Methods for association between a gateway and a device in a communication network, and associated devices
Patent Information
- Application Number
- EP2024790998
- Authority / Receiving Office
- EP · EP
- Patent Type
- Applications
- Current Assignee / Owner
- Priority Date
- 2023-10-30
- Filing Date
- 2024-10-21
- Publication Date
- 2026-09-09
AI Technical Summary
Existing association processes between devices and communication networks often compromise data security during the device installation phase, particularly when a new device communicates with a network control system.
An association process between a bridge and a device in a communication network, where the bridge and device communicate securely using a unique identifier and encryption key generated by the gateway, ensuring secure exchanges during association and subsequent data transmissions.
The proposed solution ensures secure data exchanges during device association and subsequent communication, protecting against data security risks by using a unique encryption key and identifier specific to each device.
Smart Images
Figure EP2024079625_08052025_PF_FP_ABST
Abstract
Description
[0001] DESCRIPTION
[0002] TITLE: Methods of association between a gateway and a device in a communication network, and associated devices
[0003] Technical field
[0004] Methods of associating a gateway with a device in a communications network, and associated devices, are described.
[0005] Technical background
[0006] In many applications, installing a device in a network can pose security risks to the data associated with that installation. This is particularly true when a new device must communicate with a network control device during the association phase of the new device.
[0007] There is a need for an association method that takes these aspects into account.
[0008] Summary
[0009] One or more embodiments relate to a method of association between a gateway and a device in a communication network, the gateway and the device being configured to communicate with each other, the device comprising a memory, the memory of the device comprising a code specific to the device, the method comprising: a) reading the code specific to the device; b) providing the code specific to the device to the gateway; characterized by c) generating, by the gateway, an encryption key and an identifier of the device, the identifier being unique on the communication network and constituting an address of the device on the network; d) encrypting, by the gateway, a message comprising the encryption key and the identifier, the encryption being a function of the code specific to the device; e) broadcasting, by the gateway, the encrypted message on the communication network; f) receiving, by the device, the encrypted message;(g) decryption, by the device, of the encrypted message using the device's own code; (h) transmission, between the gateway and the device, of encrypted data with the encryption key, the transmission, by the gateway to the device, of the encrypted data being carried out in point-to-point mode using the identifier.;
[0010] Exchanges during the association and subsequent exchanges relating to data are thus secure.
[0011] The transmission encryption key is transmitted by the gateway as soon as a device is associated, at the same time as an identifier is assigned to this device, this transmission being itself encrypted using a code specific to the device. This specific code will however no longer be used for the encryption of subsequent exchanges - the exchanges are then encrypted using the transmission encryption key.
[0012] According to one or more exemplary embodiments, the provision of the device's own code to the gateway is carried out via a user.
[0013] According to one or more exemplary embodiments, the device's own code being associated with the device in a manner visible to the user, the provision of the code to the gateway comprising one of: the user entering the code via a user interface of the gateway; and reading the code using a reading device manipulated by the user and the transmission of the code by the reading device to the gateway.
[0014] According to one or more exemplary embodiments, the device-specific code is a fixed random code stored by the device.
[0015] According to one or more exemplary embodiments, the gateway and the device are integrated: in the same electrical power bar; or in separate electrical power bars.
[0016] According to one or more exemplary embodiments, the method comprises, for the generation of the encryption key, the application of a random algorithm.
[0017] According to one or more exemplary embodiments, the method comprises applying a first algorithm for encrypting and decrypting the message and a second algorithm for encrypting and decrypting the data. According to one or more exemplary embodiments, the first and second algorithms are 128-bit AES algorithms.
[0018] According to one or more exemplary embodiments, the provision of the device's own code to the gateway is carried out: in clear; or in encrypted form.
[0019] One or more embodiments also relate to a system comprising a gateway and at least one device, the gateway and the at least one device being configured to communicate with each other, the gateway and the at least one device each comprising a respective processor, respective memories and respective software code, the memory of a given device among the at least one device comprising code specific to that given device, the gateway and the at least one device being configured to implement one of the described methods.
[0020] According to one or more exemplary embodiments, the gateway and the device are integrated into separate power supply bars.
