Interconnection and activation for internet of things devices in multi-tenant data center facilities

Techniques are described for a centralized, neutral system for Internet of Things (IoT) device activation and automatic onboarding on an end-to-end basis, and for establishing secure communication between IoT devices and the IoT platforms. For example, a method includes receiving an activation request message from an IoT device to activate the IoT device on an IoT core network of a plurality of IoT core networks, wherein the plurality of IoT core networks and a plurality of IoT edge devices are co-located within the co-location facilities, and wherein the plurality of IoT edge devices are connected to one or more IoT platforms; authenticating the IoT device for connection to the IoT core network; and in response to authenticating the IoT device, provisioning a connection between the IoT core network and the plurality of IoT edge devices to provide the IoT device access to the one or more IoT platforms.

TECHNICAL FIELD

The disclosure relates to computer networks and, more specifically, to interconnecting computer networks.

BACKGROUND

A network services exchange provider or co-location provider (a “provider”) may employ a communication facility, such as a data center or warehouse, in which multiple customers of the provider locate network, server, and storage gear and interconnect to a variety of telecommunications and other network service provider(s) with a minimum of cost and complexity. Data centers may be shared by the multiple tenants having their networking equipment located within the data centers. With Information Technology (IT) and communications facilities in safe, secure hands, telecommunications, Internet, application service providers, cloud service providers, content providers, and other providers, as well as enterprises, enjoy less latency and the freedom to focus on their core business. Additionally, customers may reduce their traffic back-haul costs and free up their internal networks for other uses.

In some examples, the communication facility provides interconnection services by which customers of the provider may interconnect to one another over the communication facility infrastructure or by which a customer of the provider may interconnect its spatially and/or geographically distributed customer networking equipment over the communication facility infrastructure. The communication facility may in such cases be referred to as an “interconnection facility” or “co-location facility.”

Enterprises are increasingly making use of “smart” devices, i.e., physical objects that contain embedded technology configured to provide some degree of computing intelligence. These smart devices may communicate and sense or interact with their internal states or the external environment. The “Internet of Things” (IoT) refers to a network of these smart devices (“IoT devices”). The number of connected IoT devices is increasing exponentially, leading to various technology challenges for an enterprise attempting to integrate IoT implementations with the enterprise's centralized computing architecture for Information Technology (IT) systems and cloud ecosystem. These technology challenges may include scalability, performance, interoperability, security, and privacy, for example.

SUMMARY

In general, techniques are described for a centralized, neutral system for Internet of Things (IoT) device activation and automatic onboarding on an end-to-end basis between IoT core networks and IoT platforms, and for establishing secure communication between IoT devices and the IoT platforms.

As one example, techniques described herein may provide for an interconnection system having a device activation unit that provides IoT device supply chain management. The device activation unit may provide a centralized, neutral system for providers of IoT platforms and device manufacturers to exchange device provisioning and security credential data in a systematic and scalable manner for batch device provisioning in both IoT core networks and IoT platforms.

As another example, the device activation unit provides IoT device activation and automatic onboarding. For example, providers of IoT platforms may deploy, within co-location facilities, IoT core network software that controls and manages aspects of IoT device communications for an access network, including security and data routing. Co-location facilities may further deploy IoT edge devices (e.g., gateways) that enable IoT platforms to distribute IoT intelligence, connectivity, event processing and analytics to the IoT devices via one or more core networks co-located within the co-location facilities. By interconnecting IoT core networks and the edge devices within the co-location facilities, the device activation unit may activate IoT devices within one or more core networks and automatically onboard the activated IoT devices on the IoT platforms. That is, an IoT device authenticated on a core network is also automatically onboarded into one or more IoT platforms (i.e., to create many-to-many relationships between cloud service providers, IoT device manufacturers, and network providers).

As another example, the device activation unit provides secure end-to-end communication between IoT devices and IoT platforms. The device activation unit may establish a secure end-to-end communication session between IoT devices and IoT platforms by generating session keys and sharing the session keys to core networks and edge devices coupled to IoT platforms, and sending an authentication response to the activated IoT devices including information for which the activated IoT devices may generate a session key that matches the session keys in the core networks and the edge devices.

Moreover, the techniques described herein may also provide for facilitating a build-out of the IoT network (e.g., “last mile” connectivity) in response to customer demand for network coverage. For example, if an IoT customer deploys an IoT application in the Cloud IoT platform, the system described herein determines that there is a lack of network coverage (e.g., Low Power Wide Area Network (LoRaWAN)) in a particular location where an IoT device (e.g., a sensor) is to be installed. In response, the system may alert the IoT network provider to deploy wireless gateways or access points (e.g. LoRaWAN Gateway) to provide network coverage for the particular location.

