network. Allows the propagation of network data to one or more router devices in, and that the network data includes an indication that a mesh network is available for participation;The commissioning device receives a request from one of the participating devices to join the mesh network via the joiner router, and the participating device includes the network credentials for the mesh network and the commissioning device and the participating device. It is configured to send to the joiner router an indication that it should be delegated to receive a key encryption key (KEK) shared between the joiner routers, and the transmitted indication is received by the joiner router. Includes any one or a combination of the ability to securely send network credentials to participating devices and allow participating devices to commission to a mesh network using KEK.

The method of provisioning a participating device in a mesh network includes a step of establishing a commissioning communication session between a commissioning device of the mesh network and a border router, a step of establishing a joiner communication session between the participating device and the commissioning device, and a step of establishing a joiner communication session. The commissioning information is available to the participating device to join the mesh network, including the step of transmitting the commissioning information to the participating device, the method further receiving a display of the position of the commissioner application from the participating device. Includes steps and running a commissioner application to provision participating devices.

In addition to or in addition to the methods described above, further including the step of searching for the commissioner application using the received display; the received display of the position of the commissioner application is a uniform resource locator ( URL); the commissioner application is retrieved from the cloud service over the Internet; the commissioning device uses the received URL to determine if the commissioner application is stored in the commissioning device's memory. To use; further includes a step to end the commissioning of the participating device in response to the completion of provisioning of the participating device, and the ending step is effective to allow the participating device to join the mesh network. That there is; provisioning of the participating device involves updating the software on the participating device; provisioning of the participating device involves linking the participating device to a user account on the cloud service; Provision includes configuring participating devices; and configuration includes any one or a combination of those that are local configurations associated with other devices in the mesh network. ..

A mesh network device realized as a commissioning device, the mesh network device includes a mesh network interface configured for communication in a mesh network and a memory and processor system for implementing a commissioning application, and is a commissioning application. Is configured to establish a commissioning communication session between the commissioning device of the mesh network and the border router, a joiner communication session between the participating device and the commissioning device, and send commissioning information to the participating device. The commissioning information is available to the participating devices to join the mesh network, and the commissioning application also receives a view of the commissioner application's location from the participating devices and runs the commissioner application to provision the participating devices. It is configured to do.

That the commissioning application is configured to use the received display to search for the commissioner application, in place of or in addition to the mesh network device described above; in the location of the commissioner application. The received display is a uniform resource locator (URL); the commissioner application is retrieved from a cloud service over the Internet; the commissioning device determines whether the commissioner application is stored in the commissioning device's memory. Includes using any one or a combination of those that use the received URL to determine.

The mesh network system includes a participating device configured to request participation in the mesh network and a mesh network commissioning device, which is a commissioning communication session between the commissioning device and the mesh network border router. Is configured to establish a joiner communication session between the participating device and the commissioning device and send the commissioning information to the participating device, and the commissioning information is available to the participating device to join the mesh network. Yes, the commissioning device is further configured to receive an indication of the position of the commissioner application from the participating device and run the commissioner application to provision the participating device.

That the commissioning application is configured to use the received display to search for the commissioner application, in place of or in addition to the mesh network system described above; The received display is a uniform resource locator (URL); the commissioner application is retrieved from a cloud service over the Internet; and the commissioning device is whether the commissioner application is stored in the commissioning device's memory. It includes using any one or a combination of the received URLs to determine if.

The method of identifying a device that is allowed to join the mesh network involves obtaining steering data for the mesh network, where the steering data is the device identifier associated with the device that is allowed to join the mesh network. The method further includes a step of propagating steering data from a commissioning device for a mesh network to one or more routers in the mesh network, said propagating step of propagating steering data by one or more routers. It is possible to send in beacon messages and steering data is useful to allow the device associated with the device identifier to identify that the device is allowed to join the mesh network.

