COMMUNICATING WITH A DEVICE

• US 20160234170A1
• Filed: 09/12/2014
• Published: 08/11/2016
• Est. Priority Date: 09/13/2013
• Status: Active Grant

• Current Assignee: DABCO Ltd. (Vodafone Group PLC)
• Original Assignee: Vodafone IP Licensing Limited (Vodafone Group PLC)
• Inventors: BONE, Nick
• Granted Patent: US 10,313,308 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 13/1689 Synchronisation and timing concerns synchronisation on a memory bus G06F13/4234
• CPC Class Codes: G06F 13/28 using burst mode transfer, e.g. direct memory access DMA, cycle steal G06F13/32 takes precedence
• CPC Class Codes: G06F 13/4027 using bus bridges G06F13/4022 takes precedence
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 9/4401 Bootstrapping security arrangements therefor G06F21/57
• CPC Class Codes: H04B 1/3816 Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices
• CPC Class Codes: H04L 2463/061 applying further key derivation, e.g. deriving traffic keys from a pair-wise master key cryptographic mechanisms or cryptographic arrangements for generation of secret information including derivation or calculation of cryptographic keys or passwords H04L9/0861
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/166 : at the transport layer
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/01 : Protocols
• CPC Class Codes: H04L 67/1095 : Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
• CPC Class Codes: H04L 67/125 : involving control of end-device applications over a network
• CPC Class Codes: H04L 9/0861 : Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/04 : Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 : Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 4/12 : Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 4/14 : Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 52/0229 : where the received signal is a wanted signal
• CPC Class Codes: H04W 8/04 : Registration at HLR or HSS [Home Subscriber Server]
• CPC Class Codes: H04W 80/06 : Transport layer protocols, e.g. TCP [Transport Control Protocol] over wireless transmission control protocol/Internet protocol [TCP/IP] or user datagram protocol [UDP] H04L69/16
• CPC Class Codes: H04W 88/02 : Terminal devices
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: Y02D 10/00 : Energy efficient computing, e.g. low power processors, power management or thermal management
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

The present disclosure provides a method and apparatuses configured for identifying a server instance in communications between an entity and a bootstrapping server. In particular, the method comprises the step of sending a data communication between the entity and the bootstrapping server, wherein the data comprises a pointer to the server instance.

Claims

1. A method for identifying a server instance in communications between an entity and a bootstrapping server, the method comprising:

sending a data communication between the entity and the bootstrapping server, wherein the data comprises a pointer to the server instance.

2. The method of claim 1, wherein the entity is a machine-to-machine, M2M, device or a user equipment, UE, device.

3. The method of claim 2, wherein the data communication is part of a bootstrapping process for establishing a shared secret shared between the entity and the bootstrapping server.

4. The method of either claim 2 or claim 3, wherein the pointer is used to select the server instance from a plurality of server instances.

5. The method of claim 4, wherein the data communication comprises a request to initiate the bootstrapping process.

6. The method of any of claims 2 to 5, wherein the data comprise an identifier of the entity and wherein the pointer to the server instance is at least part of the identifier of the entity.

7. The method of any of claims 2 to 6, wherein the server instance comprises an instance of the bootstrapping server.

8. The method of claim 7, further comprising a step of:

routing an interface for communication between the entity and the instance of the bootstrapping server using at least the pointer.

9. The method of any of claims 2 to 8, wherein the server instance comprises a home location register, HLR, or a home subscriber server, HSS.

10. The method of claim 9, further comprising a step of:

retrieving data from the HLR or HSS, wherein the shared secret is derivable at least in part using at least part of the retrieved data.

11. The method of either claim 2 or claim 3, wherein the pointer is used to advise of which server instance has been selected from a plurality of server instances.

12. The method of claim 11, wherein the data communication comprises security data, at least part of which relates to the shared secret.

13. The method of claim 12, wherein the security data comprise an identifier of the shared secret, and wherein the pointer to the server instance is at least part of the identifier of the shared secret.

14. The method of any of claims 11 to 13, wherein the server instance comprises an instance of the bootstrapping server.

15. The method of any of claims 11 to 14, wherein the server instance comprises a home location register, HLR, or a home subscriber server, HSS.

