Device and method for providing user-configured trust domains

A method of operating a first device in group of devices in a network is disclosed. The method comprises encrypting and decrypting, with a processor of the first device, communications with other devices in the group of devices using a shared key that is stored in a memory of each device in the group of devices; receiving, with a transceiver of the first device, a first message from a second device in the group of devices, the first message indicating that the first device is authorized to share the shared key; and transmitting, with the first device, the shared key to a third device in the network that is not in the first group of devices only after receiving the first message indicating that the first device is authorized to share the shared key.

FIELD

The device and method disclosed in this document relates to information security and, more particularly, to providing trust domains for devices in a network.

BACKGROUND

In recent years, the number of devices having network connectivity has increased substantially and it is predicted that, in the future, even the most mundane objects will have embedded network connectivity. The so-called “Internet of Things” (IoT) is a network of physical devices, such as machines, portable computers, and vehicles, which include embedded electronics and software that enables them to communicate with one another directly and indirectly. These networks may also include sensors for collecting data and actuators for performing certain control functions. Networks of such devices have near endless applications such as in home automation, industrial automation, automobiles, electrical grids, and healthcare.

One challenge that exists is with respect to establishing and maintaining effective security and privacy for communications between devices in the IoT. At least some of the devices in a system will often have very constrained processing power and memory, with little to no capability for direct human-machine interface. Accordingly, many traditional methods for establishing and maintaining secure communications between devices are not user-friendly, practical, or feasible. Accordingly, it would be advantageous to provide a user-friendly method of establishing secure communications between devices of a particular system.

SUMMARY

A method of operating a first device in group of devices in a network is disclosed. The method comprises encrypting and decrypting, with a processor of the first device, communications with other devices in the group of devices using a shared key that is stored in a memory of each device in the group of devices; receiving, with a transceiver of the first device, a first message from a second device in the group of devices, the first message indicating that the first device is authorized to share the shared key; and transmitting, with the first device, the shared key to a third device in the network that is not in the first group of devices only after receiving the first message indicating that the first device is authorized to share the shared key.

A first device is disclosed. The first device comprises a transceiver configured to communicate with other devices in a network; and a processor operably connected to the transceiver and configured to: encrypt and decrypt communications with other devices in a group of devices in the network using a shared key that is stored in a memory of each device in the group of devices; operate the transceiver to receive a first message from a second device in the group of devices, the first message indicating that the first device is authorized to share the shared key; and transmit the shared key to a third device in the network that is not in the first group of devices only after receiving the first message indicating that the first device is authorized to share the shared key.

DETAILED DESCRIPTION

System Overview

FIG. 1shows a distributed system100. The system100includes a plurality of devices102. Each of the devices102includes embedded electronics and software configured to enable communications between the devices102. The devices102may comprise machines, controllers, actuators, sensors, tablet computers, smartphones, laptops, or any other device configured with network connectivity.

By way of example, the system100is described in the context of a home. A home owner or tenant (hereinafter referred to as “the user”) is enabled to easily establish one or more logical trust domains104, which are referred to herein as “spheres.” Each user-generated sphere104defines a group of trusted member devices102and/or services provided by the trusted member devices102. The user-generated sphere104is associated with a shared secret, cryptographic key, or “sphere key”, which is used to encrypt or otherwise secure communications between member devices102of the respective sphere104. In this way, the devices102in the user's home can be grouped according to their purpose or application context and devices102within each user-defined sphere104can communicated with one another securely. As discussed in greater detail below, the user can create and manage the spheres104using an owner device106, such as a smartphone or tablet computer. In some embodiments, each sphere104is associated with a human-readable description string that is chosen by user and reflects the scope or purpose of the sphere104. Additionally, each sphere104may include a standardized identifier that corresponds to its scope or purpose, regardless of the human-readable description string chosen by the user.

For example, the user may choose to create a “Home Entertainment” sphere108. The “Home Entertainment” sphere108may include several member devices102, such as an A/V receiver110, a television112, speakers114, a media server116, and a video game console118. The user may decide to provide access to the “Home Entertainment” sphere108to guests in his or her home, so that they can have access to various services provided by member devices102of the “Home Entertainment” sphere108. For example, if the user throws a party at his or her home, then guests can be invited add their smartphones or other portable devices to the “Home Entertainment” sphere108so that the guests can control music playback from the speakers114with their smartphones, stream videos from their smartphones to the television112, or participate in various other entertainment activities.

