Patent Description:
Wi-Fi provisioning is the process of adding a wireless device to a network such as a home network or a business network. This process, typically, involves entering credential information (usernames, passwords, etc.) in to the wireless device and connecting to the network from the wireless device. Once connected to the network, any changes in the credentialing information for the network typically needs to be separately updated in the wireless device(s) connecting to the network.

<CIT> discloses a wireless local area network (WLAN) comprising a modem that forms an access point to the WLAN, the modem comprising an association device which is configured to enable association of a new client to the WLAN.

<CIT> discloses a system and machine-implemented method for wireless network access for a wireless-enabled device.

Document "<NPL> is a manual of the gateway referred to in document <CIT>.

According to an aspect there is provided a system comprising: a gateway device comprising a processor and a transceiver, the gateway device configured to operate a virtual local area network (VLAN) having a first network partition and a second network partition and the gateway device further configured to selectively operate the VLAN in one of a plurality of modes, wherein the plurality of modes includes: an operational mode and a provisioning mode, wherein the gateway device is configured to, while in the provisioning mode: activate the second network partition; receive, from the wireless device, credential data; establish a connection to the wireless device through the second network partition based at least in part on the credential data; and transmit secured credentialing data associated with the first network partition to the wireless device; wherein the credential data is preprogrammed in to the wireless device; wherein the gateway device operates in provisioning mode responsive to an input from a user; and wherein the input of the user comprises pressing a Wi-Fi Protected Setup, WPS, button and entering a login to ensure that the user activating the WPS is authorized.

The second network partition may be activated for a period of time.

The gateway device may be configured to: responsive to transmitting the secured credentialing data of the first network partition to the wireless device, operate the VLAN in operational mode; and connect to the wireless device through the first network partition.

The gateway device may receive credential data through the second network partition from the wireless device responsive to an input from a user.

The gateway device may comprise a home security system panel.

According to another aspect there is provided a method for credential provisioning, the method comprising: receiving, by a gateway device, a request for provisioning for a wireless device, wherein the gateway device operates a virtual local area network (VLAN), the VLAN comprising a first network partition and a second network partition; responsive to the request, activating the second network partition; receiving, through the second network partition, the credentialing data associated with the wireless device; establishing a connection to the wireless device through the second network partition based at least in part on the credential data; and transmitting secured credentialing data associated with the first network partition to the wireless device; the credential data is preprogrammed in to the wireless device; wherein the request for provisioning is an input from a user; and wherein the input of the user comprises pressing a Wi-Fi Protected Setup, WPS, button and entering a login to ensure that the user activating the WPS is authorized.

The method may further include: responsive to transmitting the secured credentialing data to the wireless device, connecting to the wireless device through the first network partition.

The method may further include: transmitting a reset command to the wireless device.

The diagrams depicted herein are illustrative. There can be many variations to the diagram or the operations described therein without departing from the scope of the present invention as defined by the claims. For instance, the actions can be performed in a differing order or actions can be added, deleted or modified. Also, the term "coupled" and variations thereof describes having a communications path between two elements and does not imply a direct connection between the elements with no intervening elements/connections between them. All of these variations are considered a part of the specification.

Referring to <FIG>, there is shown a processing system <NUM> for implementing the teachings herein. The system <NUM> has one or more central processing units (processors) 101a, 101b, 101c, etc. (collectively or generically referred to as processor(s) <NUM>). Each processor <NUM> may include a reduced instruction set computer (RISC) microprocessor. Processors <NUM> are coupled to system memory <NUM> and various other components via a system bus <NUM>. Read only memory (ROM) <NUM> is coupled to the system bus <NUM> and may include a basic input/output system (BIOS), which controls certain basic functions of system <NUM>.

<FIG> further depicts an input/output (I/O) adapter <NUM> and a network adapter <NUM> coupled to the system bus <NUM>. I/O adapter <NUM> may be a small computer system interface (SCSI) adapter that communicates with a hard disk <NUM> and/or tape storage drive <NUM> or any other similar component. I/O adapter <NUM>, hard disk <NUM>, and tape storage device <NUM> are collectively referred to herein as mass storage <NUM>. Operating system <NUM> for execution on the processing system <NUM> may be stored in mass storage <NUM>. A network adapter <NUM> interconnects bus <NUM> with an outside network <NUM> enabling data processing system <NUM> to communicate with other such systems. A screen (e.g., a display monitor) <NUM> is connected to system bus <NUM> by display adaptor <NUM>, which may include a graphics adapter to improve the performance of graphics intensive applications and a video controller. Adapters <NUM>, <NUM>, and <NUM> may be connected to one or more I/O busses that are connected to system bus <NUM> via an intermediate bus bridge (not shown). Suitable I/O buses for connecting peripheral devices such as hard disk controllers, network adapters, and graphics adapters typically include common protocols, such as the Peripheral Component Interconnect (PCI). Additional input/output devices are shown as connected to system bus <NUM> via user interface adapter <NUM> and display adapter <NUM>. A keyboard <NUM>, mouse <NUM>, and speaker <NUM> all interconnected to bus <NUM> via user interface adapter <NUM>, which may include, for example, a Super I/O chip integrating multiple device adapters into a single integrated circuit.

