# US 2017/0257318 A1 · Systems and methods for smart device networking

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2017/0257318 A1
- Document ID: US20170257318A1
- Status: Published application
- Kind: A1
- Application number: 15/598,039
- Filed: 2017-05-17
- Published: 2017-09-07
- Earliest claimed: 2014-10-21
- Assignees: Helium Systems, Inc.
- Applicants: Helium Systems, Inc.
- Inventors: Amir Haleem; Andrew Thompson; Eric Gnoske; Blake Leverett; Mike Vidales; Sean Carey; Theo Wilson
- Web page: https://patentgrep.com/patent/US20170257318A1

## CPC

- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04L 12/4625: {Single bridge functionality, e.g. connection of two networks over a single bridge}
- H04L 45/7453: using hashing
- H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC]
- H04W 4/80: Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 67/1001: for accessing one among a plurality of replicated servers
- H04L 2101/622: Layer-2 addresses, e.g. medium access control [MAC] addresses
- H04L 2212/00: Encapsulation of packets
- H04W 4/02: Services making use of location information
- H04W 40/20: based on geographic position or location
- H04W 84/12: WLAN [Wireless Local Area Networks]
- H04W 88/06: adapted for operation in multiple networks {or having at least two operational modes}, e.g. multi-mode terminals
- Y02D 30/70: in wireless communication networks
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- Y02D: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE

## Abstract

A system for smart device networking includes an endpoint that enables communication with a connected device, a bridge that communicates with the endpoint over a PAN and relays PAN communications to a WAN, and a router that connects to the bridge through the WAN and routes communication to and from the endpoint.

## Claims

### Claim 1

A system for smart device networking comprising:
an endpoint operable to enable communication with a connected device and to encrypt a frame based on a cryptographic key and a MAC address of the endpoint, wherein the endpoint comprises:
a hardware encryption module storing the cryptographic key; and
a first multi-band radio operable to transmit the frame;
a bridge comprising:
a second multi-band radio operable to receive the frame from the first multi-band radio on a broadcast spectrum of a set of broadcast spectra;
a wide area network (WAN) communications module operable to communicatively couple to a WAN;
a server system remote from the endpoint and connected to the bridge through the WAN, wherein the server system is operable to:
receive the frame through the WAN;
extract the MAC address of the endpoint from the frame;
identify the cryptographic key based on the MAC address of the endpoint; and
decrypt the frame based on the cryptographic key.

### Claim 2 (depends on 1)

The system of claim 1, wherein the server system comprises:
a key server operable to:
store the cryptographic key in association with the MAC address of the endpoint; and
generate a first session key based on the cryptographic key and the MAC address of the endpoint; and
a first router operable to:
store the first session key received from the key server; and
decrypt first communications from the endpoint using the first session key.

### Claim 3 (depends on 2)

The system of claim 2, wherein the frame comprises a join request,
wherein the endpoint is operable to:
generate a join key based on the MAC address and the cryptographic key;
encrypt the frame using the join key;
wherein the server system is operable to:
generate the join key based on the MAC address and the cryptographic key in response to receiving the join request; and
verify the join request using the join key.

### Claim 4 (depends on 3)

The system of claim 3,
wherein the key server is operable to transmit the join key to the first router in response to generating the join key; and
wherein the first router is operable to, in response to decrypting the frame using the join key:
store the first session key;
transmit, to the endpoint, a join response frame encrypted with the first session key;
wherein the endpoint is operable to generate and store the first session key based on the join response frame.

### Claim 5 (depends on 2)

The system of claim 2, wherein the server system is operable to:
generate a second session key based on the cryptographic key and the MAC address after a predetermined period of time from generation of the first session key;
control the endpoint to delete the first session key stored at the endpoint; and
decrypt second communications, received from the endpoint after the predetermined period of time, using the second session key.

### Claim 6 (depends on 5)

The system of claim 5, wherein the server system comprises a set of routers comprising the first router and a second router, wherein the server system is operable to:
generate a third session key based on the cryptographic key and the MAC address in response to enabling communication between the endpoint and the second router; and
decrypt third communications from the endpoint using the third session key.

### Claim 7 (depends on 1)

The system of claim 1,
wherein the endpoint is operable to:
combine the MAC address of the endpoint and a nonce to create a MAC+nonce value; and
encrypt the frame based on the cryptographic key and the MAC+nonce value; and
wherein the server system is operable to decrypt the frame based on the cryptographic key and the MAC+nonce value.