The user may also choose to, for example, create a “Home Automation” sphere120. The “Home Automation” sphere120may include several member devices102, such as a smart thermostat122, a heater124, an air conditioner126, a ventilation system128, temperature sensors130, air quality sensors132, a lighting controller134, lights136, light sensors138, curtain actuators140, and door locks142. The user may decide to only provide family members and trusted guests, such as a babysitter, with access to the “Home Automation” sphere120. An authorized member of “Home Automation” sphere120may have access to various services provided the member devices102of the “Home Automation” sphere120, such as temperature and lighting control.

Finally, in this example, the user may decide to create a “Home Security” sphere144. The “Home Security” sphere144may include several member devices102, such alarm system144, security cameras146, door and window sensors148, and door locks142. The user may decide to only provide select family members, such as the heads of household, with access to the “Home Security” sphere144. In this example, the door locks142are members of both the “Home Automation” sphere120and the “Home Security” sphere144. However, the user may decide to limit the services of the door locks142that are authorized within the “Home Automation” sphere120, while authorizing all of the services of the door locks142within the “Home Security” sphere144. For example, the “Home Automation” sphere120may only have access to a proximity based unlocking service of the door locks142, whereas the “Home Security” sphere144might also have access to a remote unlocking service of the door locks142.

It is noted that, these particular spheres104and devices102are merely exemplary and are used to demonstrate a possible advantageous usage for the methods and systems described herein. As illustrated, the spheres104enable a user to easily provide access to certain devices102, while not providing access to other devices102. Additionally, the spheres104can be easily configured and re-configured based on the needs of the user.

As discussed above, the user can dynamically create and manage the spheres104using an owner device106, such as a smartphone or tablet computer. The owner device106is not fundamentally different than any of the other devices102in the system100, except that, in one embodiment, the owner device106includes a sphere management application that enables the user to create and manage the spheres104. As used herein, the term “owner device” refers to a device102that is empowered to invite new devices102to join the respective sphere104, is empowered to promote other devices102to have the authority to invite new devices102, and is empowered to make another device102an owner device. In the exemplary system100, the owner device106may be an owner device for all of all of the spheres104and is empowered to invite new devices102to join the each of the spheres104. Additionally, the owner device106is empowered to promote other devices102within a respective sphere104so that they are also empowered to invite new devices102to join the respective spheres104. As used herein, the term “promoted device” refer to member devices102within a sphere104that are empowered to invite new devices102to join the respective sphere104, but that is not empowered to delegate the authority to invite new devices102to join the respective sphere104. For example, the user might promote the A/V receiver110so that it is empowered to invite additional devices102to the “Home Entertainment” sphere108as required. Similarly, smart thermostat122and/or the lighting controller134might be promoted devices within the “Home Automation” sphere120and the alarm system146might be a promoted device within the “Home Security” sphere144.

The creation of a sphere104enables communications between member devices102to be protected from any device that is not a member of the respective sphere104. Each sphere104defines a group of trusted member devices102and is associated with a shared secret, cryptographic key, or “sphere key”, which is used to encrypt or otherwise secure communications between member devices102of the respective sphere. Accordingly, a sphere104enables member devices102to securely communicate using unsecured and/or public network infrastructure, such as a local area network or the Internet. No additional security support or trust is required for the underlying network infrastructure and communication technology.

As discussed in further detail below, during creation of a sphere104, the owner device106is configured to generate a sphere key for the respective sphere104and securely provide the sphere key to each of the member devices102. Once the sphere104has been established, communications between the devices102of a respective sphere104are encrypted with the sphere key. In some embodiments, the sphere key is also used for encrypting information for storage. In some embodiments, different derived values from the sphere key are used in different contexts. Particularly, in one embodiment, a first derived value from the sphere key is used for encrypting communications between member devices102of the respective sphere104and a second derived value from the sphere key is used for encrypting information for storage.

In one embodiment, the owner device106also enables a user to select particular services of a device102the be joined into a sphere104, while not allowing other services of the device102to be joined into the sphere104. Particularly, if a particular device102offers several services or functions, then the device102may be a member of a particular sphere104with respect to a subset of the services provided by the device102that relate to the purpose of the particular sphere104, but not a member of the sphere104with respect to certain other services provided by the device102. Additionally, in one embodiment, when creating a new sphere104, the user can select among various default sphere configuration profiles (e.g. private, entertainment, smart home) and apply default policies for the sphere104(e.g. auto-join all services on a newly joined device102, or only manually join services).

