COMMUNICATING WITH A MACHINE TO MACHINE DEVICE

• US 20160226828A1
• Filed: 09/12/2014
• Published: 08/04/2016
• Est. Priority Date: 09/13/2013
• Status: Abandoned Application

• Current Assignee: Vodafone IP Licensing Limited (Vodafone Group PLC)
• Original Assignee: Vodafone IP Licensing Limited (Vodafone Group PLC)
• Inventors: BONE, Nick
• Application Number:
  US15/021,876
• Publication Number:
  US 20160226828A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 13/1689 Synchronisation and timing concerns synchronisation on a memory bus G06F13/4234
• CPC Class Codes: G06F 13/28 using burst mode transfer, e.g. direct memory access DMA, cycle steal G06F13/32 takes precedence
• CPC Class Codes: G06F 13/4027 using bus bridges G06F13/4022 takes precedence
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/166 : at the transport layer
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 : Protocols
• CPC Class Codes: H04L 67/1095 : Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/125 : involving control of end-device applications over a network
• CPC Class Codes: H04L 9/0861 : Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/04 : Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 : Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 4/12 : Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 4/14 : Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 52/0229 : where the received signal is a wanted signal
• CPC Class Codes: H04W 8/04 : Registration at HLR or HSS [Home Subscriber Server]
• CPC Class Codes: H04W 80/06 : Transport layer protocols, e.g. TCP [Transport Control Protocol] over wireless transmission control protocol/Internet protocol [TCP/IP] or user datagram protocol [UDP] H04L69/16
• CPC Class Codes: H04W 88/02 : Terminal devices
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: Y02D 10/00 : Energy efficient computing, e.g. low power processors, power management or thermal management
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

The present disclosure provides a wireless communication module for use in a machine to machine, M2M, the M2M device also comprising an integrated circuit card. In an alternative aspect, present disclosure also provides an integrated circuit card for use in a machine to machine device. The wireless communication module of the first aspect and the integrated circuit card of the alternative aspect are each configured for using at least part of a first data object to obtain a second data object from the integrated circuit card. The second data object is derived from the existing shared secret, is suitable for deriving security information and is suitable for use in establishing secure communication between the M2M device and a network application function, NAF.

Claims

1. A wireless communication module for use in a machine to machine, M2M, device comprising an integrated circuit card comprising an existing shared secret that is shared between a network data store and the M2M device, wherein the wireless communication module is suitable for coupling to the integrated circuit card and wherein the wireless communication module comprises:

a security module implemented in the wireless communication module, the security module being configured to;

receive a first data object; and

use at least part of the first data object to obtain a second data object from the integrated circuit card;

wherein

the second data object is derived from the existing shared secret; and

wherein

the second data object is suitable for deriving security information; and

wherein

the security information is suitable for use in establishing secure communication between the M2M device and a network application function, NAF.

2. The wireless communication module of claim 1, wherein the security module is configured to receive from an application on the M2M device an identifier of the NAF.

3. The wireless communication module of claim 2, wherein the security module is configured to receive from the application on the M2M device the identifier of the NAF as a parameter to a command.

4. The wireless communication module of claim 3, wherein the command is an AT command.

5. The wireless communication module of any of claims 2 to 4, wherein the security module is configured to use at least the identifier of the NAF and at least part of the second data object to derive the security information and return the security information to the application.

6. The wireless communication module of any preceding claim, wherein the security module is configured to receive the first data object via an interface with a bootstrapping server function, BSF.

7. The wireless communication module of any one of claims 2 to 5, wherein the security module is configured to receive the first data object from the application on the M2M device.

8. The wireless communication module of any one of claims 1 to 5, wherein the security module is configured to receive the first data object from a further application on the M2M device.

9. The wireless communication module of either claim 7 or claim 8, wherein the first data object is at least part of a push information object.

10. The wireless communication module of any preceding claim, wherein the wireless communication module comprises a modem or a baseband processor.

11. A machine to machine, M2M, device for secure communication with a network application function, NAF, the M2M device comprising:

an integrated circuit card comprising an existing shared secret that is shared between a network data store and the M2M device; and

the wireless communication module of any preceding claim, wherein the wireless communication module is coupled to the integrated circuit card.

12. The M2M device of claim 11, further comprising an application coupled to the security module, wherein the application is configured to provide an identifier of the NAF to the security module.

13. The M2M device of claim 12, wherein the security module is further configured to use at least the identifier of the NAF and at least part of the second data object to derive the security information and return the security information to the application.

14. The M2M device of either claim 12 or claim 13, wherein the application is further configured to provide the first data object to the security module.

15. The M2M device of either claim 12 or claim 13, further comprising a further application coupled to the security module, wherein the further application is configured to provide the first data object to the security module.

