Apparatus and method for incorporating a device into a local area network

Abstract

A method (300) for incorporating a device (130) into a LAN (111) is described, wherein the device (130) has a certificate (213) derived from a device reference certificate (211). The method (300) comprises checking (301) whether the certificate (213) of the device (130) matches at least one reference certificate (201) available on a first access point (110) to a first LAN (111). In addition, the method (300) comprises incorporating (302) the device (130) into the first LAN (111) when it is ascertained that the certificate (213) of the device (130) matches at least one reference certificate (201) available on the first access point (110).

Description

Technical Field

[0001] This invention relates to an efficient, reliable and convenient method for integrating devices, especially home appliances, into a local area network (LAN). Background Technology

[0002] When users bring new LAN-compatible devices, especially new home appliances, home, they typically need to spend a relatively long time integrating the devices into their LAN. Summary of the Invention

[0003] The present invention relates to the following technical objective: enabling the integration of LAN-compatible devices into a LAN in a particularly convenient, reliable, and secure manner.

[0004] This task is addressed by the subject matter of the present invention. Advantageous embodiments are particularly defined in the present invention, described in the following description, or shown in the accompanying drawings.

[0005] According to one aspect of the invention, a method (implemented by a computer if necessary) for incorporating a device into a local area network (LAN), particularly a wireless LAN, is described. The device may be, in particular, a household appliance, such as an oven, refrigerator, stove, dishwasher, washing machine, dryer, food processor, coffee maker, etc. The device may include a communication module configured to establish a wired and / or wireless LAN connection (particularly according to IEEE 802.11) to an access point. The method can be implemented through a (first) access point.

[0006] The device has a certificate derived from a device reference certificate. This certificate can be derived from the device reference certificate along a device certificate chain via one or more intermediate certificates. The device reference certificate can be assigned to a specific entity (e.g., the manufacturer of the device). Different certificates can then be generated for different devices of that entity from the device reference certificate, and these certificates can be provided on the respective devices. The certificates can be stored separately on the memory units of the respective devices, particularly on a Trusted Platform Module (TPM) or other memory solutions deemed secure. The device can be configured to retrieve the device certificate chain from its own certificate, and / or the device can be configured to provide the device certificate chain fully or partially. The device certificate chain can, for example, be stored on the device.

[0007] An entity's reference certificate can be the entity's root certificate or a certificate derived from the entity's root certificate. In this document, the term "device reference certificate" should be understood as a reference certificate of an entity from which the device's certificate (i.e., the certificate stored on the device and / or assigned to the device) is derived. Therefore, a device reference certificate is a specific reference certificate for a defined entity (especially a defined entity to which the device is assigned).

[0008] The method includes verifying whether the device's certificate matches at least one reference certificate available at a first access point to the first (W) LAN. Specifically, the availability of the device reference certificate (i.e., a reference certificate from which the device's certificate is derived) at the first access point can be verified based on the device's certificate, particularly whether the device reference certificate is stored on a memory unit at the first access point, such as on the first access point's TPM or other memory solution deemed secure.

[0009] For example, at the first access point, a list of one or more (if necessary, different entities) reference certificates may be available. This list may be provided in the first access point, for example, during its manufacture. In particular, the list of one or more reference certificates may be stored on the memory unit of the first access point, especially on the TPM of the first access point. Then, it can be verified in an efficient and reliable manner whether a device reference certificate is included in the list of one or more reference certificates, and / or whether the device certificate is derived (along the reference chain) from one of the reference certificates in the list.

[0010] Furthermore, the method includes incorporating the device into the first (W) LAN when the device's certificate is derived from at least one reference certificate available at the first access point. The device may be incorporated into the first LAN when, in particular only when it is determined that a device reference certificate (i.e., a reference certificate from which the device's certificate is derived) is included in a list having one or more reference certificates, or when, in particular only when the device's reference certificate is available at the first access point, or when, in particular only when the device's certificate is derived from a reference certificate available at the first access point (and is valid in an information security sense).

[0011] This method enables the efficient, convenient, and secure integration of devices into a (W)LAN. This integration can be automated, without requiring user input of access data to the LAN (e.g., a pre-shared key (PSK)). The integration can, for example, occur automatically when the device is put into use.

