Communicating with a machine to machine device

• US 10,439,991 B2
• Filed: 09/12/2014
• Issued: 10/08/2019
• Est. Priority Date: 09/13/2013
• Status: Active Grant

• Current Assignee: DABCO Ltd. (Vodafone Group PLC)
• Original Assignee: Vodafone IP Licensing Limited (Vodafone Group PLC)
• Inventors: Bone, Nick, Snape, Tim
• Primary Examiner(s): Mehrmanesh, Amir
• Application Number:
  US15/021,873
• Publication Number:
  US 20160234182A1
• Time in Patent Office: 1,852 Days
• CPC Class Codes: G06F 13/1689 Synchronisation and timing concerns synchronisation on a memory bus G06F13/4234
• CPC Class Codes: G06F 13/28 using burst mode transfer, e.g. direct memory access DMA, cycle steal G06F13/32 takes precedence
• CPC Class Codes: G06F 13/4027 using bus bridges G06F13/4022 takes precedence
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/166 : at the transport layer
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 : Protocols
• CPC Class Codes: H04L 67/1095 : Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/125 : involving control of end-device applications over a network
• CPC Class Codes: H04L 9/0861 : Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/04 : Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 : Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 4/12 : Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 4/14 : Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 52/0229 : where the received signal is a wanted signal
• CPC Class Codes: H04W 8/04 : Registration at HLR or HSS [Home Subscriber Server]
• CPC Class Codes: H04W 80/06 : Transport layer protocols, e.g. TCP [Transport Control Protocol] over wireless transmission control protocol/Internet protocol [TCP/IP] or user datagram protocol [UDP] H04L69/16
• CPC Class Codes: H04W 88/02 : Terminal devices
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: Y02D 10/00 : Energy efficient computing, e.g. low power processors, power management or thermal management
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

The present disclosure provides a bootstrapping server, a network application function (NAF), a system and methods for establishing secure communication between a machine to machine (M2M) device and a NAF. A method for establishing secure communication between the NAF and M2M device comprises receiving a first data object, tunneling the first data object to the M2M device, via an interface between the NAF and the M2M device, for enabling the M2M device to derive first information to establish said secure communication, receiving a second data object and deriving second information for use in establishing said secure communication with the M2M device.

Claims

1. A computing system comprising:

a network application function (NAF) for establishing secure communication between the NAF and a machine to machine (M2M) device;

at least one processor; and

a computer readable hardware storage device having stored thereon computer-executable instructions which, when executed by the at least one processor, cause the computing system to perform the following;

receive a first data object;

in response to determining that the M2M device is registered for push services, use a push message to tunnel the first data object to the M2M device via an interface between the NAF and the M2M device, the first data object enabling the M2M device to derive first information to establish said secure communication, wherein determining that the M2M device is registered for push services is performed by the M2M device sending a notification to the NAF to inform the NAF the M2M device is registered and at least one of;

the NAF, which includes a pre-established table that is based on M2M information, checking the pre-established table to determine whether the M2M device is registered;

or

the NAF refraining from checking whether the M2M device is registered and instead relying on a response from a bootstrapping server function (BSF), where the BSF determines whether the M2M device is registered and informs the NAF in the response;

receive a second data object; and

derive second information for use in establishing said secure communication with the M2M device.

2. The computing system of claim 1, wherein:

the second data object is a new shared secret;

the new shared secret is derivable at least in part from at least part of a third data object;

the third data object is derived from an existing shared secret; and

the existing shared secret is shared between a network data store and the M2M device.

3. The computing system of claim 1, wherein execution of the computer-executable instructions further causes the computing system to:

receive, via the interface between the NAF and the M2M device, a tunneled request for the first data object, the tunneled request comprising an identifier of the M2M device; and

provide the tunneled request for the first data object to a bootstrapping server function.

4. The computing system of claim 1, being further configured to:

receive a transaction identifier from a bootstrapping server function; and

tunnel the transaction identifier to the M2M device via the interface between the NAF and the M2M device.

5. The computing system of claim 1, being further configured to:

receive, via the interface between the M2M device and the NAF, a tunnelled authentication data object; and

provide the authentication data object to a bootstrapping server function.

6. The computing system of claim 1, being further configured to:

receive from a bootstrapping server function a notification of successful authentication; and

tunnel the notification of successful authentication to the M2M device via the interface between the M2M device and the NAF.