Networkable sensing devices

Abstract

A sensing device is provided that can measure physical entities and remotely transmit the measurement results while preventing spoofing and malicious attacks. The present invention relates to a sensing device (1) configured to be selectively operated in a manufacturing mode, an unprovisioned mode, a provisioned mode, and an end-of-life mode, wherein in the manufacturing mode, an electronic circuit (14) is configured to permanently store a unique code (149) in a storage medium (12); In the unprovisioned mode, the electronic circuit 14 waits for a provisioning code 31 to generate a private key 142 and a public key 143. In the provisioned mode, the electronic circuit 14 signs the timestamp provided by the timing unit 13 and the data 110 provided by the sensing unit. The collected data 110, the timestamp 146, the digital signature 144, and the public key 143 are then transmitted. In the end-of-life mode, the electronic circuit 14 permanently erases the private key.

Description

[Technical field]

[0001] The present invention relates to networkable sensing devices, and more particularly to networkable multi-sensing devices. [Background technology]

[0002] Network-enabled sensing devices, such as those in the Internet of Things (IoT), are electronic devices that provide measurements (data) of physical entities remotely to a receiving device (such as a server) either directly or through a gateway. Most of them rely on Bluetooth Low Energy (BLE) communication to transmit these data.

[0003] Since the data is transmitted over an uncontrollable medium, it is vulnerable to spoofing and malicious attacks that can lead to unpleasant or serious situations.

[0004] Even if some network-enabled sensing devices are configured to encrypt data, the network-enabled sensing devices still remain vulnerable to spoofing and malicious attacks, especially attacks based on ID substitution, key substitution, and retransmission of previously intercepted data. Summary of the Invention [Problem to be solved by the invention]

[0005] It is an object of the present invention to provide a sensing device capable of measuring physical entities and remotely transmitting the results in a manner that is more resistant to spoofing and malicious attacks than known systems and methods. [Means for solving the problem]

[0006] According to the invention, these objects are achieved by a network-connectable sensing device according to claim 1 and by a sensing device according to claim 2.17 This is achieved by the method of transmitting data to a server according to the above.

[0007] This solution is: A persistent unique code prevents unauthorized or malicious generation or regeneration of private and public keys. The packed data provides a public key that allows the integrity of collected data (such as measurements) to be verified, and Each signed packed data is made unique by a timestamp, It provides a more robust transmission of measurements of a physical entity provided by a sensing device.

[0008] The invention will be better understood with the help of the description of embodiments given by way of example and illustrated in the figures. [Brief description of the drawings]

[0009] [Figure 1] FIG. 1 shows a schematic diagram of a communication system with network-enabled sensing devices according to the present invention. [Diagram 2] FIG. 2 illustrates an example flow diagram for the sensing device of FIG. 1 operating in a production mode. [Diagram 3] FIG. 3 illustrates an example flow diagram for the sensing device of FIG. 1 operating in a non-provisioning mode. [Figure 4] FIG. 4 illustrates an example flow diagram for the sensing device of FIG. 1 operating in a provisioning mode. [Diagram 5] FIG. 5 illustrates an example flow diagram of several operational modes of the sensing device of FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0010] FIG. 1 shows a schematic diagram of a communication system comprising a network-enabled sensing device 1 configured to remotely provide measurements of a given physical quantity or event to a remotely located server 5, notably in the form of digital data.

[0011] The server 5 may be any electronic device providing storage and / or analysis of the provided measures, such as a computer, laptop, smartphone, smartwatch, tablet, mobile device, or any other suitable device.

[0012] The sensing device 1 of Fig. 1 comprises a sensing unit 11 for sensing one or more desired (physical) events, i.e. events of the sensing device or the environment in which the sensing device is located, or changes in or effects on the sensing device or the environment in which the sensing device is located. In particular, the sensing unit 11 can be configured to sense (measure) temperature (of the environment and / or the sensing device), humidity, light, the position (relative and / or absolute) of the sensing device, acceleration of the sensing device, or shocks affecting the sensing device, or any combination thereof.

[0013] The sensing device 1 comprises a communication unit 15 for transmitting the collected data from the sensing units 11 to the server 5, either directly or via the gateway device 4, notably in the form of packed data 140. The communication unit 15 is also adapted to receive digital data and / or signals from the server 5, the gateway device 4 or from another device 2, 3.