[0021] One or more embodiments also relate to a method of association between a gateway and a device in a communication network, the gateway and the device being configured to communicate with each other, the method comprising: a) receiving, by the gateway, a device specific code by the gateway, the code being provided to the gateway by a user; characterized by b) generating, by the gateway, an encryption key and an identifier of the device, the identifier being unique on the communication network and constituting an address of the device on the network; c) encrypting, by the gateway, a message comprising the encryption key and the identifier, the encryption being a function of the device specific code; d) broadcasting, by the gateway, the message encrypted by the gateway on the communication network; e) encrypting, by the gateway, the data to be transmitted using the encryption key;and transmitting encrypted data in point-to-point mode, by the gateway to the device, using the identifier. According to one or more exemplary embodiments, the device's own code being associated with the device in a manner visible to the user, the provision of the code to the gateway comprising one of: the user entering the code via a user interface of the gateway; and reading the code using a reading device manipulated by the user and transmitting the code by the reading device to the gateway.;
[0022] One or more embodiments also relate to a gateway in a system of communicating devices comprising a device other than the gateway, the gateway being configured to communicate with the device, the gateway comprising a processor and a memory comprising software code, the processor being configured, when executing the software code, to implement one of the described methods.
[0023] One or more embodiments relate to a computer program product which, when the program is executed by a processor of a device, causes the device to implement at least one of the described methods.
[0024] One or more embodiments relate to a recording medium readable by a device having a processor, said medium comprising instructions which, when the program is executed by a processor of a device, cause the device to implement at least one of the described methods.
[0025] Brief description of the figures
[0026] Other characteristics and advantages will appear during the reading of the detailed description which follows for the understanding of which one will refer to the attached drawings among which:
[0027] - Figure 1 is a block diagram of a system comprising a gateway and one or more devices, according to one or more embodiments;
[0028] - Figure 2 is a sequencing diagram illustrating a communication method according to one or more embodiments;
[0029] - Figure 3 is a functional block diagram of a device, according to one or more exemplary embodiments. Detailed description
[0030] In the following description, identical, similar or analogous elements will be designated by the same reference numbers.
[0031] The block diagrams, flowcharts, and message sequence diagrams in the figures illustrate the architecture, functionality, and operation of systems, devices, processes, and computer program products according to one or more exemplary embodiments. Each block of a block diagram or each phase of a flowchart may represent a module or a portion of software code comprising instructions for implementing one or more functions. In some implementations, the order of the blocks or phases may be changed, or the corresponding functions may be implemented in parallel. The process blocks or phases may be implemented using circuitry, software, or a combination of circuitry and software, in a centralized manner, or in a distributed manner, for all or some of the blocks or phases.The systems, devices, methods, and processes described may be modified, added to, and / or deleted from within the scope of this disclosure. For example, components of a device or system may be integrated or separated. Also, the described functions may be implemented using more or fewer components or phases, or with other components or through other phases. Any suitable data processing system may be used for the implementation. For example, a suitable data processing system or device includes a combination of software code and circuitry, such as a processor, controller, or other circuitry suitable for executing the software code. When the software code is executed, the processor or controller causes the system or device to implement some or all of the functionalities of the blocks and / or phases of the methods or processes according to the exemplary embodiments.Software code may be stored in memory or a readable medium accessible directly or through another module by the processor or controller.
[0032] Figure 1 is a schematic diagram of a system 100 according to one or more embodiments. The illustrated system comprises a gateway 101 connected to an external communication network not illustrated by a connection 106. The system further comprises one or more power bars 102a to 102c. Each bar respectively comprises a control module 103a to 103c, as well as one or more electrical outlets (104a_1 to 104a_i, 104b_1 to 104bJ, 104c_1 to 104c_k, where i, j, k are integers greater than or equal to zero). The role of a module 103a to 103c is to ensure communication with the gateway 101. A module may, depending on the implementations, also have the role of controlling the electrical outlet(s) of the bar in which this module is integrated. A communication bus 107 connecting the gateway 101 and the bar control modules 102a to 102c is schematically illustrated in Figure 1.Via the gateway, it is thus possible to communicate with all of the system's control modules.
