M2M Bootstrap Using EAP PANA Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
M2M Automated Bootstrap procedures require a method for self-diagnosis without manual user intervention, and existing solutions like TLS are inefficient due to code redundancy, limited extensibility, and unsuitable authentication models.
Innovation Solution
Employing EAP and PANA protocols for network access authentication, which allow code reuse, extensibility, and a 3-party authentication model, enabling efficient and automated bootstrap procedures by leveraging existing authentication methods and reducing processing overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If TLS protocol is used for M2M bootstrap, then security is provided, but code redundancy increases and development cost rises
Solution Approach 1:
The patent applies universality by reusing the EAP authentication framework and PANA protocol, which are already widely deployed for network access authentication in WiFi, WiMAX, Zigbee, and Ethernet. This allows the same authentication infrastructure to serve multiple purposes including M2M bootstrap, eliminating the need for separate TLS implementation and reducing code redundancy while maintaining security
2Reliability
If TLS protocol is used for M2M bootstrap, then authentication is provided, but extensibility is limited to only PSK and certificate-based methods
Solution Approach 1:
The patent leverages the inherent extensibility of EAP and PANA protocols, which support multiple authentication methods including but not limited to PSK and certificate-based authentication. The EAP framework allows dynamic selection and integration of various authentication mechanisms, providing both reliable authentication and high adaptability to different M2M scenarios
Solution Approach 2:
The patent applies dynamics by enabling the M2M bootstrap process to dynamically select appropriate authentication methods based on device capabilities and network requirements. The EAP/PANA framework allows the authentication method to be flexibly configured and changed without requiring a complete protocol redesign, making the system adaptable to evolving security requirements
3Reliability
If TLS protocol is used for M2M bootstrap, then authentication is achieved, but processing overhead increases due to TCP-based stack requirement
Solution Approach 1:
The patent extracts the authentication function from the transport layer dependency by using EAP over PANA, which can operate over UDP. This separation allows the authentication mechanism to be independent of the underlying transport protocol, eliminating the mandatory TCP stack requirement and reducing processing overhead while maintaining authentication reliability
Solution Approach 2:
The patent copies the successful authentication model from network access scenarios (where EAP/PANA are already proven) and applies it to M2M bootstrap. This proven model has been optimized for efficient processing in resource-constrained environments, thereby reducing processing overhead compared to implementing TLS from scratch
4Reliability
If TLS-based solution is used for M2M bootstrap, then authentication is provided, but the 2-party design does not fit the M2M architecture
Solution Approach 1:
The patent applies universality by adopting the 3-party authentication model (device, network, and authentication server) that is already proven in network access scenarios. This model naturally accommodates the M2M architecture where a bootstrap server or HSS is needed to provision devices, providing both reliable authentication and better architectural fit
Data Source
Figure 1~2
Figure 3
Figure 4a
AI summary
A method for machine-to-machine (M2M) service bootstrapping of an M2M device and a corresponding apparatus are provided. The method comprises transmitting, by the M2M network node server, a first message to an M2M device, the first message comprising a service provider (SP) identifier (ID) and at least one of a usage type, an M2M service bootstrap function (MSBF) ID, a network service capability layer (NSCL) ID, and a target device ID; identifying, by the M2M network node server, whether the M2M device is assigned a service provider assigned device ID; transmitting, by the M2M network node server, a second message to the M2M device after transmitting the first message to the M2M device; and generating, by the M2M network node server, an M2M root key based on the SP ID and the service provider assigned device ID if the second message from the network M2M node includes the service provider assigned device ID based on a result of the identification, wherein the M2M root key is used for mutual authentication between the M2M device and a service provider corresponding to the SP ID, and wherein the generating of the M2M root key comprises generating, if the service provider assigned device ID is not assigned by the network, the M2M root key based on an extended master session key (EMSK), a predetermined string, the SP ID, and the M2M device's own ID.