Device Hardware

As discussed above, the devices102in the system100may include machines, controllers, actuators, sensors, computers, or any other device configured with network connectivity. The owner device106is also be considered one of the devices102. The devices102can include hardware and functionalities that differ substantially from one another. However, each device102generally at least includes electronics and software configured to enable communications at least one other device102. In some embodiments, each of the devices102includes software for managing sphere membership and sphere communications. In one embodiment, the software is a middleware for managing sphere membership and sphere communications.

FIG. 2shows an exemplary embodiment of a most basic device102. In one embodiment, each of the devices102comprises at least a processor202, memory204, and a transceiver206. The memory204is configured to store program instructions that, when executed by the processor202, enable the respective device102to perform one or more services or functions. The memory204may be of any type of device capable of storing information accessible by the processor202, such as a memory card, ROM, RAM, write-capable memories, read-only memories, hard drives, discs, flash memory, or any of various other computer-readable medium serving as data storage devices as will be recognized by those of ordinary skill in the art. Additionally, it will be recognized by those of ordinary skill in the art that a “processor” includes any hardware system, hardware mechanism or hardware component that processes data, signals or other information. The processor202may include a system with a central processing unit, multiple processing units, dedicated circuitry for achieving functionality, or other systems. The device102may comprise many additional components for providing one or more services, such as sensing elements, actuators, interfaces, displays, etc.

The transceiver206may be any of various devices configured for communication with other electronic devices, including the ability to send communication signals and receive communication signals. The transceiver206may include different types of transceivers configured to communicate with different networks and systems. The transceiver206is at least configured to exchange data between the respective device102and further devices102. In one embodiment, the transceiver206is configured to exchange data using a protocol such as Wi-Fi, Bluetooth, RFID, NFC, ZigBee, Z-Wave, or Ethernet.

In some embodiments, the memory204is configured to store software or firmware for operating the processor202and other hardware components to provide one or more services. Additionally, in one embodiment, the memory204stores middleware for managing sphere membership and sphere communications. In one embodiment, each of the services provided by the device102are automatically members of a default sphere for the particularly device102. The default sphere differs from the user-generated spheres104in that the default sphere is specific to the particular device102and cannot be created or destroyed by the user. Each of the services provided by the device102can be joined to other user-generated spheres104.

Once the device102has been joined into a user-generated sphere104, the processor202is configured to encrypt outgoing messages to other member devices102in the sphere104using the respective sphere key for the sphere104. In one embodiment, the messages include a message header having a sphere identifier. The sphere identifier is transmitted in unencrypted form so that the receiving device102can determined which sphere key is to be used for message decryption. Particularly, if a device102is a member of multiple spheres104, the processor202is configured receive a message and read the sphere identifier from the message header. Based on the sphere identifier, the processor202is configured to select a corresponding sphere key and use the sphere key to decrypt a body of the message. In one embodiment, in order to ensure uniqueness of a sphere identifier, the sphere identifier is a combination of human-readable identifier with a unique device identifier of the device it was created on and/or an arbitrary number (such as a UUID) which may be created randomly or pseudo-randomly.

In some embodiments, the processor202is configured to store certain information related to a sphere104in the memory204. In one embodiment, the processor202is configured to encrypt the information using the respective sphere key for the sphere104before storage on the memory204. The information may comprise sensor data, or other operational data. In one embodiment, the messages exchanged between member devices102may include such data in their message bodies.

In some embodiments, a device102may have a very limited user interface or no user interface at all, which makes setup of the device102and inviting the device102to a sphere104more challenging. In one embodiment, the device102has a quick response code (QR code) or two-dimensional barcode208printed on a body210of the device102. Alternatively, the device102may have another type of bar code, printed text (such as a printed URL or serial key), or RFID/NFC tag in substitution of the QR code208. Additionally, more complex devices102may include a display device configured to display a dynamic or temporary QR code208. The QR code208may include meta-data METAD, which may include configuration or setup information for the device102. Alternatively, the QR code208may store references Rj, such as a URL, to such meta-data, which can be retrieved using the reference Rjfrom an external source. In one embodiment, the meta-data METADincludes a secret or key used for an initial set-up process, as will be discussed in further detail below. In one embodiment, the meta-data METADincludes information regarding recommended spheres to which the device102can be added or other characteristic information that can be used to determine which spheres would be most appropriate for the device102to be added. In one embodiment, the QR code208is alternatively located in a user manual212, a certificate of ownership, or other materials included with the device102.

