Matter commissioning over thread networks

Abstract

Techniques and devices are described for Matter commissioning over Thread networks. The described aspects remove the need for a mesh network device to also implement a Bluetooth LE (BLE) radio for commissioning. In one aspect, a Matter commissioner adopting aspects of Thread networking mesh commissioning protocols to establish a Matter Commissioner as a Thread commissioner in order to join a joiner device to a Matter network. In another aspect, a commissioning proxy provides connectivity between a Matter commissioner and a Thread network to forward commissioning messaging between the Matter commissioner and a joiner device connecting to Matter via a Thread network.

Description

MATTER COMMISSIONING OVER THREAD NETWORKSBACKGROUND

[0001] Using wireless networking to connect devices to each other, and to cloud-based services, is increasingly popular for sensing environmental conditions, controlling equipment, and providing information and alerts to users. Many devices on wireless networks are designed to operate for extended periods of time on battery -power, which limits the available computing, user interface, and radio resources in these devices. Additionally, to ensure the security of mesh networks, the identity of devices joining and operating on a mesh network is authenticated, and communication within the mesh network is encrypted, based on credentials that are commissioned into the devices. However, commissioning practices for Matter networks require the use of Bluetooth LE (BLE) to discover a joining device, to establish a secure session with the joining device, and provide network credentials to the joining device. This constraint of using BLE results in mesh network devices, such as Thread devices, including a BLE radio for the sake of commissioning with a resulting increase in the cost and complexity of the mesh network device.SUMMARY

[0002] This summary7is provided to introduce concepts of Matter commissioning over Thread networks, generally related to commissioning Thread wireless network devices to Matter networks. The concepts are further described below in the Detailed Description. This summary' is not intended to identify essential features of the claimed subject matter, nor is it intended for use in determining the scope of the claimed subject matter.

[0003] In aspects, methods, devices, systems, and means for Matter commissioning over a Thread network are described in which a commissioning proxy receives a discovery beacon from a joiner device and, based on the receiving the discovery beacon, sends a Domain Name System-Service Discovery (DNS-SD) advertisement to a commissioner device. Thecommissioning proxy receives, from the commissioner device, a request for parameters for a Password-Based Key Derivation Function and forwards the request for the parameters for the Password-Based Key Derivation Function to the joiner device. In response to forwarding the request for the parameters for the Password-Based Key Denvation Function, the commissioning proxy receives, from the joiner device, a response including the parameters for the Password-Based Key Derivation Function and forwards the response that includes the parameters for the Password-Based Key Derivation Function to the commissioner device. The commissioning proxy receives a first Password-Authenticated Key Exchange (PAKE) message from the commissioner device and forwards the first PAKE message to the joiner device. In response to forwarding the first PAKE message, the commissioning proxy receives from the joiner device, a second PAKE message and forwards the second PAKE message to the commissioner device. The commissioning proxy receives a third PAKE message from the commissioner device and forwards the third PAKE message to the joiner device, the forwarding being effective to establish a Passcode Authenticated Session Establishment (PASE) session between the commissioner device and the joiner device to commission the joiner device to a Matter network.

[0004] In aspects, methods, devices, systems, and means for Matter commissioning over a Thread network are described in which a Matter commissioner establishes a commissioning session with a Thread border agent. The Matter commissioner receives a discovery' beacon from a j oiner device and sends a request for parameters for a Password-Based Key Derivation Function to the joiner device. In response to forwarding the request for the parameters for the Password-Based Key Derivation Function, the Matter commissioner receives, from the joiner device, a response including the parameters for the Password-Based Key Derivation Function. The Matter commissioner sends a first Password-Authenticated Key Exchange (PAKE) message to the joiner device and in response to sending the first PAKE message, receives a second PAKE message. The Matter commissioner sends a third PAKE message to the joiner device that is effective toestablish a Passcode Authenticated Session Establishment (PASE) session between the Matter commissioner and the joiner device to commission the joiner device to a Matter network.BRIEF DESCRIPTION OF THE DRAWINGS

[0005] Aspects of Matter commissioning over Thread networks are described with reference to the following drawings. The same numbers are used throughout the drawings to reference like features and components:FIG. 1 illustrates an example network environment in which various aspects of Matter commissioning over Thread networks can be implemented.FIG. 2 illustrates an example environment in which various aspects of Matter commissioning over Thread networks can be implemented.FIG. 3 illustrates data and control transactions between devices for creating a secure session in accordance with aspects of Matter commissioning over Thread networks.FIGs. 4a and 4b illustrate data and control transactions betw een devices for creating a secure session in accordance with aspects of Matter commissioning over Thread networks.FIG. 5 illustrates an example method in accordance with one or more aspects of the techniques described herein.FIGs. 6a and 6b illustrate an example method in accordance with one or more aspects of the techniques described herein.FIG. 7 illustrates an example environment in which aspects of the techniques described herein can be implemented.FIG. 8 illustrates an example wireless network device that can be implemented in a home area network in accordance with one or more aspects of the techniques described herein.FIG. 9 illustrates an example system with an example device that can implement aspects of a Matter commissioning over Thread networks.DETAILED DESCRIPTION

[0006] This document illustrates aspects of Matter commissioning over Thread networks. Matter commissioning requires a joining device and a commissioner to be within direct Bluetooth LE (BLE) range of each other. This can be problematic in scenarios where the joining device and commissioner locations are not flexible (e.g., a commissioner hosted on a smart TV and joining a Matter door lock). Also, Matter commissioning is less robust and more complex for a joining device due to the need for the joining device to multiplex between BLE (for commissioning) and an operational network (e.g.. Thread). The requirement to use BLE adds another radio transceiver and RF front-end hardware to a Matter device and an associated additional protocol stack that a Matter device needs to implement, incurring additional costs associated with that additional radio and managing coexistence issues between the multiple radios. Supporting the additional BLE radio increases device development cost that includes additional certification costs for the BLE radio. The techniques described herein improve Matter commissioning over Thread networks to reduce device cost and reduce development costs.

[0007] The Thread networking standard specifies a mesh commissioning protocol (MeshCoP) for securely onboarding Thread devices at the network layer. However, MeshCoP is not used by any existing application-layer protocol built on Thread. The Matter, HomeKit, and Weave standards all define their own commissioning methods independent of MeshCoP. Existing application-layers built on top of Thread must provide their own mechanisms for discovery, secure session establishment, device attestation, and application provisioning. As a result, there is less overhead and it is simpler to leverage the same secure session to also communicate network credentials. As described below7, using portions of MeshCoP for joining devices to discover Thread networks and relaying commissioning messages across the Thread mesh may enable Matter commissioning over Thread networks while maintaining the application-specific protocol between a joiner device and a commissioner.Example Environment

[0008] FIG. 1 illustrates an example network environment 100 in which aspects of Matter commissioning over Thread networks can be implemented. The network environment 100 (e.g., a fabric network, a Thread network, a Matter network, a Weave network) includes one or more network segments that form a home area network (HAN) such as a HAN 200, described below with respect to FIG. 2. The HAN includes wireless network devices 102 that are disposed about a structure 104, such as a house, and are connected by one or more wireless and / or wired network technologies, as described below. The HAN includes a wireless network device 102 that acts as a border router 106 that connects the HAN to an external network 108 (access network 108), such as the Internet, through a home router or access point 110.

[0009] To provide user access to functions implemented using the wireless network devices 102 in the HAN, a cloud service 112 connects to the HAN via border router 106, via a secure tunnel 114 through the external network 108 (access network 108) and the access point 110. The cloud service 112 facilitates communication between the HAN and internet clients 116, such as apps on mobile devices, using a web-based application programming interface (API) 118. The cloud service 112 also manages a home graph 126 (home graph service 126) that describes connections and relationships between the wireless network devices 102, elements of the structure 104, and users and stores Thread network credentials. The cloud service 112 hosts controllers which orchestrate and arbitrate home automation experiences, as described in greater detail below.

[0010] The HAN may include one or more wireless network devices 102 that function as a hub 120. The hub 120 may be a general-purpose home automation hub, or an applicationspecific hub, such as a security' hub, an energy' management hub, an HVAC hub, and so forth. The functionality of a hub 120 may also be integrated into any wireless netw ork device 102, such as a smart thermostat device, a network-enabled television, a media streaming device, or the border router 106. In addition to hosting controllers on the cloud service 112, controllers can be hosted on any hub 120 in the structure 104, such as the border router 106. A controller hosted on thecloud service 112 can be moved dynamically to the hub 120 in the structure 104, such as moving an HVAC zone controller to a newly installed smart thermostat. Hosting functionality on the hub 120 in the structure 104 can improve reliability when the user's internet connection is unreliable, can reduce latency of operations that would normally have to connect to the cloud service 112, and can satisfy system and regulatory constraints around local access between wireless network devices 102.