16. The M2M device of either claim 14 or claim 15, wherein the first data object is at least part of a push information object.

40. The M2M device of any one of claims 11 to 16 or 30 to 39, wherein the application and/or the further application is a device management client.

41. The M2M device of any one of claims 11 to 16 or 30 to 39, further comprising a device management client, wherein the device management client comprises the application and/or the further application.

42. The M2M device of any one of claims 11 to 16 or 30 to 39, further comprising a device management client, wherein the application and/or the further application is configured to operate as a proxy to the device management client.

43. The M2M device of any one of claims 11 to 16 or 30 to 42, wherein the application and/or the further application is configured to operate as a proxy to the security module.

17. An integrated circuit card for use in a machine to machine, M2M, device, wherein the integrated circuit card comprises:

an integrated circuit card application;

an existing shared secret that is shared between a network data store and the M2M device, wherein the existing shared secret is accessible by the integrated circuit card application; and

a security module coupled to the integrated circuit card application, the security module being configured to;

use at least part of a first data object to obtain a second data object from the integrated circuit card application;

wherein

the second data object is derived from the existing shared secret; and

wherein

the second data object is suitable for deriving security information; and

wherein

the security information is suitable for use in establishing secure communication between the M2M device and a network application function, NAF.

18. The integrated circuit card of claim 17, wherein the security module is configured to:

obtain an identifier of the NAF; and

use at least the identifier of the NAF and the second data object to derive the security information.

19. The integrated circuit card of claim 18, wherein the security module is configured to obtain the identifier of the NAF from a first location on the integrated circuit card.

20. The integrated circuit card of claim 19, wherein the security module is configured to:

monitor the first location on the integrated circuit card; and

obtain the identifier of the NAF when a change to the first location is identified.

21. The integrated circuit card of any one of claims 17 to 20, wherein the security module is configured to obtain the first data object from the first location on the integrated circuit card.

22. The integrated circuit card of claim 21, wherein the security module is configured to:

monitor the first location on the integrated circuit card; and

obtain the first data object when a change to the first location is identified.

23. The integrated circuit card of any one of claims 17 to 20, wherein the security module is configured to obtain the first data object from a second location on the integrated circuit card.

24. The integrated circuit card of claim 23, wherein the security module is configured to:

monitor the second location on the integrated circuit card; and

obtain the first data object when a change to the second location is identified.

25. The integrated circuit card of any one of claims 17 to 24, wherein the security module is configured to:

write the security information to a third location on the integrated circuit card.

26. The integrated circuit card of claim 25, wherein the security module is configured to:

use at least part of the first data object to obtain a verification data object from the integrated circuit card application; and

write the verification data object to the third location on the integrated circuit card.

27. The integrated circuit card of any one of claims 17 to 25, wherein the security module is further configured to:

use at least part of the first data object to obtain a verification data object from the integrated circuit card application; and

write the verification data object to a fourth location on the integrated circuit card.

28. The integrated circuit card of any one of claims 19 to 27, wherein:

the first location is part of a phone book or part of a store of SMS messages or part of a file buffer;

the second location is part of the phone book or part of the store of SMS messages or part of a file buffer;

the third location is part of the phone book or part of the store of SMS messages or part of a file buffer; and

the fourth location is part of the phone book or part of the store of SMS messages or part of a file buffer.

29. A machine to machine, M2M, device for secure communication with a network application function, NAF, the M2M device comprising:

the integrated circuit card of any one of claims 17 to 28.

30. The M2M device of claim 29 further comprising:

an application that is coupled to the integrated circuit card and is configured to;

write an identifier of the NAF to a first location on the integrated circuit card.

31. The M2M device of claim 30, wherein the application is configured to write the identifier of the NAF to the first location on the integrated circuit card using a command.

32. The M2M device of claim 31, wherein the command is an AT command.

33. The M2M device of any of claims 30 to 32, wherein the application is configured to obtain the security information from a third location on the integrated circuit card.

34. The M2M device of claim 33, wherein the application is configured to obtain the security information from the third location using a command.

35. The M2M device of either claim 33 or claim 34, wherein the application is configured to:

monitor the third location on the integrated circuit card; and

obtain the security information when a change to the third location is identified.

36. The M2M device any one claims 30 to 35, wherein the application is further configured to write the first data object to the first location on the integrated circuit card.

37. The M2M device of any of claims 30 to 36, wherein the application is further configured to obtain a verification data object from the third location on the integrated circuit card, or from a fourth location on the integrated circuit card.

38. The M2M device of any one of claims 30 to 35, further comprising a further application configured to write the first data object to a second location on the integrated circuit card.

39. The M2M device of claim 38, wherein the further application is further configured to obtain a verification data object from the third location on the integrated circuit card, or from a fourth location on the integrated circuit card.