[0012] The method may include: determining one or more network elements for which the device has access rights via a first LAN. Here, the one or more network elements are located in a wide area network (WAN) outside the first LAN (e.g., in the Internet). The one or more network elements may be listed in a list stored at the first access point. The one or more network elements may be operated or provided by an entity that is assigned a device reference certificate.

[0013] The integration of the device into the first LAN can be restricted to access to the one or more network units. Specifically, this can be achieved through the first access point: the device can only access the one or more network units and has no other access to components of the first LAN or other components of the WAN. This further enhances the security of the device's (automatic) integration.

[0014] The method may include: providing a communication connection between the device and the one or more network units, via a first access point, particularly via a router of the first access point. This communication connection can then be used, for example, for remote maintenance of the device (starting from one or more network units). Therefore, it enables the device manufacturer to access the device in an efficient and reliable manner (because the device automatically connects to one or more of the manufacturer's network units, such as a server).

[0015] As described above, the list of one or more reference certificates can be available at the first access point, and in particular, can be stored at the first access point. This list can display at least one network element for each reference certificate (and for each entity associated therewith) such that a device with a certificate matching the corresponding reference certificate has access rights for that at least one network element. In this way, different entities can be enabled to access the corresponding entity's device in an efficient and secure manner.

[0016] The method may include: determining a device certificate chain between the device's certificate and a device reference certificate, wherein the device certificate chain shows one or more intermediate certificates between the device's certificate and the device reference certificate. The device certificate chain may be sent entirely or partially, for example, from the device to a first access point and received by the first access point. The device certificate chain can then be used to verify, in a particularly efficient and accurate manner, whether the device's certificate matches at least one reference certificate available on the first access point to the first LAN.

[0017] The first access point can be any access point where the device is located within the receiving area of ​​that access point. For example, in an urban environment, the first access point could be operated by a neighbor of a user of the device. The first access point enables first (temporary and / or restricted) access to the LAN and via that LAN to the WAN. For full access to the LAN and / or to the WAN, it may be necessary to connect the device (automatically) to a second access point (e.g., the user's access point).

[0018] As described above, the method includes determining at least one network unit where the device has access permissions via a first LAN. This network unit may display at least one second access point to a second LAN. This information may, for example, be stored in a user account of the device's user on that network unit. Access data to the second access point (e.g., a PSK to the second access point) may be stored in this user account.

[0019] Then, a communication connection can be established between the device and the network unit via the first access point, enabling the device to obtain access data from the second access point. This allows for automatic "connection" of the device from the first LAN to the second LAN, particularly enabling the device to achieve unrestricted access to the LAN and / or WAN (e.g., the Internet) within the second LAN, if necessary. Automatic integration into the second LAN further enhances user comfort. For example, integration into the second LAN can allow the user to remotely control the device (e.g., using an application device, such as a user's smartphone integrated into the second LAN).

[0020] For example, within the framework of this method, it can be verified whether remote control of the device should be performed via the user device. Then, a LAN can be determined where the user device is integrated. Specifically, it can be determined that the user device is integrated into a second LAN via a second access point. This can then automatically prompt the device to be integrated into the second LAN so that remote control of the device can be achieved via the user device. The method steps can be implemented, for example, via an access point and / or via the device.

[0021] According to another aspect of the invention, a method (implemented by a computer if necessary) for incorporating a device into a LAN is described. This method can be implemented using the device. Here, the device (e.g., on a TPM) has a certificate derived from a device reference certificate.

[0022] The method includes: identifying a first access point for a first LAN, on which a reference certificate is available, which matches the device's certificate, and in particular corresponds to a device reference certificate. In other words, a suitable first access point with a matching reference certificate can be found. The search for a suitable first access point can be initiated automatically by the device (without user interaction), for example, when the device is first put into operation.

[0023] Additionally, the method includes: integrating the device into a first LAN via a first access point. For this purpose, the device can be connected to the first access point. Access to the first LAN and / or to the WAN (if restricted) can then be achieved from the access point. Thus, convenient and secure access of the device to the LAN and / or to the WAN can be achieved.

[0024] The method includes accessing a network unit via a first access point. Here, the network unit (as described above) can be connected to at least one second access point of a second LAN. Access data (e.g., PSK) from the second access point can then be obtained from the network unit.

[0025] Then, when using access data to the second access point, the device can be (automatically) integrated into the second LAN via the second access point. On the other hand, the device can (automatically) deregister from the first access point. In this way, access to the second LAN (e.g., to the user's LAN) and (if necessary, complete) access to the WAN via the second LAN can be achieved in a particularly convenient and secure manner.

