# US 10,484,869 B2 · Generic bootstrapping architecture protocol

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,869 B2
- Document ID: US10484869B2
- Status: Granted
- Kind: B2
- Application number: 15/208,149
- Filed: 2016-07-12
- Published: 2017-02-09
- Granted: 2019-11-19
- Earliest claimed: 2015-07-13
- Assignees: Vodafone IP Licensing Limited
- Applicants: Vodafone IP Licensing Limited
- Inventors: Nicholas Bone; Tim Snape
- Web page: https://patentgrep.com/patent/US10484869B2

## CPC

- H04W 12/06: Authentication
- H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)}
- H04L 63/0281: {Proxies}
- H04L 67/55: Push-based network services
- H04L 67/565: Conversion or adaptation of application format or content (adding application control or application functional data H04L67/561)
- H04L 69/08: Protocols for interworking; Protocol conversion
- H04W 4/12: Messaging; Mailboxes; Announcements
- H04W 12/0431: Key distribution or pre-distribution; Key agreement
- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 2209/80: Wireless
- H04L 2463/061: applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
- H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC]
- H04W 12/12: Detection or prevention of fraud
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Method and system for communicating securely with a user equipment, UE, using generic bootstrapping architecture, GBA, the system comprising a bootstrapping server function, BSF. A proxy server configured to receive messages from a user equipment, UE, in a first format. Convert the received messages from the first format to a second format. Transmit the received UE messages to a bootstrapping server function, BSF, in the second format. Receive messages from the BSF, in a third format. Convert the messages received from the BSF from the third format to a fourth format. Transmit the received BSF messages to the UE in the fourth format.

## Claims

### Claim 1

A proxy server for generic bootstrapping architecture, (GBA) the proxy server configured to:
receive messages from a user equipment, UE, in a first format;
convert the messages received from the UE from the first format to a second format, including the proxy server operating to check whether each of the messages received from the UE includes content presenting a risk of system crashing or security vulnerabilities at a bootstrapping server function (BSF) and to reject or correct each of the messages received from the UE that is determined to be insecure;
check the messages received from the UE for compliance with GBA requirements;
transmit each of the messages received from the UE that is not rejected in the second format to the BSF;
receive messages from the BSF in the third format;
convert the messages received from the BSF from the third format to a fourth format; and
transmit the messages received from the BSF in the fourth format to the UE.

### Claim 2 (depends on 1)

The proxy server of claim 1, wherein the messages received from the UE by the proxy server and/or transmitted from the proxy server to the UE are over a Ub interface, and/or wherein the messages received from the BSF by the proxy server and/or transmitted from the proxy server to the BSF are over a Ub interface.

### Claim 3 (depends on 1)

The proxy server according to claim 1 wherein the format conversion from the first format to the second format and from the third format to the fourth format further comprise a translation of protocol.

### Claim 4 (depends on 1)

The proxy server according to claim 1 formed within a device management, DM, server.

### Claim 5

A method for communicating between a user equipment, UE, and a bootstrapping server function, (BSF) using generic bootstrapping architecture (GBA), the method comprising:
receiving one or more messages from the UE at a proxy server, in a first format;
converting the one or more messages received from the UE from the first format to a second format, including checking whether each of the messages received from the UE includes content presenting a risk of system crashing or security vulnerabilities at the BSF and rejecting or correcting each of the messages received from the UE that is determined to be insecure;
checking the messages received from the UE for compliance with GBA requirements;
transmitting each of the one or more messages received from the UE that is not rejected in the second format from the proxy server to the BSF;
receiving one or more messages from the BSF in a third format at the proxy server;
converting the one or more messages received from the BSF from the third format to a fourth format; and
transmitting the one or more messages received from the BSF in the fourth format from the proxy server to the UE.