In this way, the techniques described in this disclosure may provide one or more technical advantages. For example, the example systems described herein may provide a neutral, multi-network, IoT device activation and onboarding service with inter-roaming capabilities that is secure and scalable. In some instances, the techniques may enable secure application sessions between IoT devices and the IoT edge devices without requiring certificate exchange, storage, or query by the IoT devices. For example, the techniques may include an activation procedure that integrates the application session activation and network session activation to exploit the network security procedure for an interconnection and use the results to activate the application session with the IoT platform. Moreover, facilitating a buildout of the IoT network in a particular location may provide access of a newly available network in and around the particular location for all other customers. Consequently, the techniques may be particularly applicable to low cost, low power IoT devices that seek economies in power consumption and computation resource utilization by eschewing complex certificate-based authentication schemes. In one example, a method includes receiving, by a device activation unit of one or more co-location facilities, an activation request message from an Internet of Things (IoT) device to activate the IoT device on an IoT core network of a plurality of IoT core networks, wherein the plurality of IoT core networks and a plurality of IoT edge devices are co-located within the co-location facilities that are deployed and managed by a co-location facilities provider, and wherein the plurality of IoT edge devices are connected to one or more IoT platforms. The method also includes authenticating, by the device activation unit, the IoT device for connection to the IoT core network of the plurality of IoT core networks. The method further includes, in response to authenticating the IoT device, provisioning, by the device activation unit, a connection between the IoT core network of the plurality of IoT core networks and the plurality of IoT edge devices to provide the IoT device access to the one or more IoT platforms.

In another example, a system includes a plurality of Internet of Things (IoT) edge devices co-located within respective co-location facilities each deployed and managed by a single co-location facility provider, wherein at least one of the plurality of IoT edge devices is communicatively coupled to one or more IoT platforms. The system also includes a plurality of IoT core networks co-located within one or more co-location facilities each deployed and managed by the single co-location facility provider, wherein at least one of the plurality of IoT core networks is communicatively coupled to an IoT device of a plurality of IoT devices. The system further includes a device activation unit, wherein the device activation unit is configured to receive an activation request message from the IoT device to activate the IoT device on an IoT core network of the plurality of IoT core networks, authenticate the IoT device for connection to the IoT core network of the plurality of IoT core networks, and in response to authenticating the IoT device, provision a connection between the IoT core network of the plurality of IoT core networks and the plurality of IoT edge devices to provide the IoT device access to the one or more IoT platforms.

In a further example, a computer readable storage medium comprising instructions that when executed cause one or more processors of a computing system to: receive an activation request message from the IoT device to activate an Internet of Things (IoT) device on an IoT core network of the plurality of IoT core networks, authenticate the IoT device for connection to the IoT core network of the plurality of IoT core networks; and in response to authenticating the IoT device, provision a connection between the IoT core network of the plurality of IoT core networks and the plurality of IoT edge devices to provide the IoT device access to the one or more IoT platforms.

The details of one or more examples of the techniques are set forth in the accompanying drawings and the description below. Other features, objects, and advantages of the techniques will be apparent from the description and drawings, and from the claims.

Like reference characters denote like elements throughout the figures and text.

DETAILED DESCRIPTION

FIG. 1Ais a block diagram illustrating an example network system2for providing Internet of Things (IoT) device activation and interconnection, in accordance with the techniques described herein. In the example ofFIG. 1A, network system2includes one or more co-location facilities20that provides seamless activation and automatic onboarding of IoT devices4A,4B (collectively, “IoT devices4” or “devices4”) to IoT platforms36A-36N (collectively, or “IoT platforms36”) and establishes secure end-to-end communication between IoT devices4and IoT platforms36such that IoT devices4may access IoT services38A-38N (collectively, “services38”) from various of the IoT platforms36.

IoT devices4may be any of a variety of smart devices. In some examples, IoT devices4may be personal computing devices, such as smart phones, tablets, smart watches, laptop computers, desktop computers, e-readers, or other computing devices. In some examples, the IoT devices4may include devices of the home consumer, such as light bulbs, kitchen utensils, security devices, pet feeding devices, irrigation controllers, smoke alarms, entertainment units, infotainment units, energy monitoring devices, thermostats, and home appliances such as refrigerators, washers, dryers, stoves, for example. As another example, the IoT devices4may include devices for transport and mobility, such as devices for traffic routing, telematics, package monitoring, smart parking, insurance adjustments, supply chain, shipping, public transport, airlines, and trains, for example. As another example, the IoT devices4may include devices for buildings and infrastructure, such as devices for HVAC, security, lighting, electrical, transit, emergency alerts, structural integrity, occupancy, energy credits, for example. As another example, the IoT devices4may include devices for cities and industry, such as devices for electrical distribution, maintenance, surveillance, signage, utilities, smart grid, emergency services, and waste management, for example. In some examples, IoT devices4include sensors, such as for sensing conditions of the surrounding environment.