The processing system <NUM> may include a graphics processing unit <NUM>. Graphics processing unit <NUM> is a specialized electronic circuit designed to manipulate and alter memory to accelerate the creation of images in a frame buffer intended for output to a display. In general, graphics processing unit <NUM> is very efficient at manipulating computer graphics and image processing, and has a highly parallel structure that makes it more effective than general-purpose CPUs for algorithms where processing of large blocks of data is done in parallel.

Thus, as configured in <FIG>, the system <NUM> includes processing capability in the form of processors <NUM>, storage capability including system memory <NUM> and mass storage <NUM>, input means such as keyboard <NUM> and mouse <NUM>, and output capability including speaker <NUM> and display <NUM>. A portion of system memory <NUM> and mass storage <NUM> may collectively store an operating system to coordinate the functions of the various components shown in <FIG>.

Turning now to an overview of technologies that are more specifically relevant to aspects of the invention, most security systems, fire detection systems, and home control system rely on multiple sensors setup within a home or business location. For example, a home security system may require an outdoor camera set up at or near an entry point for the home. Most sensors (e.g., cameras, light sensors, etc.) are wireless and include an addressable interface that can connect to a network. These sensors can sometimes be referred to as internet of things (IoT) devices. In most cases, connecting an IoT device to a wireless network involves the manual input of a passcode or a network name or a service set identifier (SSID). Also, this sometimes will need to be performed while the system (security, fire, etc.) is in a discovery mode. Home security systems, typically, include a security panel set up in the home which may allow for entry of information into the panel. However, the IoT devices such as cameras do not include input/output devices. Also, the IoT device may not be manufactured by the same company as the home security system (panel) manufacturer. A customer may wish to utilize certain types of sensors and pair them with the home security system.

The term Internet of Things (IoT) object is used herein to refer to any object (e.g., an appliance, a sensor, etc.) that has an addressable interface (e.g., an Internet protocol (IP) address, a Bluetooth identifier (ID), a near-field communication (NFC) ID, etc.) and can transmit information to one or more other objects over a wired or wireless connection. An IoT object may have a passive communication interface, such as a quick response (QR) code, a radio-frequency identification (RFID) tag, an NFC tag, or the like, or an active communication interface, such as a modem, a transceiver, a transmitter-receiver, or the like. An IoT object can have a particular set of attributes (e.g., a device state or status, such as whether the IoT object is on or off, open or closed, idle or active, available for task execution or busy, and so on, a cooling or heating function, an environmental monitoring or recording function, a light-emitting function, a sound-emitting function, etc.) that can be embedded in and/or controlled/monitored by a central processing unit (CPU), microprocessor, ASIC, or the like, and configured for connection to an IoT network such as a local ad-hoc network or the Internet. For example, IoT objects may include, but are not limited to, refrigerators, toasters, ovens, microwaves, freezers, dishwashers, dishes, hand tools, clothes washers, clothes dryers, furnaces, heating, ventilation, air conditioning & refrigeration (HVACR) systems, air conditioners, thermostats, fire alarm & protection system, fire, smoke & CO detectors, access / video security system, elevator and escalator systems, burner and boiler controls, building management controls, televisions, light fixtures, vacuum cleaners, sprinklers, electricity meters, gas meters, etc., so long as the devices are equipped with an addressable communications interface for communicating with the IoT network. IoT objects may also include cell phones, desktop computers, laptop computers, tablet computers, personal digital assistants (PDAs), etc. Accordingly, the IoT network can include a combination of "legacy" Internet-accessible devices (e.g., laptop or desktop computers, cell phones, etc.) in addition to devices that do not typically have Internet-connectivity (e.g., dishwashers, etc.).

