Power management and security for wireless modules in “machine-to-machine” communications

• US 9,350,550 B2
• Filed: 09/10/2013
• Issued: 05/24/2016
• Est. Priority Date: 09/10/2013
• Status: Active Grant

• Current Assignee: John A. Nix
• Original Assignee: M2M and IoT Technologies LLC
• Inventors: Nix, John A.
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): HAMPTON, TARELL A
• Application Number:
  US14/023,181
• Publication Number:
  US 20150071139A1
• Time in Patent Office: 987 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/445 by mutual authentication, e.g. between devices or programs
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: H04J 11/00 Orthogonal multiplex systems, e.g. using WALSH codesH04J13/00 takes precedence
• CPC Class Codes: H04L 12/2854 Wide area networks, e.g. public data networks
• CPC Class Codes: H04L 2209/24 Key scheduling, i.e. generating round keys or sub-keys for block encryption
• CPC Class Codes: H04L 2209/72 Signcrypting, i.e. digital signing and encrypting simultaneously
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/045 wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 9/006 : involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0816 : Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
• CPC Class Codes: H04L 9/0841 : involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/085 : Secret sharing or secret splitting, e.g. threshold schemes
• CPC Class Codes: H04L 9/0861 : Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/088 : Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0894 : Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/14 : using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 : Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3066 : involving algebraic varieties, e.g. elliptic or hyper-elliptic curves
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/321 : involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3239 : involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04L 9/3249 : using RSA or related signature schemes, e.g. Rabin scheme
• CPC Class Codes: H04L 9/3263 : involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/033 : of the user plane, e.g. user's traffic
• CPC Class Codes: H04W 12/04 : Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys
• CPC Class Codes: H04W 12/40 : Security arrangements using identity modules
• CPC Class Codes: H04W 4/70 : Services for machine-to-machine communication [M2M] or machine type communication [MTC]
• CPC Class Codes: H04W 40/005 : Routing actions in the presence of nodes in sleep or doze mode
• CPC Class Codes: H04W 52/0216 : using a pre-established activity schedule, e.g. traffic indication frame
• CPC Class Codes: H04W 52/0235 : where the received signal is a power saving command
• CPC Class Codes: H04W 52/0277 : according to available power supply, e.g. switching off when a low battery condition is detected
• CPC Class Codes: H04W 76/27 : Transitions between radio resource control [RRC] states
• CPC Class Codes: H04W 8/082 : for traffic bypassing of mobility servers, e.g. location registers, home PLMNs or home agents
• CPC Class Codes: H04W 80/04 : Network layer protocols, e.g. mobile IP [Internet Protocol]
• CPC Class Codes: H04W 84/12 : WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/12 : Access point controller devices
• CPC Class Codes: H05K 999/99 : dummy group
• CPC Class Codes: Y02D 30/70 : in wireless communication networks

Abstract

Methods and systems are provided for power management and security for wireless modules in “Machine-to-Machine” communications. A wireless module operating in a wireless network and with access to the Internet can efficiently and securely communicate with a server. The wireless network can be a public land mobile network (PLMN) or a wireless local area network (LAN). The wireless module may include a sensor and may be installed next to a monitored unit. The wireless module may utilize active states for collecting and sending data, and sleep states at other times to conserve a battery and/or energy usage. The wireless module minimize the time spent in a radio resource control (RRC) connected state. Messages between the wireless module and server can be transmitted according to a user datagram protocol (UDP). The wireless module and server can utilize public key infrastructure (PKI) for encryption and digital signatures.

Claims

1. A system for supporting machine-to-machine communications, the system comprising:

a wireless module for changing a processor between a sleep state and an active state, for changing a radio between a radio off state and a connected state, for recording a private key and a wireless module identity in a memory, and for sending a message comprising an Internet Protocol (IP) packet and receiving a response, wherein the message includes (i) a module digital signature processed using the private key, (ii) a sensor measurement, and (iii) the wireless module identity, wherein the wireless module, in sequence, (a) changes the processor from the sleep state to the active state, (b) changes the radio from the radio off state to the connected state, (c) sends the message and receives the response, wherein, after the wireless module receives the response, the wireless module (d) sends a detach message before receiving a radio bearer reconfiguration message and a radio resource control connection release, and then (e) changes the radio to the radio off state and the processor to the sleep state, and wherein the wireless module sends the detach message (x) while the wireless module comprises a 4G radio resource control connected (RRC_CONNECTED) state and (y) before the wireless module utilizes a discontinuous reception (DRX) state.

2. The system of claim 1, wherein the message comprises a first user datagram protocol (UDP) datagram sent to an IP address and port (IP:

port) number, wherein the response comprises a second UDP datagram from the IP;

port number, and wherein the wireless module sends a single UDP datagram between (i) changing the radio to the connected state and (ii) changing the radio to the off state.

3. The system of claim 2, wherein the message comprises a UDP Lite datagram, and wherein the message includes a channel coding.