As shown inFIG. 1A, network system2may include a radio access network8with an access gateway10and access router12that provide IoT devices4A with access to one or more of IoT core networks22A-22N (collectively, “core networks22”). For example, IoT devices4A may support both cellular radio access and local wireless networks (e.g., WiFi) and may communicate with base station6over wireless links to access radio access network8. Radio access network8may provide network access, data transport and other services to IoT devices4A. Radio access network8may implement a cellular network architecture, such as a cellular network architecture defined by Global System for Mobile communication (GSM) Association, the 3rdGeneration Partnership Project (3GPP), the 3rdGeneration Partnership Project 2 (3GPP/2), the 3rdGeneration Partnership Project Machine Type Communication (3GPP MTC), the Internet Engineering Task Force (IETF), and the Worldwide Interoperability for Microwave Access (WiMAX) forum. For example, radio access network8may represent a radio network of a GSM architecture, a General Packet Radio Service (GPRS) architecture, a Universal Mobile Telecommunications System (UMTS) architecture, and an evolution of UMTS referred to as Long Term Evolution (LTE), each of which is standardized by 3GPP. Alternatively, or in conjunction with one of the above, radio access network8may implement code division multiple access (CDMA) architecture. Radio access network8may, alternatively, or in conjunction with one of the above, implement a WiMAX architecture. In some examples, radio access network8may implement low power cellular network architecture, such as Extended Coverage GSM (EC-GSM), LTE for Machines (LTE-M), and Narrowband IoT (NB-IoT). A low power network wide area network (otherwise referred to as “LPWAN”) may provide long range wireless connectivity, enable very long device battery life and very low cost devices (e.g., sensors and monitors), provide the ability to activate devices securely and automatically (e.g., via over-the-air (OTA)).

Network system2may also include an access network14with an access gateway16and access router18that provide IoT devices4B with access to one or more core networks22. For example, each of IoT devices4B may communicate with access gateway16over a physical interface for access to access network14. For example, IoT devices4B may utilize a Point-to-Point Protocol (PPP), such as PPP over Asynchronous Transfer Mode (ATM) or PPP over Ethernet (PPPoE), to communicate with access gateway16. Other examples may use other lines besides DSL lines, such as cable, Ethernet over a T1, T3 or other access links. In some examples, access network14may implement low power non-cellular network architecture, such as LoRa, Sigfox, and Random Phase Multiple Access (RPMA).

IoT devices4may use services38provided by IoT platforms36. IoT platforms36may each comprise a private or public cloud, an enterprise, or the like. IoT platforms36provide, for example, IoT intelligence, data analytics, device management and provisioning, data management, connectivity, event processing, and API controls to IoT devices4. For instance, IoT platforms36may provide access to IoT services38that include, for example, consumer, industrial, smart city, and/or vehicular applications. In some examples, platforms36are co-located within co-location facilities20. In some examples, platforms36are external to co-location facilities20.

In the example ofFIG. 1A, IoT devices4may connect to co-location facilities20to access services38provided by IoT platforms36. A co-location facility provider may employ one or more co-location facilities, e.g., co-location facilities20, such as a data center or warehouse, in which multiple customers of the co-location facility provider may locate network, server, storage gear and interconnect to a variety of telecommunications, cloud, and other network service provider(s) with a minimum of cost and complexity. Each of co-location facilities20may have a switch fabric (not shown) configurable for cross-connecting customer networks located within multiple customer cages. In some instances, the customer cages may each be associated with a different customer of the interconnection system provider. As used herein, the term “customer” of the interconnection system provider may refer to a tenant of the co-location facilities20deployed by the co-location facility provider, whereby the customer leases space within the co-location facilities20in order to co-locate with other tenants for improved efficiencies over independent facilities as well as to interconnect network equipment with the other tenants' network equipment within the interconnection facility or campus for reduced latency/jitter and improved reliability, performance, and security versus transport networks, among other reasons. Co-location facilities20may operate a network services exchange, such as Ethernet Exchange, and Internet Exchange, and/or a Cloud Exchange, for example, to transmit L2/L3 packet data between customer networks. Co-location facilities20may provide both an Ethernet exchange and a cloud-based services exchange, in some examples.

Further example details of a facility that provides a cloud-based services exchange are found in U.S. Ser. No. 15/099,407, filed Apr. 14, 2016 and entitled “Cloud-Based Services Exchange”; U.S. Ser. No. 14/927,451, filed Oct. 29, 2015 and entitled “INTERCONNECTION PLATFORM FOR REAL-TIME CONFIGURATION AND MANAGEMENT OF A CLOUD-BASED SERVICES EXCHANGE”; and in U.S. Provisional Patent Application 62/160,547, filed May 12, 2015 and entitled “PROGRAMMABLE NETWORK PLATFORM FOR A CLOUD-BASED SERVICES EXCHANGE”; each of which are incorporated herein by reference in their respective entireties.

In accordance with the techniques of this disclosure, co-location facilities20may provide a centralized, neutral IoT device activation and automatic onboarding service on an end-to-end basis between core networks22and IoT platforms36. In the example ofFIG. 1A, co-location facilities20may include core networks22and IoT edge devices26A-26N (collectively, “edge devices26”) co-located within co-location facilities20. For example, providers of IoT platforms36may deploy core software as virtualized network functions running on a Network Functions Virtualization Infrastructure (NFVI) provided by co-location facilities20or an operator-owned NFVI. Core networks22manage all aspects of device communications on the network including security and data routing between IoT devices4and IoT platforms36. For example, core networks22may control, manage, and provide access and connectivity for access networks (e.g., radio access network8) and IoT devices4making use of these access networks. Core networks22may include a Low Power Wide Area Network (LPWAN), Random Phase Multiple Access (RPMA) network, Sigfox wireless network, cellular network, Ethernet networks, or the like.