[0014] The gateway device may be any device that provides for the transmission of data between the sensing device 1 and the server. The gateway device may be a mobile, transferable or static device.

[0015] The sensing device 1 then comprises an electronic circuit 14 which provides a signature 144 of the transmitted data 110 with the private key of the given asymmetric key set. This allows the server 5 and / or the gateway device 4 to verify the integrity of the transmitted data with the public key 143 of the given asymmetric key set. Public and persistent verification is made possible by providing the data 140 packed in the digital signature 144 and the public key 143.

[0016] The packed data 140 also comprises a timestamp 146 provided by the timing unit 13 of the sensing device 1, which is also signed by the (same) private key.

[0017] The timestamp 146 is a sequence of symbols (represented in digital form) that identifies an event sensing, data acquisition, and / or transmission event that occurred. The symbols may be a function or representation of a particular date and time, preferably accurate to the second. Alternatively, the timestamp is a unique sequence of symbols (e.g., a random or pseudo-random sequence of symbols) assigned to the event sensing, data acquisition, and / or transmission event.

[0018] The symbols of the timestamp 146 may consist of or include alphanumeric symbols, one or more numeric symbols, one or more numeric symbols, one or more binary digits, one or more printed symbols, one or more graphic symbols, and combinations thereof.

[0019] The absolute (or at least relative) uniqueness of the timestamp guarantees the uniqueness of the generated signatures (that the signature of each packed data is different from the signatures of other packed data) and provides (essential) detection of spoofing or malicious attacks based on copying or retransmission of data.

[0020] The timing unit 13 may comprise a dedicated clock or may rely on a (shared) clock of the sensing device 1 or of its components (eg the electronic circuit 14).

[0021] Advantageously, the dedicated or shared clock may be a controlled clock 311, i.e. a clock that is synchronized automatically (i.e. by itself, without direct human control) by a synchronization signal (e.g. time code) transmitted by one or more transmitters connected to a standard time such as an atomic clock and / or Universal Time Coordinated (UTC). The transmitters may be national or regional time transmitters or universal time transmitters. The transmitters may be part of a relative or absolute positioning system requiring time synchronization such as a global (satellite) positioning system (e.g. GPS, Galileo or GLONASS). Such a system may be used for automatic setting and / or synchronization of the controlled clock.

[0022] The synchronization signal may be a wireless signal transmitted and acquired by a wireless transmitter through the communication unit (15) and / or the wireless antenna of the sensing device 1.

[0023] Alternatively or complementary, the synchronization signal can be provided by a relative or absolute positioning system 17 of the sensing unit 11 and / or the sensing device 1, the system being configured to provide clock synchronization with a time reference. Preferably, the relative or absolute positioning system 17 is a Global Navigation Satellite System (GNSS), which relies inter alia on the GPS, Galileo and / or GLONASS satellite constellations.

[0024] Alternatively or complementary, the synchronization signal may be a wired synchronization signal provided by the communication unit 15 and / or by a connection interface between the communication unit 15 and / or the sensing device 1.

[0025] The networkable sensing device 1 is advantageously a stand-alone device, i.e. an off-grid powered device.

[0026] The sensing device may therefore comprise an energy storage module 18 that supplies power to its active components. The energy storage module 18 may be a non-rechargeable or rechargeable power pack including or consisting of one or more accumulators and / or batteries, among others.

[0027] The sensing device may comprise a protective case or casing 10 which protects the sensing device, and in particular its components, from tampering. The protective casing 10 surrounds the components of the sensing device and advantageously the casing may be a watertight and / or airtight casing.

[0028] The device of the present invention is configured to foresee multiple operating modes and to selectively operate in any of the available modes. To increase robustness against attacks based on identity and / or key substitution, the sensing device 1 is configured to foresee and selectively operate in at least a manufacturing mode, an unprovisioned mode, a provisioned mode and a lifetime mode (see FIG. 5).

[0029] FIG. 2 illustrates an example flow diagram for sensing device 1 operating in production mode.

[0030] In the manufacturing mode, the electronic circuit 14 is configured to permanently store the unique code 149 in the storage medium 12 of the sensing device 1, particularly in digital form.

[0031] In particular, the unique code 149 can be stored in a dedicated storage unit of the storage medium 12 , the dedicated storage unit providing unique, one-time storage of the unique code 149 .

