End-to-end service layer authentication

• US 10,601,594 B2
• Filed: 10/10/2018
• Issued: 03/24/2020
• Est. Priority Date: 10/31/2014
• Status: Active Grant

• Current Assignee: Convida Wireless LLC
• Original Assignee: Convida Wireless LLC
• Inventors: Choyi, Vinod Kumar, Seed, Dale N., Mladin, Catalina M., Wang, Chonggang
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): Gundry, Stephen T
• Application Number:
  US16/156,396
• Publication Number:
  US 20190123909A1
• Time in Patent Office: 531 Days
• CPC Class Codes: H04L 2209/76 Proxy, i.e. using intermediary entity to perform cryptographic operations network architectures or network communication protocols using hop-by-hop encryption H04L63/0464
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/0478 applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/0833 involving conference or group key network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065
• CPC Class Codes: H04L 9/0861 Generation of secret information including derivation or calculation of cryptographic keys or passwords
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3242 involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/0433 Key management protocols
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

A variety of mechanisms to perform End-to-End authentication between entities having diverse capabilities (E.g. processing, memory, etc.) and with no prior security associations are used. Security provisioning and configuration process is done such that appropriate security credentials, functions, scope and parameters may be provisioned to an Entity. Mechanisms to distribute the security credentials to other entities which could then use the credentials to perform an End-to-End authentication at the Service Layer or the Session Layer and using Direct or Delegated modes are developed.

Claims

1. A method comprising:

receiving, from a first service layer entity performing delegated authentication on behalf of a second service layer entity, a request for one or more security credentials;

accessing a security profile associated with the second service layer entity, wherein the security profile comprises an indication of one or more security requirements associated with the second service layer entity, and wherein the one or more security requirements comprise an indication of at least one of a security level and a type of security protection mechanism associated with the second service layer entity;

generating, based on the security profile, the one or more security credentials; and

sending, to the first service layer entity, the one or more security credentials,

wherein the one or more security credentials enable the first service layer entity to establish a security association with at least one other service layer entity over a network,

wherein the first service layer entity is implemented on an apparatus of the network and the other service layer entity is implemented on another apparatus of the network, and

wherein the first service layer entity and the other service layer entity are interconnected to one another by one or more intermediate service layer entities.

2. The method of claim 1, wherein the security profile is received as part of a service enablement and security configuration process.

3. The method of claim 2, wherein the security profile is based on a type of service to be provided by the second service layer entity.

4. The method of claim 1, wherein the one or more security credentials are further generated based on a device profile associated with the second service layer entity, wherein the device profile comprises an indication of one or more capabilities of the second service layer entity.

5. The method of claim 1, wherein the one or more security credentials are further generated based on an entity profile associated with the second service layer entity, wherein the entity profile comprises an indication of one or more of a class of service, a type of service, a security level, and a privacy level associated with the second service layer entity.

6. The method of claim 1, wherein the one or more security credentials comprise one or more keys.

7. The method of claim 6, wherein a size of the one or more keys is determined based on the at least one of the security level and the type of security protection mechanism associated with the second service layer entity.

8. A device comprising a processor and a memory, the memory storing computer-executable instructions which, when executed by the processor, cause the device to perform operations comprising:

receiving, from a first service layer entity performing delegated authentication on behalf of a second service layer entity, a request for one or more security credentials;

accessing a security profile associated with the second service layer entity, wherein the security profile comprises an indication of one or more security requirements associated with the second service layer entity, and wherein the one or more security requirements comprise an indication of at least one of a security level and a type of security protection mechanism associated with the second service layer entity;

generating, based on the security profile, the one or more security credentials; and

sending, to the first service layer entity, the one or more security credentials,

wherein the one or more security credentials enable first service layer entity to establish a security association with at least one other service layer entity over a network,

wherein the first service layer entity is implemented on an apparatus of the network and the other service layer entity is implemented on another apparatus of the network, and

wherein the first service layer entity and the other service layer entity are interconnected to one another by one or more intermediate service layer entities.

9. The device of claim 8, wherein the security profile is received as part of a service enablement and security configuration process.

10. The device of claim 9, wherein the security profile is based on a type of service to be provided by the second service layer entity.

11. The device of claim 8, wherein the one or more security credentials are further generated based on a device profile associated with the second service layer entity, wherein the device profile comprises an indication of one or more capabilities of the second service layer entity.

12. The device of claim 8, wherein the one or more security credentials are further generated based on an entity profile associated with the second service layer entity, wherein the entity profile comprises an indication of one or more of a class of service, a type of service, a security level, and a privacy level associated with the second service layer entity.

13. The device of claim 8, wherein the one or more security credentials comprise one or more keys.

14. The device of claim 13, wherein a size of the one or more keys is determined based on the at least one of the security level and the type of security protection mechanism associated with the second service layer entity.

15. A computer-readable storage medium comprising computer-executable instructions which, when executed by a processor of a device, cause the device to perform operations comprising:

receiving, from a first service layer entity performing delegated authentication on behalf of a second service layer entity, a request for one or more security credentials;

accessing a security profile associated with the second service layer entity, wherein the security profile comprises an indication of one or more security requirements associated with the second service layer entity, and wherein the one or more security requirements comprise an indication of at least one of a security level and a type of security protection mechanism associated with the second service layer entity;

generating, based on the security profile, the one or more security credentials; and

sending, to the first service layer entity, the one or more security credentials,

wherein the one or more security credentials enable the first service layer entity to establish a security association with at least one other service layer entity over a network,

wherein the first service layer entity is implemented on an apparatus of the network and the other service layer entity is implemented on another apparatus of the network, and

wherein the first service layer entity and the other service layer entity are interconnected to one another by one or more intermediate service layer entities.

16. The computer-readable storage medium of claim 15, wherein the security profile is received as part of a service enablement and security configuration process.

17. The computer-readable storage medium of claim 16, wherein the security profile is based on a type of service to be provided by the second service layer entity.

18. The computer-readable storage medium of claim 15, wherein the one or more security credentials are further generated based on a device profile associated with the second service layer entity, wherein the device profile comprises an indication of one or more capabilities of the second service layer entity.

19. The computer-readable storage medium of claim 15, wherein the one or more security credentials comprise one or more keys.

20. The computer-readable storage medium of claim 19, wherein a size of the one or more keys is determined based on the at least one of the security level and the type of security protection mechanism associated with the second service layer entity.