Managing device ownership and commissioning in public-key encrypted wireless networks

Abstract

A mobile commissioning device for assisting in the commissioning of wireless public-key encrypted networks, the device being provided with: means for reading the public key from a network node to be integrated in the wireless network, the channel for reading the public key being physically different to the wireless network channel for which the node is to be commissioned, means for at least temporarily storing the read public key in the device, means for transferring a public key of the commissioning device to the network node to be commissioned, the channel for transferring the public key preferably being the wireless channel for which the node is to be commissioned, and means for transferring the read public key to a trust center.

1 . A mobile commissioning device (CD, 2 ) for assisting in the commissioning of wireless public-key encrypted networks, the device comprising:
 means for reading ( 22 ) the public key (NWN-PUB-KEY) from a network node (NWN, 1 ) to be integrated in the wireless network, the channel for reading the public key (NWN-PUB-KEY) being physically different to the wireless network channel for which the node (NWN, 1 ) is to be commissioned,   means for at least temporarily storing the read public key (NWN-PUB-KEY) in the device,   means ( 21 ) for transferring a provisional public (CD-PUB-KEY) key of the commissioning device (CD,  2 ) to the network node (NWN, 1 ) to be commissioned, the channel for transferring the provisional public key (CD-PUB-KEY), and   means for transferring the read public key (NWN-PUB-KEY) to a trust center (TC, 3 ).   
     
     
         2 . The mobile commissioning device (CD,  2 ) of  claim 1 , wherein at least one of
 the means ( 21 ) for transferring a CD-PUB-KEY key of the commissioning device (CD,  2 ) to the network node (NWN, 1 ) to be commissioned or the means for transferring the NWN-PUB-KEY to the trust center (TC,  3 ) is a communication interface ( 21 ) for communicating on the wireless network.   
     
     
         3 . The mobile commissioning device (CD,  2 ) of  claims 1 , wherein
 the means ( 22 ) for reading the NWN-PUB-KEY from a network node (NWN, 1 ) to be integrated in the wireless network is a sensor ( 22 ) for actively and/or passively obtaining ( 4 ) the NWN-PUB-KEY from the network node (NWN, 1 ).   
     
     
         4 . The mobile commissioning device (CD,  2 ) of  claim 1 , wherein
 the means for at least temporarily storing the NWN-PUB-KEY is a memory internal and/or external memory to the mobile commissioning device and wherein the memory additionally stores at least one certificate, signed data record and/or nonce (OTR), and wherein the   mobile commissioning device (CD,  2 ) is configured to transfer the NWN-PUB-KEY and the at least one certificate, signed data record and/or nonce (OTR) to the trust center (TC, 3 ).   
     
     
         5 . The mobile commissioning device (CD,  2 ) of  claim 4 , wherein
 the storing means is removable and/or exchangeable and/or the mobile commissioning device (CD,  2 ) generates the certificate, signed data record and/or nonce (OTR).   
     
     
         6 . The mobile commissioning device (CD,  2 ) of  claim 4 , further comprising a computing means for generating the certificate, signed data record and/or nonce (OTR) from the first public key (NWN-PUB-KEY) obtained by the reading means ( 22 ). 
     
     
         7 . The mobile commissioning device (CD,  2 ) of  claim 1 , further comprising a computing means for generating, or together with a network node (NWN, 1 ) agreeing to, a nonce. 
     
     
         8 . The mobile commissioning device (CD,  2 ) of  claim 1 , wherein
 the reading means is at least one of a barcode-reader, an RFID-reader, NFC-interface, a smartcard-reader or an optical and acoustical sensor.   
     
     
         9 . The mobile commissioning device (CD,  2 ) of  claim 1 , wherein the mobile commissioning device (CD,  2 ) encrypts the provisional public key (CD-PUB-KEY) with the read public key (NWN-PUB-KEY) and/or engages in a key establishment protocol. 
     
     
         10 . A network node (NWN, 1 ) for a public-key encrypted wireless network, the node comprising:
 a means for providing ( 12 ) a public key (NWN-PUB-KEY) of the network node (NWN, 1 ), the channel over which the public key (NWN-PUB-KEY) is provided being physically different to the wireless network channel for which the node (NWN, 1 ) is to be commissioned,   a storing means for storing at least temporarily a provisional public key (CD-PUB-KEY) transferred ( 5 ) to the network node (NWN, 1 ) to be commissioned, the channel for transferring the provisional public key (CD-PUB-KEY), and a storing means for permanently storing a permanent public key (TC-PUB-KEY) transferred to the network node (NWN, 1 ) from a trust center (TC, 3 ).   
     
     
         11 . The network node (NWN, 1 ) of  claim 10 , wherein the provisional public key (CD-PUB-KEY) and/or the permanent public key (TC-PUB-KEY) are transferred to the network node (NWN, 1 ) via a communication means ( 12 ) comprised in the network node (NWN, 1 ). 
     
