CARRIER NETWORK SECURITY INTERFACE FOR FIELDED DEVICES

• US 20160119311A1
• Filed: 01/06/2016
• Published: 04/28/2016
• Est. Priority Date: 05/11/2011
• Status: Active Grant

• Current Assignee: AT&T Mobility II LLC (AT&T, Inc.)
• Original Assignee: AT&T Mobility II LLC (AT&T, Inc.)
• Inventors: Maria, Arturo
• Granted Patent: US 9,596,226 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 12/06 Answer-back mechanisms or circuits
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1403 Architecture for metering, charging or billing
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/088 using filters or firewalls

Abstract

Carrier-side security services for fielded devices is disclosed. In contrast to conventional authentication systems for fielded devices, wherein an end-to-end communications pathway is typically established for authentication of a fielded device by a back-end service provider, authentication and security services can be moved into devices associated with a carrier network. A device associated with the carrier network can authenticate field components to service components without first establishing a communications pathway to a back-end service provider. Further, the device can provide for secured communications with an authenticated field component and are not readable by carrier devices. In an aspect, this can allow for centralization of security elements from the periphery of back-end service providers into a device associated with the carrier network. In a further aspect, the device can host a security services platform for back-end service providers.

Claims

1. A device associated with a network operator identity, comprising:

a processor; and

a memory that stores executable instructions that, when executed by the processor, facilitate performance of operations, comprising;

identifying an association between a field device and a service device based on a communication with the field device, wherein the service device is not associated with the network operator identity;

in response to the identifying the association, determining a service security protocol to enable communication between the field device and the service device via the service security protocol without authentication of the field device via the service device; and

in response to determining a communication link is successfully established via a network security protocol between the field device and a network device associated with the network operator identity, adapting communication employing a communication path between the field device and the service device to convey data via the service security protocol, wherein the communication path comprises the communication link, wherein the adapting comprises encrypting the data for communication via the communication path to be unreadable by network devices associated with the network operator identity, and wherein the data encrypted for the service security protocol is decryptable by the field device and the service device.

2. The device of claim 1, wherein the field device is authenticated to the network device.

3. The device of claim 2, wherein authentication of the field device to the network device is via the network security protocol.

4. The device of claim 1, wherein the service security protocol is received from a data store remotely located from the network device.

5. The device of claim 1, wherein the service security protocol is updateable via programming input to the service device.

6. The device of claim 1, wherein the service security protocol is updateable via programming input associated with a service operator identity related to the service device.

7. The device of claim 1, wherein the identifying the association is based on service information relating to a public utility provider identity and field device information from a metering device associated with the public utility provider identity.

8. The device of claim 1, wherein communications with the field device comprise a wireless communications link.

9. The device of claim 1, comprised in a femtocell device.

10. The device of claim 1, comprised in an access point device.

11. The device of claim 1, wherein the field device is a mobile computer device.

12. The device of claim 1, wherein the field device is a metering device.

13. The device of claim 1, wherein the field device is a transportation infrastructure device.

14. The device of claim 1, wherein the field device is an energy distribution device.

15. A method, comprising:

receiving, by a device associated with a network operator identity and comprising a processor, information related to determining an association between a field device and a service device, wherein the service device is not associated with the network operator identity;

receiving, by the device, protocol data representing a service security protocol, in response to the determining the association, to enable communication between the field device and the service device via the service security protocol without authentication of the field device via the service device;

establishing, by the device via a network security protocol, a communication link between the field device and a network device associated with the network operator identity; and

adapting, by the device, transmission of data over a communication path between the field device and the service device to convey the data via the service security protocol, wherein the communication path comprises the communication link, and wherein the adapting comprises encrypting the data for communication via the communication path to be inaccessible by devices other than the field device and the service device.

16. The method of claim 15, wherein the data encrypted to conform to the service security protocol is decryptable by the service device and the field device.

17. The method of claim 15, wherein the receiving the protocol data comprises receiving updated protocol data representing an updated service security protocol associated with an update of the service security protocol via a service provider identity related to the service device.

18. The method of claim 17, wherein the service security protocol is received from a storage device of the device, and wherein security protocols associated with the service provider identity and comprising the service security protocol are stored by the storage device are updateable via a remotely located update device associated with the service provider identity.

19. A machine-readable storage medium, comprising executable instructions that, when executed by a processor, facilitate performance of operations, comprising:

determining an association between a field device and a service device, wherein the service device is not associated with a network operator identity;

establishing a communication link conforming to a first security protocol between the field device and a network device associated with the network operator identity;

in response to establishing the communication, determining a second security protocol, based on the association, to enable communication between the field device and the service device in conformance with the second security protocol without authentication of the field device by the service device; and

adapting communication employing a communication path between the field device and the service device to convey data via the second security protocol, wherein the communication path comprises the communication link, wherein the adapting comprises encrypting the data for communication via the communication path to be inaccessible by network devices associated with the network operator identity, and wherein the data encrypted for the second security protocol can be decrypted by the field device and the service device.

20. The machine-readable storage medium of claim 19, further comprising, storing, at the network device, security information related to authenticating the field device according to the second security profile.