[0026] The method may include establishing a communication connection with the network unit via a first access point. Additionally, the method may include inducing maintenance actions on the device through access to the device via the first access point from the network unit. Therefore, it enables entities (such as device manufacturers) to perform maintenance actions efficiently and securely.

[0027] According to another aspect of the invention, an access point (i.e., device) to a LAN is described, wherein the access point is configured to verify whether the certificate of a device to be incorporated into the LAN matches a reference certificate available at the access point. Furthermore, the access point is configured to incorporate the device into the LAN when the retrieved certificate of the device matches a reference certificate available at a first access point. Additionally, the access point may be configured to implement at least one restricted access to a WAN (e.g., restricted to a restricted list of network elements (e.g., servers and / or URLs).

[0028] Resources can be permanently associated with corresponding reference certificates at the access point and / or on other routing components of the LAN: these resources can use devices in the LAN and / or WAN with defined certificates for specific entities (e.g., connections with one or more defined parameters, such as IP address, URL, protocol variant, port number, and the like). Therefore, access can be automatically restricted based on the affiliation between devices and entities. For example, a home appliance may only have permission to establish connections with a single server on the Internet, such as the backend of the home appliance manufacturer.

[0029] In a suitable user interface, an overview can be displayed to users or network administrators showing which reference certificates are available at the access point. Additionally, the associated permissions (URL, server, protocol variants, and similar) can be shown in this display.

[0030] The user interface provides users or administrators with the following possibilities: downloading, installing, deleting, activating, and / or deactivating (for a specific entity) a specific reference certificate. With the deactivation or removal of a reference certificate, any permissions currently connected to that access point (assigned to the deleted reference certificate by those devices) typically expire immediately. In particular, for those devices, the connection to the LAN can be interrupted.

[0031] According to another aspect of the invention, an apparatus is described having a certificate derived from a device reference certificate. The apparatus is configured to identify a first access point for a first LAN, on which a reference certificate is available, the reference certificate matching, and in particular corresponding to, the device's certificate. Furthermore, the apparatus is configured to, in response to this, initiate incorporation into the first LAN via the first access point.

[0032] It should be noted that any aspect of the methods and apparatus described in this document can be combined with each other in various ways. In particular, the features of the present invention can be combined with each other in various ways. Attached Figure Description

[0033] The invention will now be described in more detail with reference to embodiments shown in the accompanying drawings. Herein are shown: Figure 1 A block diagram of a system for integrating devices into a LAN is shown. Figure 2a An example list of certificates is shown; Figure 2b An example certificate chain is shown; Figure 3a and Figure 3b A flowchart illustrating an exemplary method for incorporating a device into a LAN is shown. Detailed Implementation

[0034] As mentioned at the beginning, this document addresses the convenient, secure, and reliable integration of devices, especially home appliances, into a LAN. In this context, Figure 1 An exemplary system 100 with a compatible LAN device 130 is shown. System 100 includes a first access point 110 (e.g., a router) to a first (W) LAN 111 and a second access point 120 (e.g., a router) to a second (W) LAN 121. Device 130 may include a communication module 132 that enables the device 130 to be incorporated into the first LAN 111 (for a first LAN connection 112) and / or the second LAN 121 (for a second LAN connection 122). Additionally, device 130 may have a control module 131 configured to control the operation of device 130.

[0035] Access points 110 and 120 can be configured to establish communication connections 113 and 123 with network unit 102 (e.g., having a server, such as in the cloud) in a wide area network (WAN, such as the Internet). LANs 111 and 121 can include, and in particular, wireless LANs (WLANs).

[0036] This document describes a method in which network device 130 automatically obtains network access, and, if necessary, full network access, and automatically obtains at least one access to a remote network unit 102 (e.g., to the network unit 102 of the manufacturer of device 130). This automatically constructed network access can be used to provide one or more services through network unit 102, such as firmware updates for device 130. This can be automatically set up and / or provided, if necessary, without user interaction, for example, when device 130 is first put into use (if necessary, only after user consent).

[0037] In urban environments (e.g., multi-family dwellings), it can be advantageous to establish access to network unit 102 via an auxiliary LAN 111, for example, via a neighbor's LAN 111, at least in the first step. This expands the available network coverage for the incorporated device 130. Here, the auxiliary access point 110 can be limited to enabling the connection between device 130 and network unit 102.

