Method for establishing resource access authorization in M2M communication

• US 9,319,413 B2
• Filed: 11/21/2012
• Issued: 04/19/2016
• Est. Priority Date: 05/30/2012
• Status: Active Grant

• Current Assignee: Moda Inc.
• Original Assignee: Moda Inc.
• Inventors: Kim, Kyung-su, Lee, Jaeho, Kim, Yong-jin
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US14/403,977
• Publication Number:
  US 20150143472A1
• Time in Patent Office: 1,245 Days
• Field of Search: 726/2, 726/3, 726/4, 726/6, 726/9
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions

Abstract

A method for establishing a resource access authorization in M2M communication is provided. When an entity including a terminal, a gateway and an end user as client in a first M2M service provider domain attempts to access resource located in terminal or gateway in second M2M service provider domain, the method includes receiving client credential allocated from M2M Authentication Server (MAS1) in first M2M service provider domain by performing client registration to Network Service Capabilities Layer (NSCL1) in first M2M service provider domain by client, requesting an authorization to access resource to resource owner through NSCL (NSCL2) in second M2M service provider domain based on information about Universal Resource Identifier (URI) of resource by client, verifying client through MAS1 by the resource owner, authorizing client to access the resource by the resource owner, and issuing access token to the client by MAS (MAS2) in second M2M service provider domain.

Claims

1. A method for establishing an authorization to access resource in Machine-to-Machine (M2M) communication, when an entity selected from a terminal, a gateway and an end user as a client in an M2M service provider domain attempts to access resource located in a terminal or a gateway in the same M2M service provider domain, the method comprising:

receiving by the client a client credential allocated from an authentication server for providing an authentication service in the M2M service provider domain by performing a client registration to a service layer of an M2M server for providing an M2M service which is required in the M2M service provider domain;

requesting an authorization to access the resource to a resource owner of the resource through the service layer based on information about a Universal Resource Identifier (URI) of the resource by the client;

verifying by the resource owner the client through the authentication server;

granting the authorization for the client to access the resource by the resource owner;

issuing an access token to the client by the authentication server in the M2M service provider domain, and

accessing by, a processor of the client, the resource based on the issued access token.

2. The method of claim 1, further comprising acquiring the information about the URI of the resource through one of the service layer and the resource owner by the client.

3. The method of claim 1, further comprising:

issuing an authorization code to the client by the authentication server; and

requesting an access token to the authentication server using the issued authorization code by the client.

4. The method of claim 1, wherein the authorization comprises:

requesting generation or update of an access right source associated with the resource to an entity in which the resource is located; and

notifying the authentication server that the client has been authorized.

5. The method of claim 1, wherein a lifetime is set for the access token.