     
         12 . The network node (NWN, 1 ) of  claim 11 , wherein the communication means ( 12 ) is a communication interface for communicating on the wireless network, and wherein
 the means for providing ( 12 ) a public key (NWN-PUB-KEY) of the network node (NWN, 1 ), is configured to provide the public key (NWN-PUB-KEY) in such a way that it can be actively or passively ( 4 ) read by a reading means ( 22 ) of a mobile commissioning device (CD,  2 ).   
     
     
         13 . The network node (NWN, 1 ) of  claim 10 , further comprising a computing means to check the validity of a certificate, signed data record and/or nonce (OTR) transferred to the network node (NWN, 1 ). 
     
     
         14 . The network node (NWN, 1 ) of  claim 13 , wherein
 the network node (NWN, 1 ) stores the permanent public key (TC-PUB-KEY) in the storing means after the network node (NWN, 1 ) verified the certificate, signed data record and/or nonce (OTR).   
     
     
         15 . The network node (NWN, 1 ) of  claim 11 , wherein the permanent public key (TC-PUB-KEY) invalidates and/or replaces the preliminary public key (CD-PUB-KEY). 
     
     
         16 . The network node (NWN, 1 ) of  claim 11 , wherein the providing means ( 12 ) provides, in addition to the public key (NWN-PUB-KEY), an identifier. 
     
     
         17 . The network node (NWN, 1 ) of  claim 11 , wherein the providing means ( 12 ) is at least one of a barcode, RFID-tag, NFC interface, smartcard, a LED interface or an acoustic interface. 
     
     
         18 . A trust center unit (TC, 3 ) in a network, the trust center (TC, 3 ) comprising:
 a communication means ( 31 ) for communicating on a wireless network, wherein the trust center (TC, 3 ) is configured to receive ( 6 ) at least one public key of a (NWN-PUB-KEY) of at least one network node (NWN, 1 ) to be integrated in the wireless network from a mobile commissioning device (CD,  2 ), and wherein the trust center (TC, 3 ) is further configured to transfer ( 7 ) its public key (TC-PUB-KEY) to the at least one network node (NWN, 1 ),   wherein the trust center (TC, 3 ) is configured to additionally receive ( 6 ) at least one certificate, signed data record and/or nonce (OTR) from the mobile commissioning device (CD,  2 ) to transfer ( 7 ) the at least one certificate, signed data record and/or nonce (OTR) to the at least one network node (NWN, 1 ) with the permanent public key (TC-PUB-KEY).   
     
     
         19 . The trust center (TC, 3 ) of  claim 18 , further comprising a storage means reader for reading a storage means of a mobile commissioning device (CD,  2 ). 
     
     
         20 . The trust center unit (TC, 3 ) of  claim 19 , wherein the storage means reader is a reader for a exchangeable and/or removable storage means. 
     
     
         21 . The trust center unit (TC, 3 ) of  claim 18 , wherein the trust center (TC, 3 ) replaces a previously transmitted public key of a commissioning device (CD-PUB-KEY) by its own TC-PUB-KEY within the storage means of all network nodes (NWN, 1 ). 
     
     
         22 . The trust center unit (TC, 3 ) of  claim 18 , wherein the trust center (TC, 3 ) uses the public key (NWN-PUB-KEY) of the at least one network node (NWN, 1 ) and/or a certificate, signed data record and/or nonce (OTR) to encrypt and/or securely transfer the trust center key (TC-PUB-KEY) to the at least one network node (NWN, 1 ). 
     
     
         23 . A method for commissioning wireless public-key encrypted networks, the method comprising the steps of:
 obtaining ( 4 ) a public key (NWN-PUB-KEY) of a network node (NWN, 1 ), the channel over which the public key (NWN-PUB-KEY) is obtained being physically different to the wireless network channel for which the node (NWN, 1 ) is to be commissioned,   storing the obtained public key (NWN-PUB-KEY) to a storing means of a mobile commissioning device (CD,  2 ),   transferring ( 5 ) a preliminary public key (CD-PUB-KEY) from the mobile commissioning device (CD,  2 ) to the network node (NWN, 1 ),   transferring ( 6 ) the public key (NWN-PUB-KEY) of the network node (NWN, 1 ) from the mobile commissioning device (CD,  2 ) to a trust center (TC, 3 ), and   transferring ( 7 ) a permanent public key (TC-PUB-KEY) from the trust center to the network node (NWN,  1 ).   
     
     
         24 . The method of  claim 23 , wherein a certificate, signed data record and/or nonce (OTR) is additionally transferred from the mobile commissioning device (CD,  2 ) to a trust center (TC, 3 ) and wherein the certificate, signed data record and/or nonce (OTR) is transferred with the permanent public key (TC-PUB-KEY) to network node (NWN, 1 ). 
     
