Associating an agent device associated with a first application providing apparatus with a second application providing apparatus

• US 10,027,646 B2
• Filed: 03/04/2016
• Issued: 07/17/2018
• Est. Priority Date: 10/17/2013
• Status: Active Grant

• Current Assignee: Arm IP Limited (SoftBank Group Corp.)
• Original Assignee: Arm IP Limited (SoftBank Group Corp.)
• Inventors: Curtis, William Allen, Anson, Douglas Miles, Balanza, Kerry S
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): Stoica, Adrian
• Application Number:
  US15/060,639
• Publication Number:
  US 20160191489A1
• Time in Patent Office: 865 Days
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

An agent device is registered in a first device registry maintained by a first registry apparatus for authenticating agent devices for communicating with application providing apparatuses. The agent device can be assigned to a second device registry maintained by second registry apparatus. The method of assignment comprises the first registry apparatus receiving from a requestor device a device assignment request. In response to the device assignment request, the first registry apparatus checks whether the agent device is allowed to be assigned to the second device registry, and if so, the agent device transmits second authentication information for authenticating the identity of the agent device to the second registry apparatus which registers this in the second device registry.

Claims

1. A method of associating an agent device associated with a first application providing apparatus with a second application providing apparatus, the agent device and the first application providing apparatus being registered with a first device registry, each of the first application providing apparatus and the second application providing apparatus including a device configured to perform one or more of the following:

provide a cloud service, execute an application program using data gathered from one or more agent devices, and issue commands for controlling one or more agent devices, the method comprising;

receiving at the first device registry an application association request requesting that the agent device is associated with the second application providing apparatus in a second device registry;

in response to the application association request, checking whether the agent device is allowed to be associated with the second application providing apparatus;

responsive to the agent device being allowed to be associated with the second application providing apparatus, instructing the agent device to generate new authentication information for use by the second device registry to authenticate the identity of the agent device, and to transmit from the agent device to the second device registry the new authentication information so as to

register the new authentication information for the agent device in the second device registry to enable authenticated communication between the agent device and the second application providing apparatus such that the agent device is associated with the second application providing apparatus.

2. The method as claimed in claim 1, wherein the second device registry facilitates the authenticated communication between the agent device and the second application providing apparatus, such that after that facilitation, the agent device and the second application apparatus are capable of the authenticated communication with each other without communication via the first and second device registries.

3. The method as claimed in claim 1, further comprising deleting authentication information for authenticating the identity of the agent device from the first device registry such that the agent device can no longer be authenticated by the first device registry.

4. The method as claimed in claim 1, wherein the checking whether the agent device is allowed to be associated with the second application providing apparatus comprises checking if the first device registry is permitted to release its registration of the agent device.

5. The method as claimed in claim 1, wherein the checking whether the agent device is allowed to be associated with the second application providing apparatus comprises checking whether the agent device is permitted to be associated with both the first application providing apparatus and the second application providing apparatus at the same time.

6. The method as claimed in claim 1, wherein the checking whether the agent device is allowed to be associated with the second application providing apparatus comprises checking whether the agent device is permitted to be registered with both the first device registry and the second device registry at the same time.

7. The method according to claim 1, wherein the checking whether the agent device is allowed to be associated with the second application providing apparatus comprises authenticating the source of the application association request.

8. The method according to claim 1, wherein the checking whether the agent device is allowed to be assigned to the second device registry comprises checking that the source of the application association request to the first registry apparatus is a trusted device that has been authenticated by the first registry device.

9. The method as claimed in claim 1, wherein responsive to the agent device being allowed to be associated with the second application providing apparatus, the first device registry instructs the agent device that it is to be assigned to the second device registry, and responsive to the first device registry instructing the agent device that it is to be assigned to the second device registry, the agent device generates the new authentication information.

10. The method as claimed in claim 1, wherein responsive to the agent device being allowed to be associated with the second application providing apparatus, the first device registry informs the requestor of the application association request that the agent device is to be assigned to the second device registry, and responsive to the first device registry informing the requestor of the application association request that the agent device is to be assigned to the second device registry, the requestor of the application association request instructs the agent device to generate the new authentication information.

11. The method as claimed in claim 1, wherein responsive to the agent device being allowed to be associated with the second application providing apparatus, the first device registry informs the second device registry that the agent device is to be assigned to the second device registry, and responsive to the first device registry informing the second device registry that the agent device is to be assigned to the second device registry, the second device registry instructs the agent device to generate the new authentication information.

