Methods for associating a gateway and a device in a communication network, and associated devices

Abstract

A method for associating a gateway (101) with a device (103a-c) is described, the device's memory containing a device-specific code. The method includes reading (201) the device's specific code and providing (202) the device's specific code to the gateway; the generation (203) by the gateway of an encryption key and a device identifier; the encryption of a message containing the encryption key and the identifier, the encryption being a function of the device's specific code, and the dissemination of the encrypted message; the reception and decryption, by the device, of the encrypted message; the encryption, by the gateway, of the data to be transmitted using the encryption key; and the point-to-point transmission, by the gateway to the device, using the identifier, of the encrypted data. Figure for the abstract: 2

Description

Title of the invention: Methods for associating a gateway and a device in a communication network, and associated devices technical field

[0001] Methods for associating a gateway and a device in a communication network are described, along with associated devices. Technical background

[0002] In many applications, installing a device in a network can pose risks to the security of the data associated with that installation. This is particularly true when a new device needs to communicate with a network control device during the association phase of the new device.

[0003] There is a need for an association process that takes these aspects into account. Summary

[0004] One or more embodiments relate to a method of association between a gateway and a device, the gateway and the device being configured to communicate with each other, the device comprising a memory, the device's memory comprising a code specific to the device, the method comprising:

[0005] a) reading the device's own code;

[0006] b) the provision of the device's own code to the gateway;

[0007] c) the generation, by the gateway, of an encryption key and an identifier of the device, the identifier being unique on the communication network;

[0008] d) the encryption, by the gateway, of a message containing the encryption key and the identifier, the encryption being a function of the device's own code;

[0009] e) the dissemination, via the gateway, of the encrypted message on the communication network;

[0010] f) the reception, by the device, of the encrypted message;

[0011] g) the decryption, by the device, of the encrypted message using the code specific to the device ;

[0012] h) the transmission, between the gateway and the device, of data encrypted with the encryption key.

[0013] Exchanges during the association and subsequent exchanges relating to data are thus secured.

[0014] The encryption key for transmissions is transmitted by the gateway as soon as a device is associated, at the same time as an identifier is assigned to that device, this transmission itself being encrypted using a code specific to the device. However, the proprietary code will no longer be used for encrypting subsequent exchanges - the exchanges are then encrypted using the transmission encryption key.

[0015] According to one or more embodiment examples, the provision of the device's own code to the gateway is carried out via a user.

[0016] According to one or more embodiments, the device's own code being associated with the device in a manner visible to the user, the provision of the code to the gateway comprising one of the following:

[0017] - the user's entry of the code via a user interface of the footbridge; and

[0018] - reading the code using a user-operated reading device and the transmission of the code from the reading device to the gateway.

[0019] According to one or more embodiment examples, the device's own code is a fixed random code stored by the device.

[0020] According to one or more embodiments, the gateway and the device are integrated:

[0021] - in the same power supply bar; or

[0022] - in separate power supply bars.

[0023] According to one or more embodiments, the method includes, for the generation of the encryption key, the application of a random algorithm.

[0024] According to one or more embodiments, the method includes the application of a first algorithm for the encryption and decryption of the message and a second algorithm for the encryption and decryption of the data.

[0025] According to one or more embodiment examples, the first and second algorithms being 128-bit AES algorithms.

[0026] According to one or more embodiments, the transmission, via the gateway to the device, of encrypted data is carried out in point-to-point mode using the identifier.

[0027] According to one or more embodiments, the provision of the device's own code to the gateway is carried out:

[0028] - in plain language; or

[0029] - in encrypted form.

[0030] One or more embodiments also relate to a system comprising a gateway and at least one device, the gateway and the at least one device being configured to communicate with each other, the gateway and the at least one device each comprising a respective processor, respective memories and respective software code, the memory of a given device among the at least one device having code specific to that given device, the gateway and the at least one device being configured to implement one of the methods described.

[0031] According to one or more embodiments, the gateway and the device are integrated into separate power supply bars.