Turning now to an overview of the aspects of the present invention, the above-described shortcomings of the prior art are addressed by providing a system for provisioning of credential information to IoT devices seamlessly. The system can isolate wireless network partitions and utilize the partitions for different functions. This can be achieved by utilizing a virtual local area network (VLAN). A VLAN is any broadcast domain that is partitioned and isolated in a computer network at the data link layer. In this sense, the VLAN can partition a wireless network operating in a home or business location. The partition can include any number of network partitions. For example, a first network partition can be utilized for IoT devices that have been authenticated and have inputted credential data for connecting to the first network partition. A second network partition can be utilized for provisioning for IoT devices.

Turning now to a more detailed description of aspects of the present invention, <FIG> depicts a system for credentialing a wireless device. The system <NUM> includes a gateway device <NUM>, connected IoT devices <NUM>, a new IoT device <NUM>, and two network partitions (secured network partition <NUM> and the provisioning network partition <NUM>). The gateway device <NUM> can be a home security panel installed at a customer's home.

The gateway device <NUM> can be implemented on the processing system <NUM> found in <FIG>. Additionally, a cloud computing system can be in wired or wireless electronic communication with one or all of the elements of the system <NUM>. Cloud can supplement, support or replace some or all of the functionality of the elements of the system <NUM>. Additionally, some or all of the functionality of the elements of system <NUM> can be implemented as a node of a cloud. The cloud computing described herein is only one example of a suitable cloud computing environment.

The gateway device <NUM> controls a virtual local area network (VLAN) that includes the secured network partition <NUM> and the provisioning network partition <NUM>. The gateway device <NUM> can control the VLAN through an intermediate device such as a modem or the like. The system <NUM> can be, for example, a home security system that has sensors and cameras (IoT devices) wirelessly set up through a home or building. The connected IoT devices <NUM> are connected to the secured network partition <NUM> as these devices have been authenticated and have entered a correct SSID or passcode to the connect to the secured network partition <NUM>. When a new IoT device <NUM> needs to be connected, the gateway device <NUM> can be operated to provide access to the new IoT device <NUM>. For the new IoT device <NUM>, the gateway device <NUM> can initiate a provisioning mode of operation. While in the provisioning mode, the gateway device <NUM> activates the provisioning network partition <NUM>. The provisioning mode is activated by a user inputting a login to the gateway device <NUM> after pressing a Wi-Fi Protected Setup, WPS, button on the gateway device <NUM>. The provisioning mode can be activated for a set period of time either automatically or by the user based on number of new devices being connected and the like. The new IoT device <NUM> can have the credentials for the provisioning network partition <NUM> preprogrammed in the new IoT device <NUM>. For example, the manufacturer of an IoT device can preprogram specific provisioning credentials in the IoT device for use with a specific type of home security system. The home security system can use the same credentialing information for each provisioning network partition <NUM> across all system lines.

While in provisioning mode, the new IoT device <NUM> can connect to the gateway device <NUM> through the provisioning network partition <NUM> utilizing the preprogrammed credential information (e.g., SSID and password). The new IoT device <NUM> can search for credential information from the gateway device <NUM> upon powering on the IOT device <NUM> or pressing a button on the IoT device <NUM> after powering on. Once connected, the gateway device <NUM> can authenticate the new IoT device <NUM> through a secure API exchange or the like. Once authenticated, the gateway device <NUM> can transmit credential information (SSID and password, etc.) for the secured network partition <NUM> to the new IoT device <NUM>. This credential information is transmitted through the provisioning network partition <NUM>. Once this credential information is received by the new IoT device <NUM>, the device can then connect to the secured network partition <NUM> and thus operate with the system <NUM>.

The new IoT device <NUM> can connect to the provisioning network partition <NUM> when a user activates the IoT device <NUM>. For example, a user could press a button on the new IoT device <NUM> which would cause the IoT device <NUM> to automatically search for a programmed SSID (for the partition <NUM>) and join it automatically. Alternatively, the new IoT device <NUM> can connect to the provisioning network partition <NUM> when it is turned on for the first time.

The system <NUM> enters into provisioning mode based on a user pressing a Wi-Fi Protected Setup (WPS) button on the gateway device <NUM>. After pressing the WPS button, the provisioning network partition <NUM> is broadcasted for a period of time. A WPS button on the new IoT device <NUM> can be pressed as well to allow for the new IoT device <NUM> to search for the pre-programmed SSID and connect through the provisioning network partition <NUM>. After pressing the WPS button, the gateway device <NUM> requires a login and password or some code to be entered to ensure that the user activating the WPS is authorized.