     
         25 . The method of  claim 23 , wherein the certificate, signed data record and/or nonce (OTR) is generated by the mobile commissioning device (CD,  2 ). 
     
     
         26 . The method of  claim 23 , wherein the certificate, signed data record and/or nonce (OTR) is generated by the network node (NWN, 1 ) and transferred to the mobile commissioning device (CD,  2 ). 
     
     
         27 . The method of  claim 23 , wherein the certificate, signed data record and/or nonce (OTR) is jointly negotiated by the network node (NWN, 1 ) and the mobile commissioning device (CD,  2 ). 
     
     
         28 . The method of  claim 23 , wherein before the preliminary public key (CD-PUB-KEY) is transferred to the network node (NWN, 1 ), the network node (NWN, 1 ) is powered and/or the network node (NWN, 1 ) scans for available networks. 
     
     
         29 . The method of  claim 23 , wherein the mobile commissioning device (CD,  2 ) acts as temporary trust center. 
     
     
         30 . The method of  claim 23 , wherein after the transfer of the preliminary public key (CD-PUB-KEY) to the network node (NWN, 1 ), the network node (NWN, 1 ) provides a specified level of functionality. 
     
     
         31 . The method of  claim 23 , wherein a storing means removable from the mobile commissioning device (CD,  2 ) is used to transfer the public key (CD-PUB-KEY) of the network node (NWN, 1 ) and/or the certificate (OTR) to the trust center (TC, 3 ). 
     
     
         32 . The method of  claim 23 , wherein after the transfer of the permanent public key (TC-PUB-KEY) to the network node (NWN, 1 ) it is determined whether a correct number and/or type of network nodes (NWN, 1 ) is present in the network and/or devices are detected with wrong security parameters to exclude from the network. 
     
     
         33 . A system comprising:
 at least one network node (NWN, 1 ) according to  claim 10 ,   at least one mobile commissioning device (CD,  2 ) for assisting in the commissioning of wireless public-key encrypted networks, the device comprising:   means for reading ( 22 ) the public key (NWN-PUB-KEY) from a network node (NWN, 1 ) to be integrated in the wireless network, the channel for reading the public key (NWN-PUB-KEY) being physically different to the wireless network channel for which the node (NWN, 1 ) is to be commissioned,   
       the network node being a participant of a wireless building automation network,
 means for at least temporarily storing the read public key (NWN-PUB-KEY) in the device, 
 means ( 21 ) for transferring a provisional public (CD-PUB-KEY) key of the commissioning device (CD,  2 ) to the network node (NWN, 1 ) to be commissioned, the channel for transferring the provisional public key (CD-PUB-KEY) being the wireless channel for which the node (NWN, 1 ) is to be commissioned, and 
 means for transferring the read public key (NWN-PUB-KEY) to a trust center (TC, 3 ); and 
 a trust center comprising: 
 a communication means ( 31 ) for communicating on a wireless network, wherein the trust center (TC, 3 ) is configured to receive ( 6 ) at least one public key of a (NWN-PUB-KEY) of at least one network node (NWN, 1 ) to be integrated in the wireless network from a mobile commissioning device (CD,  2 ), and wherein the trust center (TC, 3 ) is further configured to transfer ( 7 ) its public key (TC-PUB-KEY) to the at least one network node (NWN, 1 ), 
 wherein the trust center (TC, 3 ) is configured to additionally receive ( 6 ) at least one certificate, signed data record and/or nonce (OTR) from the mobile commissioning device (CD,  2 ) to transfer ( 7 ) the at least one certificate, signed data record and/or nonce (OTR) to the at least one network node (NWN, 1 ) with the permanent public key (TC-PUB-KEY). 
 
     
     
         34 . The system of  claim 33  using a commissioning method comprising the steps of:
 obtaining ( 4 ) a public key (NWN-PUB-KEY) of a network node (NWN, 1 ), the channel over which the public key (NWN-PUB-KEY) is obtained being physically different to the wireless network channel for which the node (NWN, 1 ) is to be commissioned, 
 storing the obtained public key (NWN-PUB-KEY) to a storing means of a mobile commissioning device (CD,  2 ), 
 transferring ( 5 ) a preliminary public key (CD-PUB-KEY) from the mobile commissioning device (CD,  2 ) to the network node (NWN, 1 ), 
 transferring ( 6 ) the public key (NWN-PUB-KEY) of the network node (NWN, 1 ) from the mobile commissioning device (CD,  2 ) to a trust center (TC, 3 ), and 
 transferring ( 7 ) a permanent public key (TC-PUB-KEY) from the trust center to the network node (NWN,  1 ).