FIG. 3shows one embodiment of the owner device106, in which it is embodied as a smartphone or tablet computer. The owner device106includes a touch screen302, an input/output (I/O) interface304, a processor308, a memory310, one or more transceivers312, and a camera314. The owner device106also includes a rechargeable battery316configured to power the electronic components within the owner device106. The owner device106also includes a protective outer shell or housing318configured to retain and protect the electronic components positioned within the housing318. As will be recognized by those of ordinary skill in the art, the components of the owner device106may vary. Alternative owner devices106may include much of the same functionality and components as the shown inFIG. 3and/or may include others not listed. Additionally, some of the device102may also include very similar functionality and components as those described with respect to the owner device106.

The touch screen302of the owner device106may be an LCD capacitive touch screen or any of various other screens appropriate for a smartphone or tablet computer. The I/O interface304of the owner device106is in communication with the touch screen302and includes software and hardware configured to facilitate communications with the user via the touch screen302and to visually display graphics, text, and other data to the user via the touch screen302. In some embodiments, the camera314is any suitable device for at least reading the QR code208, or equivalent, of a device102. In some embodiments, the camera314may include video and sound recording functionalities.

The processor308of the owner device106may be any of various processors as will be recognized by those of ordinary skill in the art. The processor308is in communication with the I/O interface304, the memory310, the transceivers312, and the camera314, and is configured to deliver data to and receive data from each of these components. It will be recognized by those of ordinary skill in the art that a “processor” includes any hardware system, hardware mechanism or hardware component that processes data, signals or other information. A processor may include a system with a central processing unit, multiple processing units, dedicated circuitry for achieving functionality, or other systems.

The memory310is configured to store information, including data and program instructions for execution by the processor308. In one embodiment, the memory310may include program instructions for a graphical user interface configured to provide a sphere management application318. The processor308is configured to read the program instructions from the memory310and execute the program instructions to provide the sphere management application318to the user so for the purpose of creating and managing the spheres104. The memory310may be of any type of device capable of storing information accessible by the processor, such as a memory card, ROM, RAM, write-capable memories, read-only memories, hard drives, discs, flash memory, or any of various other computer-readable medium serving as data storage devices as will be recognized by those of ordinary skill in the art. Program instructions stored on the memory310, such as the sphere management application318, may be downloaded from a network location, such as via the Internet.

The memory310may also store information regarding the currently established spheres104. Particularly, in one embodiment, the memory310stores a local set of sphere configuration files CONFifor the spheres104. Each of the local configuration files CONFiincludes a group identifier GRPiand meta-information GRPMETAifor the respective sphere104. The meta-information GRPMETAiat least includes a sphere key SECifor the respective sphere104and information regarding member devices102of the respective sphere104. In one embodiment, the meta-information GRPMETAiincludes a reference Ri, such as a URL, to meta-information that is retrievable from an external source, such as a remote server accessible via the Internet. When a new sphere104is created, the processor308is configured to generate a new configured configuration file CONFihaving a new group identifier GRPiand new sphere key SECi. The processor308is configured to store the new configuration file CONFiin the memory310or to store the new configuration file CONFiat the external source, while storing a new reference Riin the memory310.

The transceivers312may be any of various devices configured for communication with other electronic devices, including the ability to send communication signals and receive communication signals. The transceivers312may include different types of transceivers configured to communicate with different networks and systems. In some embodiments, the transceivers312include at least one transceiver configured to allow the owner device106to perform wireless communications with cell towers of the wireless telephony network. In some embodiments, the transceivers312include at least one transceiver configured to allow the owner device106to communicate with any of various local area networks using Wi-Fi, Bluetooth, Ethernet, or any of various other communications schemes.

Methods for operating the owner device106and/or the devices102are described below. In the description of the methods, statements that a method is performing some task or function refers to a controller or general purpose processor executing programmed instructions stored in non-transitory computer readable storage media operatively connected to the controller or processor to manipulate data or to operate one or more components in the system100to perform the task or function. Particularly, the processor308of the owner device106and/or the processor202of a device102above may be such a controller or processor. Alternatively, the controller may be implemented with more than one processor and associated circuitry and components, each of which is configured to form one or more tasks or functions described herein. Additionally, the steps of the methods may be performed in any feasible chronological order, regardless of the order shown in the figures or the order in which the steps are described.

Some or all of the methods discussed herein may be implemented as software that is stored in the memory204of each device102and executed by the processor202. In particular, in one embodiment, the software that is stored in the memory204at least includes middleware for managing sphere membership of the device102and sphere communications with other devices102. In the case of more sophisticated devices102, such as the owner device106, the software may also include the sphere management application318, which is executed by the processor308to provide a graphical user interface (GUI) for creating and managing the spheres104.

