FIELD

The subject matter disclosed herein relates to internet of things (“IoT”) devices and more particularly relates to cloud assisted authorization of IoT identity bootstrapping.

BACKGROUND

IoT devices from regular consumer scenarios, like smart-home, are not equipped with a digital identity of a network access server (“NAS”). Before being permitted access to the user network, the IoT device can be imprinted with a digital identity (e.g. cryptographic keys). This scenario raises a security issue, because the IoT device must authorize the user before accepting a new digital identity and the user must attest the validity of the IoT device before allowing access into the local network.

BRIEF SUMMARY

A method for cloud assisted authorization of IoT identity bootstrapping is disclosed. An alternate method and computer program product also perform the functions of the apparatus. The method for cloud assisted authorization of IoT identity bootstrapping includes receiving from a device, at a NAS of a user and in response to an attestation request sent from the NAS to the device, a vendor network address of a vendor server of a vendor and a device identifier for the device. The device is capable of connection to a computer network accessible by the NAS. The method includes authenticating the vendor using the vendor network address and, in response to authenticating the vendor, sending the device identifier to the vendor server. The method includes communicating device attestation packets between the vendor server and the device. Contents of a payload of the device attestation packets are inaccessible to the NAS and the device attestation packets validate the device to the vendor server. The method includes receiving device attestation from the vendor server. The device attestation indicating validity status of the device to the NAS. The method includes, in response to the device attestation indicating validity of the device, transmitting a new device identity to the device.

Another method for cloud assisted authorization of IoT identity bootstrapping includes maintaining a device in a locked state. The device is connected to a NAS of a user and the locked state prevents acceptance of a new device identity from the NAS prior to verifying authorization of the user. The method includes receiving a new device identity from the NAS and, in response to receiving the new device identity from the NAS, transmitting to the NAS a vendor network address of a vendor server of a vendor and a device identifier of the device. The method includes communicating user authorization packets with the vendor server through the NAS where contents of a payload of the user authorization packets are inaccessible to the NAS and, in response to receiving from the vendor server an indication of user authorization, transmitting a notification to the NAS that the device has accepted the new device identity and proceeding with a network identity bootstrap process with the NAS.

A program product for cloud assisted authorization of IoT identity bootstrapping includes a computer readable storage medium with program code. The program code is configured to be executable by a processor to perform operations that include receiving from a device, at a NAS of a user and in response to an attestation request sent from the NAS to the device, a vendor network address of a vendor server of a vendor and a device identifier for the device. The device is capable of connection to a computer network accessible by the NAS. The program code is also configured to perform operations that include authenticating the vendor using the vendor network address and, in response to authenticating the vendor, sending the device identifier to the vendor server. The program code is also configured to perform operations that include communicating device attestation packets between the vendor server and the device. Contents of a payload of the device attestation packets are inaccessible to the NAS and the device attestation packets validate the device to the vendor server. The program code is also configured to perform operations that include receiving device attestation from the vendor server, where the device attestation indicates validity status of the device to the NAS and, in response to the device attestation indicating validity of the device, transmitting a new device identity to the device.

