Gateway, client device and methods for facilitating communication between a client device and an application server

Patent metadata

Field	Value
Publication number	US-9985967-B2
Application number	US-201314894142-A
Country	US
Kind code	B2
Filing date	May 29, 2013
Priority date	May 29, 2013
Publication date	May 29, 2018
Grant date	May 29, 2018

Abstract

According to a first aspect, it is presented a method, executed in a gateway, the gateway being arranged to facilitate communication between a client device and an application server. The method comprises the steps of: receiving a client request from the client device, the client request comprising at least a portion being bound for the application server; sending an application server request to the application server; receiving an application server response from the application server, the application server response indicating a need to provide authentication; establishing at least one authentication credential using an authentication server for a connection between the client device and the application server; and sending a client response to the client device, the client response being based on the application server response and comprising the at least one authentication credential. An associated gateway, client device, vehicle, computer program and computer program product are also presented.

First claim

The invention claimed is:

1. A method, executed in a gateway, the gateway being arranged to facilitate communication between a client device and an application server, the method comprising the steps of:
receiving a client request from the client device, the client request comprising at least a portion being bound for the application server;
sending, in response to the client request, an application server request to the application server;
receiving an application server response from the application server, the application server response type unconditionally indicating a need to provide authentication;
in response to the application server response indicating the need to provide authentication, communicating with an authentication server to establish at least one authentication credential that is bound to an identifier associated with the client device, for use by the client device during authentication with the application server; and
sending a client response to the client device, the client response being based on the application server response and comprising the at least one authentication credential, thereby enabling the client device to authenticate itself with the application server.

2. The method according to claim 1 , wherein the step of communicating with the authentication server to establish at least one authentication credential comprises the use of a generic bootstrapping architecture.

3. The method according to claim 1 , wherein the at least one authentication credential comprises a context identifier received from the authentication server and a shared key derived by the gateway as a function of an authentication credential previously stored at the gateway, the identifier associated with the client device, an identifier of the application server, and a nonce returned by the authentication server in association with the context identifier.

4. A gateway arranged to facilitate communication between a client device and an application server, the gateway comprising:
communication circuitry configured for communicating directly or indirectly with a client device and an authentication server; and
processing circuitry configured to:
receive a client request from the client device, the client request comprising at least a portion being bound for the application server;
send, in response to the client request, an application server request to the application server;
receive an application server response from the application server, the application server response type unconditionally indicating a need to provide authentication;
in response to the application server response indicating the need to provide authentication, communicate with an authentication server to establish at least one authentication credential that is bound to an identifier associated with the client device, for use by the client device during authentication with the application server; and
send a client response to the client device, the client response being based on the application server response and comprising the at least one authentication credential, thereby enabling the client device to authenticate itself with the application server.

5. The gateway according to claim 4 , wherein the processing circuitry is configured to use a generic bootstrapping architecture to establish the at least one authentication credential.

6. The gateway according to claim 4 , wherein the at least one authentication credential comprises a context identifier received from the authentication server and a shared key, and wherein the processing circuitry is configured to derive the shared key as a function of an authentication credential previously stored at the gateway, the identifier associated with the client device, an identifier of the application server, and a nonce returned by the authentication server in association with the context identifier.

7. The gateway according to claim 4 , wherein the processing circuitry is configured to generate a new fully qualified domain name (FQDN) for the application server based on an original FQDN for the application server and the identifier associated with the client device, and wherein the processing circuitry is configured to use the new FQDN for identification of the application server when establishing the at least one authentication credential.

8. The gateway according to claim 7 , wherein the processing circuitry is configured to generate the new FQDN as a subdomain of the original FQDN, and the specification of the new FQDN, in relation to the original FQDN, is based on the identifier associated with the client device.

9. The gateway according to claim 7 , wherein the identifier associated with the client device comprises an identifier of the client device.

10. The gateway according to claim 7 , wherein the identifier associated with the client device comprises an identifier of an application executing on the client device.

11. The gateway according to claim 4 , wherein the processing circuitry is further configured to: generate a new Internet Protocol version 6 (IPv6) address for the application server based on an original IPv6 address for the application server and the identifier associated with the client device.

12. The gateway according to claim 11 , wherein the processing circuitry is configured to generate an interface identifier of the new IPv6 address based on the identifier associated with the client device.

13. The gateway according to claim 4 , wherein the processing circuitry is configured to communicate the client request, application server request, application server response and client response using any one or more of the following protocols: Hypertext Transport Protocol and Constrained Application Protocol either protocol being with or without transport layer security.

14. A non-transitory computer-readable medium storing a computer program that, when executed by a processor of a gateway, configures the gateway for facilitating communication between a client device and an application server, the computer program comprising program instructions configuring the gateway to:
receive a client request from the client device, the client request comprising at least a portion being bound for the application server;
send, in response to the client request, an application server request to the application server;
receive an application server response from the application server, the application server response type unconditionally indicating a need to provide authentication;
in response to the application server response indicating the need to provide authentication, communicating with an authentication server to establish at least one authentication credential that is bound to an identifier of the client device, for use by the client device during authentication with the application server; and
send a client response to the client device, the client response being based on the application server response and comprising the at least one authentication credential, thereby enabling the client device to authenticate itself with the application server.

15. A method performed by a device operating as a client with respect to an application server, the method comprising:
sending a client request for the application server, the client request being intercepted or received by a gateway that communicatively couples the client device to the application server;
receiving a client response from the gateway, in response to the gateway device intercepting or receiving a server response sent from the application server in response to the client request, the client response indicating the need for the c

Assignees

• Ericsson Telefon Ab L M
• Ericsson Telefon Ab L M

Inventors

• Salmela Patrik
• Lehtovirta Vesa
• Sethi Mohit
• Slavov Kristian

Classifications

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04W4/005

  Electricity · mapped topic

• H04L61/6059

  Electricity · mapped topic

• H04L63/0884 Primary

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/166

  at the transport layer · CPC title