Methods, nodes and computer programs for reduction of undesired energy consumption of a server node

• US 10,063,586 B2
• Filed: 07/02/2013
• Issued: 08/28/2018
• Est. Priority Date: 07/02/2013
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Gehrmann, Christian, Selander, Goran
• Primary Examiner(s): Jamshidi, Ghodrat
• Application Number:
  US14/902,316
• Publication Number:
  US 20160142436A1
• Time in Patent Office: 1,883 Days
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/125 Protection against power exhaustion attacks

Abstract

A method, computer program and a server node (100) in a communications network (50) for reduction of undesired energy consumption of the server node (100), the method comprising: receiving a request message from a client (120), the request message containing message fields comprising at least a message ID field and an integrity indication field containing a first integrity indication, determining a relation key by performing a calculation by usage of a master key commonly known by the server node (100) and an authorization engine (110) and at least data comprised in the message ID field, calculating a second integrity indication based on a subset of the message fields by usage of the relation key, wherein the subset excludes at least one message field that is predictable by a trusted client (120), verifying the subset of the message fields by comparing the first and second integrity indications, and determining the message to be authorized when the comparison indicates equality, and wherein when the message is not authorized, suppressing reception of the message.

Claims

1. A server node in a communications network adapted to reduce undesired energy consumption of the server node, wherein the server node comprises:

a communication unit;

a memory; and

a processor coupled to the memory, the processor configured to;

receive, via the communication unit, a request message from a client, the request message containing message fields comprising at least a message ID field and an integrity indication field containing a first integrity indication;

determine a relation key by performing a calculation by usage of a master key commonly known by the server node and an authorization engine and at least data comprised in the message ID field;

calculate a second integrity indication based on a subset of the message fields by usage of the determined relation key, wherein the subset excludes at least one message field that is predictable by a trusted client;

verify the subset of the message fields by comparing the first and second integrity indications; and

determine the message to be authorized when the comparison indicates equality, and

as a result of determining that the message is not authorized, suppress reception of the message.

2. The server node according to claim 1, wherein

the message ID and the first integrity indication are located in the beginning of the message.

3. The server node according to claim 1, wherein

the subset comprises at least a dynamic message field, wherein

the content of the dynamic message field is changed for subsequent request messages.

4. The server node according to claim 1, wherein the processor is further configured to determine the relation key by a function of:

the master key, the message ID and optionally other data.

5. The server node according to claim 1, wherein:

the processor is further configured to receive, via the communication unit, a number of not authorized request messages, wherein when the number is above a predetermined threshold during a first predefined period of time, the communication with the client is suppressed.

6. The server node according to claim 1, wherein:

the processor is further configured to receive, via the communication unit, a number of not authorized request messages, wherein when the number is above another predetermined threshold during a second predefined period of time, the communication with the communications network is suppressed.

7. The server node according to claim 1, wherein

the processor is further configured to suppress the communication for a secret time period, and

the secret time period is known by the server node and the trusted clients.

8. The server node according to claim 1, wherein

a subsequent request message comprises a new message ID relative to any previous request message during an established relation.

9. The server node according to claim 1, wherein

a subsequent request message comprises an equal message ID relative to a previous request message, wherein

a new relation key is determined for each subsequent request message.

10. A computer program product comprising a non-transitory computer readable medium storing a computer readable code which, when run on a server node, causes the server node to:

receive a request message from a client by a communication unit, the request message containing message fields comprising at least a message ID field and an integrity indication field containing a first integrity indication;

determine a relation key by performing a calculation by usage of a master key commonly known by the server node and an authorization engine and at least data comprised in the message ID field;

calculate a second integrity indication based on a subset of the message fields by usage of the determined relation key, wherein the subset excludes at least one message field that is predictable by a trusted client;

verify the subset of the message fields by comparing the first and second integrity indications; and

determine the message to be authorized when the comparison indicates equality, and

wherein when the message is not authorized, suppress reception of the message.