Increased communication security

• US 9,426,135 B2
• Filed: 03/31/2014
• Issued: 08/23/2016
• Est. Priority Date: 03/31/2014
• Status: Active Grant

• Current Assignee: Idaax Technologies Private Limited
• Original Assignee: EXILANT Technologies Private Limited
• Inventors: Sharma, Vishnu
• Primary Examiner(s): Harriman, Dant Shaifer
• Assistant Examiner(s): KAPLAN, BENJAMIN A
• Application Number:
  US14/231,625
• Publication Number:
  US 20150281195A1
• Time in Patent Office: 876 Days
• Field of Search: 713/151, 713/181, 726/5
• US Class Current: 1/1
• CPC Class Codes: H04L 51/00 User-to-user messaging in packet-switching networks, transmitted according to store-and-forward or real-time protocols, e.g. e-mail
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC

Abstract

Authentication data may be generated and included in a Constrained Application Protocol (CoAP) message communicated from a first computer system for delivery to a second computer system. The authentication data may allow the second computer system to perform message validation for verifying the authenticity of the first computer system and/or the integrity of the CoAP message. And in one embodiment, where the CoAP message includes a nonce, security can be improved by allowing the second computer system to advantageously detect and/or act on a replay attack.

Claims

1. A method of increasing communication security, said method comprising:

generating authentication data based on message data, wherein said message data includes an authentication mechanism identifier, and wherein said generating further comprises generating said authentication data using an authentication mechanism associated with said authentication mechanism identifier;

generating a Constrained Application Protocol (CoAP) message including said authentication data and said message data; and

communicating said CoAP message from a first computer system for delivery to a second computer system.

2. The method of claim 1, wherein said CoAP message includes a unique identifier associated with said first computer system.

3. The method of claim 1, wherein said authentication mechanism is selected from a group consisting of hash-based message authentication code (HMAC) utilizing a MD5 hash function, HMAC utilizing a SHA-1 hash function, HMAC utilizing a SHA256 hash function, HMAC utilizing a SHA512 hash function, OAuth, OAuth 2.0, and OpenID.

4. The method of claim 1, wherein said generating authentication data further comprises:

accessing a key associated with said first computer system; and

generating said authentication data using said key.

5. The method of claim 1, wherein said CoAP message includes a nonce, and wherein said nonce is selected from a group consisting of a random number, a pseudorandom number, and an incremental number, and a timestamp.

6. The method of claim 1, wherein said CoAP message includes a header, and wherein said header is separate from a portion of said CoAP message including said authentication data.

7. The method of claim 1, wherein said communicating comprises communicating said CoAP message using Datagram Transport Layer Security (DTLS).

8. The method of claim 1, wherein said message data is selected from a group consisting of data associated with a header, data associated with a token, data associated with at least one option, data associated with a payload marker, and data associated with at least a portion of a payload.

9. A computer-readable medium having computer-readable program code embodied therein for causing a computer system to perform a method of increasing communication security, said method comprising:

generating authentication data based on message data, wherein said message data includes an authentication mechanism identifier, and wherein said generating further comprises generating said authentication data using an authentication mechanism associated with said authentication mechanism identifier;

generating a Constrained Application Protocol (CoAP) message including said authentication data and said message data; and

communicating said CoAP message from a first computer system for delivery to a second computer system.

10. The computer-readable medium of claim 9, wherein said CoAP message includes a unique identifier associated with said first computer system.

11. The computer-readable medium of claim 9, wherein said authentication mechanism is selected from a group consisting of hash-based message authentication code (HMAC) utilizing a MD5 hash function, HMAC utilizing a SHA-1 hash function, HMAC utilizing a SHA256 hash function, HMAC utilizing a SHA512 hash function, OAuth, OAuth 2.0, and OpenID.

12. The computer-readable medium of claim 9, wherein said generating authentication data further comprises:

accessing a key associated with said first computer system; and

generating said authentication data using said key.

13. The computer-readable medium of claim 9, wherein said CoAP message includes a nonce, and wherein said nonce is selected from a group consisting of a random number, a pseudorandom number, and an incremental number, and a timestamp.

14. The computer-readable medium of claim 9, wherein said CoAP message includes a header, and wherein said header is separate from a portion of said CoAP message including said authentication data.

15. The computer-readable medium of claim 9, wherein said communicating comprises communicating said CoAP message using Datagram Transport Layer Security (DTLS).

16. The computer-readable medium of claim 9, wherein said message data is selected from a group consisting of data associated with a header, data associated with a token, data associated with at least one option, data associated with a payload marker, and data associated with at least a portion of a payload.

17. A system comprising a processor and a memory, wherein said memory comprises instructions for causing said processor to implement a method of increasing communication security, said method comprising:

generating authentication data based on message data, wherein said message data includes an authentication mechanism identifier, and wherein said generating further comprises generating said authentication data using an authentication mechanism associated with said authentication mechanism identifier;

generating a Constrained Application Protocol (CoAP) message including said authentication data and said message data; and

communicating said CoAP message from a first computer system for delivery to a second computer system.

18. The system of claim 17, wherein said CoAP message includes a unique identifier associated with said first computer system.

19. The system of claim 17, wherein said generating authentication data further comprises:

accessing a key associated with said first computer system; and

generating said authentication data using said key.

20. The system of claim 17, wherein said message data is selected from a group consisting of data associated with a header, data associated with a token, data associated with at least one option, data associated with a payload marker, and data associated with at least a portion of a payload.

21. The system of claim 17, wherein said authentication mechanism is selected from a group consisting of hash-based message authentication code (HMAC) utilizing a MD5 hash function, HMAC utilizing a SHA-1 hash function, HMAC utilizing a SHA256 hash function, HMAC utilizing a SHA512 hash function, OAuth, OAuth 2.0, and OpenID.

22. The system of claim 17, wherein said CoAP message includes a nonce, and wherein said nonce is selected from a group consisting of a random number, a pseudorandom number, and an incremental number, and a timestamp.

23. The system of claim 17, wherein said CoAP message includes a header, and wherein said header is separate from a portion of said CoAP message including said authentication data.

24. The system of claim 17, wherein said communicating comprises communicating said CoAP message using Datagram Transport Layer Security (DTLS).