Secure client authentication and service authorization in a shared communication network

• US 9,003,492 B2
• Filed: 06/19/2012
• Issued: 04/07/2015
• Est. Priority Date: 06/21/2011
• Status: Expired due to Fees

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Katar, Srinivas, Yonge, Lawrence W. III, Newman, Richard E.
• Primary Examiner(s): Dada, Beemnet
• Assistant Examiner(s): BEHESHTI SHIRAZI, SAYED ARESH
• Application Number:
  US13/527,486
• Publication Number:
  US 20130160086A1
• Time in Patent Office: 1,022 Days
• Field of Search: 726/4, 726/3, 726/116, 713/171, 713/310, 707/803, 709/203
• US Class Current: 726/4
• CPC Class Codes: H02J 7/00045 Authentication, i.e. circuits for checking compatibility between one component, e.g. a battery or a battery charger, and another component, e.g. a power source
• CPC Class Codes: H04B 2203/5458 Monitor sensor; Alarm systems
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 67/1021 based on client or server locations
• CPC Class Codes: H04L 67/1023 based on a hash applied to IP addresses or costs
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services

Abstract

Functionality for secure client authentication and service authorization in a shared communication network are disclosed. A managing network device of a communication network causes a securely connected client network device to perform an account authorization process with an accounting network device in parallel with a service matching process with the managing network device and one or more service providers of the communication network. The managing network device executes the service matching process and securely matches the client network device with one of the service providers. The accounting network device executes the account authorizing process with the client network device and provides a service voucher to the managing network device authorizing one or more of the service providers to service the client network device. The managing network device transmits the service voucher to the matched service provider to prompt the matched service provider to service the client network device.

Claims

1. A method comprising:

establishing, by a processor of a managing network device, a secure communication channel between a client network device and the managing network device of a communication network based, at least in part, on a client identifier of the client network device;

determining, based at least in part on a service environment characteristic, a number of service matching messages to be transmitted during a service matching process, wherein the service environment characteristic includes at least one member of a group consisting of a number of cables, a number of cable harnesses, and a number of switch states;

causing the client network device to perform an account authorization process with an accounting network device contemporaneously with the service matching process, wherein the service matching process includes determining a matching service provider based, at least in part, on a service matching message of the service matching messages;

matching the client network device with the matching service provider;

receiving a service voucher at the managing network device from the accounting network device authorizing the matching service provider to service the client network device; and

transmitting the service voucher to the matching service provider to allow the matching service provider to service the client network device.

2. The method of claim 1, further comprising:

generating, at the managing network device, a client key that is unique to the client network device based, at least in part, on the client identifier and a master key known to the managing network device and the matching service provider;

providing the client key from the managing network device to the client network device via the secure communication channel to allow the client network device to securely communicate with the matching service provider;

receiving, from the matching service provider, a message that indicates a signal level detected at the matching service provider in response to the service matching message; and

selecting the matching service provider based, at least in part, on the matching service provider having a highest detected signal level.

3. The method of claim 2, wherein the client key is a temporary key and is generated based, at least in part, on the master key, the client identifier, and at least one member of a group consisting of a sequence number, a random number, a start/end timestamp, a lifetime duration, a message counter, and a location identifier.

4. The method of claim 2, wherein the client key is a public encryption key.

5. The method of claim 1, wherein the client identifier is authenticated by the managing network device and by the accounting network device, and the service voucher is associated with the client identifier.

6. The method of claim 1, wherein the managing network device is one of a plurality of service providers.

7. The method of claim 6, further comprising:

determining, at the managing network device, a message counter value from a message received from the client network device; and

determining whether to process the message based, at least in part, on a comparison of the message counter value with a previously received message counter value.

8. The method of claim 1, wherein the client network device comprises a plug-in electric vehicle, the matching service provider comprises an electric charging station, the managing network device comprises a managing system associated with a plurality of electric charging stations, and the accounting network device comprises a remote account authorization server for a client account.