[0011] The wireless network devices 102 in the HAN may be from a single manufacturer that provides the cloud service 112 as well, or the HAN may include wireless network devices 102 from partners. These partners may also provide partner cloud services 122 that provide services related to their wireless network devices 102 through a partner Web API 124. The partner cloud service 122 may optionally or additionally provide services to internet clients 116 via the web-based API 118, the cloud service 112, and the secure tunnel 114.

[0012] The network environment 100 can be implemented on a variety of hosts, such as battery-powered microcontroller-based devices, line-powered devices, and servers that host cloud services. Protocols operating in the wireless network devices 102 and the cloud service 112 provide a number of services that support operations of home automation experiences in the distributed computing environment 100. These services include, but are not limited to, real-time distributed data management and subscriptions, command-and-response control, real-time event notification, historical data logging and preservation, cryptographically controlled security' groups, time synchronization, netw ork and service pairing, and software updates.

[0013] FIG. 2 illustrates an example environment (e.g., a fabric network, a Weave network, a Matter network) in which various aspects of Matter commissioning over Thread networks can be implemented. The home area network (HAN, Thread netw ork) 200 may include a wireless mesh network segment 202 (e.g., a Thread network segment), a Wi-Fi network segment 204, and / or an Ethernet segment 212. The mesh network segment 202 is a Wireless Personal Area Network (WPAN) implementing the Thread Specification, in particular the Thread Specification1.0, 1.1, 1.2, 1.3, 1.4, or any later version. For example, the mesh network segment 202 may be compatible with version 1.1, version 1.2, and / or version 1.3 of the Thread Specification. The Wi-Fi segment 204 is a Wireless Local Area Network (WLAN) implementing the IEEE 802.11 standard, in particular the IEEE 802.11 standard of 1997 and / or any later version such as 802.11b, 802.11g, 802.11n, 802.11ac, 802.11ax. 802. Had, 802.11ay, and 802.11be. For example, the Wi-Fi segment 204 may be compatible with one or more, e.g.. all. of these versions. The wireless mesh network segment 202 includes routers 206 and end devices 208. The routers 206 and the end devices 208, each include a mesh network interface for communication over the mesh network segment 202. The routers 206 receive and transmit packet data over the mesh network interface. The routers 206 also route traffic across the mesh network segment 202. The end devices 208 are devices that can communicate using the mesh network segment 202, but lack the capability, beyond simply forwarding to its parent router 206, to route traffic in the mesh network segment 202. One or more of the end devices 208 may be battery powered. For example, a battery-powered sensor is one type of end device 208. The Wi-Fi network segment 204 includes Wi-Fi devices 210. Each Wi-Fi device 210 includes a Wi-Fi network interface for communication over the Wi-Fi network segment 204. Optionally or additionally, the HAN 200 can include an Ethernet network segment 212 that includes one or more Ethernet devices 214 that connect to the border router 106 or the access point 110. The Ethernet network segment 212 may be compatible with the IEEE 802.3 standard of any version, e.g., 802.3cu or any prior version.

[0014] The border router 106 is included in the wireless mesh network segment 202 and is included in the Wi-Fi network segment 204. The border router 106 includes a mesh network interface for communication over the mesh network segment 202 and a Wi-Fi network interface for communication over the Wi-Fi network segment 204. The border router 106 routes packets between devices in the wireless mesh network segment 202 and the Wi-Fi network segment 204. The border router 106 also routes packets between devices in the HAN 200 and external networknodes (e.g., the cloud sendee 112) via the access network 108, such as the Internet, through a home router or access point 110.

[0015] The devices in the mesh network segment 202, the Wi-Fi network segment 204, and the Ethernet network segment 212 use standard IP routing configurations to communicate with each other through transport protocols such as the User Datagram Protocol (UDP) or the Transmission Control Protocol (TCP). When the devices in the mesh network segment 202, the Wi-Fi network segment 204 and / or the Ethernet network segment 212 are provisioned as part of a Weave network, a fabric network, or a Matter network, the devices can communicate messages over those same UDP and / or TCP transports.Mater Commissioning over Thread Networks

[0016] In a first aspect, a Matter commissioner acts as a Thread commissioner. The Matter commissioner connects to a Thread border agent on a Thread border router 106 using the existing Thread MeshCoP protocol. The Matter commissioner petitions to be a Thread Commissioner. The Matter commissioner configures the Thread steering-data Bloom filter to encode a set of Matter discriminators of the device(s) that are allowed to join the Matter network. The Matter commissioner and the joiner device then communicate using the existing Matter Commissioning protocol, where the Thread border agent and existing Thread routers serve as relays between the Matter commissioner and the joining device(s).

[0017] FIG. 3 illustrates, at 300, data and control transactions between devices for commissioning a joiner device to a Matter network in accordance with a first aspect of Matter commissioning over Thread networks. In this first aspect, at 310, a Matter commissioner 302 (e.g., a mobile device running a commissioning application, a commissioning device 302) uses elements of MeshCoP to establish a commissioning session with a border agent 304 (e.g., a Thread border touter 106 running border agent software). The establishment of the commissioningsession includes registering and authenticating the Matter commissioner 302, as a Thread commissioner, with the border agent 304.

[0018] At 312, a joiner device 308 (a commissionee 308) indicates that it wants to join the Matter network by transmitting a unicast discovery beacon to the routers in the Thread network, such as the joiner router 306. The discovery beacon includes information to determine what to advertise on the Wi-Fi or Ethernet side of the border agent 304 via DNS-SD. At 314. the joiner router 306 forwards the unicast discovery beacon to the border agent 304 that in turn, at 316, forwards the unicast discovery beacon to the matter commissioner 302. As indicated by the boxes 301, messages between the commissioner 302 and the joiner router 306 are encapsulated in Thread relay transmit (RLY TX.ntf) and relay receive (RLY RXntf) messages to relay the commissioning messages through the Thread mesh network. This encapsulation occurs at the network layer of the networking protocol stack. Messages from the j oiner router 306 to the Matter commissioner 302 are encapsulated in the RLY RXntf messages and messages from the Matter commissioner 302 to the joiner router 306 are encapsulated in RLY TX.ntf messages.

[0019] The Matter commissioner 302 initiates the establishment of a Passcode Authenticated Session Establishment (PASE) session. The steps of this establishment are illustrated in the box 303. At 318, the Matter commissioner requests parameters for a Password-Based Key Derivation Function by transmitting a PBKDFParamRequest message to the border agent 304. The Matter commissioner 302 encapsulates the PBKDFParamRequest message in a RLY TXntf message. At 320, the border agent forwards the PBKDFParamRequest message to thejoiner router 306. The joiner router 306 decapsulates the PBKDFParamRequest message from the RLY TX.ntf message and, at 322, sends the PBKDFParamRequest message to thejoiner 308.

[0020] Based on receiving the PBKDFParamRequest message, thejoiner 308 responds by sending the PBKDF parameters to thejoiner router 306 in a PBKDFParamResponse message, at 324, that are used to derive a pre-shared key for the commissioner (PSKc). The PBKDF parameters include a password, P, from which a derived key is generated, a cry ptographic salt, S,a Pseudo-Random Function (PRF) to be used for the key generation, a number of times, c, that the PRF is applied to generate the key, and a length, dkLen, of the generated key. For example, the PRF is AES-CMAC-PRF-128. The password is the commissioning credential for the network, the salt is a concatenation of “Thread”, the Extended PAN ID of the network, and a network name. The number of applications of the PRF is 16384 and the generated key length is 16.

[0021] At 326. the joiner router 306 encapsulates the PBKDFParamResponse message in an RLY RX.ntf message and forwards the encapsulated message to the border agent 304 that in turn forwards the message to the Matter commissioner 302, at 328. The Matter commissioner decapsulates the received PBKDFParamResponse message from the RLY RXntf message.

[0022] Using the received PBKDF parameters, the Matter commissioner 302 begins the Password- Authenticated Key Exchange (PAKE) process with the j oiner 308 to establish the PASE session that is used to commission the joiner to the network. The Matter commissioner 302 begins the PAKE process, at 330, by encapsulating a first PAKE message (PAKE1 message) in a RLY TXntf message and sending the message to the border agent 304. At 332, the border agent 304 forwards the encapsulated PAKE1 message to the joiner router 306. At 334, the joiner router 306 decapsulates the PAKE1 message and forwards the PAKE1 message to the joiner 308.

