Mobile Network Core Component for Managing Security Keys
AssigneeAT&T Mobility II LLC
InventorArturo Maria
Life of this patent
Estimating the term…
Abstract
A security keys broker residing on a core mobile communication network may manage security keys associated with network-enabled devices, such as Internet-of-Things devices. The security keys broker may authenticate, encrypt, or decrypt communications with the network-enabled devices using the associated security keys. Characteristics of the communications with the network-enabled devices may be determined, and the security keys broker may determine insecure communications based on the characteristics. Responsive to determining that an insecure communication has occurred, the security keys broker may update one or more of the security keys.
Claims20
A system of managing a plurality of security keys for a plurality of network-enabled devices, the system comprising:
- a mobile communications node of a core mobile communications network, the node capable of communicating with the plurality of network-enabled devices;
- a key broker capable of communicating with the plurality of network-enabled devices via the node and capable of storing a plurality of security keys associated with the plurality of network-enabled devices, wherein the key broker is located within the core mobile communication network;
- and
- a mobile communications gateway of the core mobile communications network, the gateway capable of communicating with the key broker and with a plurality of application servers located outside the core mobile communication network, wherein:
- the node receives an unencrypted communication from a first device of the plurality of network-enabled devices,
- the unencrypted communication is encrypted by the key broker using a first key of the plurality of security keys,
- the encrypted communication is transmitted to the gateway for delivery to a first application server of the plurality of application servers, and
- the gateway provides the encrypted communication to the first application server located outside the core mobile communication network.
A method of authenticating communications between a network-enabled device and an application server, the method including operations performed by at least one network component included in a core mobile communication network, the operations performed by the at least one network component comprising:
- receiving, at the network component, first data from the network-enabled device, wherein the network-enabled device is outside of the core mobile communication network;
- encrypting, by the network component, the first data via a security key;
- transmitting, via an in-band communication channel of the core mobile communication network, first encrypted data to the application server, wherein the application server is outside of the core mobile communication network;
- receiving, at the network component and from the application server, an instruction to modify the security key, wherein the instruction is received via a separate communication channel of the core mobile communication network;
- responsive to receiving the instruction, modifying the security key;
- receiving, at the network component, second data from the network-enabled device;
- encrypting, by the network component, the second data via the modified security key;
- and
- transmitting, via the in-band communication channel, second encrypted data to the application server.
A network component for transmitting communications via a core mobile communication network, wherein the network component resides within the core mobile communication network, wherein the network component is capable of:
- receiving first data from a network-enabled device residing outside of the core mobile communication network;
- encrypting the first data via a security key residing within the core mobile communication network;
- transmitting, via an in-band communication channel, first encrypted data to an application server residing outside of the core mobile communication network;
- receiving, from the application server, an instruction to modify the security key, wherein the instruction is received via a separate communication channel;
- responsive to receiving the instruction, modifying the security key;
- receiving second data from the network-enabled device;
- encrypting the second data via the modified security key;
- and
- transmitting, via the in-band communication channel, second encrypted data to the application server.
Dependencies are inferred from the claim text.