[0032] The unique code 149 is a series of symbols guaranteed to be unique among all codes used in other sensing devices.

[0033] The storage medium 12 is any unit or units (e.g., having the form of an electronic circuit or device) that provides storage of data (in digital form), which data is, inter alia, collected and / or assigned to components of the sensing device 1 in operation.

[0034] In particular, the unique code 149 may be provided by the manufacturing device 2, particularly in response to providing a serial number (e.g., an assigned unique manufacturing identifier) ​​of the sensing device 1. The serial number of the sensing device 1 may be hard-written during manufacturing of the sensing device 1 or may be stored in a read-only storage medium accessible (i.e., readable) by the electronic circuitry 14.

[0035] In particular, the sensing device 1 may be configured (e.g., via the electronic circuitry 14) to wait once to receive the unique code 149 from the manufacturing device 2, particularly when the sensing device is supplied with power, e.g., by the energy storage module 18, for the first time.

[0036] As shown in FIG. 5, the sensing device 1 includes the following components: receiving and / or storing a unique code 149 in a storage medium 12; In particular, reception of a sleep signal 20 provided by the manufacturing device 2 via a communication unit 15; The device may be configured to (automatically) switch from the manufacturing mode to the unprovisioned mode (S1) in response to at least one of the following:

[0037] The communication between the sensing device 1 and the manufacturing device 2 may rely on a wired and / or wireless data link 150 provided by the communication unit 15. The data link 150 may be unidirectional or bidirectional (particularly in the case of the transmission of serial numbers to the manufacturing device 2).

[0038] FIG. 3 illustrates an example flow diagram for the sensing device of FIG. 1 operating in an unprovisioned mode.

[0039] In the unprovisioned mode, the sensing device is configured to wait for receipt of a provisioning signal that generates an asymmetric key pair that is used to sign the timestamps of the collected and packed data. During the wait, the sensing device is advantageously configured to operate in a sleep mode and the communication unit 15 is configured to operate in a receive-only mode (i.e., transmissions are not permitted and / or are not operated).

[0040] In particular, the electronic circuit 14 is adapted to wait for the reception of a provisioning signal consisting of or including a provisioning code 31, If the provisioning code 31 matches the unique code 149 of the sensing device, generating a private key 142 for signing (digital) data; A public key 143 for verifying data signed by the private key 142 Speculation (Generating) conduct.

[0041] The provisioning code 31 matching the unique code 149 provides authentication of the provisioning device.

[0042] More advantageously, for example, the communication unit 15 may be configured to uniquely establish near field communication 151 with the provisioning device 3, for example by placing the sensing device and the provisioning device within 4 cm, preferably according to the NFC communication protocol, and the electronic circuitry may be configured to wait for the provisioning signal to be a near field communication (NFC) signal.

[0043] The near field communication 151 may be activated by (uniquely) enabling the NFC reader of the communication unit 15 .

[0044] As long as the sensing device is in sleep mode waiting for the (NFC) provisioning signal to wake it up, attempts to remotely attack the sensing device are thwarted, making the period of integrity more secure and longer.

[0045] Advantageously, in the sleep mode the sensing unit and / or the timing unit 13 are disabled to reduce power consumption, thereby providing a longer period of quality.

[0046] In the unprovisioned mode, the communication unit 15 may be configured to establish an unsecured or, advantageously, a secured communication with said provisioning device 3 based on a shared key 147 .

[0047] The shared key 147 may be retrievable from the storage medium 12 .

[0048] Alternatively or complementary, the shared key 147 may be generated by the electronic circuit 14 based, inter alia, on secret data of the sensing device (e.g. the unique code 149) and on a pre-shared key 30 provided by the provisioning device 3. Preferably, the electronic circuit 14 may provide an associated pre-shared key that allows the provisioning device to generate the same shared key without (directly) transmitting the shared key. In particular, the shared key 147 may be generated based on the Diffie-Hellman key exchange protocol.

[0049] The generated shared key 147 may then be stored in the storage medium 12 to enable subsequent communication with the (same) provider device.

[0050] This enables not only the creation of a secure connection between a sensing device and a providing device, but also a trusted pairing between the sensing device and the providing device using an out-of-band pre-shared key exchange.