9. The method of claim 1, further comprising:

determining, at the managing network device, a first value of the client identifier, the first value of the client identifier used for executing the service matching process;

determining a second value of the client identifier, the second value used for executing the account authorization process;

determining whether the first value matches the second value; and

in response to determining that the first value does not match the second value, preventing the matching service provider from servicing the client network device;

wherein said transmitting the service voucher from the managing network device to the matching service provider is in response to determining that the first value matches the second value.

10. A method comprising:

establishing, by a processor of a client network device, a secure communication channel with a managing network device of a communication network based, at least in part, on a client identifier of the client network device;

receiving, from the managing network device, identification information associated with the managing network device and an indication of a number of service matching messages to be transmitted during a service matching process, wherein the number of service matching messages is determined based, at least in part, on a service environment characteristic, wherein the service environment characteristic includes at least one member of a group consisting of a number of cables, a number of cable harnesses, and a number of switch states;

providing the client identifier and the identification information associated with the managing network device to an accounting network device to cause the accounting network device to execute an account authorization process with the client network device;

contemporaneously with the account authorization process, executing the service matching process with the managing network device and a matching service provider of the communication network, wherein the service matching process includes determining the matching service provider based, at least in part, on a service matching message of the service matching messages; and

detecting receipt of service from the matching service provider after completion of the account authorization process and the service matching process.

11. The method of claim 10, wherein the identification information associated with the managing network device comprises a device identifier of the managing network device and a location of the managing network device.

12. The method of claim 10, wherein in response to receiving, from the managing network device, a service matching parameter, the client network device initiates the service matching process.

13. The method of claim 10, further comprising:

receiving, from the managing network device, a client key that is unique to the client network device, via the secure communication channel, wherein the client key enables the client network device to securely communicate with the matching service provider;

receiving a client key generation parameter based on which the client key was determined, wherein the client key generation parameter comprises at least one member of a group consisting of a sequence number, a random number, a start/end timestamp, a lifetime duration, a message counter, and a location identifier;

signing the service matching message using the client key; and

transmitting the service matching message and the client key generation parameter to the matching service provider.

14. The method of claim 13, further comprising:

determining whether a length of the service matching message is greater than a predetermined threshold message length;

in response to determining that the length of the service matching message is greater than the predetermined threshold message length,

transmitting an initialization message including the client key generation parameter to the matching service provider, and

transmitting the client identifier and the sequence number in the service matching message; and

in response to determining that the length of the service matching message is less than the predetermined threshold message length, transmitting the client key generation parameter as part of the service matching message.

15. A managing network device comprising:

a network interface; and

a matching authorization unit executable, at least in part, from a memory by a processor coupled with the network interface, the matching authorization unit operable to;

establish a secure communication channel between a client network device and the managing network device of a communication network based, at least in part, on a client identifier of the client network device;

determine, based at least in part on a service environment characteristic, a number of service matching messages to be transmitted during a service matching process, wherein the service environment characteristic includes at least one member of a group consisting of a number of cables, a number of cable harnesses, and a number of switch states;

cause the client network device to perform an account authorization process with an accounting network device contemporaneously with the service matching process, the service matching process configured to determine a matching service provider based, at least in part, on a service matching message of the service matching messages;

match the client network device with the matching service provider;

receive a service voucher from the accounting network device authorizing the matching service provider to service the client network device in response to the accounting network device executing the account authorization process; and

transmit the service voucher to the matching service provider to allow the matching service provider to service the client network device.

16. The managing network device of claim 15, wherein the matching authorization unit is further operable to:

generate a client key that is unique to the client network device based, at least in part, on the client identifier and on a master key known to the managing network device and the matching service provider;

provide the client key to the client network device via the secure communication channel to allow the client network device to securely communicate with the matching service provider;

receive, from the matching service provider, a message that indicates a signal level detected at the matching service provider in response to the service matching message; and

select the matching service provider based, at least in part, on the matching service provider having a highest detected signal level.

17. The managing network device of claim 16, wherein the client key is a temporary key and is generated based, at least in part, on the master key, the client identifier, and at least one member of a group consisting of a sequence number, a random number, a start/end timestamp, a lifetime duration, a message counter, and a location identifier.