[0023] In response to the PAKE1 message, the joiner 308 responds to the joiner router 306 with a second PAKE message (PAKE2 message) at 336. The joiner router 306 encapsulates the PAKE2 message in an RLY RXntf message and forwards the encapsulated message to the border agent 304, at 338, that in turn forwards the message to the Matter commissioner 302, at 340. The Matter commissioner decapsulates the received PAKE2 message from the RLY_RX.ntf message. To complete the PAKE, the Mater commissioner 302, at 342, encapsulates a third PAKE message (PAKE3 message) in a RLY TX.ntf message and sends the message to the border agent 304. At 344, the border agent 304 forwards the encapsulated PAKE3 message to the joiner router 306. The joiner router 306 decapsulates the PAKE3 message and forwards the PAKE3 message to the joiner 308.

[0024] This completes the PAKE process and establishes, at 348, the PASE session for commissioning the joiner device. Using the PASE session the Matter commissioner 302 provides commissioning information to the joiner 308. The commissioning information includes device attestation, providing operational credentials and network credentials to the joiner 308, providing additional configuration information (e.g., access control, time, locale, regulatory information), and establishing a certificate-authenticated session.

[0025] In a second aspect, a border agent provides a commissioning proxy to proxy between a Matter commissioner and Thread network devices. The Matter commissioner 302 connects to the on-network commissioning proxy 402 that provides a proxy between Matter commissioner’s protocols and the Thread protocols at the Thread border agent 304 and beyond into the Thread network. This aspect retains existing Matter commissioning processes for the Matter commissioner. The commissioning proxy 402 acts as a Thread commissioner and masquerades as an on-network commissionee for the Matter commissioner 302. The Domain Name System-Service Discovery (DNS-SD) function enables the Matter commissioner 302 to discover the commissionable Matter device 308 on the Thread network and relays traffic from the Matter commissioner 302 to the joiner device 308. There is no authentication required the between commissioning proxy 402 and the Matter commissioner 302 and minimal need for handling failover during the commissioning process. The commissioning proxy 402 can be deployed as a software module on any suitable device, such as the border router 106.

[0026] FIGs. 4a and 4b illustrate, at 400 and 450, data and control transactions between devices for commissioning a joiner device to a Matter network in accordance with the second aspect of Matter commissioning over Thread networks. In this second aspect, at 410 in FIG. 4a, a commissioning proxy 402 establishes a commissioning session with a border agent 304 (e.g., a border touter 106 running border agent software). The establishment of the commissioning session includes registering and authenticating the commissioning proxy 402 with the border agent 304.

[0027] At 412, a joiner device 308 (a commissionee 308) indicates that it wants to join the Matter network by transmitting a unicast discovery beacon to the routers in the Thread network, such as the joiner router 306. The discovery beacon includes information to determine what to advertise on the Wi-Fi or Ethernet side of the border agent 304 via DNS-SD. Alternatively, the joiner device 308 sends a Service Registration Protocol (SRP) Update message to the commissioning proxy 402 for publishing DNS-SD information. At 414. the joiner router 306 forwards the unicast discovery’ beacon to the border agent 304 that in turn, at 416, forwards the unicast discovery beacon to the commissioning proxy 402. As indicated by the boxes 401, messages between the commissioning proxy 402 and the joiner router 306 are encapsulated in Thread RLY TX.ntf and RLY RX.ntf messages to relay the commissioning messages through the Thread mesh network. Messages from the joiner router 306 to the commissioning proxy 402 are encapsulated in the RLY RXntf messages and messages from the commissioning proxy 402 to the joiner router 306 are encapsulated in RLY TX.ntf messages.

[0028] At 418, the commissioning proxy 402 transmits a Domain Name System-Service Discovery (DNS-SD) advertisement for a Matter commissioner. In response to receiving the DNS-SD advertisement, the Matter commissioner 302 initiates the establishment of a Passcode Authenticated Session Establishment (PASE) session. The steps of this establishment are illustrated in the box 403. At 420, the Matter commissioner requests parameters for a Password-Based Key Derivation Function by transmitting a PBKDFParamRequest message to the commissioning proxy 402. At 422, the commissioning proxy 402 encapsulates the PBKDFParamRequest message in a RLY TX.ntf message and forwards the message to the border agent 304. At 424, the border agent forwards the PBKDFParamRequest message to the joiner router 306. The joiner router 306 decapsulates the PBKDFParamRequest message from the RLY TXntf message and, at 426, sends the PBKDFParamRequest message to the joiner 308.

[0029] Based on receiving the PBKDFParamRequest message, the joiner 308 responds by sending the PBKDF parameters to the joiner router 306 in a PBKDFParamResponse message, at428, that are used to derive a pre-shared key for the commissioner (PSKc). The PBKDF parameters include a password, P, from which a derived key is generated, a cryptographic salt, S, a Pseudo-Random Function (PRF) to be used for the key generation, a number of times, c, that the PRF is applied to generate the key, and a length, dkLen, of the generated key. For example, the PRF is AES-CMAC-PRF-128. The password is the commissioning credential for the network, the salt is a concatenation of “Thread”, the Extended PAN ID of the network, and a network name. The number of applications of the PRF is 16384 and the generated key length is 16.

[0030] At 430, the joiner router 306 encapsulates the PBKDFParamResponse message in an RLY RX.ntf message and forwards the encapsulated message to the border agent 304 that in turn forwards the message to the commissioning proxy, at 432. The commissioning proxy 402 decapsulates the received PBKDFParamResponse message from the RLY RXntf message and, at 434, forwards the PBKDFParamResponse message to the Matter commissioner 302.

[0031] Using the received PBKDF parameters, the Matter commissioner 302 begins the Password- Authenticated Key Exchange (PAKE) process with the joiner 308 to establish the PASE session that is used to commission the joiner to the network. The Matter commissioner 302 begins the PAKE process, at 452 in FIG. 4b, by sending a first PAKE message (PAKE1 message) to the commissioning proxy 402. At 454, the commissioning proxy 402 encapsulates the PAKE1 message in a RLY TX.ntf message and sends the message to the border agent 304. At 456, the border agent 304 forwards the encapsulated PAKE1 message to the joiner router 306. At 458, the joiner router 306 decapsulates the PAKE1 message and forwards the PAKE1 message to the joiner 308.

[0032] In response to the PAKE1 message, the joiner responds to the joiner router 306 with a second PAKE message (PAKE2 message) at 460. The joiner router 306 encapsulates the PAKE2 message in an RLY RX.ntf message and forwards the encapsulated message to the border agent 304, at 462, that in turn forwards the message to the commissioning proxy 402, at 464. The commissioning proxy 402 decapsulates the received PAKE2 message from the RLY_RX.ntfmessage and forwards the PAKE2 message to the Matter commissioner 302, at 466. To complete the PAKE, the Mater commissioner 302, at 468, sends a third PAKE message (PAKE3 message) to the commissioning proxy 402. At 470, the commissioning proxy 402 encapsulates the PAKE3 message in a RLY TX.ntf message and sends the message to the border agent 304. At 472, the border agent 304 forwards the encapsulated PAKE3 message to the joiner router 306. At 474, the joiner router 306 decapsulates the PAKE3 message and forwards the PAKE3 message to the joiner 308.

[0033] This completes the PAKE process and establishes, at 476, the PASE session for commissioning the joiner device. Using the PASE session the Matter commissioner 302 provides commissioning information to the joiner 308 that is relayed by the commissioning proxy 402. The commissioning information includes device attestation, providing operational credentials and network credentials to the joiner 308, providing additional configuration information (e.g., access control, time, locale, regulatory information), and establishing a certificate-authenticated session.Example Methods

[0034] Example methods 500 and 600 are described with reference to FIGs. 5, 6a, and 6b in accordance with one or more aspects of Matter commissioning over Thread networks. Generally, any of the components, modules, methods, and operations described herein can be implemented using software, firmware, hardware (e.g., fixed logic circuitry), manual processing, or any combination thereof. Some operations of the example methods may be described in the general context of executable instructions stored on computer-readable storage memory7that is local and / or remote to a computer processing system, and implementations can include software applications, programs, functions, and the like. Alternatively or in addition, any of the functionality described herein can be performed, at least in part, by one or more hardware logic components, such as, and without limitation, Field-programmable Gate Arrays (FPGAs), Application-specific Integrated Circuits (ASICs), Application-specific Standard Products(ASSPs), System-on-a-chip systems (SoCs), Complex Programmable Logic Devices (CPLDs), and the like. The order in which the method blocks are described is not intended to be construed as a limitation, and any number of the described method blocks can be combined in any order or skipped to implement a method or an alternate method.

