Machine-To-Machine Gateway Architecture

Patent metadata

Field	Value
Publication number	US-2018014192-A1
Application number	US-201715699843-A
Country	US
Kind code	A1
Filing date	Sep 8, 2017
Priority date	Dec 28, 2009
Publication date	Jan 11, 2018
Grant date	—

Abstract

Systems, methods, and instrumentalities are disclosed that provide for a gateway outside of a network domain to provide services to a plurality of devices. For example, the gateway may act as a management entity or as a proxy for the network domain. As a management entity, the gateway may perform a security function relating to each of the plurality of devices. The gateway may perform the security function without the network domain participating or having knowledge of the particular devices. As a proxy for the network, the gateway may receive a command from the network domain to perform a security function relating to each of a plurality of devices. The network may know the identity of each of the plurality of devices. The gateway may perform the security function for each of the plurality of devices and aggregate related information before sending the information to the network domain.

First claim

1 . In a system comprising a network domain that is capable of providing one or more service capabilities to a plurality of devices in communication with the network domain, a method of offloading certain functionality of the network domain to an entity outside of the network domain, the method comprising, by the entity:
establishing trust with the network domain; establishing a connection with each of the plurality of devices; performing a security function for each of the plurality of devices; and reporting information to the network domain relating to each of the plurality of devices.

2 . The method of claim 1 , wherein the information is aggregated from each of the plurality of devices.

3 . The method of claim 1 , wherein aggregated security functions are parsed and performed for each of the plurality of devices.

4 . The method of claim 1 , wherein the reporting is in response to a request from the network domain.

5 . The method of claim 4 , wherein the network domain is unaware of an identity of each of the plurality of devices.

6 . The method of claim 1 , wherein the reporting is performed periodically.

7 . The method of claim 1 , wherein the security function comprises registering and authenticating each of the plurality of devices with the network domain.

8 . The method of claim 7 , wherein the registering and authenticating includes using a bootstrapped credential.

9 . The method of claim 1 , wherein the security function comprises provisioning and migration of credentials to each of the plurality of devices.

10 . The method of claim 1 , wherein the security function comprises provisioning of security policies to each of the plurality of devices.

11 . The method of claim 1 , wherein the security function comprises establishing a trustworthy functionality in each of the plurality of devices, wherein an integrity validation for each of the plurality of devices is performed.

12 . The method of claim 1 , wherein the security function comprises providing device management for each of the plurality of devices.

13 . The method of claim 12 , wherein a critical failure alarm associated with at least one of the plurality of devices is sent to the network domain.

14 . The method of claim 1 , wherein the security function comprises establishing, for at least one of the plurality of devices, at least one of: a security association, a communication channel, or a communication link.

15 . The method of claim 1 , further comprising:
determining an integrity breach or failure associated with one or more of the plurality of devices; and quarantining the one or more of the plurality of devices.

16 . The method of claim 1 , wherein the security function is performed on behalf of the network domain without network domain participation.

17 . In a system comprising a network domain that is capable of providing one or more service capabilities to a plurality of devices in communication with the network domain, a method of offloading certain functionality of the network domain to an entity outside of the network domain, the method comprising, by the entity:
establishing trust with the network domain; receiving a command from the network domain to perform a security function relating to each of the plurality of devices; performing the security function for each of the plurality of devices; aggregating information from each of the plurality of devices relating to the performed security function; and sending the aggregated information to the network domain.

18 . The method of claim 17 , wherein the security function comprises registering and authenticating each of the plurality of devices with the network domain.

19 . The method of claim 18 , wherein the registering and authenticating includes using a bootstrapped credential.

20 . The method of claim 17 , wherein the security function comprises provisioning and migration of credentials to each of the plurality of devices.

21 .- 26 . (canceled)

Assignees

• Interdigital Patent Holdings Inc

Inventors

• Pattar Sudhir B
• Cha Inhyok
• Schmidt Andreas
• Leicher Andreas
• Shah Yogendra C
• Chitrapu Prabhakar R
• Case Lawrence

Classifications

• H04W4/00

  Services specially adapted for wireless communication networks; Facilities therefor · CPC title

• H04W12/06 Primary

  Authentication · CPC title

• H04W12/08

  Access security · CPC title

• H04W4/70

  Services for machine-to-machine communication [M2M] or machine type communication [MTC] · CPC title

• H04W12/10

  Integrity · CPC title