Generic bootstrapping architecture protocol

Patent metadata

Field	Value
Publication number	US-10484869-B2
Application number	US-201615208149-A
Country	US
Kind code	B2
Filing date	Jul 12, 2016
Priority date	Jul 13, 2015
Publication date	Nov 19, 2019
Grant date	Nov 19, 2019

Abstract

Method and system for communicating securely with a user equipment, UE, using generic bootstrapping architecture, GBA, the system comprising a bootstrapping server function, BSF. A proxy server configured to receive messages from a user equipment, UE, in a first format. Convert the received messages from the first format to a second format. Transmit the received UE messages to a bootstrapping server function, BSF, in the second format. Receive messages from the BSF, in a third format. Convert the messages received from the BSF from the third format to a fourth format. Transmit the received BSF messages to the UE in the fourth format.

First claim

The invention claimed is:

1. A proxy server for generic bootstrapping architecture, (GBA) the proxy server configured to:
receive messages from a user equipment, UE, in a first format;
convert the messages received from the UE from the first format to a second format, including the proxy server operating to check whether each of the messages received from the UE includes content presenting a risk of system crashing or security vulnerabilities at a bootstrapping server function (BSF) and to reject or correct each of the messages received from the UE that is determined to be insecure;
check the messages received from the UE for compliance with GBA requirements;
transmit each of the messages received from the UE that is not rejected in the second format to the BSF;
receive messages from the BSF in the third format;
convert the messages received from the BSF from the third format to a fourth format; and
transmit the messages received from the BSF in the fourth format to the UE.

2. The proxy server of claim 1 , wherein the messages received from the UE by the proxy server and/or transmitted from the proxy server to the UE are over a Ub interface, and/or wherein the messages received from the BSF by the proxy server and/or transmitted from the proxy server to the BSF are over a Ub interface.

3. The proxy server according to claim 1 wherein the format conversion from the first format to the second format and from the third format to the fourth format further comprise a translation of protocol.

4. The proxy server according to claim 1 formed within a device management, DM, server.

5. A method for communicating between a user equipment, UE, and a bootstrapping server function, (BSF) using generic bootstrapping architecture (GBA), the method comprising:
receiving one or more messages from the UE at a proxy server, in a first format;
converting the one or more messages received from the UE from the first format to a second format, including checking whether each of the messages received from the UE includes content presenting a risk of system crashing or security vulnerabilities at the BSF and rejecting or correcting each of the messages received from the UE that is determined to be insecure;
checking the messages received from the UE for compliance with GBA requirements;
transmitting each of the one or more messages received from the UE that is not rejected in the second format from the proxy server to the BSF;
receiving one or more messages from the BSF in a third format at the proxy server;
converting the one or more messages received from the BSF from the third format to a fourth format; and
transmitting the one or more messages received from the BSF in the fourth format from the proxy server to the UE.

6. The method of claim 5 , wherein the one or more messages received from the UE by the proxy server and/or transmitted from the proxy server to the UE are over a Ub interface, and further wherein the one or more messages received from the BSF by the proxy server and/or transmitted from the proxy server to the BSF are over a Ub interface.

7. The method of claim 5 , wherein the received and transmitted one or more UE and BSF messages include:
a request for a shared secret received from the UE and transmitted to the BSF; and
data to establish the shared secret received from the BSF and transmitted to the UE.

8. The method of claim 7 , wherein the request for the shared secret transmitted to the BSF includes an identifier of the UE.

9. The method of claim 8 , wherein the identifier of the UE is obtained from a device management, DM, server or a network application function, NAF.

10. The method of claim 9 further comprising the DM server obtaining the UE identifier from a Radius Accounting Start message.

11. The method of claim 7 , wherein the data to establish the shared secret received from the BSF is transmitted to the UE from the proxy server using GBA push messaging.

12. The method of claim 11 , wherein the push message is delivered over CoAP.

13. The method of claim 12 , wherein the CoAP is bound to UDP or SMS.

14. The method of claim according to claim 11 , wherein the one or more messages received from the UE by the proxy server and/or transmitted from the proxy server to the UE are GBA push messages, and further wherein the one or more messages received from the BSF by the proxy server and/or transmitted from the proxy server to the BSF are GBA push messages.

15. The method according to claim 7 further comprising authenticating, verifying and/or proving possession of the shared secret between the BSF and UE directly over CoAP or LWM2M protocols.

16. The method according to claim 7 , wherein the proxy server is formed together with a network application function, NAF, as a device management, DM server.

17. The method of claim 16 further comprising using the shared secret or a further derived shared secret (Ks_NAF) to secure a communication between the UE and the NAF.

18. The method according to claim 7 , wherein the shared secret is referenced by a bootstrapping transaction identifier, B-TID.

19. The method of claim 18 , wherein the B-TID is passed directly to a network application function, NAF, from the proxy server.

20. The method of claim 19 further comprising passing the shared secret or a further derived shared secret (Ks_NAF) directly from the proxy server to the NAF.

21. A system for communicating securely with a user equipment (UE), using generic bootstrapping architecture (GBA) the system comprising:
a bootstrapping server function (BSF); and
a proxy server configured to:
receive messages from the UE in a first format;
convert the messages received from the UE from the first format to a second format, including the proxy server operating to check whether each of the messages received from the UE includes content presenting a risk of system crashing or security vulnerabilities at the BSF and to reject or correct each of the messages received from the UE that is determined to be insecure;
check the messages received from the UE for compliance with GBA requirements;
transmit each of the messages received from the UE that is not rejected in the second format to the BSF;
receive messages from the BSF in a third format;
convert the messages received from the BSF from the third format to a fourth format; and
transmit the messages received from the BSF in the fourth format to the UE.

22. The system of claim 21 , wherein the proxy server is formed together with a network application function, NAF, as a device management, DM server.

23. The system of claim 22 , wherein the DM server further comprises a buffer arranged to store one or more identifiers of the UE and an associated address.

24. The system of claim 23 , wherein the buffer is a circular buffer.

25. The system of claim 23 , wherein the buffer is further arranged to provide the one or more identifiers of the UE for a particular address.

26. The system according to claim 21 , further comprising a Ub interface between the UE and the proxy server and/or between the proxy server and the BSF.

Assignees

• Vodafone Ip Licensing Ltd

Inventors

• Bone Nicholas
• Snape Tim

Classifications

• H04W4/70

  Services for machine-to-machine communication [M2M] or machine type communication [MTC] · CPC title

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04W4/12

  Messaging; Mailboxes; Announcements · CPC title

• H04W12/06 Primary

  Authentication · CPC title

• H04L63/1466

  Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks · CPC title