Communicating with a machine to machine device

• US 10,313,307 B2
• Filed: 09/12/2014
• Issued: 06/04/2019
• Est. Priority Date: 09/13/2013
• Status: Active Grant

• Current Assignee: DABCO Ltd. (Vodafone Group PLC)
• Original Assignee: Vodafone IP Licensing Limited (Vodafone Group PLC)
• Inventors: Bone, Nick
• Primary Examiner(s): Hoffman, Brandon S
• Assistant Examiner(s): Woldemariam, Nega
• Application Number:
  US15/021,879
• Publication Number:
  US 20160234255A1
• Time in Patent Office: 1,726 Days
• Field of Search: 726 3
• CPC Class Codes: G06F 13/1689 Synchronisation and timing concerns synchronisation on a memory bus G06F13/4234
• CPC Class Codes: G06F 13/28 using burst mode transfer, e.g. direct memory access DMA, cycle steal G06F13/32 takes precedence
• CPC Class Codes: G06F 13/4027 using bus bridges G06F13/4022 takes precedence
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/166 : at the transport layer
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 : Protocols
• CPC Class Codes: H04L 67/1095 : Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/125 : involving control of end-device applications over a network
• CPC Class Codes: H04L 9/0861 : Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/04 : Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 : Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 4/12 : Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 4/14 : Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 52/0229 : where the received signal is a wanted signal
• CPC Class Codes: H04W 8/04 : Registration at HLR or HSS [Home Subscriber Server]
• CPC Class Codes: H04W 80/06 : Transport layer protocols, e.g. TCP [Transport Control Protocol] over wireless transmission control protocol/Internet protocol [TCP/IP] or user datagram protocol [UDP] H04L69/16
• CPC Class Codes: H04W 88/02 : Terminal devices
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: Y02D 10/00 : Energy efficient computing, e.g. low power processors, power management or thermal management
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

The present disclosure provides methods and apparatus for administering an interface between a machine-to-machine, M2M, device and a network application function, NAF, for secure communication between the M2M device and the NAF. In one method, the M2M device comprises security information for enabling secure communication via the interface, and administers the interface by: setting a secure interface lifetime parameter based on a lifetime of at least part of the security information; and transmitting administration data to the NAF, wherein the administration data comprises the secure interface lifetime parameter.

Claims

1. A method for a machine-to-machine (M2M) device to administer an interface between the M2M device and a network application function (NAF) for secure communication between the M2M device and the NAF, wherein the M2M device comprises security information as a key for enabling secure communication via the interface, the method comprising the steps of initiating, before expiry of a lifetime of at least part of the security information and on wake up from a sleep cycle:

setting a secure interface lifetime parameter based on a lifetime of the at least part of the security information;

transmitting administration data to the NAF, wherein the administration data comprises the secure interface lifetime parameter;

after determining that a registration of the interface is about to expire, pre-emptively initiating a new bootstrapping process to obtain new security information, the initiating being pre-emptive as a result of obtaining the new security information prior to expiration of the registration; and

using the new security information to either update the registration or, alternatively, to carry out a new registration.

2. The method of claim 1, wherein the secure interface lifetime parameter is set to a value greater than or equal to the lifetime of the at least part of the security information.

3. The method of claim 1, wherein the secure interface lifetime parameter is set to a value greater than the lifetime of the at least part of the security information.

4. The method of claim 1, wherein the secure interface lifetime parameter is set to a value greater than the lifetime of the at least part of the security information by a first amount.

5. The method of claim 1, wherein the secure interface lifetime parameter is set to a value less than or equal to the lifetime of the at least part of the security information.

6. The method of claim 1, wherein the secure interface lifetime parameter is set to a value less than or equal to the lifetime of the at least part of the security information.

7. The method of claim 1, wherein the secure interface lifetime parameter is set to a value less than the lifetime of the at least part of the security information by a second amount.

8. The method of claim 1, further comprising the steps of:

checking the remaining lifetime of the at least part of the security information; and

if the remaining lifetime of the at least part of the security information is less than a security information lifetime threshold, requesting new security information from a bootstrapping server.

9. The method of claim 8, further comprising the step of:

if the request for new security information fails, repeating the request for new security information after a period of time.

10. The method of claim 8, wherein the step of checking the remaining lifetime of the security information is carried out before a secure communication transmission from the M2M device to the NAF via the interface.

11. A method for a network application function (NAF) to administer an interface between the NAF and a machine-to-machine (M2M), device, wherein the M2M device comprises security information as a key for enabling secure communication via the interface, the method comprising the steps of:

receiving, before expiry of a lifetime of at least part of the security information and on wake up from a sleep cycle, administration data from the M2M device, the registration data comprising a secure interface lifetime parameter that has been set based on a lifetime of the at least part of the security information;

transmitting an administration response to the M2M device;

after determining that a registration of the interface is about to expire, pre-emptively initiating a new bootstrapping process to obtain new security information, the initiating being pre-emptive as a result of obtaining the new security information prior to expiration of the registration; and

using the new security information to either update the registration or, alternatively, to carry out a new registration.

12. The method of claim 11, wherein the administration data comprises the at least part of the security information, the method further comprising:

checking the lifetime of the at least part of the security information; and

comparing the secure interface lifetime parameter with the lifetime of the at least part of the security information;

wherein if the comparison does not meet a comparison condition, the administration response is set to indicate an error in the administration data.

13. The method of claim 12, wherein the comparison condition is that the secure interface lifetime parameter is greater than or equal to the lifetime of the at least part of the security information.

14. The method of claim 12, wherein the comparison condition is that the secure interface lifetime parameter is greater than the lifetime of the at least part of the security information.

15. The method of claim 12, wherein the comparison condition is that the secure interface lifetime parameter is greater than the lifetime of the at least part of the security information by a first amount.

16. The method of claim 12, wherein the comparison condition is that the secure interface lifetime parameter is less than or equal to the lifetime of the at least part of the security information.

17. The method of claim 12, wherein the comparison condition is that the secure interface lifetime parameter is less than the lifetime of the at least part of the security information.

18. The method of claim 12, wherein the comparison condition is that the secure interface lifetime parameter is less than the lifetime of the at least part of the security information by a second amount.

19. The method of claim 11, further comprising a step of:

obtaining the lifetime of the at least part of the security information.

20. The method of claim 11, wherein:

the administration data further comprises a name for the M2M device; and

wherein the name for the M2M device is equal to, or derived at least in part from, or

otherwise linked to, at least part of data that are shared between the M2M device and the bootstrapping server.