[0035] FIG. 5 illustrates example method(s) 500 of Matter commissioning over Thread networks as generally related to commissioning by a Matter commissioner using aspects of Thread MeshCoP to perform device joining. At block 502, a Matter commissioner establishes a commissioning session with a Thread border agent. For example, a Matter commissioner (e.g., the Matter Commissioner 302) establishes a commissioning session with a Thread border agent (e.g., the border agent 304). Once established, the Matter commissioner becomes a Thread commissioner on the Thread network.

[0036] At block 504. the Matter commissioner receives a discovery’ beacon from a joiner device. For example, the Matter commissioner receives a discovery beacon from a joiner device (e.g., the joiner device 308). The discovery beacon is encapsulated in a Thread relay receive (RLY RXntf) message and the Matter commissioner decapsulates the discovery beacon from the Thread relay receive (RLY RX.ntf) message.

[0037] At block 506, the Matter commissioner sends a request for parameters for a Password-Based Key Derivation Function to the joiner device. For example, the Matter commissioner encapsulates the request for the parameters for the Password-Based Key Derivation Function in a Thread relay transmit (RLY TX.ntf) message and forwards the Thread relay transmit (RLY TX.ntf) message to the joiner device.

[0038] At block 508, in response to forwarding the request for the parameters for the Password-Based Key Derivation Function, the Matter commissioner, receives from the joiner device, a response including the parameters for the Password-Based Key Derivation Function. For example, the Matter commissioner receives from the joiner device, a response including the parameters for the Password-Based Key Derivation Function encapsulated in a Thread relayreceive (RLY RX.ntf) message. The Mater commissioner decapsulates the response including the parameters for the Password-Based Key Derivation Function from the Thread relay receive (RLY RXntf) message.

[0039] At block 510. the Mater commissioner, sends a first Password- Authenticated Key Exchange (PAKE) message to the joiner device. For example, the Matter commissioner encapsulates the first PAKE message in a Thread relay transmit (RLY TX.ntf) message and forwards the Thread relay transmit (RLY TX.ntf) message to the joiner device.

[0040] At block 512, in response to sending the first PAKE message, the Matter commissioner, receives, from the j oiner device, a second PAKE message. For example, the Mater commissioner receives from the joiner device, the second PAKE message encapsulated in a Thread relay receive (RLY RX.ntf) message. The Mater commissioner decapsulates the second PAKE message from the Thread relay receive (RLY RX.ntf) message.

[0041] At block 514. the Mater commissioner, sends a third PAKE message to the joiner device. For example, the Matter commissioner encapsulates the third PAKE message in a Thread relay transmit (RLY TX.ntf) message and forwards the Thread relay transmit (RLY TX.ntf) message to the joiner device. By forwarding of the third PAKE message to the joiner device, establishment of a PASE session between the Matter commissioner and the joiner device is initiated. Using the PASE session, the joiner device may be commissioned to a Mater network. In this sense, the third PAKE message may be considered to be effective to commission the joiner device to a Mater network.

[0042] FIGs. 6a and 6b illustrate example method(s) 600 of Matter commissioning over Thread networks as generally related to commissioning by a Mater commissioner using a commissioning proxy. At block 602, a commissioning proxy receives a discovery beacon from a joiner device. For example, a commissioning proxy (e.g., the commissioning proxy 402) receives a discovery beacon from a joiner device (e.g., the joiner device 308). The discovery beacon isencapsulated in a Thread relay receive (RLY RX.ntf) message and the commissioning proxy decapsulates the discovery beacon from the Thread relay receive (RLY RX.ntf) message.

[0043] At block 604, based on the receiving the discovery beacon, the commissioning proxy sends a Domain Name System-Service Discovery (DNS-SD) advertisement to a commissioner device. For example, based on receiving and decapsulating the discovery beacon, the commissioning proxy sends a Domain Name Sy stem- Service Discovery (DNS-SD) advertisement to a commissioner device (e.g.. the commissioning device 302).

[0044] At block 606. the commissioning proxy receives, from the commissioner device, a request for parameters for a Password-Based Key Derivation Function. For example, the commissioning proxy receives, from the commissioner device, a request for parameters for a Password-Based Key Derivation Function.

[0045] At block 608, the commissioning proxy forwards the request for the parameters for the Password-Based Key Derivation Function to the joiner device. For example, the commissioning proxy encapsulates the request for the parameters for the Password-Based Key- Derivation Function in a Thread relay transmit (RLY TX.ntf) message and forwards the Thread relay transmit (RLY TX.ntf) message to the joiner device.

[0046] At block 610, in response to forwarding the request for the parameters for the Password-Based Key Derivation Function, the commissioning proxy receives, from the joiner device, a response including the parameters for the Password-Based Key Derivation Function. For example, the commissioning proxy receives from the joiner device, a response including the parameters for the Password-Based Key Derivation Function encapsulated in a Thread relay¬ receive (RLY_RX.ntf) message. The commissioning proxy decapsulates the response including the parameters for the Password-Based Key Derivation Function from the Thread relay receive (RLY RXmtf) message.

[0047] At block 612, the commissioning proxy forwards the response that includes the parameters for the Password-Based Key Derivation Function to the commissioner device. Forexample, after decapsulating the message, the commissioning proxy forwards the response that includes the parameters for the Password-Based Key Derivation Function to the commissioner device.

[0048] At block 614, the commissioning proxy receives a first Password-Authenticated Key Exchange (PAKE) message from the commissioner device. For example, the commissioning proxy receives, from the commissioner device, a first PAKE message.

[0049] At block 616, the commissioning proxy forwards the first PAKE message to the joiner device. For example, the commissioning proxy encapsulates the first PAKE message in a Thread relay transmit (RLY TX.ntf) message and forwards the Thread relay transmit (RLY TX.ntf) message to the joiner device.

[0050] At block 618, in response to forwarding the first PAKE message, the commissioning proxy receives, from the joiner device, a second PAKE message. For example, the commissioning proxy receives from the joiner device, the second PAKE message encapsulated in a Thread relay receive (RLY RXntl) message. The commissioning proxy decapsulates the second PAKE message from the Thread relay receive (RLY RX.ntf) message.

[0051] At block 620, the commissioning proxy forwards the second PAKE message to the commissioner device. For example, the commissioning proxy forw ards the decapsulated second PAKE message to the commissioner device.

[0052] At block 622, the commissioning proxy receives a third PAKE message from the commissioner device. For example, the commissioning proxy receives, from the commissioner device, the third PAKE message.

[0053] At block 624, the commissioning proxy, forwards the third PAKE message to the joiner device, the forwarding being effective to establish a Passcode Authenticated Session Establishment (PASE) session between the commissioner device and the joiner device to commission the joiner device to a Matter network. For example, the commissioning proxy encapsulates the third PAKE message and forwards the Thread relay transmit (RLY TX.ntf)message to the joiner device. The forwarding of the encapsulated, third PAKE message is effective to establish a Passcode Authenticated Session Establishment (PASE) session between the commissioner device and the joiner device to commission the joiner device to a Matter network.Example Environments and Devices

[0054] FIG. 7 illustrates an example environment 700 in which aspects of Matter commissioning over Thread networks can be implemented. Generally, the environment 700 includes the home area network (HAN) 200 implemented as part of a home or other type of structure with any number of wireless network devices that are configured for communication in a wireless network. For example, the wireless network devices can include a thermostat 702, hazard detectors 704 (e.g., for smoke and / or carbon monoxide), cameras 706 (e.g., indoor and outdoor), lighting units 708 (e.g., indoor and outdoor), and any other types of wireless network devices 710 that are implemented inside and / or outside of a structure 712 (e.g., in a home environment), such as a network-enabled television or a media streaming device. In this example, the wireless netw ork devices can also include any of the previously described devices, such as a border router 106, as w ell as any of the devices implemented as a router device 206, and / or as an end device 208.

[0055] In the environment 700, any number of the wireless network devices can be implemented for wireless interconnection to wirelessly communicate and interact with each other. The wireless network devices are modular, intelligent, multi-sensing, network-connected devices that can integrate seamlessly with each other and / or with a central server or a cloud-computing system to provide any of a variety of useful automation objectives and implementations. An example of a wireless netw ork device that can be implemented as any of the devices described herein is shown and described with reference to FIG. 8.