[0032] One or more embodiments also relate to a method of association between a gateway and a device, the gateway and the device being configured to communicate with each other, the method comprising:

[0033] a) the reception, by the gateway, of a code specific to the device by the gateway, the code being provided to the gateway by a user;

[0034] b) the generation, by the gateway, of an encryption key and a device identifier, the identifier being unique on the communication network;

[0035] c) the encryption, by the gateway, of a message containing the encryption key and the identifier, the encryption being a function of the device's own code;

[0036] d) the transmission, by the gateway, of the message encrypted by the gateway on the communication network;

[0037] e) the encryption, by the gateway, of the data to be transmitted using the encryption key; and the transmission in point-to-point mode, by the gateway to the device, using the identifier, of the encrypted data.

[0038] According to one or more embodiments, the device's own code being associated with the device in a manner visible to the user, the provision of the code to the gateway comprising one of the following:

[0039] - the user's entry of the code via a user interface of the footbridge; and

[0040] - reading the code using a user-operated reading device and the transmission of the code from the reading device to the gateway.

[0041] One or more embodiments also relate to a gateway in a system of communicating devices comprising a device other than the gateway, the gateway being configured to communicate with the device, the gateway comprising a processor and a memory containing software code, the processor being configured, when executing the software code, to implement one of the methods described.

[0042] One or more embodiments relate to a computer program product which, when the program is executed by a processor of a device, causes the device to implement at least one of the described processes.

[0043] One or more embodiments relate to a recording medium readable by a device equipped with a processor, said medium comprising instructions which, when the program is executed by a processor of a device, cause the device to implement at least one of the described processes. Brief description of the figures

[0044] Other features and advantages will become apparent upon reading the detailed description that follows, for an understanding of which reference should be made to the attached drawings, among which:

[0045] [Fig-1] - [Fig.1] is a block diagram of a system comprising a gateway and one or more devices, according to one or more embodiments;

[0046] [Fig.2] - [Fig.2] is a sequence diagram illustrating a communication process according to one or more embodiments;

[0047] [Fig.3] - the [Fig.3] is a functional block diagram of a device, according to one or more embodiment examples. Detailed description

[0048] In the description that follows, identical, similar or analogous elements will be designated by the same reference numerals.

[0049] The block diagrams, flowcharts, and message sequence diagrams in the figures illustrate the architecture, functionalities, and operation of computer systems, devices, processes, and program products according to one or more embodiment examples. Each block in a block diagram or each phase in a flowchart can represent a module or a portion of software code comprising instructions for implementing one or more functions. In some implementations, the order of the blocks or phases can be changed, or the corresponding functions can be implemented in parallel. The process blocks or phases can be implemented using circuits, software, or a combination of circuits and software, either centrally or in a distributed manner, for all or part of the blocks or phases.The systems, devices, processes, and methods described may be modified, supplemented, and / or deleted while remaining within the scope of this description. For example, the components of a device or system may be integrated or separated. Similarly, the described functions may be implemented using more or fewer components or phases, or with different components or through different phases. Any suitable data processing system may be used for implementation. A suitable data processing system or device includes, for example, a combination of software code and circuits, such as a processor, controller, or other circuit suitable for executing the software code. When the software code is executed, the processor or controller directs the system or device to implement all or part of the functionalities of the blocks and / or phases of the processes or methods, according to the embodiment examples.Software code can be stored in memory or on a readable medium accessible directly or through another module by the processor or controller.

[0050] Figure 1 is a schematic diagram of a system 100 according to one or more embodiments. The illustrated system comprises a gateway 101 connected to an external communication network (not shown) by a connection 106. The system further comprises one or more power busbars 102a to 102c. Each busbar comprises a control module 103a to 103c, as well as one or more electrical outlets (104a_l to 104a_i, 104b_l to 104bj, 104c_l to 104c_k, where i, j, k are integers greater than or equal to zero). The role of a module 103a to 103c is to ensure communication with the gateway 101. Depending on the implementation, a module may also control the electrical outlet(s) of the busbar in which it is integrated. A communication bus 107 linking the gateway 101 and the bus control modules 102a to 102c is schematically illustrated in [Fig.1].Through the gateway, it is therefore possible to communicate with all the system's control modules.

[0051] Each of the bars 102a to 102c is associated with its own unique code, respectively referenced 105a to 105c. This code allows one bar to be uniquely distinguished from another. This code is, for example, assigned to a bar during its manufacture.