18. The managing network device of claim 15, wherein the matching authorization unit is further operable to:

determine a first value of the client identifier, wherein the first value of the client identifier was used for executing the service matching process;

determine a second value of the client identifier, wherein the second value was used for executing the account authorization process;

determine whether the first value matches the second value; and

in response to determining that the first value does not match the second value, the matching authorization unit is operable to prevent the matching service provider from servicing the client network device;

wherein the transmission of the service voucher to the matching service provider is in response to determining that the first value matches the second value.

19. A network device comprising:

a network interface; and

a communication unit executable, at least in part, from a memory by a processor coupled with the network interface, the communication unit operable to;

establish a secure communication channel with a managing network device of a communication network based, at least in part, on a client identifier of the network device;

receive, from the managing network device via the secure communication channel, identification information associated with the managing network device and an indication of a number of service matching messages to be transmitted during a service matching process, wherein the number is determined according to a service environment characteristic, wherein the service environment characteristic includes at least one member of a group consisting of a number of cables, a number of cable harnesses, and a number of switch states;

provide the client identifier and the identification information associated with the managing network device to an accounting network device to cause the accounting network device to execute an account authorization process with the network device;

contemporaneously with the account authorization process, execute the service matching process with the managing network device and a matching service provider of the communication network, the service matching process configured to determine the matching service provider based, at least in part, on a service matching message of the service matching messages; and

detect receipt of service from the matching service provider after completion of the account authorization process and the service matching process.

20. The network device of claim 19, wherein receipt, from the managing network device, of a service matching parameter causes the network device to initiate the service matching process.

21. The network device of claim 19, wherein the communication unit is further operable to:

receive, from the managing network device, a client key that is unique to the network device, via the secure communication channel, wherein the client key enables the network device to securely communicate with the matching service provider;

receive a client key generation parameter based on which the client key was determined, wherein the client key generation parameter comprises at least one member of a group consisting of a sequence number, a random number, a start/end timestamp, a lifetime duration, a message counter, and a location identifier;

sign the service matching message using the client key; and

transmit the service matching message and the client key generation parameter to the matching service provider.

22. The network device of claim 21, wherein the communication unit is further operable to:

determine whether a length of the service matching message is greater than a predetermined threshold message length;

in response to determining that the length of the service matching message is greater than the predetermined threshold message length,

transmit an initialization message including the client key generation parameter to the matching service provider, and

transmit the client identifier and the sequence number in the service matching message; and

in response to the communication unit determining that the length of the service matching message is less than the predetermined threshold message length,

transmit the client key generation parameter as part of the service matching message.

23. A method comprising:

establishing, by a processor of a managing network device, a secure communication channel between a plug-in electric vehicle and the managing network device of a communication network based, at least in part, on a client identifier of the plug-in electric vehicle;

determining, based at least in part on a service environment characteristic, a number of service matching messages to be transmitted during a service matching process, wherein the service environment characteristic includes at least one member of a group consisting of a number of cables, a number of cable harnesses, and a number of switch states;

causing the plug-in electric vehicle to perform an account authorization process with an accounting network device contemporaneously with the service matching process, the service matching process configured to determine a matching electric charging station based, at least in part, on a service matching message;

matching the plug-in electric vehicle with the matching electric charging station;

receiving a service voucher at the managing network device from the accounting network device authorizing the matching electric charging station to provide electric power to the plug-in electric vehicle in response to the accounting network device executing the account authorization process; and

transmitting the service voucher from the managing network device to the matching electric charging station to allow the plug-in electric vehicle to receive the electric power from the matching electric charging station.

24. The method of claim 23, further comprising:

generating, at the managing network device, a client key that is unique to the plug-in electric vehicle based, at least in part, on the client identifier and on a master key known to the managing network device and the matching electric charging station;

providing the client key from the managing network device to the plug-in electric vehicle via the secure communication channel to allow the plug-in electric vehicle to securely communicate with the matching electric charging station;

receiving, from the matching electric charging station, a message that indicates a signal level detected at the matching electric charging station in response to the service matching message; and

selecting the matching electric charging station based, at least in part, on the matching electric charging station having a highest detected signal level.

