Method for assigning an agent device from a first device registry to a second device registry

Patent metadata

Field	Value
Publication number	US-9307405-B2
Application number	US-201314056459-A
Country	US
Kind code	B2
Filing date	Oct 17, 2013
Priority date	Oct 17, 2013
Publication date	Apr 5, 2016
Grant date	Apr 5, 2016

Abstract

An agent device is registered in a first device registry maintained by a first registry apparatus for authenticating agent devices for communicating with application providing apparatuses. The agent device can be assigned to a second device registry maintained by second registry apparatus. The method of assignment comprises the first registry apparatus receiving from a requestor device a device assignment request. In response to the device assignment request, the first registry apparatus checks whether the agent device is allowed to be assigned to the second device registry, and if so, the agent device transmits second authentication information for authenticating the identity of the agent device to the second registry apparatus which registers this in the second device registry.

First claim

We claim:

1. A method for assigning an agent device, which is registered in a first device registry maintained by a first registry apparatus for authenticating agent devices for communicating with one or more first application providing apparatuses, to a second device registry maintained by a second registry apparatus for authenticating agent devices for communicating with one or more second application providing apparatuses, wherein the first device registry comprises first authentication information for authenticating the identity of the agent device, the method comprising:
(a) the first registry apparatus receiving from a requestor device a device assignment request requesting that the agent device be assigned to the second device registry;
(b) in response to the device assignment request, the first registry apparatus checking whether the agent device is allowed to be assigned to the second device registry in response to the device assignment request from the requestor device;
(c) if the agent device is allowed to be assigned to the second device registry, the agent device transmitting to the second registry apparatus second authentication information for authenticating the identity of the agent device; and
(d) the second registry apparatus registering the second authentication information for the agent device in the second device registry;
wherein the first and second device registries facilitate encrypted communication between the agent device and the one or more first and second application providing apparatuses, such that after that facilitation, the agent device and the one or more first and second application providing apparatuses communicate with encryption with each other without communication via the first and second registry try apparatus.

2. The method according to claim 1 , wherein the second authentication information is the same as the first authentication information.

3. The method according to claim 1 , wherein the second authentication information is different to the first authentication information.

4. The method according to claim 3 , wherein the agent device comprises authentication information generating circuitry for generating the second authentication information.

5. The method according to claim 1 , wherein the first registry apparatus deletes the first authentication information for the agent device from the first device registry after determining that the agent device is allowed to be assigned to the second device registry.

6. The method according to claim 1 , wherein the first authentication information comprises a first public key corresponding to a first private key held by the agent device, and the second authentication information comprises a second public key corresponding to a second private key held by the agent device.

7. The method according to claim 6 , wherein the agent device deletes the first private key after transmitting the second authentication information to the second registry apparatus.

8. The method according to claim 6 , wherein step (c) comprises the agent device transmitting a digital certificate comprising the second public key to the second registry apparatus, and step (d) comprises the second registry apparatus signing the digital certificate.

9. The method according to claim 1 , wherein if the agent device is allowed to be assigned to the second device registry, then at least one of the first registry apparatus, the second registry apparatus and the requestor device instructs the agent device to transmit said second authentication information to the second registry apparatus.

10. The method according to claim 1 , wherein if the agent device is allowed to be assigned to the second device registry, then at least one of the agent device and the first registry apparatus performs an atomic operation, the atomic operation comprising at least one of generating information corresponding to the second authentication information and deleting information corresponding to the first authentication information.

11. The method according to claim 1 , wherein the requestor device comprises the second registry apparatus.

12. The method according to claim 1 , wherein said checking whether the agent device is allowed to be assigned to the second device registry comprises the first registry apparatus authenticating the requestor device.

13. The method according to claim 1 , wherein said checking whether the agent device is allowed to be assigned to the second device registry comprises the first registry apparatus checking that the requestor device is a trusted device that has already been authenticated.

14. The method according to claim 1 , wherein said checking whether the agent device is allowed to be assigned to the second device registry comprises the first registry apparatus checking that the agent device supports assignment to the second device registry.

15. The method according to claim 1 , comprising steps of:
one of the first registry apparatus, the second registry apparatus and the requestor apparatus transmitting to the agent device an address of the second registry apparatus; and
the agent device storing the address of the second registry apparatus for enabling subsequent communication with the second registry apparatus.

16. The method according to claim 1 , further comprising steps of:
(e) the first registry apparatus receiving a reset request to reassign the agent device to the first device registry;
(f) the first registry apparatus checking whether the agent device is allowed to be reassigned to the first device registry in response to the reset request;
(g) if the agent device is allowed to be reassigned to the first device registry, the agent device transmitting third authentication information to the first registry apparatus; and
(h) the first registry apparatus registering the third authentication information in the first device registry.

17. The method according to claim 1 , wherein the agent device is assigned from the first device registry to the second device registry without intervention from a user of the agent device.

18. A first registry apparatus for authenticating agent devices for communicating with one or more application providing apparatuses, comprising:
storage circuitry configured to store a first device registry of agent devices, the first device registry comprising authentication information for authenticating the identity of the agent devices;
communication circuitry configured to receive, from a requestor device, a device assignment request requesting that a specified agent device registered in the first device registry is assigned to a second device registry of agent devices maintained by a second registry apparatus;
processing circuitry configured to check whether the specified agent device is allowed to be assigned to the second device registry in response to the device assignment request, and if the specified agent device is allowed to be assigned to the second device registry, configured to control the communication circuitry to instruct at least one of the specified agent device, the requestor device and the second registry apparatus that the specified agent device can be assigned to the second device registry;
wherein the first registry apparatus is configured to facilitate encrypted communication between the agent devices and the one or more application providing apparatuses, such that after that facilitation, the agent devices and the one or more application providing apparatuses communicate with encryption with each other without communication via the first and second

Assignees

• Arm Ip Ltd

Inventors

• Curtis William Allen
• Anson Douglas Miles
• Balanza Kerry Mcguire

Classifications

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/06

  for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08) · CPC title

• H04W4/70

  Services for machine-to-machine communication [M2M] or machine type communication [MTC] · CPC title

• H04L63/0876

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title