# US 2015/0143471 A1 · Method for establishing resource access authorization in m2m communication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2015/0143471 A1 - Document ID: US20150143471A1 - Status: Published application - Kind: A1 - Application number: 14/403,967 - Filed: 2012-11-21 - Published: 2015-05-21 - Earliest claimed: 2012-05-30 - Assignees: Modacom Co., Ltd. - Applicants: Modacom Co.,Ltd. - Inventors: Kyung-su Kim; Jaeho Lee; Yong-jin Kim - Web page: https://patentgrep.com/patent/US20150143471A1 ## CPC - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - H04L 63/10: {for controlling access to devices or network resources} - H04W 12/069: using certificates or pre-shared keys - H04W 48/02: Access restriction performed under specific conditions - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0892: {by using authentication-authorization-accounting [AAA] servers or protocols} - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for establishing a resource access authorization in M2M communication is provided. When an entity including a terminal, a gateway and an end user as client in a first M2M service provider domain attempts to access resource located in terminal or gateway in second M2M service provider domain, the method includes receiving client credential allocated from M2M Authentication Server (MAS1) in first M2M service provider domain by performing client registration to Network Service Capabilities Layer (NSCL1) in first M2M service provider domain by client, requesting an authorization to access resource to resource owner through NSCL (NSCL2) in second M2M service provider domain based on information about Universal Resource Identifier (URI) of resource by client, verifying client through MAS1 by the resource owner, authorizing client to access the resource by the resource owner, and issuing access token to the client by MAS (MAS2) in second M2M service provider domain. ## Claims ### Claim at position 1 1-30. (canceled) ### Claim 31 A method for establishing an authorization to access resource in Machine-to-Machine (M2M) communication, when entity selected from a terminal, a gateway and an end user as a client in an M2M service provider domain attempts to access resource located in a service layer of an M2M server for providing an M2M service in the same M2M service provider domain, the method comprising: receiving by the client a client credential allocated from an authentication server for providing an authentication service which is required in the M2M service provider domain by performing a client registration to the service layer by the client; requesting by the client an authorization to access the resource to a resource owner of the resource based on information about a Resource_URI of the resource; verifying, by the resource owner, the client through the authentication server; granting, by the resource owner, the authentication server the authorization for the client to access the resource; and issuing an access token to the client by the authentication server. ### Claim 32 (depends on 31) The method of claim 31, further comprising: issuing an authorization code to the client by the authentication server; and requesting an access token to the authentication server by using the issued authorization code by the client. ### Claim 33 (depends on 31) The method of claim 31, further comprising acquiring, by the client, the information about the URI of the resource through the service layer. ### Claim 34 (depends on 31) The method of claim 31 wherein the authentication server is an Authentication, Authorization, and Accounting (AAA) server, or a server providing an AAA service in a third M2M service provider domain. ### Claim 35 (depends on 31) The method of claim 31, wherein a lifetime is set for the access token. ### Claim 36 A method for accessing resource located in a service layer of an M2M server for providing an M2M service in a Machine-to-Machine (M2M) service provider domain by an entity selected from a terminal, a gateway and an end user as a client in the same M2M service provider domain, the method comprising: receiving a client credential allocated from an service layer in the M2M service provider domain by performing a client registration to a Network Service Capabilities Layer (NSCL) in the M2M service provider domain; requesting an authorization to access the resource to a resource owner of the resource based on information about a Universal Resource Identifier (URI) of the resource; receiving an access token issued from an authentication server for providing an authentication service which is required in the M2M service provider domain; and accessing the resource based on the issued access token. ### Claim 37 (depends on 36) The method of claim 36, further comprising acquiring information about the resource through one of the service layer and the resource owner. ### Claim 38 (depends on 36) The method of claim 36, further comprising: getting an authorization code issued from the authentication server; and requesting the access token based on using the authorization code issued from the authentication server. ### Claim 39 (depends on 36) The method of claim 36, wherein the client credential includes Client_identifier identifying the client and Client_Secret used as a password corresponding to the Client_identifier. ### Claim 40 A method for establishing an authorization of a client to access resource located in a service layer of an M2M server for providing an M2M service in a Machine-to-Machine (M2M) service provider domain by a resource owner of the resource, the client being one of a terminal, a gateway, and an end user in the M2M service provider domain, the method comprising: receiving an authorization request for the client; verifying the client through an authentication server for providing an authentication service which is required in the M2M service provider domain; and authorizing the client to access the authentication server. ### Claim 41 (depends on 40) The method of claim 40, wherein the reception of an authorization request comprises receiving an authorization request message for the client through the service layer, and wherein the authorization request message includes information about a client credential of the client and an authorization type. ### Claim 42 (depends on 41) The method of claim 41, wherein the verification of the client comprises determining whether the client is rightfully registered to the authentication server based on the information about the client credential of the client. ### Claim 43 (depends on 40) The method of claim 40, wherein the authorization comprises: requesting the service layer for a generation or update of an access right resource for the resource; and notifying the authentication server that the client has been authorized. ### Claim 44 A method for authorizing access of a client to a resource by a service layer of an M2M server for providing an M2M service having the resource in Machine-to-Machine (M2M) communication, the method comprising: receiving an authorization request from the client; forwarding the authorization request to a resource owner of the resource; receiving an access authorization request for the client from the resource owner; establishing an authorization of the client to access the resource; receiving an access token issued with respect to the resource from an authentication server for providing an authentication service; and determining whether to authorize the client to access the resource according to whether the access token issued from the authentication server is identical to an access token presented by the client. ### Claim 45 (canceled) ### Claim 46 (canceled) ### Claim 47 (depends on 44) The method of claim 44, wherein the receiving of the authorization request comprises receiving from the client an authorization request message including information about a Resource_URI, a client credential and an authorization type. ### Claim 48 (depends on 47) The method of claim 47, wherein forwarding of the authorization request comprises performing a discovery of a resource owner corresponding to the information about the Resource_URI and transmitting the authorization request message to the discovered resource owner. ### Claim 49 (depends on 48) The method of claim 48, wherein the service layer acquires information about the resource owner from an attribute of one of another object service layer, an application, a container resource, and a location container resource. ### Claim 50 (depends on 44) The method of claim 44, wherein the receiving of the authorization request comprises receiving an authorization request message including information about at least one of a client credential of the client, an access scope and a resource location. ### Claim 51 (depends on 50) The method of claim 50, wherein the establishing of the authorization comprises generating or updating an access right resource having information about an authorization to access the protected resource based on information included in the authorization request message. ### Claim 52 (depends on 51) The method of claim 51, wherein the determining of whether to authorize the client to access the resource comprises checking an allowed access scope for the client from the access right resource.