Method and apparatus for enabling machine to machine communication

Patent metadata

Field	Value
Publication number	US-9826335-B2
Application number	US-86300909-A
Country	US
Kind code	B2
Filing date	Jan 21, 2009
Priority date	Jan 18, 2008
Publication date	Nov 21, 2017
Grant date	Nov 21, 2017

Abstract

A method and apparatus for performing secure Machine-to-Machine (M2M) provisioning and communication is disclosed. In particular a temporary private identifier, or provisional connectivity identification (PCID), for uniquely identifying machine-to-machine equipment (M2ME) is also disclosed. Additionally, methods and apparatus for use in validating, authenticating and provisioning a M2ME is also disclosed. The validation procedures disclosed include an autonomous, semi-autonomous, and remote validation are disclosed. The provisioning procedures include methods for re-provisioning the M2ME. Procedures for updating software, and detecting tampering with the M2ME are also disclosed.

First claim

What is claimed is:

1. In a system comprising a visited network operator (VNO), a registration operator (RO), and a machine-to-machine equipment (M2ME) having a trusted environment (TRE), wherein the VNO, RO, and M2ME communicate via a network, a method performed by the M2ME, the method comprising:
transmitting, to the VNO, a network attach request message comprising a temporary private identifier;
authenticating with the VNO using the temporary private identifier, the temporary private identifier being a provisional connectivity identification (PCID) valid for a validity period;
generating, by the TRE, security-critical executable code and sending the security-critical executable code to a platform verification authority;
receiving authentication vectors if the platform verification authority validates an integrity, using the security-critical executable code, of the TRE that is within the M2ME;
after the M2ME is authenticated with the VNO and after the TRE is validated by the platform verification authority, establishing IP connectivity with the RO via the VNO;
receiving a manageable identity (MID) from the RO;
provisioning the MID on the M2ME and reporting a success message to the RO; and
when the validity period expires, removing the PCID such that another M2ME can use the PCID.

2. The method of claim 1 , the method further comprising:
validating the M2ME; and
based on the validation of the M2ME, sending a validation success message or a validation failure message to the platform verification authority via the VNO.

3. The method of claim 2 , wherein the validation of the M2ME is at least partially determined based on a validation procedure performed by the trusted environment (TRE) within the M2ME.

4. The method of claim 3 , wherein the validation procedure is performed autonomously within the M2ME.

5. The method of claim 3 , where in the validation procedure is performed semi-autonomously by the M2ME.

6. The method of claim 1 , wherein the MID comprises at least one of a universal mobile telecommunications (UMTS) subscriber identity module (USIM) function, credentials, or configuration information which enable the M2ME to authenticate with a selected home operator (SHO).

7. The method of claim 1 , wherein the RO comprises an initial connectivity function (ICF), a discovery and registration function (DRF), and a download and provisioning function (DPF).

8. The method of claim 7 , wherein the initial connectivity function (ICF), the discovery and registration function (DRF), and the download and provisioning function (DPF) are separate entities in the network.

9. A machine-to-machine equipment (M2ME) configured to communicate, via a network, with a visited network operator (VNO) and a registration operator (RO), the M2ME having a trusted environment (TRE), the M2ME comprising:
a memory comprising executable instructions; and
a processor in communication with the memory, the instructions, when executed by the processor, cause the processor to effectuate operations comprising:
transmitting, to the VNO, a network attach request message comprising a temporary private identifier;
authenticating with the VNO using the temporary private identifier, the temporary private identifier being a provisional connectivity identification (PCID) valid for a validity period;
generating, by TRE, security-critical executable code and sending the security-critical executable code to a platform verification authority;
receiving authentication vectors if the platform verification authority validates an integrity, using the security-critical executable code, of the TRE that is within the M2ME;
after the M2ME is authenticated with the VNO and after the TRE is validated by the platform verification authority, establishing IP connectivity with the RO via the VNO;
receiving a manageable identity (MID) from the RO;
provisioning the MID on the M2ME and reporting a success message to the RO; and
when the validity period expires, removing the PCID such that another M2ME can use the PCID.

10. The M2ME of claim 9 , wherein the processor is further configured to execute the instructions to perform operations comprising:
validating the M2ME; and
based on the validation of the M2ME, sending a validation success message or a validation failure message to platform verification authority via the VNO.

11. The M2ME of claim 10 , wherein the validation of the M2ME is at least partially determined based on a validation procedure performed by the trusted environment (TRE) within the M2ME.

12. The M2ME of claim 11 , wherein the validation procedure is performed autonomously within the M2ME.

13. The M2ME of claim 11 , where in the validation procedure is performed semi-autonomously by the M2ME.

14. The M2ME of claim 9 , wherein the MID comprises at least one of a universal mobile telecommunications (UMTS) subscriber identity module (USIM) function, credentials, or configuration information which enable the M2ME to authenticate with a selected home operator (SHO).

15. The M2ME of claim 9 , wherein the RO comprises an initial connectivity function (ICF), a discovery and registration function (DRF), and a download and provisioning function (DPF).

16. The M2ME of claim 15 , wherein the initial connectivity function (ICF), the discovery and registration function (DRF), and the download and provisioning function (DPF) are separate entities in the network.

Assignees

• Cha Inhyok
• Shah Yogendra C
• Schmidt Andreas U
• Meyerstein Michael V
• Interdigital Patent Holdings Inc

Inventors

• Cha Inhyok
• Shah Yogendra C
• Schmidt Andreas U
• Meyerstein Michael V

Classifications

• H04W12/06

  Authentication · CPC title

• H04W12/08

  Access security · CPC title

• H04W4/001

  Electricity · mapped topic

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/08

  Key distribution {or management, e.g. generation, sharing or updating, of cryptographic keys or passwords (network architectures or network communication protocols for supporting key management in a packet data network H04L63/06)} · CPC title