Communicating with a machine to machine device

Administering an interface Ua 150 between a machine-to-machine, M2M, device 110 and a network application function, NAF, 122 for secure communication between the M2M device and the NAF. In one method, the M2M device comprises security information for enabling secure communication via the interface, and administers the interface by: setting a secure interface lifetime parameter based on a lifetime of at least part of the security information; and transmitting administration data to the NAF, wherein the administration data comprises the secure interface lifetime parameter. Also disclosed is a method for a NAF to administer an interface between the NAF and a M2M device, comprising: receiving administration data from the M2M device, the registration data comprising a secure interface lifetime parameter that has been set based on a lifetime of at least part of the security information; and transmitting an administration response to the M2M device. The interface may be a Lightweight M2M, LWM2M ...

Communicating with a machine to machine device

The present disclosure provides a wireless communication module for use in a machine to machine device, M2M, the M2M device also comprising an integrated circuit card. The present disclosure also provides an integrated circuit card for use in a machine to machine device. The wireless communication module of the first aspect and the integrated circuit card of the alternative aspect are each configured for using a shared secret and at least part of a first data object to obtain a second data object from the integrated circuit card. The second data object is derived from the existing shared secret, is suitable for deriving security information and is suitable for use in establishing secure communication between the M2M device and a network application function, NAF. Many possible implementations are described using various aspects of lightweight M2M (LWM2M) standards, Generic Authentication Architecture (GAA) standards, Generic Bootstrapping Architecture (GBA) standards, OMA standards, 3GPP ...

Machine-to-machine cellular communication security

Facilitating authentication on communication between a mobile terminal and a server is achieved. The communication is made through a Serving GPRS Support Node (SGSN) of a network in which the mobile terminal is operating. A Home Public Land Mobile Network (PLMN) of the mobile terminal generates a ciphering key for encryption of packet-switched data between the mobile terminal and the server. As part of a message from a network entity in the Home PLMN to the SGSN in which the SGSN expects to receive the ciphering key, alternative data is communicated in place of the ciphering key. Secure communication between the mobile terminal and the server is performed by applying encryption using a ciphering key generated by a network entity in a Home PLMN of the mobile terminal in messages between the mobile terminal and the server.

Communicating with a machine to machine device

A method and system for routing communications traffic between a machine to machine, (M2M) device connected to a telecommunications network and having an International Mobile Subscriber Identity (IMSI) and a server, the method comprising assigning an access point name (APN) from a plurality of APNs based on the IMSI of the M2M device, routing, via the assigned APN, communications traffic between the M2M device and the server, wherein the server is determined based on one or more of: the IMSI, the APN and a characteristic of a communication traffic between the M2M device and the server. The M2M device may first connect to a default server which then may indicate an address for an alternative server or preferred server for load balancing or other network configurations to be achieved. Also disclosed is a secure method of authentication and communication with the server using Generic Bootstrapping Architecture (GBA).

Communicating with a machine to machine device

The invention relates to the distribution of session keys/shared secrets to UEs (user equipments) and NAFs (network application functions) in a GBA (generic bootstrap architecture) or GBA-Push environment. Messages from the GBF (generic bootstrap function) server 130 to the UE 110 containing the session key are tunnelled via the NAF 122. A message providing the key to the NAF is also sent. The invention is intended to be used with M2M (machine to machine) type applications. Tunnelling the messages in intended to reduce the amount/complexity of interfaces 114/116 on the M2M device 110.

Machine-to-machine cellular communication security

Communication between a mobile terminal operating in a cellular network and a server is provided. Communication between the mobile terminal and the server is routed through a Serving GPRS Support Node (SGSN) of the cellular network in which the mobile terminal is operating. Cryptographic integrity check information is communicated in data link layer messages between the mobile terminal and the SGSN.

Transport layer authentication

Access control

Methods and systems for operating a secure mobile device

The invention assumes a system wherein a key at a machine type communications (MTC) user equipment (UE) has been derived using generic bootstrapping architecture (GBA). In one claim this key is used to protect another key, preferably a public key, which is used to verify some protected data. In another claim one interface is used to derive the GBA key and another interface is used to transmit the GBA key or a key protected by the GBA key. In another claim two devices obtain two key data using GBA and a server respectively and then securely associate using the key data. In another claim a machine to machine (M2M) device derives a GBA key and uses it to verify received data.

Service provisioning

Provisioning a subscription of a service to a device comprising: receiving a message from a device 210, the message protected by first provisioning data installed on the device 205. Authenticating the message 220 using data corresponding to the first provisioning data. On successful authentication 230, providing data enabling the device to recover protected second provisioning data from a subscription manager and providing the device with the protected second provisioning data 260. A second subscription manager may also be used. Optionally the message may comprise a signature verification key corresponding to a signature key of the device. A session key may be generated using Diffie-Hellman exchange and the second provisioning data may be provided to the device encrypted by a generated session key. The first provisioning data may comprise a group key, provided to a plurality of devices, and a device key, unique to the device. Part or all of the provisioning data may be stored within the ...