[0051] moreover, Provisioning code 31 Unique code for detector 149 If it matches, the electronic circuitry may be configured to receive a provisioning configuration 32 provided by the provisioning device 3. Once the provisioning configuration 32 is received, the sensing device may be configured to apply the received provisioning configuration 32, inter alia, by storing the received configuration in a storage medium and / or by setting up components of the sensing device according to the received provisioning configuration 32.

[0052] Provisioning setting 32 is A sensing device identifier 141 that is to be transmitted within the packed data; Settings of the sensing unit such as the measurement speed or frequency, the measurement accuracy, the sensing threshold, whether to enable the sensing element of the sensing unit, etc. Setting the communication unit, Configuration of the clock and / or timing module, such as setup and synchronization signals; - a trigger event that triggers the measurement and / or collection of the data provided by the sensing unit, in particular the detection threshold of the measured movement and / or the measured acceleration; Package information and The at least one of the following may be provided:

[0053] Advantageously, the electronic circuitry may be configured to transmit the generated public key 143 to a provisioning device to activate the public key 143 on the server 5 .

[0054] The sensing device 1 is Generation of a private key 142; Public key 143 Speculation and, Applying provisioning settings 32 and Receiving a wake-up signal 33 provided by a provisioning device 3; Activating public key 143 on server 5, The mode may be configured to (automatically) switch from the unprovisioned mode to the provisioned mode (S2) in response to at least one of the above.

[0055] FIG. 4 illustrates an example flow diagram of the sensing device of FIG. 1 operating in a provision mode.

[0056] In the provision mode, the electronic circuitry 14 is configured to collect data 110 provided by the sensing unit 11. The electronic circuitry 14 further comprises: Signing the collected data 110 and a timestamp 146 provided by the timing unit 13 with a private key 142 to provide a digital signature 144; The device is configured to transmit packed data 140 to a server 5, either directly or via a gateway device 4, where packed data 140 comprises the collected data 110, a timestamp 146, a digital signature 144, a public key (143) and finally a device identifier 141.

[0057] In particular, in the provision mode, the electronic circuitry 14 performs, among other things: a given collection rule and / or sensing rule; Provisioning settings 32 provided by the provisioning device; The provisioning settings 32 provided include, inter alia: a provided trigger event that triggers at least one of a measurement and a collection of data; The provided detection threshold and is provided in accordance with at least one of the following:

[0058] Advantageously, the electronic circuit 14 is adapted to store the collected data in the storage medium 12 and to wait for a request signal 40 provided by the gateway device 4 and / or the server 5. In response to the request signal 40 provided by the gateway device 4 and / or the server 5, the electronic circuit 14: To sign the collected data 110 (e.g., data stored in the storage medium 12) and the timestamp 146, and To transmit packed data 140 It is composed.

[0059] In particular, the electronic circuitry 14 may be configured to respond to at least one of movement and acceleration sensed by the accelerometer 19 of the sensing device 1, exceeding a detection threshold, and to collect and store data provided by the sensing unit 11, as preferably provided by the provisioning settings 32.

[0060] The electronic circuit 14 may be configured to wait for an acknowledgement signal 41 provided by the gateway device 4 and / or the server 5 and, in response to receipt of the acknowledgement signal 41, to acknowledge the secure reception and / or signature verification of the packed data in order to delete the transmitted data from the storage medium 12. Alternatively or complementary, the acknowledgement signal 41 may be provided by checking the activation of a public key on the server 5.

[0061] Data removal may include data erasure (i.e., overwriting selected data with 0's and 1's to completely (securely) destroy selected data on storage medium 12).

[0062] The packed data 140 may be transmitted to the gateway device by a local communication 152 established between the sensing device and the gateway device (i.e., the sensing device and the gateway device are up to 1 km apart, preferably within a range of 4 cm to 500 meters using the communication unit 15). The local communication can be a wireless area network, a wireless local area communication, a Bluetooth® communication, an ANT communication, a wired communication (such as a USB communication), or a combination of the above.

[0063] Alternatively or complementary, the packed data 140 may be transmitted by a point-to-point communication 152 established between the sensing device and the gateway device and / or server 5, where the point-to-point communication relies at least on a point-to-point computer network connection (such as a cellular and / or wired network, satellite network, wired network).