Creating a New Sphere

FIG. 4shows a method400for creating a new user-generated sphere104for the system100. As discussed above, each of the devices102, including the owner device106, is configured to provide one or more services. In some embodiments, all of the services of a particular device102are automatically members of the default sphere for the particular device102. However, the method400enables a device102, such as the owner device106, to create a new user-generated sphere104which can include services from multiple member devices102.

The method400begins with receiving a selection from a user regarding a group of services to be added to a new sphere via an interface (block410). Particularly, with respect to the embodiments disclosed in detail herein, the processor308of the owner device106is configured to operate the I/O interface304to receive a selection regarding a group of the services of the owner device106that are to be added to a newly created sphere104. In one embodiment, the processor308executes program instructions of the sphere management application318to display a GUI on the touch screen302. The processor308is configured to provide a list of services provided by the owner device106via the GUI on the touch screen302. The user selects a group of the services provided by the owner device106to be joined into a new sphere104. The selection can include all of the services of the owner device106, some of the services of the owner device106, or even none of the services of the owner device106. In one embodiment, the GUI allows the user to enter a human-readable string that identifies the newly created sphere104(i.e. a name for the sphere104). In one embodiment, the GUI allows the user to select among various default sphere configuration profiles (e.g. private, entertainment, smart home) and apply default policies for the sphere104(e.g. auto-join all services on a newly joined device102, or only manually join services).

Once the selection regarding the group of services has been received from the user, the method400continues by generating a sphere key for the new sphere using a processor (block420). Particularly, the processor308of the owner device106is configured to generate a sphere key SECifor the newly created sphere104. In one embodiment, the sphere key SECicomprises a very long number or alphanumeric string that is generated randomly or pseudo-randomly. In one embodiment, the processor308is configured to generate a new configured configuration file CONFihaving a new group identifier GRPiand the new sphere key SECi. In one embodiment, the processor308is configured to store the new configuration file CONFiin the memory310or to store the new configuration file CONFiat the external source, while storing a new reference Riin the memory310.

Inviting Additional Devices to a User-Generated Sphere

Once a new sphere104has been created by the owner device106, additional services provided by other devices102can be invited to the newly created sphere104. Particularly, the owner device106can invite another device102to join the newly created sphere104and to share one or more of its services with the newly created sphere104.

FIG. 5shows a method500for inviting a new device102to join a user-generated sphere104. The method500begins by generating a QR code that contains a sphere key for a respective sphere with a processor of the owner device (block510). Particularly, the processor308of the owner device106is configured to generate a QR code that contains the sphere key SECifor a respective sphere104. In some embodiments, the QR code contains additional information regarding the respective sphere104, such as the human-readable string that identifies the sphere104, a list of services provided by the sphere104, and the identity of the owner of the sphere104. In some embodiments, the QR code is any other type of marking that comprises machine-readable optical representation of data, or simply a text string, such as a serial key.

Next, the method500continues by displaying the QR code on a display device of the owner device (block520). Particularly, the processor308of the owner device106is configured to operate the I/O interface304to display the QR code on the touch screen302. In one embodiment, the processor308executes program instructions of the sphere management application318to display a GUI on the touch screen302that includes that QR code. Alternatively, the processor308is configured to display another type of bar code or a text string on the touch screen302.

Once the QR code is displayed by the owner device106, new devices102can scan the QR code in order to join the sphere104. Particularly, the method500continues by scanning the QR code with a camera of the new device (block530). The new device102may be a device owned by a guest that is essentially similar to the owner device106, or the new device102may be completely different type of device, such as the A/V receiver110discussed with respect toFIG. 1. In one embodiment, the processor202of the new device102is configured to operate a camera or equivalent device to scan the QR code or other type of barcode from the owner device106. In other embodiments in which a text string is used in substitution of the QR code, the processor202is configured to operate an I/O device to receive an input of the text string via an interface.

Prior to or after scanning the QR code, the method500optionally continues with receiving a selection from a user regarding a group of services of the new device to be shared with the sphere via an interface of the new device (block540). Particularly, the processor202of the new device102is configured to receive via an interface a selection regarding a group of services of the new device102that are to be shared with the sphere104. In one embodiment, the processor202is configured to provide a list of services provided by the new device102via a GUI on a display of the new device102. The user selects a group of the services provided by the new device102to be shared with the sphere104. The selection can include all of the services of the new device102, some of the services of the new device102, or even none of the services of the new device102.

After scanning the QR code, the method500continues by extracting the sphere key from the QR code with a processor of the new device (block550). Particularly, the processor202of the new device102is configured to extract the sphere key SECifor the sphere104from the scanned QR code or the received text string. In one embodiment, the processor202is configured to store the sphere key SECifor the sphere104in the memory204.

