Authentication of Internet of Things devices, including electronic locks

A method of authenticating data communication between an electronic lock and a server comprising:

• generating, at the electronic lock, a lock certificate based at least in part on a manufacturer root certificate of a manufacturer of the electronic lock;
• transmitting the lock certificate to the server;
• after the lock certificate is verified at the server, generating a random number challenge at the electronic lock;
• transmitting the random number challenge to the server;
• receiving a signed certificate from the server, the signed certificate being based on the lock certificate and signed with a private key associated with the server;
• verifying the signed certificate with the random number challenge and a public key associated with the server;
• signing a second random number challenge received from the server at the electronic lock;
• and
• transmitting the signed second random number challenge to the server, wherein the signed second random number challenge is verified at the server;
• wherein secured data communication between the electronic lock and the server is enabled based at least in part on successful verification of the lock certificate, the signed certificate, and the signed second random number challenge.

A method of authenticating data communication between an electronic lock and a cloud server comprising:

• receiving, at a mobile device, a lock certificate from the electronic lock, the lock certificate being based at least in part on a manufacturer root certificate of a manufacturer of the electronic lock;
• transmitting the lock certificate from the mobile device to the cloud server;
• at the mobile device, requesting a first challenge from the electronic lock to authenticate the cloud server;
• communicating, with the mobile device, the first challenge from the electronic lock to the cloud server;
• communicating, with the mobile device, a first signature result from the cloud server to the electronic lock, the first signature result being signed with a private key of the cloud server;
• at the mobile device, requesting a second challenge from the cloud server to authenticate the electronic lock;
• communicating, with the mobile device, the second challenge from the cloud server to the electronic lock;
• and
• communicating, with the mobile device, a second signature result from the electronic lock to the cloud server, the second signature result being signed with a private key of the electronic lock,
• wherein secured data communication between the electronic lock and the cloud server is enabled based at least in part on successful verification of the lock certificate, the first signature result, and the second signature result.

An electronic lock comprising:

• a latch movable between a locked position and an unlocked position;
• a motor operatively connected to the latch and configured to drive the latch between the locked position and the unlocked position;
• at least one wireless communication interface;
• and
• a programmable circuit configured to selectively actuate the motor and communicate with a server regarding a status of the electronic lock, the programmable circuit configured to perform an authentication process comprising:
• generating, at the electronic lock, a lock certificate based at least in part on a manufacturer root certificate of a manufacturer of the electronic lock;
• transmitting the lock certificate to the server;
• after the lock certificate is verified at the server, generating a random number challenge at the electronic lock;
• transmitting the random number challenge to the server via the at least one wireless communication interface;
• receiving a signed certificate from the server, the signed certificate being based on the lock certificate and signed with a private key associated with the server;
• verifying the signed certificate with the random number challenge and a public key associated with the server;
• signing a second random number challenge received from the server at the electronic lock;
• and
• transmitting the signed second random number challenge to the server, wherein the signed second random number challenge is verified at the server;
• wherein secured data communication between the electronic lock and the server is enabled based at least in part on successful verification of the lock certificate, the signed certificate, and the signed second random number challenge.