[0038] In another step, device 130 can be associated with one or more user accounts (on network unit 102) through a method such as OAUTH (Open Authorization) device authorization. Here, device 130 can also obtain information about the user's network infrastructure, particularly access point 120, if necessary. Specifically, device 130 can be incorporated into the user's LAN 121. Previously isolated and / or restricted (W)LAN access via secondary access point 110 can thus be converted into unrestricted access for device 130 via the second access point 120. The device is then a fully authenticated network device within the user's (W)LAN 121.

[0039] Therefore, a method is described by which a device 130 in a compatible network can, if necessary, initially join the (auxiliary) network 111 without user interaction and automatically acquire access to one or more defined resources 102, such as defined computing devices on the Internet. In particular, the user can be informed which device 130 accesses which resource 102.

[0040] An infrastructure for private keys can be provided by an entity, such as the manufacturer of device 130 or through the Wi-Fi Alliance, through which certificates are issued. The issued certificates preferably conform to a common standard, such as x.509. The certificates can then be stored (in a suitable encoding manner) on the components involved, particularly on one or more devices 130 and one or more access points 110, 120. Private keys can be securely stored on so-called Trusted Platform Modules (TPMs) and can be generated on the corresponding TPMs if necessary.

[0041] Within a PKI (Public Key Infrastructure), only a root certificate exists where necessary, and this root certificate has the longest possible lifespan, such as 30 years. All other certificates can be derived from this root certificate through one or more intermediate certificates (and multi-level certificates if necessary). Thus, for different groups of devices 130 (e.g., different manufacturers of devices 130), separate certificate trees can be created, each certificate tree being explicitly unique to the respective group of devices 130, and the leaves of this certificate tree can be assigned to specific subtrees (e.g., "Factory 1", "Factory 2", ...). An entity's (e.g., a manufacturer's) certificate tree can have a root certificate from which all certificates for that entity's group of devices 130 are derived.

[0042] Certificates and / or intermediate certificates can be created with the help of suitable metadata, which provides, for example, information about the relevant issuing entity of the certificate.

[0043] The validity of a certificate can be verified at any time through appropriate protocols and / or services, such as OCSP (Online Certificate Status Protocol) responses and / or OCSP bindings. Furthermore, the exchange of certificates among different network devices 130 can be achieved through appropriate, and where necessary, standardized methods.

[0044] Network device 130 may, for example, be equipped with a digital identity and at least one certificate during manufacturing. This certificate may be signed by an intermediate certificate from an intermediate certificate in a corresponding subtree of the certificate tree and may be securely stored in the device along with a private key in a suitable storage device (e.g., a TPM).

[0045] Additionally, the certificate chain up to the root certificate or up to the reference certificate derived from the root certificate can be stored in device 130 and can be transmitted to access points 110 and 120, for example, when establishing a connection, or can be communicated to access points 110 and 120 through other mechanisms. The certificate in device 130 may also store information on which Internet address allows access to the corresponding root certificate.

[0046] A root certificate or a reference certificate derived from the root certificate for the group of devices 130 can be provided in one or more access points or routers 110, 120. In particular, manufacturers or Wi-Fi alliances participating in the system 100 can transfer copies of their respective root certificates (or reference certificates derived from the root certificates) to the access points or routers 110, 120 in a suitable manner. Similar to a web browser's certificate store, the access points thus obtain information about trusted locations, which may be determined during the manufacturing of the access points 110, 120 if necessary.

[0047] Figure 2a An exemplary list 200 is shown, containing one or more root certificates or reference certificates 201 for one or more corresponding entities (e.g., manufacturers). For each entity, at least one network unit 102 (e.g., at least one Internet server) accessible via access points 110, 120 may be shown in list 200 if necessary. Within list 200, the one or more network units 102 may be listed in the field 202 for access rights.

[0048] Figure 2bAn exemplary certificate chain 210 is shown, comprising one or more intermediate certificates 212 between a device reference certificate 211 of an entity and a certificate 213 of device 130. The certificate chain 210 may be stored on device 130. All intermediate certificates 212 and device certificate 213 are derived sequentially from device reference certificate 211. Device reference certificate 211 of an entity (e.g., a device manufacturer) may be, for example, the root certificate of that entity. (As shown by...) Figure 2b As indicated by the arrows, different device certificates 213 for different devices 130 can be derived from reference certificate 211 and / or from intermediate certificate 212.