The gateway device <NUM> can be a panel for a home security system or a home controlling system. For example, the panel can be used to operate IoT devices such as electronic locks, indoor and outdoor lighting, appliances, and the like. Each of the IoT devices can connect to the wireless network through the systems and methodology described herein.

The new IoT device <NUM> can be, for example, a wireless camera for a home security system. During provisioning, to get the camera to search for the pre-programmed SSID, a user can hold up an image for the camera and utilizing image recognition for the image, the camera would search the required SSID and connect to the provisioning network partition <NUM>. The image could be an image on a smart phone or tablet or a printed out image that can be included with the IoT device <NUM>.

If the credential information for the secured network partition changes, the gateway device <NUM> can pass along the updated information to the connected IoT device <NUM> before the credential information (e.g., password to the Wi-Fi) is changed. This can be performed through the first partition <NUM> before credential information is changed and applied to the first partition <NUM>. In one example, when changing the credential information of the first network partition <NUM>, the user will be notified of any offline devices.

<FIG> depicts a system for credentialing a wireless device. The system <NUM> includes a control panel <NUM>, a user device <NUM>, and an IoT device <NUM>. The control panel <NUM> can be a security panel for a home security system and can operate multiple IoT devices such as sensors and cameras connected through a network. The user device <NUM> can be any type of device such as, for example, a smart phone, a tablet, a smart watch, and the like. The system <NUM> can provide credential information for the IoT device <NUM> utilizing the user device <NUM>. The user device <NUM> can connect to the control panel <NUM> using near field communication (NFC). The user device <NUM> access the control panel <NUM> by utilizing a login or some other authentication process. Once accessed, the control panel <NUM> can transmit to the user device <NUM> credential data and any other data for the new IoT device <NUM> to access the network. The other data can include authentication data or identifier data so that the control panel <NUM> can discover the new IoT device <NUM> on the network once connected. The user device <NUM>, after receiving the credential data and other data, can connect to the IoT device <NUM> using a NFC connection. Once connected and authenticated, the user device <NUM> can transmit the credential data and the other data to the IoT device <NUM> allowing for the IoT device <NUM> to connect to the network.

<FIG> depicts a flow diagram of a method for credential provisioning. The method <NUM> includes receiving, by a gateway device, a request for provisioning for a wireless device, wherein the gateway device operates a virtual local area network (VLAN), the VLAN comprising a first network partition and a second network partition, as shown in block <NUM>. At block <NUM>, the method <NUM> includes responsive to the request, activating the second network partition. The method <NUM>, at block <NUM>, includes receiving, through the second network partition, credential data associated with the wireless device. At block <NUM>, the method <NUM> includes establishing a connection to the wireless device through the second network partition based at least in part on the credential data. The method <NUM>, at block <NUM>, includes transmitting secured credentialing data associated with the first network partition to the wireless device and ask the wireless device to establish the connection to first network by rebooting or restarting. And at block <NUM>, the method <NUM> includes accepting through the first network partition, the new wireless device.

Additional processes may also be included. It should be understood that the processes depicted in <FIG> represent illustrations and that other processes may be added or existing processes may be removed, modified, or rearranged without departing from the scope of the present invention as defined by the appended claims.

A detailed description of the present invention is presented herein by way of exemplification and not limitation with reference to the Figures.

The terminology used herein is for the purpose of describing particular examples only and is not intended to be limiting.

Claim 1:
A system (<NUM>) comprising:
a gateway device (<NUM>) comprising a processor and a transceiver, the gateway device configured to operate a virtual local area network (VLAN) having a first network partition (<NUM>) and a second network partition (<NUM>); and
the gateway device further configured to selectively operate the VLAN in one of a plurality of modes, wherein the plurality of modes includes:
an operational mode; and
a provisioning mode, wherein the gateway device is configured to, while in the provisioning mode:
activate the second network partition;
receive, from a wireless device (<NUM>), credential data;
establish a connection to the wireless device through the second network partition based at least in part on the credential data; and
transmit secured credentialing data associated with the first network partition to the wireless device;
wherein the credential data is preprogrammed in to the wireless device;
wherein the gateway device (<NUM>) operates in provisioning mode responsive to an input from a user; and
wherein the input of the user comprises pressing a Wi-Fi Protected Setup, WPS, button; and
characterised in that the input of the user further comprises, after pressing the WPS button, entering a login to ensure that the user activating the WPS is authorized.