Next, the method500continues by transmitting a service share message using a transceiver of the new device (block560). Particularly, the processor202of the new device102is configured to operate the transceiver206to transmit a service share message to the owner device106that indicates which services of the new device102are shared with the sphere104. Next, the method500continues by receiving the service share message using a transceiver of the owner device (block570). Particularly, the processor308of the owner device is configured to operate the transceivers312to receive the service share message from the new device102. In one embodiment, in response to the service share message, the processor308is configured to operate the I/O interface304to show a GUI on the touch screen302prompting a user to select which of the shared services are to be allowed into the sphere104. In one embodiment, the processor308is configured to operate the transceivers312to broadcast a notification to all member devices102of the sphere104that indicates that the new device102has been added to the sphere and indicates which services of the new device102have been shared with the new sphere104.

In some cases, the new device102may not have any camera or other interface for scanning a QR code or inputting a text string. For example, some devices102may have a display capable of displaying a QR code, but no camera for scanning a QR code. Furthermore, very simple devices102such as sensors and actuators will likely have no interface at all. Accordingly, another process is be used to invite such devices102to a sphere.

FIG. 6shows an alternative method600for inviting a new device102to a user-generated sphere104. The method600begins with providing a QR code having a temporary key associated with the new device to be invited or added to a respective sphere (block610). In some embodiments, the new device102is configured to generate and display a QR code that includes a temporary cryptographic key (block620a). Particularly, the processor202of the new device102is configured to generate a QR code that includes the temporary cryptographic key and to display the QR code on a display device of the new device102. However, in some embodiments, the new device102does not have any display device that can display a QR code. Accordingly, in some embodiments, a pre-existing QR code is already associated with the new device and includes a temporary cryptographic key (block620b). Particularly, as described above with respect toFIG. 2, the new device102may have a QR code208printed directly onto a housing of the new device102or printed in a user manual212or other associated documents. In another embodiment, a third device can be used to generated or display the QR code having the temporary cryptographic key.

Next, the method600continues by scanning the QR code with a camera of the owner device (block630). Particularly, the processor308of the owner device106is configured to operate the camera314to read the QR code that is displayed by or otherwise associated with the new device102. Next, the method600continues by extracting the temporary key from the QR code with a processor of the owner device (block640). Particularly, the processor308is configured to extract the temporary cryptographic key from the QR code.

Once the owner device has obtained the temporary cryptographic key, the method600continues by encrypting a sphere key for a respective sphere using the temporary cryptographic key with a processor of the owner device (block650). Particularly, the processor308is configured to use the temporary cryptographic key to encrypt the sphere key SECifor the sphere104to which the new device102is to be invited or added. Next, the method600continues by transmitting the encrypted sphere key using a transceiver of the owner device (block660). Particularly, the processor308of the owner device106is configured to operate the transceivers312to transmit the encrypted sphere key SECifor the sphere104to the new device102. In one embodiment, the encrypted sphere key SECiis transmitted via an unsecured network, such as a local area network.

In embodiment, the owner device106is configured to prompt the user to decide which sphere104to which the new device102should be added. Particularly, the processor308executes program instructions of the sphere management application318to display a GUI on the touch screen302which provides a list of spheres to which the new device102can be added. The user selects at least one of the spheres and the owner device106transmits the respective sphere key SECito the new device102. In one embodiment, the owner device106is configured to automatically select a sphere for the new device102with reference to the meta-data METADof the QR code, which includes information regarding recommended spheres to which the new device102can be added or other characteristic information that can be used to determine which spheres would be most appropriate for the device102to be added.

Next, the method600continues with receiving the encrypted sphere key using a transceiver of the new device (block670). Particularly, the processor202of the new device is configured to operate the transceiver206to receive the encrypted sphere key SECifrom the owner device106. Finally, the method600continues with decrypting the sphere key using the temporary key with a processor of the new device (block680). Particularly, the processor202of the new device102is configured to decrypt the sphere key SECifor the sphere104using the temporary cryptographic key. In one embodiment, the processor202is configured to store the sphere key SECifor the sphere104in the memory204. In one embodiment, the processor202is configured to operate the transceivers312to transmit a notification to the owner device106or to all member devices102of the sphere104that the new device102has been successfully added to the sphere.