[0052] The code is accessible by a user, either directly or using a reading device. For example, a code may be readably accessible for each bar. It may, for instance, be in the form of a number, a barcode, or a QR code on the bar itself or in documentation associated with the bar. In the example of the system in [Fig. 1], a QR code is affixed in the form of a label to each bar 102a to 102c.

[0053] In the illustrative example of [Fig. 1], the gateway 101 and the power supply bars 102a to 102c are separate devices. However, it is entirely possible for the gateway to be integrated into one of the power supply bars.

[0054] Element 108 of [Fig.1] is the element whose function is to serve as a communication vector for code 105a to 105c to gateway 101. This element may differ depending on the implementations.

[0055] For example, element 108 is a natural person (operator, installer, user, etc.) who will read the code and provide it to the gateway via an appropriate user interface. The code is, for example, entered on a web page of the gateway via a computer (not shown) connected to the gateway. In another embodiment, the person uses a reading device which, after reading the code, transmits it to the gateway, for example via a wireless link. This device is, for example, a portable device with a barcode reader, a quick-response code reader, or a plaintext reader. For example, the device is a mobile phone or a tablet equipped with a camera and a dedicated application. According to another implementation example, element 108 operates in a completely automated manner.

[0056] The gateway's unique code is provided either securely (e.g., encrypted) or in plain text. Having a person transmit this code provides a degree of security. If the device's unique code is transmitted using a tool, such as a portable device as previously mentioned, then this communication can be encrypted. This is particularly useful in the case of wireless communication.

[0057] The communication bus 107 can be a wired or wireless bus. In the case of a wired bus, it is, for example, a bus using RS485 type cables. The connection 106 is, for example, a wired Ethernet connection, but can also be of a different nature, depending on the context.

[0058] According to specific terminology, the gateway can also be referred to as a 'node' and the 103a-c modules as 'bases'. The power supply bars can also be called power distribution units (PDUs). The sockets can also be referred to as 'sockets'.

[0059] The code specific to each 103a-c module is, for example, a 128-bit installation code as defined in the ZigBee standard (registered trademark) and stored in a module at the time of its manufacture.

[0060] The [Fig.2] is a sequence diagram illustrating a process according to one or more embodiment examples, between the gateway 101, a module 103x and the element 108.

[0061] According to 201 and 202, the code specific to module 103x is provided to the gateway. In the illustrated case, this provision is made via element 108, which can be a user or a user equipped with a suitable device.

[0062] In 203, the gateway determines on the one hand a transmission encryption key and an identifier of the 103x module.

[0063] The transmission encryption key is intended to encrypt and decrypt communications between the gateway and the 103x module. It is, for example, a symmetric key.

[0064] According to one embodiment, an 'AES' key is used, for example of 128 bits.

[0065] The generation of the transmission encryption key by the gateway can, for example, be done randomly.

[0066] The module identifier is intended to uniquely identify the module on the communication bus 107. This identifier thus constitutes an address of the module 103x on the network.

[0067] The generation of this identifier can for example be carried out by taking the value of a counter of sufficient length in relation to the maximum number of modules on the bus 107, a counter which will be incremented for each module 103x.

[0068] In step 204, the gateway transmits the encryption key and identifier to module 103x in encrypted form. This transmission is carried out, for example, by broadcasting a message containing this information on communication bus 107. The message is encrypted using the 103x module's own code as the encryption key. Only module 103x possessing this code can decrypt the message and thus obtain the transmission encryption key and identifier.

[0069] According to one embodiment, the encryption key is derived from the code specific to the 103x module by means of an algorithm known to both the gateway and the 103x module.

[0070] At 205, module 103x acknowledges receipt of the message. At this stage, module 103x is considered to be associated by gateway 101.

[0071] Subsequently, the gateway will be able to transmit messages to the 103x module in point-to-point mode, using the identifier. The 103x module will be able to identify a message concerning it based on this identifier used as the destination address. Both the gateway and the 103x module will use the transmission encryption key to encrypt and decrypt at least the payload of the exchanged messages (206).