16. The method of claim 1, wherein the entity is a network application function, NAF.

17. The method of claim 16, wherein the data communication is part of a bootstrapping process for establishing a shared secret between a device and the bootstrapping server.

18. The method of claim 17, wherein the pointer is used to select the server instance from a plurality of server instances.

19. The method of claim 18, wherein the data communication comprises a request for push information for forwarding to the device as part of the bootstrapping process.

20. The method of claim 16, wherein the data communication is part of a process of establishing secure communication between a network application function, NAF, and a device, wherein secure communication is establishable using a shared secret that is shared between the device and the bootstrapping server.

21. The method of any of claims 18 to 20, wherein the data communication comprises a request for the shared secret and/or a lifetime of the shared secret.

22. The method of any of claims 18 to 21, wherein the data communication comprises an identifier of the shared secret and/or an identifier of the device, wherein the pointer to the server instance is at least part of the identifier of the shared secret and/or the identifier of the device.

23. The method of any of claims 18 to 22, wherein the server instance comprises an instance of the bootstrapping server.

24. The method of claim 23, further comprising a step of:

routing an interface for communication between the NAF and the instance of the bootstrapping server using at least the pointer to the instance of the bootstrapping server.

25. The method of any of claims 18 to 24, wherein the server instance comprises a home location register, HLR, or a home subscriber server, HSS.

26. The method of claim 25, further comprising a step of:

retrieving data from the HLR or HSS, wherein the shared secret is derivable at least in part using at least part of the retrieved data.

27. The method of claim 16 or claim 17, wherein the pointer is used to advise of which server instance has been selected from a plurality of server instances.

28. The method of claim 27, wherein the data communication comprises push information for forwarding to the device as part of the bootstrapping process.

29. The method of claim 28, wherein the push information comprises bootstrapping data for use in the bootstrapping process, wherein the pointer to the security server instance is at least part of a data item in the bootstrapping data.

30. The method of any of claims 27 to 29, wherein the server instance comprises an instance of the bootstrapping server.

31. The method of any of claims 27 to 30, wherein the server instance comprises a home location register, HLR, or a home subscriber server, HSS.

32. The method of any of claims 17 to 31, wherein the device is a machine-to-machine, M2M, device or a user equipment, UE, device.

33. A bootstrapping server for use in a bootstrapping process for establishing a shared secret shared between a device and the bootstrapping server, the bootstrapping server being configured to:

set, in at least part of data to be communicated to an entity, a pointer to a security server instance, wherein the security server instance has access to shared secret data; and

output to the entity the data to be communicated to the entity, as part of the bootstrapping process.

34. The bootstrapping server of claim 33, wherein the entity is the device.

35. The bootstrapping server of claim 34, wherein the data to be communicated to the device comprises security data, at least part of which relates to the shared secret.

36. The bootstrapping server of claim 35, wherein the security data comprise an identifier of the shared secret, and wherein the pointer to the security server instance is at least part of the identifier of the shared secret.

37. The bootstrapping server of claim 33, wherein the entity is a network application function, NAF.

38. The bootstrapping server of claim 37, wherein the data to be communicated to the NAF comprises push information for forwarding to the device as part of the bootstrapping process.

39. The bootstrapping server of claim 38, wherein the push information comprises bootstrapping data for use in the bootstrapping process, wherein the pointer to the security server instance is at least part of a data item in the bootstrapping data.

40. The bootstrapping server of any of claims 33 to 39, wherein the security server instance comprises an instance of the bootstrapping server.

41. The bootstrapping server of claim 40, wherein a communications interface between the instance of the bootstrapping server and the NAF is routable using the pointer to the instance of the bootstrapping server.

42. The bootstrapping server of any of claims 33 to 40, wherein the security server instance comprises a home location register, HLR, or a home subscriber service, HSS.

43. The bootstrapping server of claim 42, further configured to:

receive a request for the shared secret and/or a lifetime of the shared secret, wherein the request comprises the pointer to the security server instance; and

retrieve data from the HLR or HSS using the pointer, wherein the shared secret and/or lifetime of the shared secret is derivable at least in part using at least part of the retrieved data.