[0064] Prior to or advantageously prior to verification of the signature 144, the gateway device 3 may transmit the (entire) packed data 140 to a server 5 for storage, preferably using a blockchain providing a secure record. Once stored and / or blockchained (i.e. stored or recorded using a blockchain) on the server, the packed data 140 may be placed at the disposal of a user who can always verify the integrity of the data provided by the sensing device 1 using, inter alia, the signature 144 and the public key 143 provided in the packed data 140.

[0065] As shown in FIG. 5, in the end-of-life mode, the sensing device is configured to be temporarily or permanently disabled (via, among other things, electronic circuitry), by, among other things, permanently erasing the private key 142.

[0066] The electronic circuitry 14 may be configured, inter alia, to permanently disable the sensing device 1 by triggering the deactivation (mechanical and / or electronic) of one or more components of the sensing device 1.

[0067] In particular, the electronic circuit 14 includes: For example, damage or destruction of the battery by shorting the electrodes of the battery or using an actuator; Complete discharge of the battery and For example, the breaking or opening of a sealed casing by means of an actuator; Damage or destruction of the sensor unit, for example by causing an overvoltage or using an actuator; Damage or destruction of storage media, for example by causing overvoltage or using an actuator; Destruction of instruction data present in the sensing device (e.g., on the storage medium and / or on the electronic circuitry) that is readable by the electronic circuitry 14, among other things, to enable one or more tasks of the electronic circuitry 14; Disruption or shorting of an electrical connection of the sensing device, for example an electrical connection that is electrically dependent on the electronic circuit 14 to other components of the sensing device, for example by causing an overvoltage or using an effector; At least one of the above may be activated.

[0068] Alternatively, in the end-of-life mode, the electronic circuitry 14 may be configured to permanently erase (collect) the data 110 from the storage medium and switch the sensing device 1 to an unprovisioned mode (S31) to provide for a secure reuse of the sensing device 1. Preferably, the electronic circuitry 14 may be configured to permanently erase (e.g., by data erasure) the public key and / or the provisioning settings.

[0069] In particular, the sensing device receiving an end-of-life signal provided by a device, in particular a conditioning device; detection of the remaining energy of the storage module 18 below a given energy threshold (by the electronic circuit), preferably below an energy threshold provided by the manufacturing device and / or the provisioning device 3 (for example by the provisioning settings 32); The sensing device 1 may be configured (particularly by an electronic circuit) to switch to the end of life mode in response to at least one of a detection of tampering with the protective casing 10 provided by a tamper detector 16 of the sensing device 1 .

[0070] The sensing device 1 may also be configured to (automatically) switch from end-of-life mode or from provisioned mode to unprovisioned mode (S21, S31) in response to receiving a provisioning code 31 provided by a (linked) provisioning device 3, where the provisioning code 31 matches the unique code 149 of the sensing device. This allows a reliable re-initialization of the sensing device 1.

[0071] The sensing device 1 therefore A persistent unique code prevents unauthorized or malicious generation or regeneration of private and public keys. The packed data provides a public key that allows the integrity of collected data (such as measurements) to be verified, and Each signed packed data is made unique by a timestamp, It provides a more robust transmission of measurements of a physical entity provided by a sensing device.

[0072] In fact, since the packed data is different for each transmission, data duplication attacks can be easily detected on the server by comparing the packed data already stored or recorded in the blockchain. The timestamp ensures that the generated signatures are different, so the package is simply uncloneable.

[0073] The public key provided by the sensing device provides the origin of the data and can avoid identity theft attacks, since the (associated) private key is randomly generated by the device itself during provisioning (i.e., the private key is unique and only known by the sensing device). Furthermore, the public key is transmitted within the packed data, allowing the user to verify that the information was indeed signed by the device. This signature serves as an authentication certificate.