[0033] Each of the bars 102a to 102c is associated with a code specific to it, respectively referenced 105a to 105c. This is a code making it possible to distinguish one bar from another in a unique way. This code is for example associated with a bar during its manufacture.
[0034] The code is accessible by a user, either directly or using a reading device. For example, a code may be readably accessible for each bar. It may, for example, be in the form of a number, a bar code, or a quick response code (QR code) on the bar itself or in documentation associated with the bar. In the example system of Figure 1, a quick response code is affixed as a label to each bar 102a to 102c.
[0035] In the illustrative example of Figure 1, the gateway 101 and the power bars 102a to 102c are separate devices. However, it is entirely possible for the gateway to be integrated into one of the power bars.
[0036] Element 108 of Figure 1 is the element whose function is to serve as a communication vector of the code 105a to 105c to the gateway 101. This element may differ depending on the implementations.
[0037] For example, the element 108 is a physical person (operator, installer, user, etc.) who will read the code and provide it to the gateway via an appropriate user interface. The code is, for example, entered on a 'web' page of the gateway via a computer (not shown) connected to the gateway. According to another embodiment, the person uses a reading device which, after reading the code, transmits it to the gateway, for example via a wireless link. This device is, for example, a portable device having a barcode reader function, a quick response code reader, or a plain text reader. For example, the device is a mobile phone or a tablet, equipped with a camera and a dedicated application. According to another exemplary embodiment, the element 108 operates in a completely automated manner.The gateway's own code is provided either securely (e.g., encrypted) or in clear text. Having this communication happen through a person provides a degree of security. If the device's own code is communicated using a tool, such as a handheld device as mentioned above, then this communication can be encrypted. This is particularly useful in the case of wireless communication.
[0038] The communication bus 107 may be a wired or wireless bus. In the case of a wired bus, it is, for example, a bus using RS485 type cables. The connection 106 is, for example, a wired connection of the Ethernet type, but may also be of a different nature, depending on the context.
[0039] In a specific terminology, the gateway may also be referred to as a 'node' and the 103a-c modules as 'bases'. Power strips may also be referred to as power distribution units (PDUs). Outlets may also be referred to as 'sockets'.
[0040] The code specific to each 103a-c module is, for example, a 128-bit installation code as defined in the ZigBee standard (registered trademark) and stored in a module at the time of its manufacture.
[0041] Figure 2 is a sequencing diagram illustrating a method according to one or more exemplary embodiments, between the gateway 101, a module 103x and the element 108.
[0042] According to 201 and 202, the code specific to the module 103x is provided to the gateway. In the illustrated case, this provision is carried out via the element 108, which can be a user or a user equipped with a suitable device.
[0043] In 203, the gateway determines on the one hand a transmission encryption key and an identifier of the 103x module.
[0044] The transmission encryption key is used to encrypt and decrypt communications between the gateway and the 103x module. For example, it is a symmetric key.
[0045] According to one embodiment, an 'AES' key is used, for example 128 bits.
[0046] The generation of the transmission encryption key by the gateway can, for example, be done randomly. The module identifier is intended to uniquely identify the module on the communication bus 107. This identifier thus constitutes an address of the module 103x on the network.
[0047] The generation of this identifier can for example be achieved by taking the value of a counter of sufficient length in relation to the maximum number of modules on the 107 bus, a counter which will be incremented for each 103x module.
[0048] At 204, the gateway transmits the encryption key and the identifier to the module 103x in encrypted form. This transmission is carried out, for example, by broadcasting, on the communication bus 107, a message comprising this information, the message being encrypted using, as the encryption key, the code specific to the module 103x. Only the module 103x possessing this code can decrypt the message and thus obtain the transmission encryption key and the identifier.
[0049] According to an alternative embodiment, the encryption key is derived from the code specific to the 103x module by means of an algorithm known both to the gateway and to the 103x module.
[0050] At 205, module 103x acknowledges receipt of the message. At this point, module 103x is considered associated by gateway 101.
[0051] Subsequently, the gateway will be able to transmit messages to the 103x module in point-to-point mode, using the identifier. The 103x module will be able to identify a message concerning it based on this identifier used as a destination address. Both the gateway and the 103x module will use the transmission encryption key to encrypt and decrypt at least the payload of the exchanged messages (206).
