# US 10,313,307 B2 · Communicating with a machine to machine device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,307 B2 - Document ID: US10313307B2 - Status: Granted - Kind: B2 - Application number: 15/021,879 - Filed: 2014-09-12 - Published: 2016-08-11 - Granted: 2019-06-04 - Earliest claimed: 2013-09-13 - Assignees: Vodafone IP Licensing Limited - Applicants: Vodafone IP Licensing Limited - Inventors: Nick Bone - Web page: https://patentgrep.com/patent/US10313307B2 ## CPC - G06F 13/1689: {Synchronisation and timing concerns (synchronisation on a memory bus G06F13/4234)} - G06F 9/4401: Bootstrapping (security arrangements therefor G06F21/57) - G06F 13/28: using burst mode transfer, e.g. direct memory access {DMA}, cycle steal (G06F13/32 takes precedence) - G06F 13/4027: {using bus bridges (G06F13/4022 takes precedence)} - G06F 21/606: {by securing the transmission between two devices or processes} - G06F 21/71: to assure secure computing or processing of information - H04B 1/3816: Mechanical arrangements for accommodating identification devices, e.g. cards or chips; with connectors for programming identification devices - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/04: {for providing a confidential data exchange among entities communicating through data packet networks} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)} - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/0869: {for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/166: {at the transport layer} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/1095: Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes - H04L 67/125: involving control of end-device applications over a network - H04W 4/12: Messaging; Mailboxes; Announcements - H04W 4/14: Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD] - H04W 4/50: Service provisioning or reconfiguring - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04W 8/04: Registration at HLR or HSS [Home Subscriber Server] - H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04W 12/0431: Key distribution or pre-distribution; Key agreement - H04W 12/06: Authentication - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - H04W 52/0229: {where the received signal is a wanted signal} - H04W 80/06: Transport layer protocols, e.g. TCP [Transport Control Protocol] over wireless {(transmission control protocol/Internet protocol [TCP/IP] or user datagram protocol [UDP] H04L69/16)} - H04W 88/02: Terminal devices - H04W 88/06: adapted for operation in multiple networks {or having at least two operational modes}, e.g. multi-mode terminals - H04L 63/0838: {using one-time-passwords} - H04L 2463/061: applying further key derivation, e.g. deriving traffic keys from a pair-wise master key - Y02D 10/00: Energy efficient computing, e.g. low power processors, power management or thermal management - Y02D 30/70: in wireless communication networks - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04B: TRANSMISSION - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - Y02D: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE ## Abstract The present disclosure provides methods and apparatus for administering an interface between a machine-to-machine, M2M, device and a network application function, NAF, for secure communication between the M2M device and the NAF. In one method, the M2M device comprises security information for enabling secure communication via the interface, and administers the interface by: setting a secure interface lifetime parameter based on a lifetime of at least part of the security information; and transmitting administration data to the NAF, wherein the administration data comprises the secure interface lifetime parameter. ## Claims ### Claim 1 A method for a machine-to-machine (M2M) device to administer an interface between the M2M device and a network application function (NAF) for secure communication between the M2M device and the NAF, wherein the M2M device comprises security information as a key for enabling secure communication via the interface, the method comprising the steps of initiating, before expiry of a lifetime of at least part of the security information and on wake up from a sleep cycle: setting a secure interface lifetime parameter based on a lifetime of the at least part of the security information; transmitting administration data to the NAF, wherein the administration data comprises the secure interface lifetime parameter; after determining that a registration of the interface is about to expire, pre-emptively initiating a new bootstrapping process to obtain new security information, the initiating being pre-emptive as a result of obtaining the new security information prior to expiration of the registration; and using the new security information to either update the registration or, alternatively, to carry out a new registration. ### Claim 2 (depends on 1) The method of claim 1, wherein the secure interface lifetime parameter is set to a value greater than or equal to the lifetime of the at least part of the security information. ### Claim 3 (depends on 1) The method of claim 1, wherein the secure interface