In place of or in addition to the methods described above, the steering data shall include a 16-bit cyclic redundancy check (CRC16) for the device identifier; the device identifier shall be an IEEE 64-bit extended unique identifier (EUI-64). That is; the step of obtaining steering data for the mesh network further includes the step of obtaining steering data for additional device identifiers associated with additional devices that are allowed to participate in the mesh network; That the step of propagating the steering data is effective to allow the device to distinguish between the mesh network and the other network; the other network is the IEEE802.15.4 network; and Steering data includes any one or a combination of indicating that the commissioner is active on the mesh network.

A mesh network device realized as a commissioning device, the mesh network device includes a mesh network interface configured for communication in a mesh network and a memory and processor system for implementing a commissioning application. Is configured to ask for steering data for the mesh network, which includes displaying the device identifier associated with the device that is allowed to join the mesh network, and the commissioning application also for the mesh network. The commissioning device is configured to propagate steering data from the commissioning device to one or more routers in the mesh network, which allows one or more routers to transmit steering data in beacon messages, where the steering data is the device identifier. The device associated with is useful to allow the device to be identified as being allowed to join the mesh network.

That the steering data includes a 16-bit cyclic redundancy check (CRC16) of the device identifier in place of or in addition to the mesh network device described above; the device identifier is an IEEE 64-bit extended unique identifier (EUI). -64); the commissioning application asks for steering data for additional device identifiers associated with additional devices that are allowed to join the mesh network in order to ask for steering data for the mesh network. That the steering data is available by the device to distinguish the mesh network from the other network; the other network is the IEEE802.15.4 network; and Steering data includes any one or a combination of indicating that the commissioner is active on the mesh network.

The mesh network system includes a participating device configured to request participation in the mesh network and a mesh network commissioning device, the commissioning device being configured to seek steering data for the mesh network and steering data. Includes a display of device identifiers associated with devices that are allowed to join the mesh network, and the commissioning device further propagates steering data from the commissioning device for the mesh network to one or more routers in the mesh network. The propagation is configured to allow one or more routers to send steering data in a beacon message, which allows the device associated with the device identifier to join the device and the device to join the mesh network. It is effective to make it possible to identify that.

In place of or in addition to the mesh network system described above, or in addition to the mesh network system described above, the steering data includes a 16-bit cyclic redundancy check (CRC16) for the device identifier; the device identifier is an IEEE 64-bit extended unique identifier (EUI). -64); the commissioning device seeks steering data for additional device identifiers associated with additional devices that are allowed to join the mesh network in order to obtain steering data for the mesh network. That the steering data allows the device to distinguish between the mesh network and other networks; the steering data indicates that the commissioner is active on the mesh network. That, any one of them, or a combination thereof is included.

The method of identifying a device that is allowed to join the mesh network involves obtaining steering data for the mesh network, where the steering data is the device identifier associated with the device that is allowed to join the mesh network. The display is represented as a set of values in the bloom filter that represents the device identifier, the method further comprising steering data from the commissioning device for the mesh network to one or more routers in the mesh network. Propagating, said propagating step allows one or more routers to transmit steering data in a beacon message, where the steering data is a set of devices associated with the device identifier in the bloom filter. Compares the value of to a second set of values determined by the device, allowing the device to be identified as being allowed to join the mesh network.

In place of or in addition to the methods described above, the steps to obtain steering data include applying a first hash function to the device identifier to generate a first hash value, and a second hash. A step of applying a second hash function to the device identifier to generate a value, a step of performing a modulo operation on the first hash value to find the position of the first bitfield in the bloom filter, and Bloom. To find the second bitfield position in the filter, perform a modulo operation on the second hash value, set the value in the first bitfield position of the bloom filter to 1, and the bloom filter. It includes a step to set the value at the second bitfield position to 1; the first and second hash functions are cyclic redundancy check (CRC), the first hash function is CRC16-CCITT, the second. The hash function of is CRC16-ANSI; the divisor for modulo arithmetic is the length of the bloom filter bit array; the device identifier is the IEEE 64-bit extended unique identifier (EUI-64). The device identifier is the least significant 24 bits of EUI-64; the step of obtaining steering data for the mesh network is further an additional device associated with an additional device that is allowed to join the mesh network. Includes a step to find the steering data for the identifier; further includes a step to set the value of the steering data to a value of 0 that disables participation for the mesh network; and the mesh network is any device Includes any one or a combination thereof, further including the step of setting all bitfield values in the steering data to a value of 1 to indicate that it is available for participation.