47. The bootstrapping server of any of claims 33 to 46, wherein the device is a machine-to-machine, M2M, device or a user equipment, UE, device.

62. A system comprising the bootstrapping server of any of claims 33 to 47 and the device of any of claims 48 to 52.

64. A system comprising the bootstrapping server of any of claims 33 to 47 and the network application function, NAF, of any of claims 53 to 61.

44. A bootstrapping server for use in establishing secure communication between a network application function, NAF, and a device, the bootstrapping server being configured to:

receive a request for a shared secret and/or a life time of the shared secret, wherein the shared secret is derivable from a key shared between the device and a security server instance, and wherein the request comprises a pointer to the security server instance;

retrieve, using the pointer, data for derivation of the shared secret and/or the lifetime of the shared secret from the security server instance; and

output the shared secret and/or the lifetime of the shared secret in response to the request.

45. The bootstrapping server of claim 44, wherein the request comprises an identifier of the shared secret and/or an identifier of the device, and wherein the pointer is at least part of the identifier of the shared secret and/or the identifier of the device.

46. The bootstrapping server of either claim 44 or claim 45, wherein the security server instance comprises a home location register, HLR, or a home subscriber server, HSS.

48. A device for communication with a network application function, NAF, wherein the communication between the device and the NAF is securable using a shared secret shared between the device and a bootstrapping server, the device being configured to:

exchange data with a bootstrapping server as part of a process for bootstrapping the shared secret to the device, wherein the data comprises a pointer to a security server instance that has access to shared secret data; and

output the pointer for provision to the NAF.

49. The device of claim 48, wherein the exchanged data comprise an identifier of the shared secret and/or an identifier of the device, and wherein the pointer is at least part of the identifier of the shared secret and/or the identifier of the device.

50. The device of claim 49, wherein the pointer is output for provision to the NAF by outputting the identifier of the shared secret and/or the identifier of the device.

51. The device of either claim 48 or claim 49 being further configured to:

extract the pointer from the data before outputting the pointer for provision to the NAF.

52. The device of any of claims 48 to 51, wherein the device is a machine-to-machine, M2M, device, or a user equipment device, UE.

65. A system comprising the machine-to-machine, M2M, device of any of claims 48 to 52 and the network application function, NAF, of any of claims 53 to 61.

53. A network application function, NAF, for use in a bootstrapping process for establishing a shared secret shared between a device and a bootstrapping server, wherein the NAF is configured to:

set an identifier of the shared secret, wherein the identifier is set to a value to point to an instance of the bootstrapping server; and

output a request for push information for forwarding to the device as part of a bootstrapping process, wherein the request comprises the identifier of the shared secret and is routable to the instance of the bootstrapping server using the identifier of the shared secret.

54. The NAF of claim 53, being further configured to:

output a request for the shared secret and/or a life time of the shared secret, wherein the request comprises the identifier of the shared secret and is routable to the instance of the bootstrapping server using the identifier of the shared secret.

63. The system of claim 62, further comprising the network application function, NAF, of any of claims 53 to 61.

55. A network application function, NAF, for communication with a device, wherein the communication is securable using a shared secret that is shared between the device and a bootstrapping server, wherein the NAF is configured to:

receive data from an entity, wherein the data comprise a pointer to a security server instance that has access to shared secret data.

56. The NAF of claim 55, being further configured to:

extract the pointer from the received data; and

store the pointer with an association to the device.

57. The NAF of either claim 55 or claim 56, being further configured to:

output a request to the bootstrapping server for the shared secret and/or a life time of the shared secret, wherein the request comprises the pointer to the security server instance.

58. The NAF of claim 57, wherein the security server instance comprises an instance of the bootstrapping server, and wherein the request to the bootstrapping server is routed to the instance of the bootstrapping server using the pointer.

59. The NAF of any of claims 55 to 58, wherein the entity is the device.

60. The NAF of any of claims 55 to 58, wherein the entity is the bootstrapping server, and wherein the received data communication from the bootstrapping server comprises push information for forwarding to the device as part of the bootstrapping process.

61. The NAF of any of claims 55 to 60, wherein the device is a machine-to-machine, M2M, device or a user equipment, UE, device.