In other embodiments, Diffie-Hellman key exchange and/or Encrypted Key Exchange (EKE) processes are used to provide the sphere key SECiof a respective sphere104to a new devices102. In one embodiment, the processor202of a new device102is configured operate the respective transceiver206to transmit a public key to the owner device106via an unsecured network, such as a local area network. The processor308of the owner device106is configured to operate the transceivers312to receive the public key from the new device102. Next, the processor308of the owner device106is configured to encrypt a sphere key SECifor the a respective sphere104using the public key and operate the transceivers312to transmit the encrypted sphere key SECito via the unsecured network, such as the local area network. Finally, the processor202of the new device102is configured operate the respective transceiver206to receive the encrypted sphere key SECiand to decrypt the sphere key SECiusing a private key known only to the new device102.

Secure Sphere Communications

Once devices102have been added into a sphere104, the devices102are configured to encrypt communications between member devices102using the sphere key SECifor the respective sphere104. Particularly, with respect to the embodiments disclosed in detail herein, the processor202of each device102in the respective sphere104is configured to encrypt communications between it and other devices102in the newly created sphere104using the sphere key SECifor the respective sphere104. As discussed above, the messages may include a message header that includes a sphere identifier for the respective sphere104, which is transmitted in unencrypted form. When a member device102receives a message, the processor202is configured read the sphere identifier from the message header. In response to the message header including the sphere identifier for the respective sphere104, the processor202is configured to use the sphere key SECifor the respective sphere104to decrypt a body of the message. Additionally, in one embodiment, the processor202is configured to encrypt information relating to the respective sphere104using the sphere key SECifor the respective sphere104before storage in the memory204.

Sphere Membership and Service Discovery

Member devices102can perform a discovery process in order to determine which other devices102are members of a respective sphere104and determine which services of the devices102are shared with the respective sphere104. Particularly, in one embodiment, the processor202of a device102is configured to operate the transceiver206to broadcast or multicast a discovery request message to other devices102on the network. In one embodiment, the discovery request message is encrypted using the sphere key SECifor the sphere104, so that only member devices102of the sphere104will understand and respond to the message.

In response to receiving a discovery request message, the processor202of a member device102is configured to operate the transceiver206to transmit a discovery response message to the discovery requesting device102that identifies the member device102and all services of the member device102that are shared with the particular sphere. In one embodiment, the discovery response message is also encrypted using the sphere key SECifor the sphere104. In one embodiment, the discovery response message is broadcasted or multicasted so that all member devices102are updated with current information regarding sphere membership and the services available in the sphere104.

In some embodiments, the member devices102are configured to periodically (such as every 5 or 10 seconds) broadcast or multicast discovery response messages in order to provide a heartbeat of service status in the sphere104. Alternatively, the owner device106for the sphere104may be configured to periodically (such as every 5 or 10 seconds) broadcast a service update message that identifies all services available in the sphere104.

Promotion of Member Devices

As discussed above, in some embodiments, devices102other than the owner device106can be promoted within a particular sphere104and empowered to invite new devices102to join the respective sphere104. As used herein, the term “promoted device” refer to member devices102within a sphere104that are empowered to invite new devices102to join the respective sphere104. In some embodiments, a promoted device is also empowered to promote other devices102within the sphere and are, accordingly, essentially an owner device.

FIG. 7shows a method700of delegating authority to invite new devices to a sphere. The method700begins by receiving a selection regarding a member device of a sphere to be promoted via an interface of the owner device (block710). Particularly, with respect to the embodiments disclosed in detail herein, the processor308of the owner device106is configured to operate the I/O interface304to receive a selection regarding a member device102of a particular sphere104that is to be promoted within the respective sphere104. In one embodiment, the processor308executes program instructions of the sphere management application318to display a GUI on the touch screen302to provide a list of member devices102that can be promoted. The user selects a member device102to be promoted using the touch screen302.

Next, the method700continues by transmitting a promotion message identifying the device to be promoted with a transceiver of the owner device (block720). Particularly, the processor308is configured to operate the transceivers312to transmit a promotion message to the device102that corresponds to the selection from the user regarding which member device102is to be promoted. The promotion message indicates that device102to be promoted is authorized to share the sphere key SECifor a respective sphere104with new devices102in order to invite the new devices102to the sphere104(i.e. the device has inviting authority for the respective sphere). In one embodiment, the promotion message is encrypted and transmitted to the device102to be promoted using a public key and private key mechanism.

Next, the method700continues by receiving the promotion message with a transceiver of the device to be promoted (block730). Particularly, the processor202of the device102to be promoted is configured to operate the transceiver206to receive the promotion message. In one embodiment, the promotion message is received and decrypted according to a public key and private key mechanism. In one embodiment, the processor202of the promoted device102is configured operate the transceiver206to transmit a promotion acknowledgement message to the owner device106in response to receiving the promotion message from the owner device106.