[0049] Once power is supplied to device 130, it can begin searching for a suitable access point 110, which contains the root certificate or reference certificates 210, 211 of certificate 213 for device 130, if necessary, through a suitable means, such as a Device Provisioning Protocol (DPP). The exact processing method is pre-defined by the corresponding protocol used.

[0050] When a suitable access point 110 is found, a secure LAN connection 112 can be established to access point 110 using a public key, and a corresponding certificate chain 210 can be transmitted. The provided certificate chain 210 has sufficient depth to enable access point 110 to assign the certificate chain 210 provided by device 130 to the root certificate 201 existing internally. If the certificate chain 210 can be successfully assigned, at least one resource 102 can be released for device 130.

[0051] Once the connection between device 130 and access point 110 is established at the network layer, higher-protocol-layer, dynamically determined data can be supplied to device 130, which is to be integrated into network 111. The permissions required for this can be provided, for example, through a shared secret (however, this requires prior exchange of secrets, such as passwords).

[0052] In the presence of a known root certificate or reference certificate 201, 211 at access point 110, access permissions can be granted automatically (without prior exchange of secrets). This allows for connection establishment in a particularly convenient and efficient manner. Specifically, a connection 112 to access point 110 can be automatically established after device 130 is connected, and access point 110 then automatically grants access to higher protocols and / or access to one or more defined routing destinations 102.

[0053] In particular, network devices 130 from known manufacturers of access point 110 can be automatically enabled for (at least or exactly) one network unit 102 on the Internet, such as a network unit explicitly identified in root certificates or reference certificates 201, 211. No user interaction is required for access to network unit 102. Conversely, access to other resources, such as the local intranet 110 and / or other targets / endpoints on the Internet, can be disabled.

[0054] For example, the x.509 extension of the root certificate or reference certificate 201, 211 can record which Internet addresses (“domain names”) the identified root authority or entity's device 130 should access. This access can then be restricted to the explicitly identified Internet addresses via access point 110. Data communications originating from device 130, destined for other addresses, or using other protocols can then be automatically rejected by access point 110.

[0055] If a device 130 that is not authorized through the list 200 of known certification authorities stored on access point 110 attempts to establish a connection to access point 110, its data communication may be automatically blocked by access point 110. Alternatively or supplementarily, the user may be provided with the option of whether the affected device 130 should be manually authorized.

[0056] If multiple access points 110 and 120 with corresponding permissions are located within the scope of device 130, device 130 can select the preferred access point 110 or 120 according to a suitable method (e.g., based on the highest corresponding signal strength and / or the highest corresponding data transmission rate). Here, it is also possible, if necessary, to select access points 110 and 120 that do not operate through users (but rather, for example, through neighbors).

[0057] After (restricted) incorporation into the first LAN 111, subsequent incorporation into another second LAN 121 can be made (e.g., to achieve unrestricted incorporation and / or unrestricted access). The second LAN 121 can be a user-operated LAN. For this purpose, WPS (Wi-Fi Protected Setup) can be used, allowing the input of a Wi-Fi password, and / or any other method if necessary, such as a forced portal and soft access point.

[0058] In a preferred embodiment, a user account can be provided to a user on network unit 102, on which, for example, the user's access point 120 can be registered. Within this user account, access point allocation can be managed, including access data from one or more of the user's network devices 130 to specific access points 120. This can be achieved by incorporating devices 130 initially connected to network unit 102 via external access point 110 into the user account. For this purpose, an OAUTH device authorization method, for example, can be used.

[0059] Once the association between device 130 and the user account is established, network unit 102 can select a suitable access point 120 for device 130 (e.g., based on the signal strength observed by network device 130 at possible access points 120). Then, the access data required for access to the selected access point 120 can be transmitted to network device 130. Device 130 can then automatically connect to access point 120.

[0060] Instead of or supplementing the automatic provision of root certificates or reference certificates 201, 211 and associated access rights to network unit 102, users can manually configure access points 110, 120 (through a user interface). For example, users can access access points 110, 120 via user device 140 (e.g., a smartphone or computer) (e.g., via LAN connection 124) to edit a list 200 containing one or more root certificates or reference certificates 201, 211 and / or entries 202 for access rights to one or more network units 102.

