Method and apparatus for machine-to-machine communication

• US 8,560,835 B2
• Filed: 06/12/2008
• Issued: 10/15/2013
• Est. Priority Date: 06/12/2008
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Johansson, Mattias, Cheng, Yi, Huang, Vincent
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): BAYOU, YONAS A
• Application Number:
  US12/997,468
• Publication Number:
  US 20110154022A1
• Time in Patent Office: 1,951 Days
• Field of Search: 713/154
• US Class Current: 713/154
• CPC Class Codes: H04L 2209/805 Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 67/12 specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 4/00 Services specially adapted for wireless communication networks; Facilities therefor
• CPC Class Codes: H04W 4/70 Services for machine-to-machine communication [M2M] or machine type communication [MTC]

Abstract

According to a first aspect of the present invention there is provided a method of at least partly delegating processing of data in a machine-to-machine system to reduce computational load on a broker entity 11 while maintaining security of the data to be processed, the broker entity 11 serving as a link between a node 13 of a sensor network providing the data and an application node 12 requesting the data. In the method, at the broker entity 11, following receipt of a request for processed data from the application node 12, determining the node to provide the data to be processed, generating a data key for the data-providing node 13, generating a data-processing algorithm for processing the data in dependence upon the request, sending the data key to the data-providing node 13, and sending the data key and data-processing algorithm to a remote data-processing entity 15. At the data-providing node 13, encrypting the data using the data key and sending the encrypted data to the data-processing entity 15. At the data-processing entity 15, decrypting the data using the data key, processing the data using the data-processing algorithm, and sending the processed data to the application node 12.

Claims

1. A method of at least partly delegating processing of data for use in a machine-to-machine system to reduce computational load on a broker entity while maintaining security of the data to be processed, the broker entity serving as a link between a node of a sensor network providing the data and an application node requesting the data, and the method comprising:

at the broker entity, responsive to receiving a request from the application node for processed data, determining a data-providing node as the node of the sensor network that provides the data to be processed, generating a data key for the data-providing node, generating a data-processing algorithm for processing the data in dependence upon the request, sending the data key to the data-providing node, and sending the data key and data-processing algorithm to a remote data-processing entity;

at the data-providing node, encrypting the data using the data key and sending the encrypted data to the remote data-processing entity; and

at the remote data-processing entity, decrypting the encrypted data using the data key, processing the decrypted data using the data-processing algorithm, and sending the processed data to the application node.

2. The method of claim 1, further comprising authenticating the data-processing entity by:

sending a message from the broker entity to the remote data-processing entity requesting the remote data-processing entity'"'"'s public key certificate;

sending a message from the remote data-processing entity to the broker entity containing the remote data-processing entity'"'"'s public key certificate; and

at the broker entity, confirming whether or not the certificate is valid.

3. The method of claim 1, wherein sending the data key and data-processing algorithm to the remote data-processing entity comprises:

at the broker entity, encrypting the data key and data-processing algorithm using a public key of the remote data-processing entity;

sending the encrypted data key and data-processing algorithm to the remote data-processing entity; and

at the remote data-processing entity, decrypting the data key and data-processing algorithm using a private key of the remote data-processing entity.

4. The method of claim 1, wherein the data-processing algorithm is arranged to filter out at least some information from the data the algorithm is used to process.

5. The method of claim 1, wherein said sending the processed data to the application node comprises sending only the processed data to the application node, thereby hiding any unprocessed data from the application node.

6. The method of claim 1, wherein said sending the data key and data-processing algorithm to the remote data-processing entity comprises sending the data key and data-processing algorithm to the remote data-processing entity via the application node.

7. The method of claim 1, wherein said sending the encrypted data to the remote data-processing entity comprises bypassing the broker entity.

8. The method of claim 1, wherein the data-providing node comprises a plurality of nodes.

9. The method of claim 1, further comprising sending a further data-processing algorithm to the remote data-processing entity, and using this further data-processing algorithm at the remote data-processing entity to process already-received data.

10. The method of claim 9, further comprising, at the remote data-processing entity, sending the data processed using the further data-processing algorithm to a further application node associated with the further data-processing algorithm.

11. The method of claim 1, wherein said sending the encrypted data to the remote data-processing entity comprises:

establishing a communication network session between the data-providing node and the remote data-processing entity; and

sending the encrypted data using the communication network session.

12. The method of claim 11, wherein said establishing the communication network session comprises:

at the broker entity, generating and sending an access token and a session key to the data-providing node;

authenticating and registering the data-providing node with the communication network using the access token and the session key; and

once the data-providing node is registered with the communication network, sending a session initiation message to the remote data-processing entity.

13. The method of claim 12, wherein the session key is a cryptographic function of the broker entity'"'"'s public key and a session identifier, and the access token comprises at least the identity of the broker entity and the session identifier signed with a private key of the broker entity.

14. The method of claim 13, wherein said authenticating and registering the data-providing node with the communication network comprises:

sending a register message containing the access token to the communication network, the communication network using the identity of the broker entity contained within the access token to determine the public key of the broker entity;

using the session identifier contained within the access token and the public key of the broker entity to calculate the session key; and

using the session key as a shared secret to mutually authenticate the communication network and the data-providing node.

15. The method of claim 11, wherein the communication network is an IP Multimedia Subsystem.

16. The method of claim 1, wherein the data-processing entity is provided in an application environment associated with the application node.

17. A broker entity configured to at least partly delegate processing of data in a machine-to-machine system to reduce computational load on the broker entity while maintaining security of the data to be processed, the broker entity serving as a link between a node of a sensor network providing the data and an application node requesting the data, and the broker entity comprising:

a receiver configured to receive a request for processed data from the application node;

a data reasoner configured to determine a data-providing node as the node of the sensor network that provides the data to be processed, and to generate a data-processing algorithm to process the data in dependence upon the request;

a key generator configured to generate a data key for the data-providing node;

a transmitter configured to send the data key to the data-providing node, and to send the data key and data-processing algorithm to a remote data-processing entity.

18. The broker entity of claim 17, wherein the transmitter is further configured to send a message to the remote data-processing entity requesting the remote data-processing entity'"'"'s public key certificate, wherein the receiver is further configured to receive a message containing the remote data-processing entity'"'"'s public key certificate, and wherein the broker entity further comprises a processor configured to confirm whether or not the certificate is valid and to correspondingly authenticate the remote data-processing entity.

19. A data-processing entity configured to assist with at least partial delegation of data processing in a machine-to-machine system, to thereby reduce the computational load on a broker entity while maintaining security of the data to be processed, the broker entity serving as a link between a node of a sensor network providing the data and an application node requesting the data, and the data-processing entity comprising:

a receiver configured to receive a data key and a data-processing algorithm from the broker entity, and to receive encrypted data from a data-providing node;

a decryptor configured to decrypt the encrypted data using the data key;

a processor configured to process the decrypted data using the data-processing algorithm; and

a transmitter configured to send the processed data to the application node.

20. The data-processing entity of claim 19, wherein the receiver is further configured to receive a message requesting a public key certificate of the data-processing entity, and wherein the transmitter is further configured to send a message containing the public key certificate.