Edge devices26may also be deployed in co-location facilities20to provide device connectivity functions (e.g., protocol and messaging adaptation), processing (e.g., event processing), streaming analytics and security, customer segmentation and interface to IoT platforms36. Edge devices26may implement, for example, Azure IoT Edge technologies, Amazon Web Services (AWS) Greengrass technologies, or the like.

Core networks22are connected to edge devices26within co-location facilities20. For example, edge devices26are connected via the switch fabric within co-location facilities20and the physical and virtual circuits to IoT platforms36. Edge devices26can leverage the capabilities of the co-location service provider in the areas of co-location, interconnection, and access to a variety of different IoT platforms36that are also customers of the co-location facility provider, to provide an interconnection architecture in which edge devices26may access multiple core networks22of the same or different kinds. In some examples, edge devices26may analyze traffic data communicated to IoT platforms36to influence billing decisions.

In the example ofFIG. 1A, co-location facilities20may provide a centralized system that provides IoT device supply chain management, IoT device activation and automated onboarding service, and end-to-end secure communication between core networks22and IoT platforms36.

As one example, co-location facilities20may include at least one Device Activation Unit30(“DAU30”) that provides IoT device supply chain management by allowing providers of IoT platforms36and device manufacturers (not shown) to exchange IoT device provisioning and security credential data. For example, DAU30may receive authentication information, e.g., root keys, device identifiers, application identifiers, etc., from providers of IoT platforms36. Device manufacturers may retrieve the authentication information from DAU30and configure IoT devices4based on the authentication information. By storing the authentication information in DAU30, DAU30may activate the IoT devices in bulk unlike edge devices that activate IoT devices individually.

DAU30may provide an IoT device activation and automatic onboarding service on an end-to-end basis between core networks22and IoT platforms36. For example, DAU30may activate IoT devices4based on the authentication information stored in DAU30. In response to activating IoT devices4, DAU30may share information of the activated IoT device4to edge devices26and/or IoT platforms36to enable integrated device activation in IoT platforms36when the device activates in core networks22. In some examples, DAU30may include a roaming policy unit34(“RPU34”) that implements roaming policies between core networks22and edge devices26. In response, RPU34may instantiate forwarding rules into the interconnection fabric of co-location facilities20to allow IoT device traffic to flow between core networks22and edge devices26. Although RPU34is illustrated as included in DAU30, RPU34may be external to DAU30.

DAU30may also establish secure end-to-end communication between IoT devices4and IoT platforms36. For example, DAU30may establish a secure communication session between the IoT devices4and IoT platforms36. The secure communication session may include Message Queueing Telemetry Transport (MQTT), MQTT for Sensor Networks (MQTT-SN), Transport Layer Security (TLS), Datagram Transport Layer Security (DTLS), Advanced Message Queuing Protocol, Constrained Application Protocol (CoAP), Extensible Messaging and Presence Protocol (XMPP), Web sockets, Hyper-Text Transfer Protocol2(HTTP2), Secure Sockets Layer (SSL), Transmission Control Protocol (TCP), for example. As further described below, DAU30may generate a session key based on information (e.g., identifiers, security keys, etc.) included in the activation request from IoT devices4. DAU30may share the session key with core networks22and edge devices26. By sharing the session key with core networks22and edge devices26, core networks22and edge devices26may accept encrypted communication from IoT devices4with a matching session key.

DAU30may also send an activation response to IoT devices4including information for which IoT devices4may generate a session key that matches the session key of core networks22and edge devices26. In this way, traffic from IoT devices4may establish secure communication through the switch fabric of co-location facilities20to IoT platforms36.

DAU30may also maintain network coverage (e.g., “last mile” coverage) information on a per IoT network provider basis to automatically alert network providers if there is a lack of, or insufficient, network (e.g., wireless) coverage in specific geographic locations causing failures in connectivity or activation of IoT devices4. To alert network providers, geographic location information (e.g., where a given IoT device needs to be deployed) may be included in the device onboarding/provisioning information along with device and application identification information. In this case, DAU30can compare the network coverage information with the requested device location information and determine if there is network coverage in the requested location. If there is no sufficient coverage, DAU30may alert one or more network providers and trigger deployment of wireless gateways (e.g., access gateways/points) in order to provide the network coverage. Once the coverage is provided for the initial requesting device, all other IoT devices4may access the newly deployed access gateway will be able to use the IoT access network (e.g., radio access network8).

FIG. 1Bis a block diagram illustrating another example system for providing an interconnected system for IoT device provisioning and secure communication, in accordance with techniques described herein. System2ofFIG. 1Bis similar to system2ofFIG. 1Aexcept as described below.

In the example ofFIG. 1B, co-location facilities20may include one or more cloud based services exchanges40A-40N (collectively, “cloud exchanges40”) for interconnecting IoT platforms36with edge devices26. For example, cloud exchanges40each includes a network infrastructure that provides an L2/L3 switching fabric by which IoT platforms36and edge devices26interconnect. The network infrastructure may include network devices, such as routers, switches, software defined networking (SDN) controllers, network management systems, provisioning systems, or the like, to provide the interconnection of customers/carriers. This enables a carrier/customer to have options to create many-to-many interconnections with only a one-time hook up to the switch fabric and underlying interconnection platform of cloud exchanges40. In other words, instead of having to establish separate connections across transit networks to access different IoT platforms, cloud exchanges40allows IoT devices4to access one or more IoT platforms36using the network infrastructure within co-location facilities20.