A mesh network device realized as a commissioning device, the mesh network device includes a mesh network interface configured for communication in a mesh network and a memory and processor system for implementing a commissioning application. Is configured to ask for steering data for the mesh network, the steering data includes a display of the device identifier associated with the device allowed to join the mesh network, the display representing the device identifier, Bloom. Represented as a set of values in a filter, commissioning applications are further configured to propagate steering data to one or more routers in a mesh network, where propagation is such that one or more routers beacon steering data. Effective to allow sending in a message, the steering data is such that the device associated with the device identifier compares a set of values in the bloom filter with a second set of values determined by the device. The device can then be identified as being allowed to join the mesh network.

Instead of the above-described mesh network devices, or in addition to the above-described mesh network devices, commissioning Apu publication is the first hash function is applied to the device identifier to generate a first hash value, the second hash A second hash function is applied to the device identifier to generate a value, a modulus operation is performed on the first hash value to find the first bitfield position in the bloom filter, and a second in the bloom filter. To find the bitfield position of, perform a modulus operation on the second hash value, set the value at the first bitfield position of the bloom filter to 1, and set the value at the second bitfield position of the bloom filter to 1. Is configured to set to 1; the first and second hash functions are Cyclic Redundancy Checks (CRC), the first hash function is CRC16-CCITT, and the second hash function is CRC16-. Of being ANSI; and that the divisor for modular arithmetic is the length of the bloom filter bit array; that the device identifier is an IEEE 64-bit extended unique identifier (EUI-64). Includes any one or a combination thereof.

The mesh network system includes a participating device configured to request participation in the mesh network and a commissioning device, the commissioning device is configured to obtain steering data for the mesh network, and the steering data is meshed. Includes a display of the device identifier associated with a device that is allowed to join the network, the display is represented as a set of values in a bloom filter that represents the device identifier, and the commissioning device is also a mesh network. Configured to propagate steering data to one or more routers in, propagation is effective to allow one or more routers to transmit steering data in a beacon message, and the steering data is a device. That the device associated with the identifier compares the set of values in the bloom filter with the second set of values determined by the device to identify the device as being allowed to join the mesh network. to enable.

In place of or in addition to the mesh network system described above, the commissioning device applies a first hash function to the device identifier to generate a first hash value and a second hash value. A second hash function is applied to the device identifier to generate, and a modulo operation is performed on the first hash value to find the first bitfield position in the bloom filter, and the second in the bloom filter. To find the bitfield position, perform a modulo operation on the second hash value, set the value at the first bitfield position of the bloom filter to 1, and set the value at the second bitfield position of the bloom filter. It is configured to be set to 1; the first and second hash functions are cyclic redundancy check (CRC), the first hash function is CRC16-CCITT, and the second hash function is CRC16-ANSI. The divisor for modulo arithmetic is the length of the bloom filter bit array; the device identifier is the IEEE 64-bit extended unique identifier (EUI-64); the commissioning device is the mesh network. One of the fact that it is configured to ask for steering data for additional device identifiers associated with additional devices that are allowed to join the mesh network to obtain steering data for. Includes one or a combination thereof.

The method of updating the commissioning data on the nodes of the mesh network is to set the step of receiving the commissioning data set on the node device in the mesh network and the time stamp contained in the received commissioning data set as the commissioning data stored in the node device. Responds to the step of comparing with the stored time stamp included in the set, the step of determining that the stored time stamp is more recent than the received time stamp from the comparison step, and the step of determining. The message contains the stored commissioning data set, and the reader device uses the stored commissioning data set as the most recent commissioning data for the mesh network. It is useful for accepting as a set and allowing the stored commissioning data set to propagate to the mesh network.