[0074] The robustness of the transmission is further increased by activating on the server 5 the public key 243 generated on the sensing device 1, preferably the public key 143 transmitted to the server 5 by the provisioning device 3. The activation can be used on the server and / or on the gateway device to validate the received packed data (notably its public key) and / or to allow the storage and / or block chaining of the received packed data. The present invention includes the following aspects. Form 1 a sensing unit for sensing at least a given phenomenon; A storage medium for storing digital data; a communication unit for receiving and transmitting digital data and / or signals; a timing unit for providing a time stamp; an electronic circuit operatively connected to the storage medium, the sensing unit, the communication unit, and the timing unit; In a sensing device comprising: the sensing device is configured to be selectively operated in a manufacturing mode, an unprovisioned mode, a provisioned mode, and an end-of-life mode; In a manufacturing mode, the electronic circuitry is configured to permanently store the unique code in the storage medium; In an unprovisioned mode, the electronic circuitry is configured to wait for receipt of a provisioning code from a provisioning device, and, if the provisioning code matches a unique code of the sensing device, to respond to the provisioning code by generating a private key for signing data and inferring a public key for verifying data signed by the private key; In the provision mode, the electronic circuitry is configured to collect data provided by the sensing unit, and To provide a digital signature verifiable by the public key, the collected data and the timestamp provided by the timing unit are signed by the private key. It is configured, and the electronic circuitry is configured to transmit the packed data to at least one of the gateway device and the server; the packed data comprises the collected data, a timestamp, a digital signature, and a public key; The sensing device, wherein in an end-of-life mode, the electronic circuitry is configured to permanently erase the secret key. Form 2 2. The sensing device of claim 1, wherein in a manufacturing mode, the electronic circuitry is configured to receive the unique code from a manufacturing device. Form 3 3. The sensing device of claim 2, wherein in a manufacturing mode, the electronic circuitry is configured to send a serial number to the manufacturing device, the serial number being a unique identifier assigned to the sensing device. Form 4 The sensing device of claim 1, wherein the sensing device is configured to switch from a manufacturing mode to an unprovisioned mode in response to at least one of storing a unique code in a storage medium and receiving a sleep signal provided from a manufacturing device. Form 5 an electronic circuit configured to, in response to the provisioning code, apply a provisioning configuration provided by a provisioning device if the provisioning code matches a unique code of the sensing device; The provisioning settings are a sensing device identifier to be transmitted within the packed data; and Settings of the sensing unit, such as the measurement speed or frequency, the measurement accuracy, the sensing threshold, and whether or not the sensing element of the sensing unit is enabled; Setting the communication unit, - configuration of the clock and / or timing unit, such as configuration and / or synchronization signals; a triggering event that triggers at least one of a measurement and collection of data provided by the sensing unit; Package information and The sensing device of embodiment 1, comprising at least one of the following: Form 6 2. The sensing device of embodiment 1, wherein in the unprovisioned mode, the communication unit is configured to establish short-range communication with the provisioning device. Form 7 The sensing device of claim 1, wherein in the unprovisioned mode, the communication unit is configured to establish unsecured or secured communication with the provisioning device based on a shared key obtained and / or generated by the electronic circuit and stored in the storage medium. Form 8 The sensing device of embodiment 7, wherein the electronic circuitry is configured to obtain a pre-shared key from a provisioning device, and the electronic circuitry is configured to generate a shared key from the pre-shared key and secret data or a unique code. Form 9 The sensing device of claim 1, wherein the sensing device is configured to switch from an unprovisioned mode to a provisioned mode in response to at least one of generating a private key, inferring a public key, applying a provisioning configuration, and receiving a wake-up signal provided from the provisioning device. Form 10 In provision mode, an electronic circuit configured to store the collected data on a storage medium; The sensing device of claim 1, wherein the electronic circuit is configured to sign the collected data and a timestamp and transmit the packed data in response to a request signal provided from at least one of the gateway device or the server. Form 11 In provision mode, the electronic circuitry is configured to confirm secure receipt of the packed data and receive a confirmation signal from at least one of the gateway device and the server; 11. The sensing device of claim 10, wherein the electronic circuitry is configured to remove the collected data from the storage medium in response to receipt of the confirmation signal. Form 12 2. The sensing device of claim 1, wherein the sensing device is configured to switch to an end of life mode in response to receiving an end of life signal. Form 13 2. The sensing device of claim 1, wherein in the provision mode, the communication unit is configured to establish local communication with the gateway device or point-to-point communication with the gateway device. Form 14 In end of life mode, The sensing device of claim 1, wherein the electronic circuitry is configured to permanently erase collected data provided by the sensing unit and switch the sensing device to an unprovisioned mode and / or permanently disable the sensing device. Form 15 Further provided with a protective casing to protect against tampering; The sensing device of claim 1, further comprising a tamper detector configured to detect tampering with the protective casing, the tamper detector being surrounded by the protective casing, and in response to detecting the tampering, the sensing device being configured to switch to an end of life mode. Form 16 further comprising an energy storage module for powering the electronic circuitry, the communication unit, the sensing unit, the storage medium, the electronic circuitry, the timing unit, the modified detector, the global positioning system, the clock, and / or the radio antenna; an electronic circuit configured to detect when a remaining energy of the storage module is below a given energy threshold; 2. The sensing device of claim 1, wherein the electronic circuitry is configured to switch the sensing device to an end-of-life mode in response to detecting a fall below a given energy threshold. Form 17 in a manufacturing mode, permanently storing the unique code in a storage medium of the sensing device; generating a private key and a public key on the sensing device in response to the provisioning code if the provisioning code matches the unique code, the unique code being provided by the provisioning device; providing a digital signature by signing, in a provision mode, the collected data provided by the sensing unit and the timestamp provided by the timing unit with a private key on the sensing device; transmitting, in a provision mode, the collected data, the packed data including the time stamp, the digital signature and the public key to a server; and in an end-of-life mode, in response to at least one of detecting a tampering with a protective casing of the sensing device, detecting that the remaining energy of a storage module of the sensing device is below a given energy threshold, and receiving an end-of-life signal, permanently erasing the private key from the sensing device; A method for transmitting data from a sensing device according to any one of aspects 1 to 16, comprising: Form 18 and activating, on the server, the public key generated by the sensing device; 20. The method of claim 17, wherein the validation includes transmitting a public key through a provisioning device to a server. [Explanation of symbols]

