# US 12,010,105 B2 · Control method, apparatus, and system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,105 B2 - Document ID: US12010105B2 - Status: Granted - Kind: B2 - Application number: 17/684,820 - Filed: 2022-03-02 - Published: 2022-08-25 - Granted: 2024-06-11 - Earliest claimed: 2019-11-13 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: Lu Gan; Xiaoshuang Ma; Jianhao Huang; Chao He - Web page: https://patentgrep.com/patent/US12010105B2 ## CPC - H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)} - G06F 21/33: using certificates - G06F 21/44: Program or device authentication - G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine - H04L 9/0844: {with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys} - H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)} - H04L 63/0407: {wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00)} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)} - H04L 67/125: involving control of end-device applications over a network - H04L 2463/062: applying encryption of the keys - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A first device and a home hub have a same TEE platform, and a second device and the home hub have different TEE platforms. A control method includes the home hub receiving an identity credential of the second device and public key information of the first device from the second device. The home hub controls an IoT device based on the identity credential of the second device. The home hub receives private key information that is of the first device and that is from the first device. The home hub forms an identity credential of the first device based on the public key information of the first device and the private key information of the first device to control the IoT device. ## Claims ### Claim 1 A control method implemented by a home hub having a first trusted execution environment (TEE) platform, the control method comprising: receiving, from a second device that has a second TEE platform, a first identity credential of the second device and first public key information of a second identity credential of a first device having the first TEE platform, wherein the first identity credential comprises second public key information of the second device and first private key information of the second device; controlling at least one internet of things (IoT) device based on the first identity credential; receiving, from the first device, second private key information of the second identity credential; and controlling the at least one IoT device based on the second identity credential, wherein the second identity credential comprises the first public key information and the second private key information. ### Claim 2 (depends on 1) The control method of claim 1, wherein before receiving the first identity credential and the second public key information, the control method further comprises: receiving a PAKE protocol negotiation from the second device; and establishing a secure encrypted channel with the second device, and wherein the first identity credential and the first public key information that are received from the second device are encrypted. ### Claim 3 (depends on 2) The control method of claim 2, further comprising: decrypting the first identity credential to generate a decrypted first identity credential; decrypting the first public key information to generate decrypted first public key information; and storing, in a secure storage in the home hub, the decrypted first identity credential and the decrypted first public key information. ### Claim 4 (depends on 1) The control method of claim 1, wherein before receiving the second private key information, the control method further comprises: receiving an STS protocol negotiation from the first device; attempting to verify an identity of the first device using the first public key information; and establishing, when the home hub verifies the identity of the first device, a secure encrypted channel with the first device, wherein the second private key information that is received from the first device is encrypted, and wherein the second private key information is received via the secure encrypted channel. ### Claim 5 (depends on 4) The control method of claim 4, further comprising: decrypting the second private key information to generate decrypted second private key information; and storing the decrypted second private key information in a secure storage in the home hub. ### Claim 6 A home hub, comprising: memory configured to store one or more programs; and a processor coupled to the memory and configured to execute the one or more programs to cause the home hub to: receive, from a second device, a first identity credential of the second device and first public key information of a second identity credential of a first device, wherein the first identity credential comprises second public key information of the second device and first private key information of the second device; control at least one internet of things (IoT) device based on the first identity credential; receive, from the first device, second private key information of the second identity credential; and control the at least one IoT device based on the second identity credential, wherein the second identity credential comprises the first public key information and the second private key information. ### Claim 7 (depends on 6) The home hub of claim 6, wherein the first identity credential and the first public key information that are received from the second device are encrypted, and wherein when executed by the processor, the one or more programs further cause the home hub to: receive a PAKE protocol negotiation from the second device; and establish a secure encrypted channel with the second device; and receive, via the secure encrypted channel, the first identity credential and the first public key information. ### Claim 8 (depends on 7) The home hub of claim 7, wherein when executed by the processor, the one or more programs further cause the home hub to: decrypt the first identity credential to generate a decrypted first identity credential; decrypt the first public key information to generate decrypted first public key information; and store, in a secure storage in the home hub, the decrypted first identity credential and the decrypted first public key information. ### Claim 9 (depends on 6) The home hub of claim 6, wherein the second private key information that is received from the first device is encrypted, and wherein when executed by the processor, the one or more programs further cause the home hub to: receive an STS protocol negotiation from the first device; attempt to verify an identity of the first device using the first public key information; establish a secure encrypted channel with the first device when the home hub verifies the identity of the first device; and receive the second private key information via the secure encrypted channel. ### Claim 10 (depends on 9) The home hub of claim 9, wherein when executed by the processor, the one or more programs further cause the home hub to: decrypt the second private key information to generate decrypted second private key information; and store the decrypted second private key information in a secure storage in the home hub. ### Claim 11 (depends on 6) The home hub of claim 6, wherein the home hub has a first trusted execution environment (TEE) platform, and wherein the first device has the first TEE platform. ### Claim 12 (depends on 11) The home hub of claim 11, wherein the second device has a second TEE platform. ### Claim 13 A control system, comprising: at least one internet of things (IoT) device; a home hub having a first trusted execution environment (TEE) platform and configured to: receive, from a second device having a second TEE platform, a secure channel establishment protocol when the second device logs into an IoT application program for a first time, wherein the IoT application program is for controlling the home hub and the at least one IoT device; establish, according to the secure channel establishment protocol, a secure channel with the second device; receive, via the secure channel and from the second device, a first identity credential of the second device and first public key information of a second identity credential of the first device; and control the at least one IoT device based on the first identity credential; and a first device having the first TEE platform and configured to log in to the IoT application program, wherein the home hub is further configured to: attempt to verify an identity of the first device based on the first public key information when the first device logs in to the IoT application program; receive, from the first device and after verifying the identity, private key information of the second identity credential of the first device; and control the at least one IoT device based on the second identity credential, wherein the second identity credential comprises the first public key information and the private key information. ### Claim 14 (depends on 11) The control system of claim 11, wherein the home hub is further configured to: receive a control instruction from the first device; and control, responsive to receiving the control instruction, the at least one IoT device based on the second identity credential and further according to the control instruction. ### Claim 15 (depends on 11) The control system of claim 11, wherein the home hub is further configured to: receive a control instruction from the second device; and control, responsive to receiving the control instruction, the at least one IoT device based on the first identity credential and further according to the control instruction. ### Claim 16 (depends on 11) The control system of claim 11, wherein the secure channel establishment protocol comprises a PAKE protocol. ### Claim 17 (depends on 11) The control system of claim 11, wherein the secure channel establishment protocol comprises an STS protocol. ### Claim 18 (depends on 11) The control system of claim 11, wherein the first identity credential that is received from the second device is encrypted. ### Claim 19 (depends on 18) The control system of claim 18, wherein the first public key information that is received from the second device is encrypted. ### Claim 20 (depends on 19) The control system of claim 19, wherein the home hub is further configured to decrypt the first identity credential and the first public key information.