In place of or in addition to the methods described above, from the comparison step, a step of determining that the received time stamp is more recent than the stored time stamp, and the received time stamp. Further includes a step of updating the stored commissioning data set to be consistent with the received commissioning data set in response to the step of determining that it is more recent than the stored time stamp; That the received commissioning dataset contains the received time stamp, the commissioning credentials, the network name of the mesh network, and the security policy indicating which security-related actions are allowed on the mesh network; received. The time stamp contains the time value and the indication that the time value is traceable to the Agreement World Time (UTC); the node device and reader device were previously commissioned to the mesh network, and the previous commissioning was The same commissioning data set was stored on the node device and the reader device; the stored commissioning data set on the node device was updated after the mesh network split, and the split splits the mesh network into multiple partitions, and the mesh network. The first partition of the mesh network contains the leader device and the second partition of the mesh network contains the node device; the split means that the communication between the node device and the leader device on the mesh network is stopped; the node The step of receiving the commissioning data set on the device occurs after the merger of the first and second compartments of the mesh network, and the merger reestablishes the communication path between the node device and the reader device on the mesh network. That means;And, the node device includes any one or a combination thereof of being a router device or a router-eligible device.

A mesh network device implemented as a router, the mesh network device includes a mesh network interface configured for communication in the mesh network and a memory and processor system for implementing the commissioning application, and the commissioning application is , Receives the commissioning data set, compares the time stamp contained in the received commissioning data set with the stored time stamp contained in the commissioning data set stored in the router, and from the comparison, the stored time stamp. Is configured to determine that it is more recent than the time stamp received and, in response, send a message to the leader device of the mesh network, the message containing the stored commissioning dataset and the reader. It is useful to allow the device to accept the stored commissioning data set as the most recent commissioning data set for the mesh network and propagate the stored commissioning data set to the mesh network.

In place of or in addition to the mesh network device described above, or in addition to the mesh network device described above, the commissioning application determined from the comparison that the received time stamp was more recent than the stored time stamp and was received. That the time stamp is configured to update the stored commissioning data set to be consistent with the received commissioning data set in response to the determination that the time stamp is more recent than the stored time stamp. The received commissioning dataset contains the received time stamp, the commissioning credentials, the network name of the mesh network, and the security policy indicating which security-related actions are allowed on the mesh network; received. The time stamps given include a time value and an indication that the time value is traceable to the Agreement World Time (UTC); routers and reader devices were previously commissioned to the mesh network, and the previous commissioning was That the same commissioning data set was stored on the router and reader device; and the stored commissioning data set on the router was updated after the mesh network split, which splits the mesh network into multiple partitions, and the mesh network. The first partition of the mesh network contains the reader device and the second partition of the mesh network contains the router, any one or a combination thereof.

The mesh network system includes a reader device and a router device that are configured to maintain commissioning data for the mesh network, and the router device receives the commissioning data set and the time contained in the received commissioning data set. The stamp is compared with the stored time stamp contained in the commissioning data set stored in the router, and the comparison determines that the stored time stamp is more recent than the received time stamp. In response, the message is configured to send a message to the leader device of the mesh network, the message contains the stored commissioning data set, and the reader device makes the stored commissioning data set the most recent commissioning for the mesh network. It is useful for accepting as a data set and allowing the stored commissioning data set to propagate to the mesh network.

In place of or in addition to the mesh network system described above, or in addition to the mesh network system described above, the router device determined from the comparison that the received time stamp was more recent than the stored time stamp and was received. That the time stamp is configured to update the stored commissioning data set to be consistent with the received commissioning data set in response to the determination that the time stamp is more recent than the stored time stamp. The received commissioning dataset contains the received time stamp, the commissioning credentials, the network name of the mesh network, and the security policy indicating which security-related actions are allowed on the mesh network; received. The time stamps given include a time value and an indication that the time value is traceable to Agreement World Time (UTC); and routers and reader devices have previously been commissioned to the mesh network and previously commissioned. Includes the storage of the same commissioning data set on routers and reader devices, any one or a combination thereof.