Next, the method700continues by performing a process for inviting or adding a new device to the sphere with the promoted device only after receiving the promotion message indicating that the device has been promoted (blocks740and750). Particularly, the processor202of the promoted device102is configured to perform a process for inviting or adding a new device102to the sphere only after receiving a promotion message from the owner device106or another device102that is authorized to promote new device102. As discussed above, the sphere key SECifor a respective sphere104is transmitted or otherwise shared with a new device102in order to invite or add the new device102to the sphere104. Accordingly, the processor202of the promoted device102is configured to share the sphere key SECifor a respective sphere104with a new device102only after receiving a promotion message from the owner device106. If a promotion message has not been received by the device102, then the processor202is configured to never share the sphere key SECiwith any other devices102. The sphere key SECifor a respective sphere104can be shared using the one of methods500and600or by any other key exchange method, as discussed above.

In one embodiment, the promotion message may also indicate that the device102is authorized to delegate authorization to share the shared key other devices102. In other words, the promotion message can indicate that the device to be made an owner device which also has the authority to promote other devices. The device102that has been made an owner device can be used the method700to further delegate authority to invite new devices102. Particularly, the processor202of the device102to be made an owner device is configured to operate the transceiver206to transmit a further promotion message to a further device102in the sphere104only after receiving the promotion message indicating that the device is authorized to delegate authorization to share the shared key other devices102. In this way, the authority to promote other devices102is delegated, as well as the authority to invite other devices102.

In some embodiments, a public-private key pair may be used to authenticate a promoted device102. Particularly, when a sphere104is generated, the owner device106is configured to generate a public-private key pair for the sphere104. When the owner device106promotes another device102with the authority to invite new devices102to a respective sphere104, the owner device106is configured to generate a certificate or cryptographic signature using the private key, which is transmitted with the promotion message to the device102to be promoted. In some embodiment, the certificate or cryptographic signature is generated based on or otherwise certifies the sphere key SECi. In one embodiment, the certificate or cryptographic signature is further based on or otherwise certifies the identity of a promoted device (e.g. using a unique hardware identifier of the promoted device). When the promoted device102invites a new device102to join the respective sphere104, the promoted device102is configured to transmit the certificate or cryptographic signature, which was signed by the owner device106, to the new device102. The new device102is configured to authenticate the sphere key SECiand the identity of the promoted device102using the received certificate or cryptographic signature and the public key.

Alternatively or in addition, in some embodiments, each device102includes trusted hardware (e.g. a trusted platform module or a secure boot mechanism) configured to enforce that devices102which have not received a valid promote message cannot share the sphere key or promote other devices102. Enforcement can also be performed using anti-debugging measures such as signatures or checksums.

Other Changes to Sphere Membership

In some circumstances, a device102may leave a sphere104. Particularly, in some embodiments, if a device102is to leave a sphere104, then the processor202of the leaving device102is configured to operate the transceiver206to transmit a leave message indicating that the device102is leaving the sphere104. In one embodiment, the leave message is transmitted only to the owner device106of the sphere104. In one embodiment, the leave message is encrypted and transmitted to the owner device106using a public key and private key mechanism. Alternatively, in other embodiments, the leave message is broadcast or multicast to all member devices102. In one embodiment, processor308of the owner device106is configured operate the transceivers312to transmit a leave acknowledgement message to the leaving device102.

In some circumstances, a device102may be expelled from a sphere104without its knowledge. Particularly, in some embodiments, if a device102is to be expelled from a sphere104, then the processor308of the owner device106is configured to generate a new sphere key SECifor the respective sphere104and distribute the new sphere key SECito all member devices102other than the expelled device102. In one embodiment, the processor308of the owner device106is configured operate the transceivers312to transmit a sphere change message to all member devices102other than the expelled device102that indicates that a new sphere key will be provided. Subsequently, the processor308of the owner device106is configured operate the transceivers312to transmit the new sphere key SECifor the respective sphere104to all member devices102other than the expelled device102. In one embodiment, the new sphere key SECiis encrypted and transmitted to all member devices102other than the expelled device102using a public key and private key mechanism. In one embodiment, after receiving the new sphere key SECi, the processors202of the remaining member devices102are configured to transmit a sphere change confirmation message to the owner device. In one embodiment, after receiving the new sphere key SECi, the processors202of the remaining member devices102are configured to delete the old sphere key SECifrom the memory204and store the new sphere key SECiin the memory204.