4. The system of claim 1, wherein the wireless module comprises a mobile device and includes a battery and a sensor, and wherein the wireless module uses a sleep timer to change the processor from the sleep state to the active state (i) in order to record data from the sensor and (ii) without any user input.

5. The system of claim 1, wherein the wireless module sends the detach message before sending a radio control message after receiving the response.

6. The system of claim 1, wherein the sleep state of the processor comprises at least one of (i) a dormant state where a first power level used by all cores in the processor is less than 0.01 milliwatts during a period of at least one second, and (ii) a shutdown state where a second power level used by the processor is less than 0.002 milliwatt during the period of at least one second.

7. The system of claim 6, wherein the dormant state of the processor comprises a random access memory (RAM) in the processor continuing to record data, and wherein the shutdown state of the processor comprises the RAM being flushed.

8. The system of claim 1, wherein the wireless module includes a public key associated with a server, wherein the message includes a module encrypted data, wherein the module encrypted data includes the sensor measurement, and wherein the wireless module uses the public key to encrypt the module encrypted data.

9. The system of claim 8, wherein the public key includes an elliptic curve cryptography (ECC) algorithm.

10. The system of claim 1, wherein the module digital signature comprises a hash string, wherein the wireless module processes the hash string using the private key, wherein the message includes a body, wherein the body includes the wireless module identity and a module encrypted data, and wherein the module encrypted data includes the sensor measurement.

11. The system of claim 10, wherein a server sends the response to the message, wherein the response includes a server encrypted data, wherein the server utilizes a wireless module public key to process the server encrypted data, and wherein the wireless module sends the detach message after the wireless module decrypts the server encrypted data using the private key.

12. The system of claim 1, wherein a server includes a server private key, wherein the response sent by the server includes a server digital signature, and wherein the wireless module uses the server public key to process the server digital signature.

13. The system of claim 1, wherein the radio off state comprises the radio operating at a sufficiently low power where at least two of (i) a layer 1 message received at an antenna of the wireless module is not processed by a baseband processing unit, (ii) a base transceiver station beacon is not monitored by the wireless module, (iii) power to a radio frequency power amplifier is reduced below an operating threshold value, and (iv) the radio does not utilize a discontinuous receive (DRX) timer.

14. A system for reporting a sensor measurement, the system comprising:

a wireless module for changing a radio in the wireless module between a radio off state and a connected state, for recording a key in a memory, and for sending a message comprising an Internet Protocol (IP) packet and receiving a response to the message, wherein the message includes a module identity and a module encrypted data encrypted using the key, wherein the module encrypted data includes the sensor measurement, wherein the wireless module, in sequence, (i) changes the radio to the connected state from the radio off state, (ii) sends the message and receives the response, wherein after the wireless module receives the response, the wireless module (iii) changes the radio to the radio off state from the connected state before receiving (a) a radio bearer reconfiguration message, and (b) a radio resource control connection release, and wherein the wireless module changes the radio from the connected state to the radio off state (x) after the wireless module enters a 4G Long Term Evolution (LTE) radio resource control connected (RRC_CONNECTED) state and (y) before the wireless module utilizes a discontinuous reception (DRX) state.

15. The system of claim 14, wherein, after receiving the response, the wireless module changes the radio to the radio off state from the connected state before sending a radio control message.

16. The system of claim 14, wherein the message comprises a first user datagram protocol (UDP) datagram sent to an IP address and port (IP:

port) number, wherein the response comprises a second UDP message from the IP;

port number, and wherein the wireless module sends a single UDP datagram between (i) changing the radio to the connected state and (ii) changing the radio to the off state.

17. The system of claim 16, wherein the message comprises a UDP Lite datagram, and wherein the message includes a channel coding.

18. The system of claim 14, wherein the wireless module comprises a mobile device and includes a battery and a sensor, wherein the message includes data from the sensor, and wherein wireless module uses a sleep timer to change the radio from the radio off state to the connected state.

19. The system of claim 14, wherein the wireless module includes a wireless module private key, wherein the message includes a module digital signature, and wherein the wireless module uses the wireless module private key to process the module digital signature.

20. The system of claim 14, wherein the key comprises a public key associated with a server, wherein the module encrypted data includes a security token, and wherein the message includes a module digital signature, and wherein the public key includes an elliptic curve cryptography (ECC) algorithm.

21. The system of claim 14, wherein the message includes a module digital signature, wherein the module digital signature comprises a hash string, wherein the wireless module processes the hash string using the wireless module private key, wherein the private key includes an elliptic curve cryptography (ECC) algorithm.

22. The system of claim 14, wherein a server sends the response, wherein the response includes a server encrypted data, wherein the server utilizes a wireless module public key to process the server encrypted data, and wherein the wireless module changes the radio from the connected state to the radio off state after the wireless module decrypts the server encrypted data using a wireless module private key.