[0061] Access points 110 and 120 may provide users with, for example, an overview (e.g., through a user interface), which may have, for example, the following information and / or the following possibilities: • It can display one or more root certificates or reference certificates that have been installed (201); • It can display one or more parameters or necessary permissions for each root certificate or reference certificate 201, such as: endpoint 102 in the Internet, data transfer rate, service, protocol, required resources, etc.; • For each network device, there are 130 possibilities to edit, apply, or remove one or more restrictions: o Access to a defined endpoint 102, which is, for example, the manufacturer's infrastructure; o protocols (IP*, HTTP*, ...); o services (such as time servers); Other parameters (data transfer rate, access time limit, ...); • It can display the status of each network device 130, such as active connections, current data transfer rate, cumulative data volume, services used ("Manufacturer Backend", "Time Server", ...), fault status ("Root certificate or reference certificate expired", ...); and / or • When a new device 130 has been connected using the described method or when a connection is expected to be established, general settings, such as notification settings, can be made.

[0062] This information can be accessed on the local network 111, 121 via methods and protocols such as uPNP or HTTP when necessary, and can be analyzed, processed and modified by a suitable proxy, mobile device 140, web browser or similar device when necessary.

[0063] The measures described in this document enable users of device 130 to integrate device 130 into LANs 111 and 121 in a particularly convenient and secure manner, and to connect it to network unit 102 in the WAN when necessary (e.g., for maintenance work, for firmware updates, etc.).

[0064] Figure 3a A flowchart illustrates an exemplary method 300 for integrating a device 130 into a local area network (LAN) 111 and, if necessary, into a WAN via that LAN. The device is, in particular, a household appliance such as a food processor, oven, washing machine, stove, refrigerator, dishwasher, dryer, etc. Method 300 can be implemented via an access point 110 (particularly via a router) to the LAN 111. Here, access point 110 can be configured to provide a wireless LAN (WLAN).

[0065] Device 130 may have a certificate 213 derived from device reference certificate 211. Here, certificate 213 of device 130 may be generated from device reference certificate 211 via certificate chain 210 (with one or more intermediate certificates 212). Device 130 may be configured to provide certificate chain 210. The device's certificate 213 and the potentially provided certificate chain 210 may be stored on the trusted platform module (TPM) of device 130.

[0066] The method 300 includes: verifying whether the certificate 213 of device 130 matches at least one reference certificate 201 available on a first access point 110 to the first LAN 111. Specifically, it may verify whether a device reference certificate 211 of an entity on the first access point 110 (i.e., reference certificates 201, 211 from which the certificate 213 of device 130 is derived) is available. A list 200 having one or more reference certificates 201 (e.g., for corresponding manufacturers of device 130) may be stored in a memory unit of the first access point 110, particularly on a TPM. For each reference certificate 201, at least one network unit 102 may be identified (as a list entry 202) for which access via the first access point 110 is enabled when device 130 has a certificate 213 matching the corresponding reference certificate 201. Therefore, an access point 110 (especially a router) can be provided to enable automatic (restricted) LAN access and, if necessary, automatic (restricted) Internet access for the selected device 130.

[0067] Furthermore, method 300 includes: merging device 130 into the first LAN 111 when (only when necessary) the certificate 213 of device 130 matches at least one reference certificate 201 available on the first access point 110, by means of merging device 130 into the first LAN 111. Here, the merging 302 can be performed automatically, without requiring input from the user of device 130. Therefore, convenient and secure access to LAN 111 and / or network units 102 in the WAN can be achieved.

[0068] Figure 3b A flowchart is shown for an exemplary method 310 for incorporating device 130 into LAN 111, 121 and / or WAN. Method 310 can be implemented by device 130 in a manner complementary to method 300. Here, device 130 has a certificate 213 derived from the entity's device reference certificate 211.

[0069] Method 310 includes: identifying 311 a first access point 110 for the first LAN 111, on which an entity's reference certificate 201 is available, the reference certificate matching a certificate 213 of device 130, and in particular, the reference certificate corresponding to device reference certificate 211. For this purpose, device 130 may contact multiple different access points 110, 120 if necessary. Then, device 130's certificate 213 (in particular, device 130's certificate chain 210) may be sent to the respective access points 110, 120. The respective access points 110, 120 may then verify whether the reference certificate 201 (in particular, device reference certificate 211) matching certificate 213 is available on the respective access point 110, 120. Here, the process of identifying 311 the appropriate access point 110 can be automatically initiated by device 130 (without user input), for example, when device 130 is put into operation.