IoT platforms202may each include, for example, a public and/or private cloud, an enterprise, a carrier network, Mobile Virtual Network Operator (MVNO), or the like. IoT platforms202may provide IoT devices218with applications, analytics, orchestration, data management, application programming interface (API) management, device management, and connection management. For example, IoT platforms202may provide access to IoT services such as consumer, industrial, smart city, and/or vehicular services. IoT customers, e.g., IoT devices218may access the IoT services by creating virtual environments and deploying business-specific IoT applications.

Delivery networks204may include public internet, Virtual Private Network (VPN) over the public internet, and private interconnect. Delivery networks204may provide connectivity between IoT platforms202and edge devices206of core networks212.

Edge devices206may each comprise a public edge gateway or a private edge gateway. Edge devices206may provide connectivity functions, processing, streaming analytics and security, customer segmentation, and interface to IoT platforms202and core networks212. Edge devices206are connected via the switch fabric of co-location facilities and the physical and virtual circuits to the data centers including IoT platforms202.

Core networks212may represent core network software deployed within co-location facilities20. Core networks212may include, for example, cellular networks, low power core networks (e.g., LoRaWAN network), or other core networks that control and manage connectivity for access networks216. Core networks212provide aggregation and authentication services to customers (i.e., IoT devices218) to provide IoT devices218with access to IoT platforms202connected to core networks212.

IoT devices218may include low power devices, mobile devices, or any variety of smart devices. As further described below, IoT devices218may send activation requests to DAU210for which DAU210may activate and automatically onboard the IoT devices218into IoT platforms202.

Device activation unit210(“DAU210”) may provide device authentication, interworking, security, and onboarding. For example, DAU210may provide supply chain management by interconnecting providers of platforms202and device manufacturers such that providers of platforms202and device manufacturers may exchange device provisioning and security credential data. DAU210may also provide machine interconnection and authentication services to connect IoT devices218and IoT platforms202. To connect IoT devices218to IoT platforms202, DAU210may activate IoT devices218in core networks212and in response to activating IoT devices218, automatically onboard the authenticated IoT devices218by sharing device information of the activated IoT devices218to edge devices and/or IoT platforms202. DAU210may also provide encrypted end-to-end communication between IoT devices218and IoT platforms202.

FIG. 3is a block diagram illustrating an example interconnection of a Device Activation Unit for device supply chain management and device provisioning, in accordance with the techniques described in this disclosure. In the example ofFIG. 3, device activation unit302(“DAU302”) may represent device activation unit30ofFIGS. 1A, 1B, and device activation unit210ofFIG. 2. DAU302may provide secure data exchange for IoT platforms316A-316N (collectively, “IoT platforms316”) and device manufacturers312A-312N (collectively, “device manufacturers312”) for any of core networks314A-314N (collectively, “core networks314”) and any IoT device. Device manufacturers312may include Original Equipment Manufacturers (“OEMs”) or any other manufacturer that may produce parts and equipment for accessing IoT platforms316.

DAU302may receive from IoT platforms316authentication information304that is to be pre-loaded in IoT devices at the time of manufacture. Authentication information304may comprise, for example, IoT device identification and master security information, as well as (where applicable, for stationary IoT devices) geographic location information where the device is to be deployed. Assume for example, core network314A is a low power non-cellular network (e.g., LoRa network). In this example, DAU302receives authentication information that may include root security keys (“AppKeys”), device identifiers (“DevEUIs”), and application identifiers (“AppEUIs”). AppKeys are used for activating IoT devices. AppKeys may be assigned by an application owner to the IoT device. AppKeys may be used to derive session keys, e.g., an application session key (“AppSKey”) and network session key (“NwkSKey”) that are specific for the IoT device to encrypt and verify network communication and application data, as further described below. DevEUI may be a 64-bit end-device identifier that uniquely identifies the IoT device. AppEUI may be a 64-bit application identifier that uniquely identifies an application provider of the IoT device. Although described with respect to authentication information for low power IoT devices and low power networks, authentication information304may comprise any type of IoT device identification and master security information for accessing any of core networks314.

A low power device manufacturer, e.g., device manufacturer312A, may access the DAU302to retrieve authentication information304to be loaded in newly manufactured low power non-cellular IoT devices. For example, device manufacturer312A may provision devices with AppKey, AppEUI, and DevEUI.

