M2M Authorization Updates for Signed Device Identity Changes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Machine-to-Machine (M2M) communication systems, when an access device's identifier changes due to re-registration, the existing authorization relationships are disrupted, leading to service discontinuity and impaired resource access.
Innovation Solution
The system identifies the access device's identity by verifying the signature of verification information and updates the authorization relationships accordingly, ensuring seamless resource access by maintaining the original authorization relationship.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the access device re-registers with a different registrar and obtains a new identifier, then the device can continue to access the M2M system, but the existing authorization relationships are disrupted and service continuity is lost
Solution Approach 1:
The system performs preliminary actions by storing the original device identifier in the authorization relationship before the device re-registers. When the device obtains a new identifier, the system can match it with the stored original identifier through verification information, thereby maintaining the authorization relationship and ensuring service continuity.
Solution Approach 2:
The system introduces verification information as an intermediary element that links the original device identifier with the new device identifier. This verification information acts as a mediator that enables the authorization system to recognize the device's identity despite the identifier change, thus maintaining authorization relationships across re-registration events.
2Reliability
If the system maintains strict binding between device identifier and authorization relationship, then authorization security is ensured, but device re-registration causes authorization failure and service interruption
Solution Approach 1:
The system segments the authorization verification process into two independent parts: the original device identifier stored in the authorization relationship, and the current device identifier presented by the device. By separating these identifiers and introducing verification information as a linking mechanism, the system maintains security through the original identifier while enabling adaptability through the current identifier.
Solution Approach 2:
The system allows the device identifier parameter to change during re-registration while maintaining the authorization relationship. The verification information serves as a stable parameter that remains valid across identifier changes, enabling the system to accommodate parameter changes (identifier updates) without compromising authorization security.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention relates to an authorization processing method and a device. The following is disclosed: An authorization server receives an authorization update request including a first identifier of an access device; sends, to the access device, an authorization update response including signature request information, where the signature request information instructs the access device to sign verification information; receives a signature verification request sent by the access device, where the signature verification request includes the first identifier, the verification information, and a signature of the verification information, and the signature of the verification information is generated by the access device by signing the verification information by using a key; obtains a stored authorization relationship according to the verification information; determines that the signature of the verification information in the signature verification request is valid; and updates the authorization relationship according to the first identifier. According to the method in the present invention, when the identifier of the access device in an M2M system changes, the M2M system can identify an identity of the access device by determining whether the signature of the verification information is valid, and further update an existing authorization relationship, so that the access device can continue to use the existing authorization relationship.