# US 12,192,203 B2 · Security lifecycle management of devices in a communications network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,203 B2 - Document ID: US12192203B2 - Status: Granted - Kind: B2 - Application number: 18/494,287 - Filed: 2023-10-25 - Published: 2024-02-22 - Granted: 2025-01-07 - Earliest claimed: 2018-12-06 - Assignees: Convida Wireless, LLC - Applicants: Convida Wireless, LLC - Inventors: Vinod Kumar Choyi; Chonggang Wang; Dale N. Seed - Web page: https://patentgrep.com/patent/US12192203B2 ## CPC - H04L 63/0892: {by using authentication-authorization-accounting [AAA] servers or protocols} - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04W 12/043: using a trusted network node as an anchor - H04W 12/30: Security of mobile devices; Security of mobile applications - H04W 48/18: Selecting a network or a communication service - H04W 48/16: Discovering, processing access restriction or access information - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Described herein are complete lifecycle management processes for IoT/M2M devices. In an example, devices are commissioned and de-commissioned in a given system without requiring a user/human administrator. A delegated life-cycle management process is described, wherein devices rely upon a delegatee, which may have more computing and battery resources than the devices, to perform complete or partial lifecycle management operations on behalf of the devices. The delegatee may be a trusted entity that may belong to the same domain as the devices. Further, a Trust Enabling Infrastructure (TEI) is described herein, which may belong to a different trusted domain than the given device and its delegatee. ## Claims ### Claim 1 A method for a service providing service capabilities through a set of application programming interfaces (APIs) to a plurality of applications, the service being provided as a middleware, the method comprising: authenticating, by a trust enabling infrastructure (TEI) in the service, a device by performing an attestation check; receiving, by the TEI and from the device, a credential registration message; determining, by the TEI and based on the credential registration message, one or more security policies comprising one or more rules for assigning devices to a network function in the service; and sending, by the TEI and to the device, a response comprising an identifier of the network function and one or more parameters comprising a parameter associated with a security credential, wherein the identifier and the parameter associated with the security credential facilitate the device attaching to the network function. ### Claim 2 (depends on 1) The method as recited in claim 1, wherein the credential registration message comprises an indication of one or more capabilities or security functionality of the device. ### Claim 3 (depends on 1) The method as recited in claim 1, further comprising sending, by the TEI, on behalf of the device and to a third party, a message comprising an indication of a trustworthiness associated with the device. ### Claim 4 (depends on 1) The method as recited in claim 1, wherein the determined network function comprises a first network function, and wherein the method further comprises migrating, by the TEI, the device from the first network function to a second network function in the service providing the device access to an application or service provider, wherein the migrating is based on the one or more rules of the one or more security policies. ### Claim 5 (depends on 1) The method as recited in claim 1, wherein at least one of the one or more rules of the one or more security policies has a dependency based on a location of the device. ### Claim 6 (depends on 4) The method as recited in claim 4, further comprising de-commissioning, by the TEI, the device from the application or service provider, whereby the device is prevented from using the application or service provider. ### Claim 7 (depends on 1) The method as recited in claim 1, further comprising sending, by the TEI to the network function, a message comprising an identifier and a credential associated with the device. ### Claim 8 (depends on 1) The apparatus as recited in claim 1, wherein the instructions, when executed by the one or more processors, further cause sending, by the TEI to the network function, a message comprising an identifier and a credential associated with the device. ### Claim 9 A device comprising one or more processors and one or more memories storing instructions that, when executed by the one or more processors, cause the device to perform operations comprising: establishing, based on an authentication of the device, a secure connection with a trust enabling infrastructure (TEI) in a service providing service capabilities through a set of application programming interfaces (APIs) to a plurality of applications, the service being provided as a middleware; sending, to the TEI, a credential registration message; receiving, from the TEI, a response to the credential registration message, wherein the response comprises an identifier of a network function in the service to which the device is to attach and one or more parameters comprising a parameter associated with a security credential, and wherein the identified network function is determined based on the credential registration message and one or more security policies comprising one or more rules for assigning devices to the network function in the service; and attaching, based on the identifier of the network function and the parameter associated with the security credential, to the network function. ### Claim 10 (depends on 9) The device as recited in claim 9, wherein the credential registration message comprises an indication of one or more capabilities or security functionality of the device. ### Claim 11 (depends on 9) The device as recited in claim 9, wherein the determined network function comprises a first network function, and wherein the instructions, when executed, further cause the device to migrate, under control of the TEI, from the first network function to a second network function in the service providing an application or service provider, wherein the migrating is based on the one or more rules of the one or more security policies. ### Claim 12 (depends on 9) The device as recited in claim 9, wherein at least one of the one or more rules of the one or more security policies has a dependency based on a location of the device. ### Claim 13 (depends on 11) The device as recited in claim 11, wherein the instructions, when executed, further cause the device to be prevented from accessing the application or service provider based on a de-commissioning by the TEI. ### Claim 14 An apparatus comprising one or more processors and memory storing instructions that, when executed by the one or more processors, cause the apparatus to implement a trust enabling infrastructure (TEI) in a service providing service capabilities through a set of application programming interfaces (APIs) to a plurality of applications, the service being provided as a middleware, the instructions further causing the apparatus to perform operations comprising: authenticating, by the TEI in the service, a device by performing an attestation check; receiving, by the TEI and from the device, a credential registration message; determining, by the TEI and based on the credential registration message, one or more security policies comprising one or more rules for assigning devices to a network function in the service; and sending, by the TEI and to the device, a response comprising an identifier of the network function and one or more parameters comprising a parameter associated with a security credential, wherein the identifier and the parameter associated with the security credential facilitate the device attaching to the network function. ### Claim 15 (depends on 14) The apparatus as recited in claim 14, wherein the credential registration message comprises an indication of one or more capabilities or security functionality of the device. ### Claim 16 (depends on 14) The apparatus as recited in claim 14, wherein the instructions, when executed by the one or more processors, further cause sending, by the TEI, on behalf of the device and to a third party, a message comprising an indication of a trustworthiness associated with the device. ### Claim 17 (depends on 14) The apparatus as recited in claim 14, wherein the determined network function comprises a first network function, and wherein the instructions, when executed by the one or more processors, further cause migrating, by the TEI, the device from the first network function to a second network function in the service providing the device access to an application or service provider, wherein the migrating is based on the one or more rules of the one or more security policies. ### Claim 18 (depends on 14) The apparatus as recited in claim 14, wherein at least one of the one or more rules of the one or more security policies has a dependency based on a location of the device. ### Claim 19 (depends on 17) The apparatus as recited in claim 17, wherein the instructions, when executed by the one or processors, further cause de-commissioning, by the TEI, the device from the application or service provider, whereby the device is prevented from using the application or service provider.