lifetime parameter is set to a value greater than the lifetime of the at least part of the security information. ### Claim 4 (depends on 1) The method of claim 1, wherein the secure interface lifetime parameter is set to a value greater than the lifetime of the at least part of the security information by a first amount. ### Claim 5 (depends on 1) The method of claim 1, wherein the secure interface lifetime parameter is set to a value less than or equal to the lifetime of the at least part of the security information. ### Claim 6 (depends on 1) The method of claim 1, wherein the secure interface lifetime parameter is set to a value less than or equal to the lifetime of the at least part of the security information. ### Claim 7 (depends on 1) The method of claim 1, wherein the secure interface lifetime parameter is set to a value less than the lifetime of the at least part of the security information by a second amount. ### Claim 8 (depends on 1) The method of claim 1, further comprising the steps of: checking the remaining lifetime of the at least part of the security information; and if the remaining lifetime of the at least part of the security information is less than a security information lifetime threshold, requesting new security information from a bootstrapping server. ### Claim 9 (depends on 8) The method of claim 8, further comprising the step of: if the request for new security information fails, repeating the request for new security information after a period of time. ### Claim 10 (depends on 8) The method of claim 8, wherein the step of checking the remaining lifetime of the security information is carried out before a secure communication transmission from the M2M device to the NAF via the interface. ### Claim 11 A method for a network application function (NAF) to administer an interface between the NAF and a machine-to-machine (M2M), device, wherein the M2M device comprises security information as a key for enabling secure communication via the interface, the method comprising the steps of: receiving, before expiry of a lifetime of at least part of the security information and on wake up from a sleep cycle, administration data from the M2M device, the registration data comprising a secure interface lifetime parameter that has been set based on a lifetime of the at least part of the security information; transmitting an administration response to the M2M device; after determining that a registration of the interface is about to expire, pre-emptively initiating a new bootstrapping process to obtain new security information, the initiating being pre-emptive as a result of obtaining the new security information prior to expiration of the registration; and using the new security information to either update the registration or, alternatively, to carry out a new registration. ### Claim 12 (depends on 11) The method of claim 11, wherein the administration data comprises the at least part of the security information, the method further comprising: checking the lifetime of the at least part of the security information; and comparing the secure interface lifetime parameter with the lifetime of the at least part of the security information; wherein if the comparison does not meet a comparison condition, the administration response is set to indicate an error in the administration data. ### Claim 13 (depends on 12) The method of claim 12, wherein the comparison condition is that the secure interface lifetime parameter is greater than or equal to the lifetime of the at least part of the security information. ### Claim 14 (depends on 12) The method of claim 12, wherein the comparison condition is that the secure interface lifetime parameter is greater than the lifetime of the at least part of the security information. ### Claim 15 (depends on 12) The method of claim 12, wherein the comparison condition is that the secure interface lifetime parameter is greater than the lifetime of the at least part of the security information by a first amount. ### Claim 16 (depends on 12) The method of claim 12, wherein the comparison condition is that the secure interface lifetime parameter is less than or equal to the lifetime of the at least part of the security information. ### Claim 17 (depends on 12) The method of claim 12, wherein the comparison condition is that the secure interface lifetime parameter is less than the lifetime of the at least part of the security information. ### Claim 18 (depends on 12) The method of claim 12, wherein the comparison condition is that the secure interface lifetime parameter is less than the lifetime of the at least part of the security information by a second amount. ### Claim 19 (depends on 11) The method of claim 11, further comprising a step of: obtaining the lifetime of the at least part of the security information. ### Claim 20 (depends on 11) The method of claim 11, wherein: the administration data further comprises a name for the M2M device; and wherein the name for the M2M device is equal to, or derived at least in part from, or otherwise linked to, at least part of data that are shared between the M2M device and the bootstrapping server.