# US 10,313,116 B2 · Apparatuses and a method for protecting a bootstrap message in a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,116 B2 - Document ID: US10313116B2 - Status: Granted - Kind: B2 - Application number: 14/454,853 - Filed: 2014-08-08 - Published: 2014-11-27 - Granted: 2019-06-04 - Earliest claimed: 2009-02-05 - Assignees: Telefonaktiebolaget LM Ericsson (publ) - Applicants: Telefonaktiebolaget LM Ericsson (publ) - Inventors: Luis Barriga; Per-Anders Dysenius; Magnus Lindström - Web page: https://patentgrep.com/patent/US10313116B2 ## CPC - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)} - H04L 41/0803: Configuration setting - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04W 12/0431: Key distribution or pre-distribution; Key agreement - H04W 12/12: Detection or prevention of fraud - H04L 2209/80: Wireless - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract The embodiments of the present invention relate to apparatuses in the form of a first network unit and a device, and also relates to a method for enabling protection of a bootstrap message in a device management network system. The method comprises: receiving at the first network unit, a request to bootstrap the device; transmit a request for a bootstrap key, to a second network unit; receiving a message comprising the bootstrap key and further comprises trigger information and transmitting the trigger information to the device to trigger generation of the bootstrap key internally in the device. Thereafter a protected bootstrap message can be transmitted to the device from the first network unit, and when the device verifies and/or decrypts the bootstrap message, device management (DM) sessions can start between the device and the first network unit. ## Claims ### Claim 1 A node implementing a network application function for enabling protection of a bootstrap message, the node comprising: one or more processing circuits and a memory, the memory containing instructions executable by the one or more processing circuits whereby the network application function is configured to: receive an identifier of a device that is to be bootstrapped and an identifier of a subscriber associated with said device; send to a bootstrapping server function a request for a bootstrap key that is associated with the identifier for said subscriber and that will protect a bootstrap message to be sent to the device to provision the device with the ability to initiate a management session with a device management (DM) network system over an IP connection, wherein said management session configures the device with settings that the device requires in order for the device to support one or more services, wherein the request for the bootstrap key also requests trigger information that will trigger the device itself to generate the bootstrap key; receive the requested bootstrap key and the trigger information from the bootstrapping server function; and send the trigger information to the device to bootstrap the device; wherein the bootstrap message comprises service setting parameters, a username and a password, and the bootstrap message is further protected by encrypting the bootstrap message with the bootstrap key, wherein the username and password are used to authenticate with the DM network system. ### Claim 2 (depends on 1) The node of claim 1, wherein the service setting parameters include parameters that configure the device to accept management commands from the DM network system during the management session. ### Claim 3 (depends on 1) The node of claim 1, wherein the service setting parameters include parameters that provision the device with capability for General Packet Radio Service (GPRS). ### Claim 4 (depends on 1) The node of claim 1, wherein the trigger information comprises GBA PUSH information (GPI), and wherein the request for the bootstrap key and the trigger information comprises a GPI request message. ### Claim 5 (depends on 1) The node of claim 1, wherein said settings with which the device is configured during the management session include settings for at least one of an email service and a Multimedia Messaging Service (MMS). ### Claim 6 A server comprising: one or more processing circuits and a memory, the memory containing instructions executable by the one or more processing circuits whereby the server is configured to: receive a request to bootstrap a device that includes an identifier of the device and an identifier of a subscriber associated with the device; obtain from a bootstrapping server function a bootstrap key that is associated with the identifier for said subscriber and that will protect a bootstrap message to be sent to the device to provision the device with the ability to initiate a management session with a device management (DM) network system over an IP connection, wherein said management session configures the device with settings that the device requires in order for the device to support one or more services; obtain from a bootstrapping server function trigger information that will trigger the device itself to generate the bootstrap key; and send the trigger information to the device as a response to the request to bootstrap the device; wherein the bootstrap message comprises service setting parameters, a username and a password, and the bootstrap message is further protected by encrypting the bootstrap message with the bootstrap key, wherein the username and password are used to authenticate with the DM network system. ### Claim 7 (depends on 6) The server of claim 6, wherein the memory contains instructions executable by the one or more processing circuits whereby the server is further configured to send the encrypted bootstrap message to the device. ### Claim 8 (depends on 7) The server of claim 7, wherein the trigger information is sent to the device in a generic bootstrapping architecture push information message. ### Claim 9 (depends on 6) The server of claim 6, wherein the server setting parameters include parameters that configure the device to accept management commands from the DM network system during the management session. ### Claim 10 (depends on 6) The server of claim 6, wherein the server setting parameters include parameters that provision the device with capability for General Packet Radio Service (GPRS). ### Claim 11 (depends on 6) The server of claim 6, wherein the trigger information comprises GBA PUSH information (GPI). ### Claim 12 (depends on 6) The server of claim 6, wherein said settings with which the device is configured during the management session include settings for at least one of an email service and a Multimedia Messaging Service (MMS). ### Claim 13 A device comprising: one or more processing circuits and a memory, the memory containing instructions executable by the one or more processing circuits whereby the device is configured to: send an identifier of the device and an identifier of a subscriber associated with the device to a server; after sending said identifiers, receive trigger information from the server; wherein the server sends a request for the trigger information and a bootstrap key to a bootstrapping server function and in response to sending the request receives the trigger information and the bootstrap key from the bootstrapping server function; generate itself the bootstrap key responsive to said trigger information; receive from the server a protected bootstrap message that includes parameters provisioning the device with the ability to initiate a management session with a device management (DM) network system over an IP connection; verify, decrypt, or both verify and decrypt the protected bootstrap message using the device-generated bootstrap key; and initiate said management session with the DM network system, the management session configuring the device with settings that the device requires in order for the device to support one or more services; wherein the bootstrap message comprises service setting parameters, a username and a password, and the bootstrap message is further protected by encrypting the bootstrap message with the bootstrap key, wherein the username and password are used to authenticate with the DM network system. ### Claim 14 (depends on 13) The device of claim 13, wherein the trigger information is received in a generic bootstrapping architecture push information message. ### Claim 15 (depends on 13) The device of claim 13, wherein the trigger information comprises GBA PUSH information (GPI). ### Claim 16 (depends on 13) The device of claim 13, wherein the service setting parameters include parameters that provision the device with capability for General Packet Radio Service (GPRS). ### Claim 17 (depends on 13) The device of claim 13, wherein said settings with which the device is configured during the management session include settings for at least one of an email service and a Multimedia Messaging Service (MMS).