[0072] Figure 3 is a block diagram of a device 300 comprising a processor 301, a memory 302, a communication interface 303, and a communication bus 304 connecting these components. The memory 302 contains software code 305. The device may include other functional components. The communication interface is adapted to communicate over one or more media (wireless network, wired network, etc.), depending on the function of the device 300. When the processor 301 executes the software code, it causes the device to implement one of the processes described, or one of the processes described from the perspective of a particular device. For example, the device 300 is a possible simple implementation for a communication module 103a-c or the gateway 101. A communication module communicates with the outlets of its power supply busbar in a manner known from other sources.

Claims

Demands

1. A method for associating a gateway (101) and a device (103a-c) in a communication network, the gateway and the device being configured to communicate with each other, the device having a memory, the device's memory having a device-specific code, the method comprising: a- reading (201) the device's specific code; b- providing (202) the device's specific code to the gateway; the method being characterized in that it further comprises: c- the generation (203), by the gateway, of an encryption key and a device identifier, the identifier being unique on the communication network and constituting a device address on the network; d- the encryption, by the gateway, of a message comprising the encryption key and the identifier, the encryption being a function of the device's specific code; e- the dissemination (204), by the gateway, of the encrypted message on the communication network;f- the reception, by the device, of the encrypted message; g- the decryption, by the device, of the encrypted message using the device's own code; the transmission, between the gateway and the device, of encrypted data with the encryption key, the transmission, by the gateway to the device, of the encrypted data being carried out in point-to-point mode using the identifier.

2. A method according to claim 1, wherein the reading and provision of the device's own code are carried out via a user.

3. A method according to claim 2, wherein the device's own code is associated with the device in a manner visible to the user, the provision of the code to the gateway comprising one of: - the user entering the code via a user interface of the gateway; and - the user reading the code with a user-operated reading device and the transmission of the code by the reading device to the gateway.

4. A method according to any one of the preceding claims, wherein the device-specific code is a fixed random code stored by the device.

5. A method according to any one of the preceding claims, wherein the gateway and the device are integrated: - in the same power supply busbar; or - in separate power supply busbars.

6. A method according to any one of the preceding claims, comprising, for the generation of the encryption key, the application of a random algorithm.

7. A method according to any one of the preceding claims comprising the application of a first algorithm for encrypting and decrypting the message and a second algorithm for encrypting and decrypting the data.

8. Method according to claim 7, the first and second algorithms being 128-bit AES algorithms.

9. A method according to any one of claims 1 to 8, the provision of the device's own code to the gateway being carried out: - in plain text; or - in encrypted form.

10. System comprising a gateway (101) and at least one device (103a-c), the gateway and the at least one device being configured to communicate with each other, the gateway and the at least one device each comprising a respective processor, respective memories and respective software code, the memory of a given device among the at least one device comprising code specific to that given device, the gateway and the at least one device being configured to implement a method according to any one of claims 1 to 9.

11. System according to claim 10, wherein the gateway and the device are integrated into separate power supply bars.

12. A method for associating a gateway (101) and a device (103a) in a communication network, the gateway and the device being configured to communicate with each other, the method comprising: a- the reception (202), by the gateway, of a device-specific code by the gateway, the code being provided to the gateway by a user; the process being characterized in that it further comprises b- the generation (203), by the gateway, of an encryption key and a device identifier, the identifier being unique on the communication network and constituting an address of the device on the network; c- the encryption, by the gateway, of a message containing the encryption key and the identifier, the encryption being a function of the device-specific code; d- the broadcast (204), by the gateway, of the message encrypted by the gateway on the communication network; e- the encryption (206), by the gateway, of data to be transmitted using the encryption key; and the transmission in point-to-point mode, by the gateway to the device, using the identifier, of the encrypted data.

13. The method according to claim 12, wherein the device's proprietary code is associated with the device in a manner visible to the user, the provision of the code to the gateway comprising one of: - the user's entry of the code via a gateway user interface; and - reading the code using a user-operated reading device and transmitting the code from the reading device to the gateway.

14. Gateway (101) in a system of communicating devices comprising a device (103a) other than the gateway, the gateway being configured to communicate with the device, the gateway comprising a processor and a memory containing software code, the processor being configured, when executing the software code, to implement the method according to one of claims 12 or 13.

Images