[0075] 1 Sensing device 10 Casing 11. Sensing Unit 110 Data 12 Storage medium 13 Timing unit 131 Clock 14 Electronic circuit 140 Packed Data 141 Identifier (ID) 142 Private key 143 Public Key 144 Signatures 145 Key Code 146 Timestamp 147 Shared Key 148 Serial Number 149 Unique Code 15 Communication Unit 150 Data Links 151 Near Field Communication (NFC) Data Link 152 (Radio) Data Link 16 Modified detector 17 Global Positioning System 18 Energy Storage Module 19 Accelerometer 2 Manufacturing equipment 20 Sleep Signal 3 Provisioning Device 30 pre-shared key 31 Provisioning Code 32 Provisioning Settings 33 Wake-up signal 34 Data Links 4. Gateway Device 40 request signal 41 Confirmation Signal 44 Data Links 5 Server 51 Confirmation signal S1, S21, S31 Switch to Unprovisioned Mode Switch to S2 provision mode Switch to S3 end of life mode

Claims

1. a sensing unit for sensing at least a given phenomenon; A storage medium for storing digital data; a communication unit for receiving and transmitting digital data and / or signals; a timing unit for providing a time stamp; an electronic circuit operatively connected to the storage medium, the sensing unit, the communication unit, and the timing unit; In a sensing device comprising: the sensing device is configured to be selectively operated in a manufacturing mode, an unprovisioned mode, a provisioned mode, and an end-of-life mode; In a manufacturing mode, the electronic circuitry is configured to permanently store the unique code in the storage medium; In an unprovisioned mode, the electronic circuitry is configured to wait for receipt of a provisioning code from a provisioning device, and, if the provisioning code matches a unique code of the sensing device, to generate a private key for signing data and deduce a public key for verifying data signed by the private key in response to the provisioning code; In the provision mode, the electronic circuitry is configured to collect data provided by the sensing unit, and To provide a digital signature verifiable by the public key, the collected data and the timestamp provided by the timing unit are signed by the private key. It is configured, and the electronic circuitry is configured to transmit the packed data to at least one of the gateway device and the server; the packed data comprises the collected data, a timestamp, a digital signature, and a public key; The sensing device, wherein in an end-of-life mode, the electronic circuitry is configured to permanently erase the secret key.

2. The sensing device of claim 1 , wherein in a manufacturing mode, the electronic circuitry is configured to receive the unique code from a manufacturing device.

3. The sensing device of claim 2 , wherein in a manufacturing mode, the electronic circuitry is configured to send a serial number to the manufacturing device, the serial number being a unique identifier assigned to the sensing device.

4. 10. The sensing device of claim 1, wherein the sensing device is configured to switch from a manufacturing mode to an unprovisioned mode in response to at least one of storing a unique code in a storage medium and receiving a sleep signal provided by a manufacturing device.