[0052] Figure 3 is a block diagram of a device 300 comprising a processor 301, a memory 302, a communication interface 303 and a communication bus 304 connecting these components. The memory 302 comprises software code 305. The device may comprise other functional components. The communication interface is adapted to communicate on one or more media (wireless network, wired network, etc.), depending on the function of the device 300. When the processor 301 executes the software code, it causes the device to implement one of the methods described, or one of the methods described as seen from a particular device. For example, the device 300 is a possible simple implementation for a communication module 103a-c or the gateway 101. A communication module communicates with the sockets of its power bar in a manner known elsewhere.
Claims
CLAIMS 1. A method of association between a gateway (101) and a device (103a-c) in a communication network, the gateway and the device being configured to communicate with each other, the device comprising a memory, the memory of the device comprising a code specific to the device, the method comprising: a) reading (201) the device's own code; b) providing (202) the device's own code to the gateway; characterized by c) generating (203), by the gateway, an encryption key and an identifier of the device, the identifier being unique on the communication network and constituting an address of the device on the network; d) encrypting, by the gateway, a message comprising the encryption key and the identifier, the encryption being a function of the device's own code; e) broadcasting (204), by the gateway, the encrypted message on the communication network; f) receiving, by the device, the encrypted message;(g) decryption, by the device, of the encrypted message using the device's own code; transmission, between the gateway and the device, of encrypted data with the encryption key; transmission, by the gateway to the device, of the encrypted data being carried out in point-to-point mode using the identifier.; 2. Method according to claim 1, in which the reading and provision of the device's own code are carried out by means of a user.
3. The method of claim 2, wherein the device's own code is associated with the device in a manner visible to the user, providing the code to the gateway comprising one of: entering the code by the user via a user interface of the gateway; and reading the code using a reading device operated by the user and transmitting the code by the reading device to the gateway.
4. Method according to one of the preceding claims, in which the code specific to the device is a fixed random code stored by the device.
5. Method according to one of the preceding claims, in which the gateway and the device are integrated: in the same electrical power bar; or in separate electrical power bars.
6. Method according to one of the preceding claims, comprising, for the generation of the encryption key, the application of a random algorithm.
7. Method according to one of the preceding claims comprising the application of a first algorithm for the encryption and decryption of the message and a second algorithm for the encryption and decryption of the data.
8. The method of claim 7, wherein the first and second algorithms are 128-bit AES algorithms.
9. Method according to one of claims 1 to 8, the provision of the device's own code to the gateway being carried out: in clear text; or in encrypted form.
10. System comprising a gateway (101) and at least one device (103a-c), the gateway and the at least one device being configured to communicate with each other, the gateway and the at least one device each comprising a respective processor, respective memories and respective software code, the memory of a given device among the at least one device comprising code specific to this given device, the gateway and the at least one device being configured to implement a method according to one of claims 1 to 9.
11. The system of claim 10, wherein the gateway and the device are integrated into separate power bars.
12. A method of association between a gateway (101) and a device (103a) in a communication network, the gateway and the device being configured to communicate with each other, the method comprising: a) receiving (202), by the gateway, a code specific to the device by the gateway, the code being provided to the gateway by a user; characterized by b) generating (203), by the gateway, an encryption key and an identifier of the device, the identifier being unique on the communication network and constituting an address of the device on the network; c) encrypting, by the gateway, a message comprising the encryption key and the identifier, the encryption being a function of the code specific to the device; d) broadcasting (204), by the gateway, the message encrypted by the gateway on the communication network; e) encrypting (206), by the gateway, data to be transmitted using the encryption key;and the transmission in point-to-point mode, by the gateway to the device, using the identifier, of the encrypted data.; 13. The method of claim 12, wherein the device's own code is associated with the device in a manner visible to the user, providing the code to the gateway comprising one of: entering the code by the user via a user interface of the gateway; and reading the code using a reading device operated by the user and transmitting the code by the reading device to the gateway.
14. Gateway (101) in a system of communicating devices comprising a device (103a) other than the gateway, the gateway being configured to communicate with the device, the gateway comprising a processor and a memory comprising software code, the processor being configured, when executing the software code, to implement the method according to one of claims 12 or 13.