Method and apparatus for providing wireless service groups

• US 9,848,332 B2
• Filed: 11/20/2015
• Issued: 12/19/2017
• Est. Priority Date: 11/21/2014
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Liu, Yong, Hartman, Christiaan A., Li, Guoqing, Wong, Chiu Ngok E., Yong, Su Khiong
• Primary Examiner(s): Gelin, Jean
• Application Number:
  US14/947,782
• Publication Number:
  US 20160150412A1
• Time in Patent Office: 760 Days
• Field of Search: 455410, 455411, 4554141, 455517, 455518, 455519
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06V 30/224 of printed characters having additional code marks or containing code marks
• CPC Class Codes: G06V 30/412 Layout analysis of documents structured with printed lines or input boxes, e.g. business forms or tables
• CPC Class Codes: G06V 30/414 Extracting the geometrical structure, e.g. layout tree; Block segmentation, e.g. bounding boxes for graphics or text
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 4/08 User group management
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

The disclosed embodiments provide a system that provides wireless service groups. During operation, a wireless device'"'"'s advertising mechanism advertises a service group over Wi-Fi, wherein the service group comprises at least the wireless device and wherein the service group'"'"'s security requirements regulate multicast protection within the service group. In response to receiving a request from a second device to be admitted into the service group, the wireless device'"'"'s security mechanism admits the second device into the service group and sends the service group'"'"'s security requirements to the second device, thereby enabling the second device to initialize multicast protection in accordance with the service group'"'"'s security requirements.

Claims

1. A wireless device, the device comprising:

a processor;

a memory coupled to the processor;

a Wi-Fi transceiver coupled to the processor;

an advertising mechanism configured to advertise a service group over Wi-Fi, wherein the service group comprises at least the wireless device and wherein security requirements of the service group regulate multicast protection within the service group; and

a security mechanism configured to admit a second device into the service group and send the security requirements of the service group to the second device, thereby enabling the second device to initialize multicast protection in accordance with the security requirements of the service group.

2. The wireless device of claim 1, further comprising:

a local service endpoint configured to send security requirements of the local service endpoint to the security mechanism,

wherein the security requirements of the service group accommodate the security requirements of the local service endpoint.

3. The wireless device of claim 2, wherein the security mechanism is further configured to form the service group in response to establishment of a Wi-Fi connection between the wireless device and a third device;

and

wherein, in addition to accommodating the security requirements of the local service endpoint, the security requirements of the service group accommodate security requirements obtained from the third device.

4. The wireless device of claim 1, wherein the security mechanism is further configured to designate the second device as an authorized member, thereby enabling the second device to perform at least one of the following:

advertise the service group to a new device;

admit the new device into the service group; and

deliver security information to the new device.

5. The wireless device of claim 4, wherein the second device is further configured to perform at least one of the following to facilitate pairwise authentication between the new device and other members of the service group:

deliver a group shared key to the new device; and

deliver authentication material to the new device.

6. The wireless device of claim 1, wherein in addition to regulating multicast protection within the service group, the security requirements of the service group regulate security configurations of Wi-Fi connections within the service group.

7. The wireless device of claim 6, wherein the security mechanism is further configured to prevent a fourth device from being admitted into the service group in response to determining that security requirements obtained from the fourth device are incompatible with the security requirements of the service group.

8. A computer-implemented method for managing a service group from a first device:

advertising the service group over Wi-Fi, wherein the service group comprises at least the first device and wherein security requirements of the service group regulate multicast protection within the service group; and

admitting a second device into the service group and sending the security requirements of the service group to the second device, thereby enabling the second device to initialize multicast protection in accordance with the security requirements of the service group.

9. The computer-implemented method of claim 8, wherein the security requirements of the service group accommodate security requirements of a service endpoint that runs on the first device.

10. The computer-implemented method of claim 9, further comprising, prior to advertising the service group, forming the service group in response to establishment of a Wi-Fi connection between the first device and a third device,

wherein, in addition to accommodating the security requirements of the service endpoint, the security requirements of the service group accommodate security requirements obtained from the third device.

11. The computer-implemented method of claim 8, further comprising designating the second device as an authorized member, thereby enabling the second device to perform at least one of the following:

advertise the service group to a new device;

admit the new device into the service group; and

deliver security information to the new device.

12. The computer-implemented method of claim 11, wherein the second device is further configured to perform at least one of the following to facilitate pairwise authentication between the new device and other members of the service group:

deliver a group shared key to the new device; and

deliver authentication material to the new device.

13. The computer-implemented method of claim 8, wherein in addition to regulating multicast protection within the service group, the security requirements of the service group regulate security configurations of Wi-Fi connections within the service group.

14. The computer-implemented method of claim 13, further comprising preventing a fourth device from being admitted into the service group in response to determining that security requirements obtained from the fourth device are incompatible with the security requirements of the service group.

15. A non-transitory computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method for managing a service group from a first device, the method comprising:

advertising the service group over Wi-Fi, wherein the service group comprises at least the first device and wherein security requirements of the service group regulate multicast protection within the service group; and

admitting a second device into the service group and sending the security requirements of the service group to the second device, thereby enabling the second device to initialize multicast protection in accordance with the security requirements of the service group.

16. The non-transitory computer-readable medium of claim 15, wherein the security requirements of the service group accommodate security requirements of a service endpoint that runs on the first device.

17. The non-transitory computer-readable medium of claim 16, wherein the method further comprises, prior to advertising the service group, forming the service group in response to establishment of a Wi-Fi connection between the first device and a third device;

and

wherein, in addition to accommodating the security requirements of the service endpoint, the security requirements of the service group accommodate security requirements obtained from the third device.

18. The non-transitory computer-readable medium of claim 15, wherein the method further comprises designating the second device as an authorized member, thereby enabling the second device to perform at least one of the following:

advertise the service group to a new device;

admit the new device into the service group; and

deliver security information to the new device.

19. The non-transitory computer-readable medium of claim 18, wherein the second device is further configured to perform at least one of the following to facilitate pairwise authentication between the new device and other members of the service group:

deliver a group shared key to the new device; and

deliver authentication material to the new device.

20. The non-transitory computer-readable medium of claim 15, wherein in addition to regulating multicast protection within the service group, the security requirements of the service group regulate security configurations of Wi-Fi connections within the service group.