When the newly manufactured low power non-cellular IoT devices send activation requests to low power core network314A, core network314A may send the activation requests to DAU302. The activation request may include, for example, AppEUI, DevEUI, and device nonce value. In response, DAU302may activate these low power non-cellular IoT devices within core network314A. For example, DAU302may also generate session security keys (e.g., AppSKey and NwkSKey). AppSKey may be used to encrypt or decrypt payload data between an IoT device and an application server. NwkSKey may be used to encrypt MAC commands between the IoT device and network server. DAU302may send the generated session keys to core network314A and IoT platform316A. DAU302may send an activation response including information for which the IoT devices may generate session keys that match the session keys sent to core networks314A and edge devices. For example, DAU302may send an activation response including the NwkSKey and an application nonce value to core network314A. DAU302may also send to an IoT device an activation response including a device identifier and an application nonce value. The IoT device may generate session security keys from the activation response that match the AppKey and NwkSKey generated by DAU302. By using the session keys, the IoT device may securely communicate with core networks314A and the IoT edge devices by encrypting a packet using, e.g., NwkSKey to securely access core network314A, and by encrypting the packet using, e.g., AppSKey, to securely access IoT platform316A.

DAU302may also automatically onboard the activated devices to one or more IoT platforms316. For example, DAU302may update roaming policy unit306(RPU306) in the event IoT devices are activated. In this example, DAU302provide information associated with the activated low power non-cellular IoT device to IoT platform316A and/or the edge device connected to IoT platform316A to enable integrated device activation in IoT platform316A when the low power non-cellular device activates on core network314A.

RPU306may instantiate forwarding rules into the switch fabric of the co-location facilities to allow traffic from low power IoT devices to flow through core network314A and IoT platform316A. RPU306may provide a roaming policy function (RPF).

Alternatively, or additionally, DAU302may perform the above for cellular IoT devices. For example, assume for example, core network314B is a cellular network (e.g., LTE). In this example, DAU302receives authentication information (e.g., eSIM) configured for cellular networks (e.g., core network314B). A cellular device manufacturer, e.g., device manufacturer312B, may access the DAU302to retrieve authentication information304to be loaded in newly manufactured cellular IoT devices.

When the newly manufactured cellular IoT devices send activation requests to mobile core network314B, mobile core network314B may send the activation requests to DAU302. In response, DAU302may activate these cellular IoT devices within core network314B.

DAU302may also automatically onboard the activated devices to one or more IoT platforms316. For example, DAU302may update RPU306in the event IoT devices are activated. In this example, DAU302provide information associated with the activated cellular IoT devices to IoT platform316B and/or the edge device connected to IoT platform316B to enable integrated device activation in IoT platform316B when the cellular device activates on core network314B.

DAU302may also include network coverage information308to maintain network coverage (e.g., “last mile” coverage) information on a per IoT network provider basis to automatically alert network providers if there is a lack of, or insufficient, network (e.g., wireless) coverage in specific geographic locations causing failures in connectivity or activation of IoT devices (e.g., IoT devices4ofFIG. 1). To alert network providers, geographic location information (e.g., where a given IoT device needs to be deployed) may be included in the device onboarding/provisioning information along with device and application identification information. In this case, DAU302can compare the network coverage information308with the requested device location information and determine if there is network coverage in the requested location. If there is no sufficient coverage, DAU302may alert one or more network providers and trigger deployment of wireless gateways (e.g., access gateways/points) in order to provide the network coverage. Once the coverage is provided for the initial requesting device, all other IoT devices may access the newly deployed access gateway will be able to use the IoT access network.

FIG. 4is a block diagram illustrating an example Device Activation Unit in further detail, in accordance with the techniques described herein. Device Activation Unit402(“DAU402”) may represent Device Activation Unit30ofFIGS. 1A and 1B, Device Authentication Unit210ofFIG. 2, and Device Activation Unit302ofFIG. 3. Although the following example is described with respect to low power IoT devices and low power networks, DAU402may be extended for any type of IoT device and network.

DAU402includes an application provider and device manufacturer authentication unit404(“manufacturer authentication unit404”), security and authentication unit406, core management units408A-408N (collectively, “core management units408”), one or more storage devices410, and network-specific device credential management unit412.

Manufacturer authentication unit404may facilitate device supply chain management (as described above inFIG. 3). For example, manufacturer authentication unit404of DAU402may facilitate interconnection with IoT platforms414A-414N (collectively, “IoT platforms414”) and device manufacturers416A-416N (collectively, “device manufacturers416”) such that DAU404may receive authentication information from one or more IoT platforms414and provide the authentication information for one or more device manufacturers416to manufacture IoT devices based on the authentication information. As one example, DAU402may receive from IoT platform414A authentication information such as root security keys (“AppKeys”), device identifiers (“DevEUIs”), and application identifiers (“AppEUIs”) for low power devices, and store this information in one or more of storage devices410.

DAU402may also interconnect with device manufacturers416such that device manufacturers416may access the authentication information stored in one or more storage devices410of DAU402. Continuing the example above, DAU402may interconnect with a low power device manufacturer, e.g., device manufacturer416A, such that the low power IoT device manufacturer416A may retrieve the AppKeys, DevEUIs, and AppEUIs stored in storage devices410and manufacture low power IoT devices based on the authentication information.

Core management units408may each manage connection and routing to a respective one of core networks418. For example, core management units408may each perform respective network specific device activation functions. For example, core management unit408A may provide LoRa activation functions for LoRa (e.g., over-the-air (OTA) activation procedures), core management unit408B may provide eSIM activation functions for eSIM/Cellular, and so on. In some examples, core management units408may each include, or have access to, specific network coverage data. For example, core management units408may each use the network coverage data to determine whether there is network coverage in a particular location, and may alert network provider(s) if network coverage is insufficient.