### Claim 7 (depends on 7)

system of claim 7,
wherein the endpoint is operable to:
combine the MAC+nonce value with the cryptographic key to create a MAC+nonce+key value;
generate a session key from the MAC+nonce+key value; and
encrypt a payload of the frame using the session key without encrypting a header of the frame;
wherein the server system is operable to:
extract the MAC address from the header of the frame.

### Claim 8 (depends on 7)

The system of claim 7,
wherein the endpoint is operable to:
truncate a first set of time bits of the nonce to create a truncated nonce; and
insert the truncated nonce into a header of the frame; and
wherein the server system is operable to:
decrypt the frame based on the truncated nonce.

### Claim 9 (depends on 8)

The system of claim 8, wherein the server system is operable to:
recover the nonce from the truncated nonce by adding a second set of time bits retrieved from a system time of the server system; and
decrypt the frame based on the cryptographic key and the recovered nonce.

### Claim 10 (depends on 9)

The system of claim 9, wherein the first set of time bits is associated with a first time period, wherein the second set of time bits is associated with a second time period, and wherein the server system is operable to recover the nonce in response to the first time period being within a predetermined threshold of the second time period.

### Claim 12 (depends on 1)

The system of claim 1, further comprising a set of endpoints comprising the endpoint and operable to communicate with the bridge, wherein each endpoint of the set of endpoints stores a unique cryptographic key and corresponds to a globally unique MAC address, and wherein the server system stores, for each endpoint of the set of endpoints, the corresponding globally unique MAC address in association with the unique cryptographic key stored by the endpoint.

### Claim 13 (depends on 1)

The system of claim 1, wherein the server system is operable to:
authenticate the endpoint based on the frame and the cryptographic key; and
disable operation of the endpoint in response to failed authentication of the endpoint.

### Claim 14

A system for smart device networking comprising:
a first endpoint operable to enable communication with a connected device and to encrypt a first frame based on a first cryptographic key and a nonce, the first endpoint comprising:
a hardware encryption module storing the first cryptographic key; and
a first multi-band radio operable to transmit the first frame;
a bridge comprising:
a second multi-band radio operable to receive the first frame from the first multi-band radio on a broadcast spectrum of a set of broadcast spectra;
a WAN communications module operable to communicatively couple to a WAN;
a server system connected to the bridge through the WAN, wherein the server system is operable to:
store a second cryptographic key associated with the first endpoint;
receive the first frame through the WAN; and
decrypt the first frame based on the second cryptographic key and the nonce.

### Claim 15 (depends on 14)

The system of claim 14, wherein the first cryptographic key is a non-secret key, and wherein the second cryptographic key is a secret key.

### Claim 16 (depends on 15)

The system of claim 15, wherein the system comprises a set of endpoints comprising the first endpoint, wherein each endpoint of the set of endpoints is operable to encrypt corresponding frames with the non-secret key, and wherein the server system is operable to decrypt the corresponding frames with the non-secret key.

### Claim 17 (depends on 16)

The system of claim 16,
wherein the first endpoint is associated with a first user,
wherein the set of endpoints comprises a second endpoint associated with a second user and operable to:
encrypt a second frame; and
transmit the second frame to the bridge; and
wherein the bridge is operable to route the encrypted first frame and the encrypted second frame to the server system.

### Claim 18 (depends on 14)

The system of claim 14, wherein the first endpoint is operable to encrypt the first frame based on the first cryptographic key, the nonce, and a MAC address of the first endpoint, and wherein the server system is operable to decrypt the first frame based on the second cryptographic key, the nonce, and the MAC address of the first endpoint.

### Claim 19 (depends on 18)

The system of claim 18, wherein the system comprises a set of endpoints comprising the first endpoint and associated with a set of globally unique MAC addresses, wherein the server system is operable to:
store the set of globally unique MAC addresses;
generate a third cryptographic key;
generate a fourth cryptographic key based on and complementary to the third cryptographic key; and
distribute the fourth cryptographic key to the set of endpoints based on the set of globally unique MAC addresses.

### Claim 20 (depends on 14)

The system of claim 14,
wherein the first endpoint is operable to:
truncate a first set of time bits of the nonce to create a truncated nonce; and
insert the truncated nonce into the first frame; and
wherein the server system is operable to:
recover the nonce from the truncated nonce by adding a second set of time bits retrieved from a system time of the server system; and
decrypt the first frame based on the second cryptographic key and the recovered nonce.