SYSTEM AND METHODS FOR ACHIEVING END-TO-END SECURITY FOR HOP-BY-HOP SERVICES

• US 20180332047A1
• Filed: 10/28/2016
• Published: 11/15/2018
• Est. Priority Date: 10/30/2015
• Status: Active Grant

• Current Assignee: Convida Wireless LLC
• Original Assignee: Convida Wireless LLC
• Inventors: SHAH, Yogendra C., CHOYI, VInod Kumar, SEED, IV, Dale N., STARSINIC, Michael F., FLYNN, IV, William Robert, CHEN, Zhuo
• Granted Patent: US 10,999,289 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

An IoT E2E Service Layer Security Management system supports methods/procedures to allow an application to establish, use, and teardown an IoT SL communication session that has application specified E2E security preferences and that targets one or more SL addressable targets (e.g. an IoT application, device, or gateway SL addressable resource). E2E SL Session based methods/procedures achieve a required overall E2E security level, by allowing IoT SL instances to influence and coordinate hop security for a multi-hop communication path spanning across multiple intermediary nodes. Methods/procedures reduce overhead, simplify and obviate the need for E2E service level nodes (initiation/termination nodes) from having to perform security service negotiation, in order to establish secure hop-by-hop security associations aligned with an E2E security requirement.

Claims

1. An apparatus comprising a processor and a memory, the apparatus further including computer-executable instructions stored in the memory of the apparatus which, when executed by the processor of the apparatus, cause the apparatus to:

receive a security level value for a hop-by-hop service layer connection; and

set up security for a service layer connection hop using the security level value, wherein the security level value is coordinated with security level values for other hops to ensure that a certain level of end-to-end hop-by-hop security is achieved.

2. The apparatus of claim 1, wherein the computer-executable instructions stored in the memory of the apparatus further cause the apparatus to:

forward the security level to another apparatus to set up another service layer connection hop.

3. The apparatus of claim 1, wherein the computer-executable instructions stored in the memory of the apparatus further cause the apparatus to:

share a hop with another end to end connection.

4. The apparatus of claim 3, wherein the computer-executable instructions stored in the memory of the apparatus further cause the apparatus to:

set the security for a shared hop based on a highest security value.

5. The apparatus of claim 1, wherein the hop-by-hop service layer connection is an oneM2M service layer connection.

6. The apparatus of claim 1, wherein an authentication server provides the security level value to the apparatus to establish a security association.

7. An apparatus comprising a processor and a memory, the apparatus further including computer-executable instructions stored in the memory of the apparatus which, when executed by the processor of the apparatus, cause the apparatus to:

determine a security level for a shared hop for multiple service layer connections by selecting a highest security layer value of the multiple service layer connections; and

set up security for the shared hop using the determined security level value.

8. The apparatus of claim 7, wherein the computer-executable instructions stored in the memory of the apparatus further cause the apparatus to:

reevaluate the security of the shared hop when one of the multiple service layer connections is removed from the shared hop.

9. The apparatus of claim 7, wherein the computer-executable instructions stored in the memory of the apparatus further cause the apparatus to:

set the security for a shared hop based on a highest security value.

10. The apparatus of claim 7, wherein the computer-executable instructions stored in the memory of the apparatus further cause the apparatus to:

forward the security level to another apparatus to set up another service layer connection hop.

11. The apparatus of claim 7, wherein the hop-by-hop service layer connection is an oneM2M service layer connection.

12. A method for use by an apparatus, wherein the apparatus comprises a processor and memory, and wherein the apparatus further includes computer-executable instructions stored in the memory which, when executed by the processor, perform functions of a method comprising:

receiving a security level value for a hop-by-hop service layer connection; and

setting up security for a service layer connection hop using the security level value, wherein the security level value is coordinated with security level values for other hops to ensure that a certain level of end-to-end hop-by-hop security is achieved.

13. The method of claim 12, further comprising forwarding the security level to another apparatus to set up another service layer connection hop.

14. The method of claim 12, further comprising sharing a hop with another end to end connection.

15. The method of claim 12, further comprising setting the security for a shared hop based on a highest security value.

15-1. The method of claim 12, wherein the hop-by-hop service layer connection is a oneM2M service layer connection.

16. The method of claim 12, wherein an authentication server provides the security level value to the apparatus to establish a security association.

17. A method for use by an apparatus, wherein the apparatus comprises a processor and memory, and wherein the apparatus further includes computer-executable instructions stored in the memory which, when executed by the processor, perform functions of a method comprising:

determining a security level for a shared hop for multiple service layer connections by selecting a highest security layer value of the multiple service layer connections; and

setting up security for the shared hop using the determined security level value.

18. The method of claim 17, further comprising:

reevaluating the security of the shared hop when one of the multiple service layer connections is removed from the shared hop.

19. The method of claim 17, further comprising:

setting the security for a shared hop based on a highest security value.

20. The method of claim 17, further comprising:

forwarding the security level to another apparatus to set up another service layer connection hop.

21. The method of claim 17, wherein the hop-by-hop service layer connection is a oneM2M service layer connection.