5. an electronic circuit configured to, in response to the provisioning code, apply a provisioning configuration provided by a provisioning device if the provisioning code matches a unique code of the sensing device; The provisioning settings are a sensing device identifier to be transmitted within the packed data; and Settings of the sensing unit, such as the measurement speed or frequency, the measurement accuracy, the sensing threshold, and whether or not the sensing element of the sensing unit is enabled; Setting the communication unit, - configuration of the clock and / or timing unit, such as configuration and / or synchronization signals; a triggering event that triggers at least one of a measurement and collection of data provided by the sensing unit; Package information and The sensing device of claim 1 , comprising at least one of:

6. The sensing device of claim 1 , wherein in the unprovisioned mode, the communication unit is configured to establish short-range communication with a provisioning device.

7. 2. The sensing device of claim 1, wherein in the unprovisioned mode, the communication unit is configured to establish unsecured or secured communication with the provisioning device based on a shared key obtained and / or generated by the electronic circuit and stored in the storage medium.

8. 8. The sensing device of claim 7, wherein the electronic circuitry is configured to obtain a pre-shared key from a provisioning device, and the electronic circuitry is configured to generate a shared key from the pre-shared key and secret data or a unique code.

9. 2. The sensing device of claim 1, wherein the sensing device is configured to switch from an unprovisioned mode to a provisioned mode in response to at least one of generating a private key, deducing a public key, applying a provisioning configuration, and receiving a wake-up signal provided by a provisioning device.

10. In provision mode, an electronic circuit configured to store the collected data on a storage medium; 10. The sensing device of claim 1, wherein the electronic circuitry is configured to, in response to a request signal being provided from at least one of a gateway device or a server, sign the collected data and a time stamp and transmit the packed data.

11. In provision mode, the electronic circuitry is configured to confirm secure receipt of the packed data and receive a confirmation signal from at least one of the gateway device and the server; 11. The sensing device of claim 10, wherein the electronic circuitry is configured to remove the collected data from the storage medium in response to receipt of the confirmation signal.

12. The sensing device of claim 1 , wherein in response to receiving an end-of-life signal, the sensing device is configured to switch to an end-of-life mode.

13. The sensing device of claim 1 , wherein in the provision mode, the communication unit is configured to establish a local communication with the gateway device or a point-to-point communication with the gateway device.

14. In end of life mode, 10. The sensing device of claim 1, wherein the electronic circuitry is configured to permanently erase collected data provided by the sensing unit and switch the sensing device to an unprovisioned mode and / or permanently disable the sensing device.

15. Further provided with a protective casing to protect against tampering; 13. The sensing device of claim 1, further comprising a tamper detector configured to detect tampering with the protective casing, the tamper detector being surrounded by the protective casing, and in response to detecting the tampering, the sensing device is configured to switch to an end of life mode.

16. further comprising an energy storage module for powering the electronic circuitry, the communication unit, the sensing unit, the storage medium, the electronic circuitry, the timing unit, the modified detector, the global positioning system, the clock, and / or the radio antenna; an electronic circuit configured to detect when a remaining energy of the storage module is below a given energy threshold; 10. The sensing device of claim 1, wherein the electronic circuitry is configured to switch the sensing device to an end of life mode in response to detecting below a given energy threshold.

17. in a manufacturing mode, permanently storing the unique code in a storage medium of the sensing device; generating a private key and a public key on the sensing device in response to the provisioning code if the provisioning code matches the unique code, the unique code being provided by the provisioning device; providing a digital signature by signing, in a provision mode, the collected data provided by the sensing unit and the timestamp provided by the timing unit with a private key on the sensing device; transmitting, in a provision mode, the collected data, the packed data including the time stamp, the digital signature and the public key to a server; and in an end-of-life mode, in response to at least one of detecting a tampering with a protective casing of the sensing device, detecting that the remaining energy of a storage module of the sensing device is below a given energy threshold, and receiving an end-of-life signal, permanently erasing the private key from the sensing device; A method for transmitting data from a sensing device according to any preceding claim, comprising:

18. and activating, on the server, the public key generated by the sensing device; 20. The method of claim 17, wherein the activation includes transmitting a public key through a provisioning device to a server.

Images