25. The method of claim 24, wherein the client key is a temporary key and is generated based, at least in part, on the master key, the client identifier, and at least one member of a group consisting of a sequence number, a random number, a start/end timestamp, a lifetime duration, a message counter, and a location identifier.

26. A non-transitory machine-readable storage medium having instructions stored therein, which when executed by a processor causes the processor to perform operations that comprise:

establishing a secure communication channel between a client network device and a managing network device of a communication network based, at least in part, on a client identifier of the client network device;

determining, based at least in part on a service environment characteristic, a number of service matching messages to be transmitted during a service matching process, wherein the service environment characteristic includes at least one member of a group consisting of a number of cables, a number of cable harnesses, and a number of switch states;

causing the client network device to perform an account authorization process with an accounting network device contemporaneously with the service matching process, wherein the service matching process includes determining a matching service provider based, at least in part, on a service matching message of the service matching messages;

matching the client network device with the matching service provider;

receiving a service voucher at the managing network device from the accounting network device authorizing the matching service provider to service the client network device in response to the accounting network device executing the account authorization process; and

transmitting the service voucher from the managing network device to the matching service provider to allow the matching service provider to service the client network device.

27. The non-transitory machine-readable storage medium of claim 26, wherein the operations further comprise:

generating a client key that is unique to the client network device based, at least in part, on the client identifier and a master key known to the managing network device and the matching service provider;

providing the client key to the client network device via the secure communication channel to allow the client network device to securely communicate with the matching service provider;

receiving, from the matching service provider, a message that indicates a signal level detected at the matching service provider in response to the service matching message; and

selecting the matching service provider based, at least in part, on the matching service provider having a highest detected signal level.

28. The non-transitory machine-readable storage medium of claim 26, wherein the operations further comprise:

determining a first value of the client identifier, wherein the first value was used for executing the service matching process;

determining a second value of the client identifier, wherein the second value was used for executing the account authorization process;

determining whether the first value matches the second value; and

in response to determining that the first value does not match the second value, preventing the matching service provider from servicing the client network device;

wherein transmitting the service voucher from the managing network device to the matching service provider is in response to determining that the first value matches the second value.

29. A non-transitory machine-readable storage medium having instructions stored therein, which when executed by a processor causes the processor to perform operations that comprise:

establishing a secure communication channel with a managing network device of a communication network based, at least in part, on a client identifier of a client network device;

receiving, from the managing network device via the secure communication channel, identification information associated with the managing network device and an indication of a number of service matching messages to be transmitted during a service matching process, wherein the number is determined based, at least in part, on a service environment characteristic, wherein the service environment characteristic includes at least one member of a group consisting of a number of cables, a number of cable harnesses, and a number of switch states;

providing the client identifier and the identification information associated with the managing network device to an accounting network device to cause the accounting network device to execute an account authorization process with the client network device;

contemporaneously with the account authorization process, executing the service matching process with the managing network device and a matching service provider of the communication network, wherein the service matching process includes determining the matching service provider based, at least in part, on a service matching message of the service matching messages; and

detecting receipt of service from the matching service provider after completion of the account authorization process and the service matching process.

30. The non-transitory machine-readable storage medium of claim 29, wherein the operations further comprise:

receiving, from the managing network device, a client key that is unique to the client network device, via the secure communication channel, wherein the client key enables the client network device to securely communicate with the matching service provider;

receiving a client key generation parameter based on which the client key was determined, wherein the client key generation parameter comprises at least one member of a group consisting of a sequence number, a random number, a start/end timestamp, a lifetime duration, a message counter, and a location identifier;

signing the service matching message using the client key; and

transmitting the service matching message and the client key generation parameter to the matching service provider.

31. The non-transitory machine-readable storage medium of claim 30, wherein the operations further comprise:

determining whether a length of the service matching message is greater than a predetermined threshold message length;

in response to determining that the length of the service matching message is greater than the predetermined threshold message length,

transmitting an initialization message including the client key generation parameter to the matching service provider, and

transmitting the client identifier and the sequence number in the service matching message; and

in response to determining that the length of the service matching message is less than the predetermined threshold message length,

transmitting the client key generation parameter as part of the service matching message.