[0070] Furthermore, method 310 includes incorporating device 130 into a first LAN 111 via (identified) first access point 110. This enables convenient and secure access to LAN 111 (especially WLAN).

[0071] This invention is not limited to the embodiments shown. In particular, it should be noted that the specification and drawings are intended only to illustrate the principles of the proposed methods and apparatus.

Claims

1. A method (300) for incorporating a device (130) into a local area network (111), wherein the local area network is abbreviated as LAN; wherein, The device (130) has a certificate (213) derived from a device reference certificate (211); wherein the method (300) includes, - Verify (301) whether the certificate (213) of the device (130) matches at least one reference certificate (201) available on the first access point (110) to the first LAN (111); - Determine network unit (102): For the network unit, there is access permission of the device (130) via the first LAN (111), wherein the network unit (102) is located in a wide area network other than the first LAN (111), the wide area network being abbreviated as WAN, and the network unit (102) is shown to at least one second access point (120) of the second LAN (121). - When the certificate (213) of the device (130) is found to match at least one reference certificate (201) available on the first access point (110), the device (130) is incorporated (302) into the first LAN (111), wherein the incorporation of the device (130) into the first LAN (111) is restricted to access to the network unit (102), and - Establish a communication connection between the device (130) and the network unit (102) via the first access point (110) so that the device (130) can obtain access data from the second access point (120) from the network unit (102).

2. The method (300) according to claim 1, wherein, - A list (200) of one or more reference certificates (201) is available on the first access point (110); - The method (300) includes, - Determine whether the device reference certificate (211) is included in a list (200) having one or more reference certificates (201); - When it is determined that the device reference certificate (211) is included in a list (200) having one or more reference certificates (201), the device (130) is incorporated (302) into the first LAN (111).

3. The method (300) according to claim 2, wherein, A list (200) of one or more reference certificates (201) is stored in the memory cell of the first access point (110).

4. The method (300) according to any one of the preceding claims, wherein, - The verification (301) includes: verifying the certificate (213) of the device (130) to see if the device reference certificate (211) is available on the first access point (110); - When the device reference certificate (211) is found to be available on the first access point (110), the device (130) is incorporated into the first LAN (111) via the first access point (110).

5. The method (300) according to any one of claims 1 to 3, wherein, - A list (200) of one or more reference certificates (201) is available on the first access point (110); - The list (200) displays at least one network unit (102) for each of the reference certificates (201) as follows: For the at least one network unit (102), a device (130) having a certificate (213) that matches the corresponding reference certificate (201) has access rights.

6. The method (300) according to any one of claims 1-3, wherein, The method (300) includes, - Calculate the device certificate chain (210) between the certificate (213) of the device (130) and the device reference certificate (211); wherein the device certificate chain (210) shows one or more intermediate certificates (212) between the certificate (213) of the device (130) and the device reference certificate (211). - Based on the device certificate chain (210), check whether the certificate (213) of the device (130) matches at least one reference certificate (201) available on the first access point (110) to the first LAN (111).

7. A system including a device (130) and a first access point (110) to a first local area network (111), the local area network being abbreviated as LAN; in, The device has a certificate (213) derived from a device reference certificate (211); wherein the device (130) is configured to, - Identify a first access point (110) for the first LAN (111), on which a reference certificate (201) is available, the reference certificate being matched with the certificate (213) of the device (130); - In response to this, incorporation into the first LAN (111) is caused via the first access point (110); The first access point (110) is configured to, - Verify that the certificate (213) of the device (130) to be incorporated into the first LAN (111) matches the reference certificate (201) available on the first access point (110); Determine network unit (102): For the network unit, there is access permission of the device (130) via the first LAN (111), wherein the network unit (102) is located in a wide area network other than the first LAN (111), the wide area network being abbreviated as WAN, and the network unit (102) is shown to at least one second access point (120) of the second LAN (121). When the certificate (213) of the device (130) is found to match at least one reference certificate (201) available on the first access point (110), the device (130) is incorporated (302) into the first LAN (111), wherein the incorporation of the device (130) into the first LAN (111) is restricted to access to the network unit (102), and - Establish a communication connection between the device (130) and the network unit (102) via the first access point (110) so that the device (130) can obtain access data from the second access point (120) from the network unit (102).

Images