[0056] In implementations, the thermostat 702 may include a Nest® Learning Thermostat that detects ambient climate characteristics (e.g., temperature and / or humidity) and controls a HVAC system 714 in the home environment. The learning thermostat 702 and other network-connected devices “lean® by capturing occupant settings to the devices. For example, the thermostat learns preferred temperature set-points for mornings and evenings, and when the occupants of the structure are asleep or awake, as well as when the occupants are typically away or at home.

[0057] A hazard detector 704 can be implemented to detect the presence of a hazardous substance or a substance indicative of a hazardous substance (e.g., smoke, fire, or carbon monoxide). In examples of wireless interconnection, a hazard detector 704 may detect the presence of smoke, indicating a fire in the structure, in which case the hazard detector that first detects the smoke can broadcast a low-power wake-up signal to all of the connected wireless network devices. The other hazard detectors 704 can then receive the broadcast wake-up signal and initiate a high-power state for hazard detection and to receive wireless communications of alert messages. Further, the lighting units 708 can receive the broadcast wake-up signal and activate in the region of the detected hazard to illuminate and identify the problem area. In another example, the lighting units 708 may activate in one illumination color to indicate a problem area or region in the structure, such as for a detected fire or break-in, and activate in a different illumination color to indicate safe regions and / or escape routes out of the structure.

[0058] In various configurations, the wireless network devices 710 can include an entry way interface device 716 that functions in coordination with a network-connected door lock system 718, and that detects and responds to a person’s approach to or departure from a location, such as an outer door of the structure 712. The entry way interface device 716 can interact with the other wireless network devices based on whether someone has approached or entered the smart-home environment. An entry way interface device 716 can control doorbell functionality7, announce the approach or departure of a person via audio or visual means, and control settings ona securin’ system, such as to activate or deactivate the security system when occupants come and go. The wireless network devices 710 can also include other sensors and detectors, such as to detect ambient lighting conditions, detect room-occupancy states (e.g., with an occupancy sensor 720), and control a power and / or dim state of one or more lights. In some instances, the sensors and / or detectors may also control a power state or speed of a fan. such as a ceiling fan 722. Further, the sensors and / or detectors may detect occupancy in a room or enclosure and control the supply of power to electrical outlets or devices 724, such as if a room or the structure is unoccupied.

[0059] The wireless network devices 710 may also include connected appliances and / or controlled systems 726, such as refrigerators, stoves and ovens, washers, dryers, air conditioners, pool heaters 728, irrigation systems 730. security systems 732. and so forth, as well as other electronic and computing devices, such as televisions, entertainment systems, computers, intercom systems, garage-door openers 734, ceiling fans 722, control panels 736, and the like. When plugged in, an appliance, device, or system can announce itself to the home area network as described above and can be automatically integrated with the controls and devices of the home area network, such as in the home. It should be noted that the wireless network devices 710 may include devices physically located outside of the structure, but within wireless communication range, such as a device controlling a swimming pool heater 728 or an irrigation system 730.

[0060] As described above, the HAN 200 includes a border router 106 that interfaces for communication with an external network, outside the HAN 200. The border router 106 connects to an access point 110, which connects to the access network 108, such as the Internet. A cloud sendee 112, which is connected via the access network 108, provides services related to and / or using the devices within the HAN 200. By way of example, the cloud service 112 can include applications for connecting end user devices 738, such as smartphones, tablets, and the like, to devices in the home area network, processing and presenting data acquired in the HAN 200 to end users, linking devices in one or more HANs 200 to user accounts of the cloud senice 112, provisioning and updating devices in the HAN 200, and so forth. For example, a user can controlthe thermostat 702 and other wireless network devices in the home environment using a network-connected computer or portable device, such as a mobile phone or tablet device. Further, the wireless network devices can communicate information to any central server or cloud-computing system via the border router 106 and the access point 110. The data communications can be earned out using any of a variety of custom or standard wireless protocols (e.g., Wi-Fi, ZigBee for low power. 6L0WPAN, Thread, etc.) and / or by using any of a variety of custom or standard wired protocols (CAT6 Ethernet, HomePlug, etc.).

[0061] Any of the wireless network devices in the HAN 200 can sen e as low-power and communication nodes to create the HAN 200 in the home environment. Individual low-power nodes of the network can regularly send out messages regarding what they are sensing, and the other low-powered nodes in the environment - in addition to sending out their own messages -can repeat the messages, thereby communicating the messages from node to node (i.e., from device to device) throughout the home area network. The wireless network devices can be implemented to conserve power, particularly when battery-powered, utilizing low-powered communication protocols to receive the messages, translate the messages to other communication protocols, and send the translated messages to other nodes and / or to a central server or cloudcomputing system. For example, an occupancy and / or ambient light sensor can detect an occupant in a room as well as measure the ambient light, and activate the light source when the ambient light sensor 740 detects that the room is dark and when the occupancy sensor 720 detects that someone is in the room. Further, the sensor can include a low-power wireless communication chip (e.g., an IEEE 802.15.4 chip, a Thread chip, a ZigBee chip) that regularly sends out messages regarding the occupancy of the room and the amount of light in the room, including instantaneous messages coincident with the occupancy sensor detecting the presence of a person in the room. As mentioned above, these messages may be sent wirelessly, using the home area network, from node to node (e.g., network-connected device to network-connected device) within the home environment as well as over the Internet to a central server or cloud-computing system.

[0062] In other configurations, various ones of the wireless network devices can function as “tripwires” for an alarm system in the home environment. For example, in the event a perpetrator circumvents detection by alarm sensors located at windows, doors, and other entry points of the structure or environment, the alarm could still be triggered by receiving an occupancy, motion, heat, sound, etc. message from one or more of the low-powered mesh nodes in the home area network. In other implementations, the home area network can be used to automatically turn on and off the lighting units 708 as a person transitions from room to room in the structure. For example, the wireless network devices can detect the person’s movement through the structure and communicate corresponding messages via the nodes of the home area network. Using the messages that indicate which rooms are occupied, other wireless network devices that receive the messages can activate and / or deactivate accordingly. As referred to above, the home area network can also be utilized to provide exit lighting in the event of an emergency, such as by turning on the appropriate lighting units 708 that lead to a safe exit. The light units 708 may also be tumed-on to indicate the direction along an exit route that a person should travel to safely exit the structure.

[0063] The various wireless network devices may also be implemented to integrate and communicate with wearable computing devices 742, such as may be used to identify and locate an occupant of the structure, and adjust the temperature, lighting, sound system, and the like accordingly. In other implementations, RFID sensing (e.g., a person having an RFID bracelet, necklace, or key fob), synthetic vision techniques (e.g., video cameras and face recognition processors), audio techniques (e.g., voice, sound pattern, vibration pattern recognition), ultrasound sensing / imaging techniques, and infrared or near-field communication (NFC) techniques (e.g., a person wearing an infrared or NFC-capable smartphone), along with rules-based inference engines or artificial intelligence techniques that draw useful conclusions from the sensed information as to the location of an occupant in the structure or environment.

[0064] In other implementations, personal comfort-area networks, personal health-area networks, personal safety-area networks, and / or other such human-facing functionalities of service robots can be enhanced by logical integration with other wireless network devices and sensors in the environment according to rules-based inferencing techniques or artificial intelligence techniques for achieving better performance of these functionalities. In an example relating to a personal health-area, the system can detect whether a household pet is moving toward the current location of an occupant (e.g., using any of the wireless network devices and sensors), along with rules-based inferencing and artificial intelligence techniques. Similarly, a hazard detector service robot can be notified that the temperature and humidity levels are rising in a kitchen, and temporarily raise a hazard detection threshold, such as a smoke detection threshold, under an inference that any small increases in ambient smoke levels will most likely be due to cooking activity and not due to a genuinely hazardous condition. Any service robot that is configured for any type of monitoring, detecting, and / or servicing can be implemented as a mesh node device on the home area network, conforming to the wireless interconnection protocols for communicating on the home area network.

[0065] The wireless network devices 710 may also include a network-connected alarm clock 744 for each of the individual occupants of the structure in the home environment. For example, an occupant can customize and set an alarm device for a wake time, such as for the next day or week. Artificial intelligence can be used to consider occupant responses to the alarms when they go off and make inferences about preferred sleep patterns over time. An individual occupant can then be tracked in the home area network based on a unique signature of the person, which is determined based on data obtained from sensors located in the wireless network devices, such as sensors that include ultrasonic sensors, passive IR sensors, and the like. The unique signature of an occupant can be based on a combination of patterns of movement, voice, height, size, etc., as well as using facial recognition techniques.

