CROSS REFERENCE TO RELATED APPLICATIONS

This application claims priority under 35 U.S.C. § 371 to International Patent Application No. PCT/US15/23340, “Zero-Touch Onboarding in a Mesh Network,” by David Sheldon Stephenson, filed on Mar. 30, 2015, the contents of which are herein incorporated by reference.

BACKGROUND

Field

The described embodiments relate to techniques for establishing communication between electronic devices. In particular, the described embodiments relate to techniques for determining the location of a controller in a network and receiving security information to establish connectivity between electronic devices.

Related Art

Many electronic devices are capable of wirelessly communicating with other electronic devices. For example, these electronic devices can include a networking subsystem that implements a network interface for: a cellular network (UMTS, LTE, etc.), a wireless local area network (e.g., a wireless network such as described in the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standard or Bluetooth from the Bluetooth Special Interest Group of Kirkland, Wash.), and/or another type of wireless network.

One approach to wireless communication is to use a wireless mesh network (which is henceforth referred to as a ‘mesh network’). In a mesh network, multiple electronic devices (which are sometimes referred to as ‘nodes’) are organized in a mesh topology in which electronic devices wirelessly communicate with each other or to the Internet via zero or more intermediate electronic devices or nodes.

However, it can be difficult to establish a mesh network. In particular, in order for electronic devices to establish a mesh network they typically need to have mesh-network information, such as a mesh-network identifier (such as a mesh-network service set identifier or a mesh-network SSID) and credentials for the mesh network (such as a mesh-network encryption key and/or a mesh-network password). Usually, the mesh-network information is manually installed by an operator on the electronic device before it joins the mesh network. Moreover, the manual installation typically involves the operator establishing a wired connection between the electronic device and the controller. Consequently, this manual approach to provisioning or priming the electronic device is often cumbersome and time-consuming.

SUMMARY

The described embodiments relate to an electronic device that receives security information. This electronic device includes an antenna and an interface circuit, coupled to the antenna, that communicates with other electronic devices. During operation, the electronic device discovers, via wireless communication, the other electronic device. Then, the electronic device provides, to a registrar device at a predefined location in a network, a request for location information of a controller for the electronic device, where the request includes a manufacturer certificate that confirms an identity of the electronic device, and the communication with the registrar device may occur via the other electronic device using the wireless communication without an authenticated session between the electronic device and the other electronic device. Moreover, the electronic device receives, from the registrar device, the location information and a registrar certificate that confirms an identity of the registrar device, and the electronic device validates the registrar certificate. Furthermore, the electronic device provides, to the controller via the other electronic device, a request for security information to establish connectivity with another electronic device. Next, the electronic device receives, from the controller via the other electronic device, the security information and a controller certificate that confirms an identity of the controller, and the electronic device validates the controller certificate.

Additionally, the electronic device may establish a connection with the other electronic device based on the security information. The security information may facilitate secure communication between the electronic device and the other electronic device.

Note that the electronic device may exclude the security information prior to requesting the security information. Moreover, note that the electronic device may be a headless electronic device without a user interface.

In some embodiments, the electronic device provides the request for the location information a first time that the electronic device is connected to the network.

Moreover, the security information may include provisioning information for a mesh network. For example, the provisioning information may include a mesh-network service set identifier (SSID), a mesh-network encryption key and/or a mesh-network password.

Furthermore, the electronic device may establish the mesh network with a third electronic device by: broadcasting the mesh-network SSID; receiving, from the third electronic device, the manufacturer certificate; validating the manufacturer certificate received from the third electronic device; and providing, to the third electronic device, the provisioning information.

Note that the wireless communication may be compatible with IEEE 802.11 public action frames (such as a generic advertising service in an IEEE802.11u communication protocol). Thus, the communication with the other electronic device and the registrar device may occur without the electronic device having an Internet Protocol (IP) address.

In some embodiments, prior to providing the request for the security information, the electronic device receives, from the other electronic device, the mesh-network information for the mesh network that includes the other electronic device, where the mesh-network information includes the mesh-network SSID, the mesh-network encryption key and/or the mesh-network password. Then, the electronic device joins the mesh network using the mesh-network information, where the security information includes additional provisioning information for the mesh network.

Note that the other electronic device may be an access point in the mesh network.

Additionally, after discovering the other electronic device, the electronic device may: request an encryption key and a manufacturer certificate of the other electronic device; and validate the manufacturer certificate of the other electronic device. Subsequent wireless communication from the electronic device to the other electronic device may be encrypted using the encryption key of the other electronic device. Similarly, after discovering the other electronic device, the electronic device may provide an encryption key of the electronic device to the other electronic device, and subsequent wireless communication from the other electronic device to the electronic device may be encrypted using the encryption key of the electronic device.

In some embodiments, the electronic device includes: a processor; and a memory, coupled to the processor, which stores a program module that is executed by the processor. This program module may include instructions for at least some of the operations performed by the electronic device (i.e., at least some of the operations performed by the electronic device may be performed using software).

Another embodiment provides a computer-program product for use with the electronic device. This computer-program product includes instructions for at least some of the operations performed by the electronic device.

Another embodiment provides a method. This method includes at least some of the operations performed by the electronic device.

This Summary is provided merely for purposes of illustrating some exemplary embodiments, so as to provide a basic understanding of some aspects of the subject matter described herein. Accordingly, it will be appreciated that the above-described features are merely examples and should not be construed to narrow the scope or spirit of the subject matter described herein in any way. Other features, aspects, and advantages of the subject matter described herein will become apparent from the following Detailed Description, Figures, and Claims.

