Machine to-machine (M2M) call flow security
View Patent ↗Systems, methods, and instrumentalities are disclosed to provide secure operations in an M2M device. An M2M device may receive an indication that an operation to be performed is security sensitive. The M2M device may determine that the operation is to be performed in a secure environment on the M2M device. The secure environment may be a logically distinct portion of the M2M device. The determination may be made in in accordance with a policy. For example, the M2M device may determine that the operation meets a requirement specified in the policy indicating that the operation is to be performed in the secure environment. The M2M device may perform the operation in the secure environment on the M2M device. The M2M device may store a result relating to the operation in the secure environment.
1. A method to provide secure operations in an M2M device, the method comprising:
sending a security profile of the M2M device to a core network, the security profile indicating to the core network a security capability supported by the M2M device;
receiving a security requirement from the core network for the M2M device to satisfy relating to a security of a communication session or operation of the M2M device, the security requirement comprising a security profile setting specified for at least one application, operation, or service performed on the M2M device;
performing the communication session or operation associated with the at least one application, operation or service in a secure environment on the M2M device based on the security requirement and security profile setting; and
storing a result relating to the communication session or operation in the secure environment.
2. The method of claim 1 , further comprising determining that the communication session or operation is to be performed in the secure environment in accordance with the security requirement.
3. The method of claim 1 , wherein the security requirement is received in a response from the core network relating to the security profile sent thereto.
4. The method of claim 1 , wherein the security requirement includes a security profile setting for one or more of the following: secure storage, secure execution, or integrity validation.
5. The method of claim 1 , wherein the operation comprises generating a key for use in the communication session or for storage of information on the M2M device.
6. The method of claim 1 , wherein the secure environment is a logically distinct portion of the M2M device.
7. The method of claim 1 , further comprising:
adjusting a setting of the security profile to reflect one or more received values of the security profile setting; and
producing a final security profile with the adjusted setting.
8. The method of claim 7 , further comprising sending the final security profile to the core network to be used by the M2M device in the communication session or operation of the M2M device.
9. An M2M device configured, at least in part, to:
send a security profile of the M2M device to a core network, the security profile indicating to the core network a security capability supported by the M2M device;
receive a security requirement from the core network for the M2M device to satisfy relating to a security of a communication session or operation of the M2M device, the security requirement comprising a security profile setting specified for at least one application, operation, or service performed on the M2M device;
perform the communication session or operation associated with the at least one application, operation or service in a secure environment on the M2M device based on the security requirement and security profile setting; and
store a result relating to the communication session or operation in the secure environment.
10. The M2M device of claim 9 , further configured to determine that the communication session operation is to be performed in the secure environment in accordance with the security requirement.
11. The M2M device of claim 9 , wherein the security requirement is received in a response from the core network relating to the security profile sent thereto.
12. The M2M device of claim 9 , wherein the security requirement includes a security profile setting for one or more of the following: secure storage, secure execution, or integrity validation.
13. The M2M device of claim 9 , wherein the operation comprises generating a key for use in the communication session or for storage of information on the M2M device.
14. The M2M device of claim 9 , wherein the secure environment is a logically distinct part of the M2M device.
15. The M2M device of claim 9 , further configured to:
adjust a setting of the security profile to reflect one or more received values of the security profile setting; and
produce a final security profile with the adjusted setting.
16. The M2M device of claim 15 , further configured to send an indicator to the core network indicating the final security profile to be used by the M2M device in the communication session or operation of the M2M device.