[0066] In an example of wireless interconnection, the wake time for an individual can be associated with the thermostat 702 to control the HVAC system in an efficient manner so as to pre-heat or cool the structure to desired sleeping and awake temperature settings. The preferred settings can be learned over time, such as by capturing the temperatures set in the thermostat before the person goes to sleep and upon waking up. Collected data may also include biometric indications of a person, such as breathing patterns, heart rate, movement, etc., from which inferences are made based on this data in combination with data that indicates when the person actually wakes up. Other wireless network devices can use the data to provide other automation objectives, such as adjusting the thermostat 702 so as to pre-heat or cool the environment to a desired setting and tuming-on or turning-off the lights 708.

[0067] In implementations, the wireless network devices can also be utilized for sound, vibration, and / or motion sensing such as to detect running water and determine inferences about water usage in a home environment based on algorithms and mapping of the water usage and consumption. This can be used to determine a signature or fingerprint of each water source in the home and is also referred to as ‘‘audio fingerprinting water usage.’' Similarly, the wireless network devices can be utilized to detect the subtle sound, vibration, and / or motion of unw anted pests, such as mice and other rodents, as well as by termites, cockroaches, and other insects. The system can then notify an occupant of the suspected pests in the environment, such as with warning messages to help facilitate early detection and prevention.

[0068] The environment 700 may include one or more wireless network devices that function as a hub 746. The hub 746 may be a general-purpose home automation hub, or an application-specific hub, such as a security hub, an energy management hub, an HVAC hub, and so forth. The functionality of a hub 746 may also be integrated into any wireless netw ork device, such as a netw ork-connected thermostat device or the border router 106. Hosting functionality on the hub 746 in the structure 712 can improve reliability when the user's internet connection is unreliable, can reduce latency of operations that w ould normally have to connect to the cloudservice 112, and can satisfy system and regulatory constraints around local access between wireless network devices.

[0069] Additionally, the example environment 700 includes a network-connected speaker (network-connected assistant device) 748. The network-connected speaker 748 provides voice assistant services that include providing voice control of network-connected devices. The functions of the hub 746 may be hosted in the network-connected speaker 748. The network-connected speaker 748 can be configured to communicate via the wireless mesh network 202, the Wi-Fi network 204, or both.

[0070] FIG. 8 illustrates an example wireless network device 800 that can be implemented as any of the wireless network devices (nodes) in a home area network (Thread network, fabric network, Weave network, Matter network) in accordance with one or more aspects of Matter commissioning over Thread networks as described herein. The device 800 can be integrated with electronic circuitry, microprocessors, memory’, input output (I / O) logic control, communication interfaces and components, as well as other hardware, firmware, and / or software to implement the device in a home area network. Further, the wireless network device 800 can be implemented with various components, such as with any number and combination of different components as further described with reference to the example device shown in FIG. 9.

[0071] In this example, the wireless network device 800 includes a low-power microprocessor 802 and a high-power microprocessor 804 (e.g., microcontrollers or digital signal processors) that process executable instructions. The device also includes an input-output (I / O) logic control 806 (e.g., to include electronic circuitry). The microprocessors can include components of an integrated circuit, programmable logic device, a logic device formed using one or more semiconductors, and other implementations in silicon and / or hardware, such as a processor and memory’ system implemented as a system-on-chip (SoC). Alternatively or in addition, the device can be implemented with any one or combination of software, hardw are, firmware, or fixed logic circuitry’ that may be implemented w’ith processing and control circuits.The low-power microprocessor 802 and the high-power microprocessor 804 can also support one or more different device functionalities of the device. For example, the high-power microprocessor 804 may execute computationally intensive operations, whereas the low-power microprocessor 802 may manage less-complex processes such as detecting a hazard or temperature from one or more sensors 808. The low-power processor 802 may also wake or initialize the high-power processor 804 for computationally intensive processes.

[0072] The one or more sensors 808 can be implemented to detect various properties such as acceleration, temperature, humidity, water, supplied power, proximity, external motion, device motion, sound signals, ultrasound signals, light signals, fire, smoke, carbon monoxide, global-positioning-satellite (GPS) signals, radio frequency (RF), other electromagnetic signals or fields, or the like. As such, the sensors 808 may include any one or a combination of temperature sensors, humidity sensors, hazard-related sensors, other environmental sensors, accelerometers, microphones, optical sensors up to and including cameras (e.g.. charged coupled-device or video cameras, active or passive radiation sensors, GPS receivers, and radio frequency identification detectors. In implementations, the wireless network device 800 may include one or more primary' sensors, as well as one or more secondary sensors, such as primary sensors that sense data central to the core operation of the device (e.g.. sensing a temperature in a thermostat or sensing smoke in a smoke detector), while the secondary' sensors may sense other types of data (e.g., motion, light or sound), which can be used for energy -efficiency objectives or automation objectives.

[0073] The wireless network device 800 includes a memory device controller 810 and a memory' device 812, such as any type of a nonvolatile memory' and / or other suitable electronic data storage device. The wireless network device 800 can also include various firmware and / or software, such as an operating system 814 that is maintained as computer executable instructions by the memory and executed by a microprocessor. The device software may also include a commissioning application 816 that implements aspects of Matter commissioning over Thread networks. The wireless network device 800 also includes a device interface 818 to interface withanother device or peripheral component and includes an integrated data bus 820 that couples the various components of the wireless network device for data communication between the components. The data bus in the wireless network device may also be implemented as any one or a combination of different bus structures and / or bus architectures.

[0074] The device interface 818 may receive input from a user and / or provide information to the user (e.g., as a user interface), and a received input can be used to determine a setting. The device interface 818 may also include mechanical or virtual components that respond to a user input. For example, the user can mechanically move a sliding or rotatable component, or the motion along a touchpad may be detected, and such motions may correspond to a setting adjustment of the device. Physical and virtual movable user-interface components can allow the user to set a setting along a portion of an apparent continuum. The device interface 818 may also receive inputs from any number of peripherals, such as buttons, a keypad, a switch, a microphone, and an imager (e g., a camera device).

[0075] The wireless network device 800 can include network interfaces 822, such as a home area network interface for communication with other wireless network devices in a home area netw ork, wired netw ork devices (e.g., Ethernet-connected devices), and an external network interface for network communication, such as via the Internet. The wireless network device 800 also includes wireless radio systems 824 for wireless communication with other wireless network devices via the home area network interface and for multiple, different wireless communications systems. The wireless radio systems 824 may include Wi-Fi, Bluetooth™, Mobile Broadband, BLE, and / or point-to-point IEEE 802.15.4. Each of the different radio systems can include a radio device, antenna, and chipset that is implemented for a particular wireless communications technology. The wireless netw ork device 800 also includes a pow er source 826, such as a batten' and / or to connect the device to line voltage. An AC pow er source may also be used to charge the battery of the device.

[0076] FIG. 9 illustrates an example system 900 that includes an example device 902, which can be implemented as any of the wireless network devices that implement aspects of Matter commissioning over Thread networks as described with reference to the previous FIGs.1-8. The example device 902 may be any type of computing device, client device, mobile phone, tablet, communication, entertainment, gaming, media playback, and / or other type of device. Further, the example device 902 may be implemented as any other type of wireless network device that is configured for communication on a home area network, such as a thermostat, hazard detector, camera, light unit, commissioning device, router, border router, joiner router, joining device, end device, leader, access point, and / or other wireless network devices.

[0077] The device 902 includes communication devices 904 that enable wired and / or wireless communication of device data 906. such as data that is communicated between the devices in a home area network, data that is being received, data scheduled for broadcast, data packets of the data, data that is synchronized between the devices, etc. The device data can include any type of communication data, as well as audio, video, and / or image data that is generated by¬ applications executing on the device. The communication devices 904 can also include transceivers for cellular phone communication and / or for network data communication.

[0078] The device 902 also includes input / output (I / O) interfaces 908, such as data network interfaces that provide connection and / or communication links between the device, data networks (e.g., ahome area network, external netw ork, etc.), and other devices. The I / O interfaces can be used to couple the device to any ty pe of components, peripherals, and / or accessory- devices. The I / O interfaces also include data input ports via which any ty pe of data, media content, and / or inputs can be received, such as user inputs to the device, as well as any ty pe of communication data, as well as audio, video, and / or image data received from any content and / or data source.

