Multi-domain message routing with E2E tunnel protection

Patent metadata

Field	Value
Publication number	US-11546304-B2
Application number	US-201816649076-A
Country	US
Kind code	B2
Filing date	Sep 28, 2018
Priority date	Nov 13, 2017
Publication date	Jan 3, 2023
Grant date	Jan 3, 2023

Abstract

Systems and techniques to enable message routing among multiple devices and device domains, via end-to-end tunneling techniques, are disclosed. In an example, techniques and device configurations involving the use of RESTful protocols that communicate OSCORE (Object Security for Constrained RESTful Environments) payloads over OSCORE tunnels, involve receiving an OSCORE message having an encrypted COSE (Concise Binary Object Representation (CBOR) Object Signing and Encryption) object payload and inserting the OSCORE message into an OSCORE tunnel message to implement a tunneled communication with a receiving device. Here, the tunnel message includes the OSCORE message within an envelope encrypted COSE object payload. The OSCORE tunnel message may then be transmitted to the receiving device. Further techniques and device configurations for the receipt, processing, conversion, and decryption of such tunneled messages are also disclosed.

First claim

What is claimed is:

1. A device, comprising:
communications circuitry;
processing circuitry; and
a memory device including instructions embodied thereon, wherein the instructions, which when executed by the processing circuitry, configure the processing circuitry to perform operations comprising:
receiving, via the communications circuitry, an OSCORE (Object Security for Constrained RESTful Environments) message, wherein the OSCORE message includes an encrypted COSE (Concise Binary Object Representation (CBOR) Object Signing and Encryption) object payload;
inserting the OSCORE message into an OSCORE tunnel message, wherein the OSCORE tunnel message is used to implement an end-to-end tunneled communication between the device and a destination device, wherein the OSCORE tunnel message is structured to include the OSCORE message within an envelope encrypted COSE object payload of the OSCORE tunnel message; and
transmitting, via the communications circuitry, the OSCORE tunnel message to the destination device in the tunneled communication, the transmitting to provide the OSCORE message inside the envelope encrypted COSE object payload of the OSCORE tunnel message;
wherein the tunneled communication between the device and the destination device includes communication of the envelope encrypted COSE object payload of the OSCORE tunnel message via at least one intermediate device located between the device and the destination device; and
wherein message routing headers of the OSCORE message are encrypted in the envelope encrypted COSE object payload to prevent identification of the message routing headers at the at least one intermediate device.

2. The device of claim 1 , wherein the device is a first proxy device, and wherein the destination device is a second proxy device.

3. The device of claim 1 , the operations further comprising:
translating the OSCORE message from a first format to a second format, wherein the first format is one of a HyperText Transport Protocol (HTTP) message format or a Constrained Application Protocol (COAP) message format, and the second format is the other of the HTTP message format or the COAP message format;
wherein the encrypted COSE object payload is included in the OSCORE message as provided in the one of the HTTP message format or the COAP message format used for the OSCORE message prior to the translating.

4. The device of claim 1 , wherein the encrypted COSE object payload comprises a COSE object including end-to-end headers and a CBOR object, and wherein the CBOR object is encrypted.

5. The device of claim 1 , wherein the OSCORE message comprises one of:
an OSCORE HyperText Transport Protocol (HTTP) message comprising a HTTP request, hop-by-hop headers, and the encrypted COSE object payload; or
an OSCORE Constrained Application Protocol (COAP) message comprising a COAP header, hop-by-hop options, and the encrypted COSE object payload.

6. The device of claim 1 , wherein the envelope encrypted COSE object payload is decrypted into the OSCORE message upon being received at the destination device.

7. The device of claim 1 , wherein the OSCORE message comprises a RESTful communication message provided between: the device operating as one of a client or a server, and the destination device operating as the other of the client or the server.

8. A method for secure communications using OSCORE tunneling, using operations performed by a device comprising:
receiving an OSCORE (Object Security for Constrained RESTful Environments) message, wherein the OSCORE message includes an encrypted COSE (Concise Binary Object Representation (CBOR) Object Signing and Encryption) object payload;
inserting the OSCORE message into an OSCORE tunnel message, wherein the OSCORE tunnel message is used to implement a tunneled communication between the device and a destination device, wherein the OSCORE tunnel message is structured to include the OSCORE message within an envelope encrypted COSE object payload of the OSCORE tunnel message; and
transmitting the OSCORE tunnel message to the destination device in the tunneled communication, the transmitting to provide the OSCORE message inside the envelope encrypted COSE object payload of the OSCORE tunnel message;
wherein the tunneled communication between the device and the destination device includes communication of the envelope encrypted COSE object payload of the OSCORE tunnel message via at least one intermediate device located between the device and the destination device; and
wherein message routing headers of the OSCORE message are encrypted in the envelope encrypted COSE object payload to prevent identification of the message routing headers at the at least one intermediate device.

9. The method of claim 8 , wherein the device is a first proxy device, and wherein the destination device is a second proxy device.

10. The method of claim 8 , the operations further comprising:
translating the OSCORE message from a first format to a second format, wherein the first format is one of a HTTP message format or a Constrained Application Protocol (COAP) message format, and the second format is the other of the HTTP message format or the COAP message format;
wherein the encrypted COSE object payload is included in the OSCORE message as provided in the one of the HTTP message format or the COAP message format used for the OSCORE message prior to the translating.

11. The method of claim 8 , wherein the encrypted COSE object payload comprises a COSE object including end-to-end headers and a CBOR object, wherein the CBOR object is encrypted.

12. The method of claim 8 , wherein the OSCORE message comprises one of:
an OSCORE HyperText Transport Protocol (HTTP) message comprising a HTTP request, hop-by-hop headers, and the encrypted COSE object payload; or
an encrypted OSCORE Constrained Application Protocol (COAP) message comprising a COAP header, hop-by-hop options, and the encrypted COSE object payload.

13. The method of claim 8 , wherein the envelope encrypted COSE object payload is decrypted into the OSCORE message upon being received at the destination device.

14. The method of claim 8 , wherein the OSCORE message comprises a RESTful communication message provided between: the device operating as one of a client or a server, and the destination device operating as the other of the client or the server.

15. A non-transitory machine-readable storage medium including instructions, wherein the instructions, when executed by a processing circuitry of a device, cause the processing circuitry to perform operations comprising:
receiving an OSCORE (Object Security for Constrained RESTful Environments) message, wherein the OSCORE message includes an encrypted COSE (Concise Binary Object Representation (CBOR) Object Signing and Encryption) object payload;
inserting the OSCORE message into an OSCORE tunnel message, wherein the OSCORE tunnel message is used to implement a tunneled communication between the device and a destination device, wherein the OSCORE tunnel message is structured to include the OSCORE message within an envelope encrypted COSE object payload of the OSCORE tunnel message; and
transmitting the OSCORE tunnel message to the destination device in the tunneled communication, the transmitting to provide the OSCORE message inside the envelope encrypted COSE object payload of the OSCORE tunnel message;
wherein the tunneled communication between the device and the destination device includes communication of the envelope encrypted COSE object payload of the OSCORE tunnel message via at least one intermediate device located between the device and the des

Assignees

• Intel Corp

Inventors

• Smith Ned M

Classifications

• H04L63/029 Primary

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• H04L63/0281

  Proxies · CPC title

• H04L63/0421 Primary

  Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer · CPC title

• H04W12/02

  Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] · CPC title