Security and authentication unit406(“authentication unit406”) may facilitate activation and authentication of IoT devices (and Blockchain based devices) for access to core networks418A-418N (collectively, “core networks418”) interconnected to DAU402. Suppose for example that a low power IoT device manufactured by device manufacturer416A seeks access to low power core network418A. The low power IoT device may send an activation request (e.g., via Over-The-Air (OTA) activation procedures, or other activation procedures) to low power core network418A to request activation within low power core network418A. In turn, low power core network418A forwards the activation request to DAU402.

Authentication unit406may share information of the activated IoT device to core network418A and an edge device coupled to IoT platform414A to enable integrated device activation in IoT platform414A when the IoT device activates on core network418A. In some examples, DAU402may include (or connect with) a roaming policy function that may instantiate forwarding rules into the interconnection fabric to allow traffic to flow between the access network and core network418A, and between core network418A and the edge device coupled to IoT platform414A. That is, when an IoT device activates on core network418A, the IoT device is also activated in IoT platform414A.

Network-specific device credentials management unit412(“management unit412”) may generate a session key used for encrypting messages in a secure communication session (e.g., MQTT session) between the low power IoT device and low power core network418A. For example, management unit412may generate a session key from information included in the activation request, such as an application identifier, device identifier, and nonce value.

Management unit412may then send an activation response to core network418, which in turn forwards the activation response to the low power IoT device. The low power IoT device may generate a session key (e.g., network session key (“NwkSKey”) that matches the session key of low power core network418A and edge device coupled to IoT platform414A. The low power IoT device may use the session key for forwarding encrypted traffic between the low power IoT device and IoT platform414A.

FIG. 5is a flowchart illustrating example operation of a Device Activation Unit in provisioning an IoT device and establishing secure communication between the IoT device and an IoT edge device, in accordance with techniques described herein. For ease of illustration,FIG. 5is described with respect toFIG. 1AandFIG. 3. Although the following is described with respect to low power networks, the techniques described below are also applicable to other IoT network technologies.

The provider for platform36A may order low power devices configured to access core network22A. DAU30may receive authentication information from providers of platforms36for low power devices. For example, DAU30may receive authentication information such as root security keys (“AppKeys”), device identifiers (“DevEUIs”), and application identifiers (“AppEUIs”), to activate low power devices within core network22A. Device manufacturers may retrieve the authentication information from DAU30and manufacture low power IoT devices, e.g., IoT device4A, based on the authentication information.

IoT device4A sends an activation request to access a low power core network, e.g., core network22A, co-located in co-location facilities20(502). For example, IoT device4A may initiate Over-The-Air (OTA) activation procedures by turning the device on. In this example, IoT device4A sends an activation request (e.g., a JOIN request) in accordance with LoRa OTA device activation specification.

Core network22A within co-location facilities20receives the activation request and may forward the activation request to DAU30. DAU30may receive the activation request (504) and authenticate IoT device4A (506). For example, security and authentication unit406of the DAU may initiate activation procedures and authenticate IoT device4A for accessing core network22A.

DAU30generate session keys for secure end-to-end communication between IoT device4A and core network22A (508). For example, network-specific device credentials management unit412of the DAU may generate a session key used for encrypting messages in a secure communication session (e.g., MQTT session) between low power IoT device4A and low power core network22A. The session key may be generated from information included in the activation request without exposing root keys. IoT device4A may securely communicate to core network22A and edge device26A by encrypting a packet using, e.g., AppSKey, and also encrypting the packet using, e.g., NwkSKey. Access networks may receive the packet for which the network server for core network22A may decrypt the packet using NwkSKey and the application server for IoT platform36A may decrypt the packet using AppSKey.

DAU30sends the session keys to core network22A and edge device26A to establish an end-to-end communication session (510). For example, network-specific device credentials management unit412of the DAU may send the session keys to core network22A and edge device26A such that encrypted traffic may flow between access network8and core network22A and between core network22A and edge device26A.

Edge device26A receives the session key to enable edge device26A to send and receive encrypted traffic from core network22A and IoT platform36A (512). Similarly, core network22A receives the session key to enable core network22A to send and receive encrypted traffic from IoT device4A and IoT platform36A (514).

DAU30sends an activation update to core network22A and edge device26A (516). For example, security and authentication unit406of the DAU may send an activation update to core network22A and edge device26A to enable integrated device activation in IoT platform36A when the IoT device4A is activated on core network22A. The activation update may include information identifying the activated IoT device, e.g., IoT device4A. In some examples, DAU30may send the activation update directly to IoT platform36A to activate IoT device4A in IoT platform36A.

Edge device26A receives the activation update and activates IoT device4A in IoT platform36A (518). Similarly, core network22A receives the activation update and activates IoT device4A in core network22A (520).

DAU30may instantiate forwarding rules into interconnection fabric (522). For example, DAU30may include (or interconnect with) roaming policy unit34that may install forwarding rules in the interconnection fabric of co-location facilities20to allow connections to and from IoT device4A and gateway24A and to and from IoT edge26A.