12. A registry apparatus comprising:

storage circuitry to store a first device registry of agent devices associated with a first application providing apparatus, the first device registry comprising authentication information for authenticating the identity of the agent devices for the first application providing apparatus;

communication circuitry to receive from a requestor device, an application association request requesting that at least one of the agent devices is associated with a second application providing apparatus,

wherein each of the first application providing apparatus and the second application providing apparatus includes a device configured to perform one or more of the following;

provide a cloud service, execute an application program using data gathered from one or more agent devices, and issue commands for controlling one or more agent devices; and

processing circuitry to check whether the at least one agent device is allowed to be associated with the second application providing apparatus in response to the application association request,

wherein responsive to the at least one agent device being allowed to be associated with the second application providing apparatus, the processing circuitry is configured to control the communication circuitry to instruct the at least one agent device to generate new authentication information for use by a second device registry to authenticate the identity of the at least one agent device, such that the at least one agent device can be associated with the second application providing apparatus in the second device registry by transmitting the new authentication information generated by the at least one agent device to the second device registry and by enabling the new authentication information for the at least one agent device to be registered in the second device registry, enabling authenticated communication between the at least one agent device and the second application providing apparatus.

13. The registry apparatus of claim 12, wherein responsive to the at least one agent device being allowed to be associated with the second application providing apparatus, the processing circuitry is further configured to delete authentication information from the storage circuitry for the at least one agent device in the first device registry such that the at least one agent device can no longer be authenticated by the first device registry.

14. The registry apparatus of claim 12, wherein the processing circuitry is further configured to check whether the first device registry is permitted to release its registration of the at least one agent device to permit the allowance to be associated with the second application providing apparatus.

15. The registry apparatus of claim 12, wherein the processing circuitry is further configured to check whether the at least one agent device is permitted to be associated with both the first device registry and the second device registry at the same time to allow the at least one agent device to be further associated with the second application providing apparatus.

16. The registry apparatus of claim 12, wherein the processing circuitry is further configured to authenticate the requestor device to check whether the at least one agent device is permitted to be associated with the second application providing apparatus.

17. The registry apparatus of claim 12, wherein the processing circuitry is further configured to check that the source of the application association request is a trusted device that has been authenticated by the first device registry to permit the at least one agent device to be associated with the second application providing apparatus.

18. The register apparatus of claim 12, wherein the processing circuitry is further configured to check that the at least one agent device supports assignment to the second device registry to permit the at least one agent device to be associated with the second application providing apparatus.

19. A method for assigning an agent device registered with a first device registry and capable of authenticated communication with an associated first application providing apparatus registered with the first device registry, to a second application providing apparatus registered with a second device registry, each of the first application providing apparatus and the second application providing apparatus including a device configured to perform one or more of the following:

provide a cloud service, execute an application program using data gathered from one or more agent devices, and issue commands for controlling one or more agent devices, the method comprising;

receiving, at the second device registry, an indication that the agent device registered with the first device registry is to be associated with the second application providing apparatus in the second device registry;

in response to receiving the indication that the agent device is to be associated with the second application providing apparatus, instructing the agent device to generate new authentication information for use by the second device registry to authenticate the identity of the agent device;

receiving, at the second device registry, the new authentication information for authenticating the identity of the agent device; and

registering the new authentication information for the agent device in the second device registry to enable authenticated communication between the agent device and the second application providing apparatus such that the agent device is associated with the second application providing apparatus in the second device registry.

20. A registry apparatus comprising:

communication circuitry to receive from a first device registry an indication that an agent device registered with the first device registry and capable of authenticated communication with a first application providing apparatus, is to be associated with a second application providing apparatus in a second device registry,

wherein each of the first application providing apparatus and the second application providing apparatus includes a device configured to perform one or more of the following;

provide a cloud service, execute an application program using data gathered from one or more agent devices, and issue commands for controlling one or more agent devices;

storage circuitry to store the second device registry; and

processing circuitry to control the communication circuitry to instruct the agent device to generate new authentication information for use by the second device registry to authenticate the identity of the agent device, responsive to receiving the indication that the agent device is to be associated with the second application providing apparatus, to control the communication circuitry to receive from the agent device the new authentication information, and to register the new authentication information in the second device registry to enable authenticated communication between the agent device and the second application providing apparatus such that the agent device is associated with the second application providing apparatus in the second device registry.