### Claim 6 (depends on 5)

The method of claim 5, wherein the one or more messages received from the UE by the proxy server and/or transmitted from the proxy server to the UE are over a Ub interface, and further wherein the one or more messages received from the BSF by the proxy server and/or transmitted from the proxy server to the BSF are over a Ub interface.

### Claim 7 (depends on 5)

The method of claim 5, wherein the received and transmitted one or more UE and BSF messages include:
a request for a shared secret received from the UE and transmitted to the BSF; and
data to establish the shared secret received from the BSF and transmitted to the UE.

### Claim 8 (depends on 7)

The method of claim 7, wherein the request for the shared secret transmitted to the BSF includes an identifier of the UE.

### Claim 9 (depends on 8)

The method of claim 8, wherein the identifier of the UE is obtained from a device management, DM, server or a network application function, NAF.

### Claim 10 (depends on 9)

The method of claim 9 further comprising the DM server obtaining the UE identifier from a Radius Accounting Start message.

### Claim 11 (depends on 7)

The method of claim 7, wherein the data to establish the shared secret received from the BSF is transmitted to the UE from the proxy server using GBA push messaging.

### Claim 12 (depends on 11)

The method of claim 11, wherein the push message is delivered over CoAP.

### Claim 13 (depends on 12)

The method of claim 12, wherein the CoAP is bound to UDP or SMS.

### Claim 14 (depends on 11)

The method of claim according to claim 11, wherein the one or more messages received from the UE by the proxy server and/or transmitted from the proxy server to the UE are GBA push messages, and further wherein the one or more messages received from the BSF by the proxy server and/or transmitted from the proxy server to the BSF are GBA push messages.

### Claim 15 (depends on 7)

The method according to claim 7 further comprising authenticating, verifying and/or proving possession of the shared secret between the BSF and UE directly over CoAP or LWM2M protocols.

### Claim 16 (depends on 7)

The method according to claim 7, wherein the proxy server is formed together with a network application function, NAF, as a device management, DM server.

### Claim 17 (depends on 16)

The method of claim 16 further comprising using the shared secret or a further derived shared secret (Ks_NAF) to secure a communication between the UE and the NAF.

### Claim 18 (depends on 7)

The method according to claim 7, wherein the shared secret is referenced by a bootstrapping transaction identifier, B-TID.

### Claim 19 (depends on 18)

The method of claim 18, wherein the B-TID is passed directly to a network application function, NAF, from the proxy server.

### Claim 20 (depends on 19)

The method of claim 19 further comprising passing the shared secret or a further derived shared secret (Ks_NAF) directly from the proxy server to the NAF.

### Claim 21

A system for communicating securely with a user equipment (UE), using generic bootstrapping architecture (GBA) the system comprising:
a bootstrapping server function (BSF); and
a proxy server configured to:
receive messages from the UE in a first format;
convert the messages received from the UE from the first format to a second format, including the proxy server operating to check whether each of the messages received from the UE includes content presenting a risk of system crashing or security vulnerabilities at the BSF and to reject or correct each of the messages received from the UE that is determined to be insecure;
check the messages received from the UE for compliance with GBA requirements;
transmit each of the messages received from the UE that is not rejected in the second format to the BSF;
receive messages from the BSF in a third format;
convert the messages received from the BSF from the third format to a fourth format; and
transmit the messages received from the BSF in the fourth format to the UE.

### Claim 22 (depends on 21)

The system of claim 21, wherein the proxy server is formed together with a network application function, NAF, as a device management, DM server.

### Claim 23 (depends on 22)

The system of claim 22, wherein the DM server further comprises a buffer arranged to store one or more identifiers of the UE and an associated address.

### Claim 24 (depends on 23)

The system of claim 23, wherein the buffer is a circular buffer.

### Claim 25 (depends on 23)

The system of claim 23, wherein the buffer is further arranged to provide the one or more identifiers of the UE for a particular address.

### Claim 26 (depends on 21)

The system according to claim 21, further comprising a Ub interface between the UE and the proxy server and/or between the proxy server and the BSF.