[0079] The device 902 includes a processing system 910 that may be implemented at least partially in hardware, such as with any type of microprocessors, controllers, and the like that process executable instructions. The processing system can include components of an integratedcircuit programmable logic device, a logic device formed using one or more semiconductors, and other implementations in silicon and / or hardware, such as a processor and memon' system implemented as a system-on-chip (SoC). Alternatively or in addition, the device can be implemented with any one or combination of software, hardware, firmware, or fixed logic circuitry that may be implemented with processing and control circuits. The device 902 may further include any type of a system bus or other data and command transfer system that couples the various components within the device. A system bus can include any one or combination of different bus structures and architectures, as well as control and data lines.

[0080] The device 902 also includes computer-readable storage memory’ 912, such as data storage devices that can be accessed by a computing device, and that provide persistent storage of data and executable instructions (e.g.. software applications, modules, programs, functions, and the like). The computer-readable storage memory described herein excludes propagating signals. Examples of computer-readable storage memory include volatile memory and non-volatile memory, fixed and removable media devices, and any suitable memory device or electronic data storage that maintains data for computing device access. The computer-readable storage memory’ can include various implementations of random access memory (RAM), read-only memory’ (ROM), flash memory, and other types of storage memory’ in various memory device configurations.

[0081] The computer-readable storage memory 912 provides storage of the device data 906 and various device applications 914, such as an operating system that is maintained as a software application with the computer-readable storage memory and executed by the processing system 910. The device applications may also include a device manager, such as any form of a control application, software application, signal processing and control module, code that is native to a particular device, a hardware abstraction layer for a particular device, and so on. In this example, the device applications also include a commissioning application 916 that implementsaspects of Matter commissioning over Thread networks, such as when the example device 902 is implemented as any of the wireless network devices described herein.

[0082] The device 902 also includes an audio and / or video system 918 that generates audio data for an audio device 920 and / or generates display data for a display device 922. The audio device and / or the display device include any devices that process, display, and / or otherwise render audio, video, display, and / or image data, such as the image content of a digital photo. In implementations, the audio device and / or the display device are integrated components of the example device 902. Alternatively, the audio device and / or the display device are external, peripheral components to the example device. In aspects, at least part of the techniques described for Matter commissioning over Thread networks may be implemented in a distributed system, such as over a "‘cloud’" 924 in a platform 926. The cloud 924 includes and / or is representative of the platform 926 for services 928 and / or resources 930.

[0083] The platform for the services 926 and / or resources 928 includes processor(s) and computer-readable storage media. The processor may be a single core processor or a multiple core processor composed of a variety of materials, such as silicon, polysilicon, high-K dielectric, copper, and so on. CRM may include any suitable memory or storage device such as randomaccess memory (RAM), static RAM (SRAM), dynamic RAM (DRAM), non-volatile RAM (NVRAM), read-only memory (ROM), or Flash memory useful to store device data, such as Thread network credentials and / or structure-related data.

[0084] The platform 926 abstracts underlying functionality' of hardware, such as server devices (e.g., included in the services 928) and / or software resources (e.g., included as the resources 930), and connects the example device 902 with other devices, servers, etc. The resources 930 may also include applications and / or data that can be utilized while computer processing is executed on servers that are remote from the example device 902. Additionally, the sendees 928 and / or the resources 930 may facilitate subscriber network services, such as over the Internet, a cellular network, or Wi-Fi network. The platform 926 may also serve to abstract andscale resources to service a demand for the resources 930 that are implemented via the platform, such as in an interconnected device aspect with functionality distributed throughout the system 700. For example, the functionality may be implemented in part at the example device 902 as well as via the platform 926 that abstracts the functionality of the cloud 924.

[0085] In the following some examples are described:Example 1 : A method for Matter commissioning over a Thread network by a commissioning proxy, the method comprising:receiving a discovery beacon from a joiner device;based on the receiving the discovery beacon, sending a Domain Name System-Service Discovery (DNS-SD) advertisement to a commissioner device;receiving, from the commissioner device, a request for parameters for a Password-Based Key Derivation Function;forwarding the request for the parameters for the Password-Based Key Derivation Function to the joiner device;in response to forwarding the request for the parameters for the Password-Based Key Derivation Function, receiving from the joiner device, a response including the parameters for the Password-Based Key Derivation Function;forwarding the response that includes the parameters for the Password-Based Key Derivation Function to the commissioner device;receiving a first Password- Authenticated Key Exchange (PAKE) message from the commissioner device;forwarding the first PAKE message to the joiner device;in response to forwarding the first PAKE message, receiving from the joiner device, a second PAKE message;forwarding the second PAKE message to the commissioner device;receiving a third PAKE message from the commissioner device; andforwarding the third PAKE message to the joiner device, the forwarding being effective to commission the joiner device to a Matter network.Example 2: The method of example 1, further comprising:decapsulating the discovery beacon from a Thread relay receive (RLY RX.ntf) message before sending the DNS-SD advertisement to the commissioner device.Example 3 : The method of example 1 or example 2, further comprising:encapsulating the request for the parameters for the Password-Based Key Derivation Function in a Thread relay transmit (RLY TX.ntf) message before sending request to the joiner device; anddecapsulating the response that includes the parameters for the Password-Based Key Derivation Function from a Thread relay receive (RLY RXntf) message before sending the parameters for the Password-Based Key Derivation Function to the commissioner device.Example 4: The method of any one of the preceding examples, further comprising:encapsulating the first PAKE message in a Thread relay transmit (RLY TX.ntf) message before sending first PAKE message to the joiner device;decapsulating the second PAKE message from a Thread relay receive (RLY RX.ntf) message before sending the second PAKE message to the commissioner device; and encapsulating the third PAKE message in a Thread relay transmit (RLY_TX.ntf) message before sending third PAKE message to the j oiner device.Example 5 : The method of any one of the preceding examples, wherein messages to, and messages from, the joiner device are forwarded by ajoiner router.Example 6: The method of example 5, wherein the joiner router encapsulates messages to the commissioning proxy in Thread relay receive (RLY RX.ntf) messages, and wherein the joiner router decapsulates Thread relay transmit (RLY TX.ntf) messages from the commissioning proxy before forwarding the encapsulated messages to the joiner device.Example 7 : The method of any one of the preceding examples, wherein messages to. and messages from, the joiner router are forwarded by a Thread border agent.Example 8: The method of any one of the preceding examples, wherein the parameters for the Password-Based Key Derivation Function include a password, a cryptographic salt, a PseudoRandom Function (PRF) used for key generation, a number of times that the PRF is applied to generate the key, and a length of the generated key.Example 9: The method of any one of the preceding examples, further comprising:registering and authenticating the commissioning proxy with the border agent to establish a commissioning session.Example 10: The method of any one of the preceding examples, wherein the commissioning of the joiner device to a Matter network further comprises:relaying, from the commissioner device, commissioning information including one or more of: device attestation, operational credentials, network credentials, and additional configuration information to the joiner device to establish a certificate-authenticated session that completes commissioning the joiner device.Example 11: The method of any one of the preceding examples, wherein the forwarding of the third PAKE message to the joiner device to commission the joiner device to a Matter network comprises:establishing a PASE session between the Matter commissioner and the joiner device to commission the joiner device to the Matter network.Example 12: A method for Matter commissioning over a Thread network by a Matter commissioner, the method comprising:establishing a commissioning session with a Thread border agent:receiving a discovery beacon from a joiner device;sending a request for parameters for a Password-Based Key Derivation Function to the joiner device;in response to forwarding the request for the parameters for the Password-Based Key Derivation Function, receiving from the joiner device, aresponse including the parameters for the Password-Based Key Derivation Function;sending a first Pass word- Authenticated Key Exchange (PAKE) message to the joiner device;in response to sending the first PAKE message, receiving from the joiner device, a second PAKE message; andsending a third PAKE message to the joiner device that is effective to establish a Passcode Authenticated Session Establishment (PASE) session between the commissioner device and the joiner device to commission the joiner device to a Matter network.Example 13: The method of example 12, wherein the establishing the commissioning session with the Thread border agent establishes the Matter commissioner as a Thread network commissioner.Example 14: The method of example 12 or example 13, further comprising:receiving the discovery beacon from the joiner device encapsulated in a Thread relay receive (RLY RX.ntf) message; anddecapsulating the discovers’ beacon from the Thread relay receive (RLY RX.ntf) message.Example 15: The method of any one of examples 12 to 14, further comprising:encapsulating the request for the parameters for the Password-Based Key Derivation Function in a Thread relay transmit (RLY TX.ntf) message before sending request to the joiner device; anddecapsulating the response that includes the parameters for the Password-Based Key Derivation Function from a Thread relay receive (RLY RX.ntf) message.Example 16: The method of any one of examples 12 to 15, further comprising:encapsulating the first PAKE message in a Thread relay transmit (RLY TX.ntf) message before sending first PAKE message to the joiner device;decapsulating the second PAKE message from a Thread relay receive (RLY RX.ntf) message; andencapsulating the third PAKE message in a Thread relay transmit (RLY TX.ntf) message before sending third PAKE message to the joiner device.Example 17: The method of any one of examples 12 to 16, wherein messages to, and messages from, the joiner device are forwarded by a joiner router.Example 18: The method of example 17, wherein the joiner router encapsulates messages to the Matter commissioner in Thread relay receive (RLY RX.ntf) messages, and wherein the joinerrouter decapsulates Thread relay transmit (RLY TX.ntf) messages from the Matter commissioner before forwarding the encapsulated messages to the joiner device.Example 19: The method of any one of examples 12 to 18. wherein the commissioning of the joiner device to a Matter network further comprises:sending commissioning information including one or more of: device attestation, operational credentials, network credentials, and additional configuration information to the joiner device to establish a certificate-authenticated session that completes commissioning the joiner device.Example 20: An apparatus comprising:a processor; andmemory’ comprising instructions executable by the apparatus to cause the apparatus to perform the method of any one of the preceding examples.Example 21: A non-transitoiy computer-readable storage medium comprising instructions for an application, the instructions executable by one or more processors, to configure the application to perform a method as recited in any one of examples 1 to 19.