DAU30sends an activation response (e.g., LoRa join accept) to core network22A, which forwards the activation response to IoT device4A (524). The activation response may include parameters necessary for IoT device4A to generate session keys that match the session keys received by edge device26A and core network22A.

IoT device4A receives the activation response (526) and generates, based on the parameters included in the activation response, a session key that matches the session keys received by edge device26A and core network22A (528).

IoT device4A may forward traffic based on the session key (530). In this way, IoT platform36A may receive secure communication from IoT device4A (532).

FIG. 6is a block diagram illustrating further details of one example of a computing device that operates in accordance with one or more techniques of the present disclosure.FIG. 6may illustrate a particular example of a server or other computing device600that includes one or more processor(s)602for executing a Device Activation Unit624, or any other computing device described herein. Other examples of computing device600may be used in other instances. Computing device600may be, for example, Device Activation Unit30(FIGS. 1A, 1B), Device Activation Unit202(FIG. 2), Device Activation Unit302(FIG. 3), or Device Activation Unit402(FIG. 4). Although shown inFIG. 6as a stand-alone computing device600for purposes of example, a computing device may be any component or system that includes one or more processors or other suitable computing environment for executing software instructions and, for example, need not necessarily include one or more elements shown inFIG. 6(e.g., communication units606; and in some examples components such as storage device(s)608may not be co-located or in the same chassis as other components).

As shown in the example ofFIG. 6, computing device600includes one or more processors602, one or more input devices604, one or more communication units606, one or more output devices612, one or more storage devices608, and user interface (UI) device(s)610. Computing device600, in one example, further includes one or more application(s)622, Device Activation Unit624, and operating system616that are executable by computing device600. Each of components602,604,606,608,610, and612are coupled (physically, communicatively, and/or operatively) for inter-component communications. In some examples, communication channels614may include a system bus, a network connection, an inter-process communication data structure, or any other method for communicating data. As one example, components602,604,606,608,610, and612may be coupled by one or more communication channels614.

Processors602, in one example, are configured to implement functionality and/or process instructions for execution within computing device600. For example, processors602may be capable of processing instructions stored in storage device608. Examples of processors602may include, any one or more of a microprocessor, a controller, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or equivalent discrete or integrated logic circuitry.

One or more storage devices608may be configured to store information within computing device600during operation. Storage device608, in some examples, is described as a computer-readable storage medium. In some examples, storage device608is a temporary memory, meaning that a primary purpose of storage device608is not long-term storage. Storage device608, in some examples, is described as a volatile memory, meaning that storage device608does not maintain stored contents when the computer is turned off. Examples of volatile memories include random access memories (RAM), dynamic random access memories (DRAM), static random access memories (SRAM), and other forms of volatile memories known in the art. In some examples, storage device608is used to store program instructions for execution by processors602. Storage device608, in one example, is used by software or applications running on computing device600to temporarily store information during program execution.

Storage devices608, in some examples, also include one or more computer-readable storage media. Storage devices608may be configured to store larger amounts of information than volatile memory. Storage devices608may further be configured for long-term storage of information. In some examples, storage devices608include non-volatile storage elements. Examples of such non-volatile storage elements include magnetic hard discs, optical discs, floppy discs, flash memories, or forms of electrically programmable memories (EPROM) or electrically erasable and programmable (EEPROM) memories.

Computing device600, in some examples, also includes one or more communication units606. Computing device600, in one example, utilizes communication units606to communicate with external devices via one or more networks, such as one or more wired/wireless/mobile networks. Communication units606may include a network interface card, such as an Ethernet card, an optical transceiver, a radio frequency transceiver, or any other type of device that can send and receive information. Other examples of such network interfaces may include 3G and WiFi radios. In some examples, computing device600uses communication unit606to communicate with an external device.

Computing device600, in one example, also includes one or more user interface devices610. User interface devices610, in some examples, are configured to receive input from a user through tactile, audio, or video feedback. Examples of user interface devices(s)610include a presence-sensitive display, a mouse, a keyboard, a voice responsive system, video camera, microphone or any other type of device for detecting a command from a user. In some examples, a presence-sensitive display includes a touch-sensitive screen.

One or more output devices612may also be included in computing device600. Output device612, in some examples, is configured to provide output to a user using tactile, audio, or video stimuli. Output device612, in one example, includes a presence-sensitive display, a sound card, a video graphics adapter card, or any other type of device for converting a signal into an appropriate form understandable to humans or machines. Additional examples of output device612include a speaker, a cathode ray tube (CRT) monitor, a liquid crystal display (LCD), or any other type of device that can generate intelligible output to a user.

Computing device600may include operating system616. Operating system616, in some examples, controls the operation of components of computing device600. For example, operating system616, in one example, facilitates the communication of one or more applications622and Device Activation Unit624with processors602, communication unit606, storage device608, input device604, user interface devices610, and output device612.

Application provider and device manufacturer authentication unit632, security and authentication unit634, core management unit636, network-specific device credentials management unit638, and storage640may also include program instructions and/or data that are executable by computing device600to perform the functions as described herein.