Content security at service layer
Existing approaches to security within network, for instance oneM2M networks, are limited. For example, content might only be protected while the content is in transit between entities that trust each other. Here, the integrity and the confidentiality of content in an M2M network are protected. Such content may be “at rest,” such that the content is stored at a hosting node. Only authorized entities may store and retrieve the data that is stored at the hosting node, and the data may be protected from a confidentiality perspective and an integrity perspective.
1. An apparatus comprising a processor, a memory, and communication circuitry, the apparatus being connected to a network via its communication circuitry, the apparatus further comprising computer-executable instructions stored in the memory of the apparatus which, when executed by the processor of the apparatus, cause the apparatus to perform operations comprising:
receiving, from a device, a first request for one or more credentials that encrypt or integrity protect application content when stored at rest on a hosting common services entity, the request based on one or more security parameters associated with the application content; and
sending, based on the request and to the device, the one or more credentials to cause:
encrypting or integrity protecting the application content, and
sending, by the device to the hosting common services entity, a second request to create a resource that stores the encrypted or integrity protected content.
2. The apparatus as recited in claim 1 , wherein the one or more credentials comprise a master key for symmetric key confidentiality protection.
3. The apparatus as recited claim 1 , wherein the apparatus is a common service entity, and the credentials are obtained from a trust enablement function.
4. The apparatus as recited in claim 3 , wherein a second application entity that is authorized to obtain the content can obtain the one or more credentials from the trust enablement function or common service entity.
5. The apparatus as recited claim 1 , wherein the apparatus is a trust enablement function.
6. The apparatus as recited in claim 1 , wherein the one or more credentials comprise a credential identifier.
7. A method comprising:
receiving, from a device, a first request for one or more credentials that encrypt or integrity protect application content when stored at rest on a hosting common services entity, the request based on one or more security parameters associated with the application content; and
sending, based on the request and to the device, the one or more credentials to cause:
encrypting or integrity protecting the application content, and
sending, by the device to the hosting common services entity, a second request to create a resource that stores the encrypted or integrity protected content.
8. The method as recited in claim 7 , wherein the one or more credentials comprise a master key for symmetric key confidentiality protection.
9. The method as recited claim 7 , wherein the method is performed by a common service entity, and the credentials are obtained from a trust enablement function or common service entity.
10. The method as recited in claim 9 , wherein a second application entity that is authorized to obtain the content can obtain the one or more credentials from the trust enablement function.
11. The method as recited claim 7 , wherein the method is performed by a trust enablement function.
12. The method as recited in claim 7 , wherein the one or more credentials comprise a credential identifier.