METHOD AND APPARATUS FOR PROVIDING WIRELESS SERVICE GROUPS

• US 20160150412A1
• Filed: 11/20/2015
• Published: 05/26/2016
• Est. Priority Date: 11/21/2014
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Li, Guoqing, Liu, Yong, Hartman, Christiaan A., Wong, Chiu Ngok E., Yong, Su Khiong
• Granted Patent: US 9,848,332 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/334 Query execution G06F16/335 takes precedence
• CPC Class Codes: G06F 16/93 Document management systems
• CPC Class Codes: G06V 30/224 of printed characters having additional code marks or containing code marks
• CPC Class Codes: G06V 30/412 Layout analysis of documents structured with printed lines or input boxes, e.g. business forms or tables
• CPC Class Codes: G06V 30/414 Extracting the geometrical structure, e.g. layout tree; Block segmentation, e.g. bounding boxes for graphics or text
• CPC Class Codes: H04L 63/065 for group communications cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 4/08 User group management
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

The disclosed embodiments provide a system that provides wireless service groups. During operation, a wireless device'"'"'s advertising mechanism advertises a service group over Wi-Fi, wherein the service group comprises at least the wireless device and wherein the service group'"'"'s security requirements regulate multicast protection within the service group. In response to receiving a request from a second device to be admitted into the service group, the wireless device'"'"'s security mechanism admits the second device into the service group and sends the service group'"'"'s security requirements to the second device, thereby enabling the second device to initialize multicast protection in accordance with the service group'"'"'s security requirements.

Claims

1. A wireless device, the device comprising:

a processor;

a memory coupled to the processor;

a Wi-Fi transceiver coupled to the processor;

an advertising mechanism, configured to advertise a service group over Wi-Fi, wherein the service group comprises at least the device and wherein the service group'"'"'s security requirements regulate multicast protection within the service group; and

a security mechanism, configured to admit a second device into the service group and send the service group'"'"'s security requirements to the second device, thereby enabling the second device to initialize multicast protection in accordance with the service group'"'"'s security requirements.

2. The device of claim 1, wherein the device further comprises a local service endpoint configured to send the local service endpoint'"'"'s security requirements to the security mechanism;

and

wherein the service group'"'"'s security requirements accommodate the local service endpoint'"'"'s security requirements.

3. The device of claim 2, wherein the security mechanism is further configured to form the service group in response to the establishment of a Wi-Fi connection between the device and a third device;

and

wherein, in addition to accommodating the local service endpoint'"'"'s security requirements, the service group'"'"'s security requirements accommodate security requirements obtained from the third device.

4. The device of claim 1, wherein the security mechanism is further configured to designate the second device as an authorized member, thereby enabling the second device to perform at least one of the following:

advertise the service group to a new device;

admit the new device into the service group; and

deliver security information to the new device.

5. The device of claim 4, wherein the second device is further enabled to perform at least one of the following to facilitate pairwise authentication between the new device and other members of the service group:

deliver a group shared key to the new device; and

deliver authentication material to the new device.

6. The device of claim 1, wherein in addition to regulating multicasting within the service group, the service group'"'"'s security requirements regulate security configurations of Wi-Fi connections within the service group.

7. The device of claim 6, wherein the security mechanism is further configured to prevent a fourth device from being admitted into the service group in response to determining that security requirements obtained from the fourth device are incompatible with the service group'"'"'s security requirements.

8. A computer-implemented method for managing a service group from a first device:

advertising the service group over Wi-Fi, wherein the service group comprises at least the first device and wherein the service group'"'"'s security requirements regulate multicast protection within the service group; and

admitting a second device into the service group and sending the service group'"'"'s security requirements to the second device, thereby enabling the second device to initialize multicast protection in accordance with the service group'"'"'s security requirements.

9. The computer-implemented method of claim 8, wherein the service group'"'"'s security requirements accommodate security requirements of a service endpoint that runs on the first device.

10. The computer-implemented method of claim 9, further comprising, prior to advertising the service group, forming the service group in response to the establishment of a Wi-Fi connection between the first device and a third device;

and

wherein, in addition to accommodating the service endpoint'"'"'s security requirements, the service group'"'"'s security requirements accommodate security requirements obtained from the third device.

11. The computer-implemented method of claim 8, further comprising designating the second device as an authorized member, thereby enabling the second device to perform at least one of the following:

advertise the service group to a new device;

admit the new device into the service group; and

deliver security information to the new device.

12. The computer-implemented method of claim 11, wherein the second device is further enabled to perform at least one of the following to facilitate pairwise authentication between the new device and other members of the service group:

deliver a group shared key to the new device; and

deliver authentication material to the new device.

13. The computer-implemented method of claim 8, wherein in addition to regulating multicasting within the service group, the service group'"'"'s security requirements regulate security configurations of Wi-Fi connections within the service group.

14. The computer-implemented method of claim 13, further comprising preventing a fourth device from being admitted into the service group in response to determining that security requirements obtained from the fourth device are incompatible with the service group'"'"'s security requirements.

15. A non-transitory computer-readable medium storing instructions that, when executed by a computer, cause the computer to perform a method for managing a service group from a first device, the method comprising:

advertising the service group over Wi-Fi, wherein the service group comprises at least the first device and wherein the service group'"'"'s security requirements regulate multicast protection within the service group; and

admitting a second device into the service group and sending the service group'"'"'s security requirements to the second device, thereby enabling the second device to initialize multicast protection in accordance with the service group'"'"'s security requirements.

16. The non-transitory computer-readable medium of claim 15, wherein the service group'"'"'s security requirements accommodate security requirements of a service endpoint that runs on the first device.

17. The non-transitory computer-readable medium of claim 16, wherein the method further comprises, prior to advertising the service group, forming the service group in response to the establishment of a Wi-Fi connection between the first device and a third device;

and

wherein, in addition to accommodating the service endpoint'"'"'s security requirements, the service group'"'"'s security requirements accommodate security requirements obtained from the third device.

18. The non-transitory computer-readable medium of claim 15, wherein the method further comprises designating the second device as an authorized member, thereby enabling the second device to perform at least one of the following:

advertise the service group to a new device;

admit the new device into the service group; and

deliver security information to the new device.

19. The non-transitory computer-readable medium of claim 18, wherein the second device is further enabled to perform at least one of the following to facilitate pairwise authentication between the new device and other members of the service group:

deliver a group shared key to the new device; and

deliver authentication material to the new device.

20. The non-transitory computer-readable medium of claim 15, wherein in addition to regulating multicasting within the service group, the service group'"'"'s security requirements regulate security configurations of Wi-Fi connections within the service group.