23. The system of claim 22, wherein the server encrypted data includes a server digital signature and an instruction for the wireless module, and wherein the wireless module processes the instruction after verifying the server digital signature with a server public key.

24. The system of claim 14, wherein a server includes a server private key, wherein the response sent by the server includes a server digital signature, and wherein the wireless module uses a server public key to process the server digital signature.

25. The system of claim 14, wherein the radio off state comprises the radio operating at a sufficiently low power where at least one of (i) a layer 1 message received at an antenna of the wireless module is not processed by a baseband processing unit, (ii) a base transceiver station beacon is not monitored by the wireless module, (iii) power to a radio frequency power amplifier is reduced below an operating threshold value, and (iv) the radio does not utilize a discontinuous receive (DRX) timer.

26. The system of claim 25, wherein the radio off state further comprises the radio using a lower power than both (i) a radio resource control idle (RRC_IDLE) state and a (ii) 3G idle state, and wherein the radio off state has a duration of at least 60 seconds.

27. The system of claim 14, wherein the radio off state comprises powering down at least two of (i) a power amplifier, (ii) a baseband processing unit, (iii) a radio modem, and (iv) a radio.

28. The system of claim 14, wherein the radio changes from the connected state to the radio off state after receiving the response and before the radio enters a radio resource connected idle state (RRC_IDLE).

29. The system of claim 14, wherein the connected state comprises the wireless module in the RRC_Connected state.

30. A method for supporting machine-to-machine communications, the method comprising a wireless module, in sequence:

reading a public key, an address, and a wireless module private key from a nonvolatile memory;

changing a radio in the wireless module from a radio off state to a connected state, wherein the radio off state comprises the radio not utilizing a discontinuous receiver (DRX) timer;

sending a message to the address, wherein the message comprises a user datagram protocol (UDP) packet, wherein the UDP packet includes (i) a module encrypted data processed using the public key, and (ii) a module digital signature processed using the wireless module private key, and wherein the module encrypted data includes a sensor measurement;

receiving a response to the message, and;

sending a detach message before (i) receiving a radio bearer reconfiguration message after receiving the response, and (ii) receiving a radio resource control connection release after receiving the response.

31. The method of claim 30, wherein the connected state for the radio comprises the wireless module in one of a RRC_Connected state, a Cell_DCH state, a FACH state, and a GRPS ready state.

32. The method of claim 30, after sending the detach message the wireless module changes the radio to the radio off state, and wherein the radio off state comprises powering down at least two of (i) a power amplifier, (ii) a baseband processing unit, (iii) a radio modem, or (iv) the radio.

33. The method of claim 32, wherein the radio off state further comprises the radio using a lower power than both (i) a radio resource control idle (RRC_IDLE) state and a (ii) 3G idle state, and wherein the radio off state has a duration of at least 60 seconds.

34. The method of claim 30, wherein the wireless module sends the detach message after receiving the response and before the radio enters at least one of (i) a radio resource connected idle state (RRC_IDLE), (ii) a 3G idle state, and (iii) a GPRS idle state.

35. The method of claim 30, wherein the message comprises a first user datagram protocol (UDP) datagram sent to an IP address and port (IP:

port) number, wherein the response comprises a second UDP message from the IP;

port number, and wherein the wireless module sends a single UDP datagram between (i) changing the radio to the connected state and (ii) changing the radio to the off state.

36. The method of claim 30, wherein the message comprises a UDP Lite datagram, and wherein the message includes a channel coding.

37. The method of claim 30, wherein the wireless module comprises a mobile device and includes a battery and a sensor, and wherein the wireless module uses a sleep timer to change the radio from the radio off state to the connected state.

38. The method of claim 30, wherein the wireless module sends the detach message (i) while the wireless module comprises a 3G dedicated channel (3G DCH) state, and (ii) before the wireless module utilizes a 3G forward access channel (3G FACH) state.

39. The method of claim 30, wherein the wireless module sends the detach message (i) while the wireless module comprises a radio resource control connected (RRC_CONNECTED) state and (ii) before the wireless module utilizes a discontinuous reception (DRX) state.

40. The method of claim 30, wherein the module digital signature comprises a hash string, wherein the wireless module processes the hash string using the wireless module private key, wherein the message includes a body, wherein the body includes a wireless module identity.

41. The method of claim 30, wherein the public key includes an elliptic curve cryptography (ECC) algorithm.

42. The method of claim 30, wherein a server includes a wireless module public key, and wherein the server (i) processes the module digital signature using the wireless module public key and (i) decrypts the module encrypted data using a server private key.

43. The method of claim 42, wherein the server sends the response, wherein the response includes a server encrypted data, wherein the server utilizes the wireless module public key to process the server encrypted data, and wherein the wireless module changes the radio from the connected state to the radio off state after the wireless module decrypts the server encrypted data using the wireless module private key.

44. The method of claim 30, wherein a server includes a server private key, wherein the response sent by the server includes a server digital signature, and wherein the wireless module uses a server public key to process the server digital signature.