[0086] Although aspects of Matter commissioning over Thread networks have been described in language specific to features and / or methods, the subject of the appended claims is not necessarily limited to the specific features or methods described. Rather, the specific features and methods are disclosed as example implementations of Matter commissioning over Thread networks, and other equivalent features and methods are intended to be within the scope of the appended claims. Further, various different aspects are described, and it is to be appreciated that each described aspect can be implemented independently or in connection with one or more other described aspects.

Claims

CLAIMS1. A method for Matter commissioning over a Thread network by a commissioning proxy, the method comprising:receiving a discover}' beacon from a joiner device;based on the receiving the discovery beacon, sending a Domain Name System-Service Discovery (DNS-SD) advertisement to a commissioner device;receiving, from the commissioner device, a request for parameters for a Password-Based Key Derivation Function;forwarding the request for the parameters for the Password-Based Key Derivation Function to the joiner device;in response to forwarding the request for the parameters for the Password-Based Key Derivation Function, receiving from the joiner device, a response including the parameters for the Password-Based Key Derivation Function;forwarding the response that includes the parameters for the Password-Based Key Derivation Function to the commissioner device;receiving a first Password-Authenticated Key Exchange (PAKE) message from the commissioner device;forwarding the first PAKE message to the joiner device;in response to forwarding the first PAKE message, receiving from the joiner device, a second PAKE message;forwarding the second PAKE message to the commissioner device;receiving a third PAKE message from the commissioner device; andforwarding the third PAKE message to the joiner device, the forwarding being effective to establish a Passcode Authenticated Session Establishment (PASE) session between the commissioner device and the joiner device to commission the joiner device to a Matter network.

2. The method of claim 1, further comprising:decapsulating the discovery beacon from a Thread relay receive (RLY RX.ntf) message before sending the DNS-SD advertisement to the commissioner device.

3. The method of claim 1 or claim 2, further comprising:encapsulating the request for the parameters for the Password-Based Key Derivation Function in a Thread relay transmit (RLY TX.ntf) message before sending request to the joiner device; anddecapsulating the response that includes the parameters for the Password-Based Key- Derivation Function from a Thread relay receive (RLY RXntf) message before sending the parameters for the Password-Based Key Derivation Function to the commissioner device.

4. The method of any one of the preceding claims, further comprising: encapsulating the first PAKE message in a Thread relay transmit (RLY TX.ntf) message before sending first PAKE message to the joiner device;decapsulating the second PAKE message from a Thread relay receive (RLY RX.ntf) message before sending the second PAKE message to the commissioner device; and encapsulating the third PAKE message in a Thread relay transmit (RLY TX.ntf) message before sending third PAKE message to the joiner device.

5. The method of any one of the preceding claims, wherein messages to, and messages from, the joiner device are forwarded by a joiner router.

6. The method of claim 5, wherein the joiner router encapsulates messages to the commissioning proxy in Thread relay receive (RLY RX.ntf) messages, and wherein the joinerrouter decapsulates Thread relay transmit (RLY TX.ntf) messages from the commissioning proxy before forwarding the encapsulated messages to the joiner device.

7. The method of any one of the preceding claims, wherein messages to, and messages from, the joiner router are forwarded by a Thread border agent.

8. The method of any one of the preceding claims, wherein the parameters for the Password-Based Key Derivation Function include a password, a cryptographic salt, a PseudoRandom Function (PRF) used for key generation, a number of times that the PRF is applied to generate the key. and a length of the generated key.

9. The method of any one of the preceding claims, further comprising: registering and authenticating the commissioning proxy with the border agent to establish a commissioning session.

10. The method of any one of the preceding claims, wherein the commissioning of the joiner device to a Matter network further comprises:relaying, from the commissioner device, commissioning infonnation including one or more of: device attestation, operational credentials, network credentials, and additional configuration information to the joiner device to establish a certificate-authenticated session that completes commissioning the joiner device.

11. A method for Matter commissioning over a Thread network by a Matter commissioner, the method comprising:establishing a commissioning session with a Thread border agent;receiving a discovery' beacon from a joiner device;sending a request for parameters for a Password-Based Key Derivation Function to the joiner device;in response to forwarding the request for the parameters for the Password-Based Key Derivation Function, receiving from the j oiner device, a response including the parameters for the Password-Based Key Derivation Function;sending a first Pass word- Authenticated Key Exchange (PAKE) message to the joiner device;in response to sending the first PAKE message, receiving from the joiner device, a second PAKE message; andsending a third PAKE message to the joiner device that is effective to establish a Passcode Authenticated Session Establishment (PASE) session between the Matter commissioner and the joiner device to commission the joiner device to a Matter network.

12. The method of claim 11, wherein the establishing the commissioning session with the Thread border agent establishes the Matter commissioner as a Thread network commissioner.

13. The method of claim 11 or claim 12, further comprising:receiving the discovery' beacon from the joiner device encapsulated in a Thread relay receive (RLY RX.ntf) message; anddecapsulating the discovery' beacon from the Thread relay receive (RLY RX.ntf) message.

14. The method of any one of claims 11 to 13, further comprising: encapsulating the request for the parameters for the Password-Based Key Derivation Function in a Thread relay transmit (RLY_TX.ntf) message before sending request to the joiner device; anddecapsulating the response that includes the parameters for the Password-Based Key Derivation Function from a Thread relay receive (RLY RX.ntf) message.

15. The method of any one of claims 11 to 14, further comprising: encapsulating the first PAKE message in a Thread relay transmit (RLY TX.ntf) message before sending first PAKE message to the joiner device;decapsulating the second PAKE message from a Thread relay receive (RLY RX.ntf) message; andencapsulating the third PAKE message in a Thread relay transmit (RLY TX.ntf) message before sending third PAKE message to the joiner device.

16. The method of any one of claims 11 to 15. wherein messages to, and messages from, the joiner device are forwarded by a joiner router.

17. The method of claim 16, wherein the joiner router encapsulates messages to the Matter commissioner in Thread relay receive (RLY RX.ntf) messages, and wherein the joiner router decapsulates Thread relay transmit (RLY TX.ntf) messages from the Matter commissioner before forwarding the encapsulated messages to the joiner device.

18. The method of any one of claims 11 to 17, wherein the commissioning of the joiner device to a Matter network further comprises:sending commissioning information including one or more of: device attestation, operational credentials, network credentials, and additional configuration information to the joiner device to establish a certificate-authenticated session that completes commissioning the joiner device.

19. An apparatus comprising:a processor; andmemory comprising instructions executable by the apparatus to cause the apparatus to perform the method of any one of the preceding claims.

20. A non-transitory computer-readable storage medium comprising instructions for an application, the instructions executable by one or more processors, to configure the application to perform a method as recited in any one of claims 1 to 18.

Images