End-to-end service layer authentication

• US 10,129,031 B2
• Filed: 10/30/2015
• Issued: 11/13/2018
• Est. Priority Date: 10/31/2014
• Status: Active Grant

• Current Assignee: Convida Wireless LLC
• Original Assignee: Convida Wireless LLC
• Inventors: Choyi, Vinod Kumar, Seed, Dale N., Mladin, Catalina M., Wang, Chonggang
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Gundry, Stephen
• Application Number:
  US14/928,909
• Publication Number:
  US 20170012778A1
• Time in Patent Office: 1,110 Days
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0433 Key management protocols
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

A variety of mechanisms to perform End-to-End authentication between entities having diverse capabilities (E.g. processing, memory, etc.) and with no prior security associations are used. Security provisioning and configuration process is done such that appropriate security credentials, functions, scope and parameters may be provisioned to an Entity. Mechanisms to distribute the security credentials to other entities which could then use the credentials to perform an End-to-End authentication at the Service Layer or the Session Layer and using Direct or Delegated modes are developed.

Claims

1. A method for securing a message to be transmitted from a first application entity to a target one of a plurality of service layer entities over a network, the method comprising:

requesting, by the first application entity from a trusted third party entity on the network, first credentials to be used for end-to-end authentication of the message by the first application entity and the target service layer entity;

wherein the first application entity is implemented on a first apparatus of the network and the plurality of service layer entities are implemented on respective other apparatuses of the network;

wherein the message is transmitted on a path through the network that traverses one or more intermediate service layer entities between the first application entity and the target service layer entity;

receiving, from the trusted third party on the network, the first credentials;

generating, by the first application entity based on the first credentials and at least some information associated with the message, an authentication code for authenticating the message;

transmitting, by the first application entity to a first intermediate service layer entity on the path to the target service layer entity, via a secure tunnel established between the first application entity and the first intermediate service layer entity using credentials that are different from the first credentials, the message and the authentication code;

wherein the message and the authentication code are securely transmitted thereafter from intermediate service layer entity-to-intermediate service layer entity along the path until they reach the target service layer entity, and wherein each transmission from one intermediate service layer entity to a next intermediate service layer entity along the path is secured using credentials that are different from the first credentials; and

wherein the target service layer entity, upon receiving the message and the authentication code, uses the authentication code and the first credentials to authenticate the message at the target service layer entity.

2. The method of claim 1, wherein authentication of the message at the target service layer entity comprises:

verifying, using the authentication code, that the message received at the target service layer entity originated from the first application entity.

3. The method of claim 2, wherein authentication of the message at the target service layer entity further comprises:

verifying, using the authentication code, the integrity of the message received at the target service layer entity.

4. The method of claim 1, wherein the authentication code comprises one or more of:

at least a part of the message;

the first credentials;

a nonce; and

a timestamp of when the message was created.

5. The method of claim 1, wherein the request to the third party entity for the first credentials comprises an identifier of the target service layer entity.

6. The method of claim 1, wherein requesting the first credentials comprises:

establishing a secure tunnel with the first intermediate service layer entity; and

transmitting the request to the first intermediate service layer entity, wherein the request comprises an identifier of the target service layer entity,

wherein the first service layer entity forwards the request to the third party entity, receives a response from the third party entity comprising the requested first credentials, and passes the response to the first application entity.

7. The method of claim 1, wherein the target service layer entity receives the first credentials from the trusted third party prior to receiving the message and the authentication code from a given one of the intermediate service layer entities.

8. The method of claim 1, wherein the target service layer entity requests the first credentials from the trusted third party after receiving the message and the authentication code from a given one of the intermediate service layer entities.

9. The method of claim 1, wherein said each transmission from one intermediate service layer entity to a next intermediate service layer entity along the path is secured using credentials different from the first credentials and different from the credentials used between any other pair of intermediate service layer entities.

10. A first application entity implemented on a first apparatus of a network, the first application entity being configured to secure a message to be transmitted from the first application entity to a target one of a plurality of service layer entities implemented on respective other apparatuses of the network the first application entity being configured to implement a method comprising:

requesting, by the first application entity from a trusted third party entity on the network, first credentials to be used for end-to-end authentication of the message by the first application entity and the target service layer entity;

wherein the message is transmitted on a path through the network that traverses one or more intermediate service layer entities between the first application entity and the target service layer entity;

receiving, from the trusted third party on the network, the first credentials;

generating, by the first application entity based on the first credentials and at least some information associated with the message, an authentication code for authenticating the message;

transmitting, by the first application entity to a first intermediate service layer entity on the path to the target service layer entity, via a secure tunnel established between the first application entity and the first intermediate service layer entity using credentials that are different from the first credentials, the message and the authentication code;

wherein the message and the authentication code are securely transmitted thereafter from intermediate service layer entity-to-intermediate service layer entity along the path until they reach the target service layer entity, and wherein each transmission from one intermediate service layer entity to a next intermediate service layer entity along the path is secured using credentials that are different from the first credentials; and

wherein the target service layer entity, upon receiving the message and the authentication code, uses the authentication code and the first credentials to authenticate the message at the target service layer entity.

11. The first application entity of claim 10, wherein authentication of the message at the target service layer entity comprises:

verifying, using the authentication code, that the message received at the target service layer entity originated from the first application entity.

12. The first application entity of claim 11, wherein authentication of the message at the target service layer entity further comprises:

verifying, using the authentication code, the integrity of the message received at the target service layer entity.

13. The first application entity of claim 10, wherein the authentication code comprises one or more of:

at least a part of the message;

the first credentials;

a nonce; and

a timestamp of when the message was created.

14. The first application entity of claim 10, wherein the request to the third party entity for the first credentials comprises an identifier of the target service layer entity.

15. The first application entity of claim 10, wherein requesting the first credentials comprises:

establishing a secure tunnel with the first intermediate service layer entity; and

transmitting the request to the first intermediate service layer entity, wherein the request comprises an identifier of the target service layer entity,

wherein the first service layer entity forwards the request to the third party entity, receives a response from the third party entity comprising the requested first credentials, and passes the response to the first application entity.

16. The first application entity of claim 10, wherein the target service layer entity receives the first credentials from the trusted third party prior to receiving the message and the authentication code from a given one of the intermediate service layer entities.

17. The first application entity of claim 10, wherein the target service layer entity requests the first credentials from the trusted third party after receiving the message and the authentication code from a given one of the intermediate service layer entities.

18. The first application entity of claim 10, wherein said each transmission from one intermediate service layer entity to a next intermediate service layer entity along the path is secured using credentials different from the first credentials and different from the credentials used between any other pair of intermediate service layer entities.