Security information exchange between a client and a server
A server node is configured to assume a server role in a particular message exchange with a client node. The server node registers, with a resource directory node, security information (e.g., security capabilities and/or security preferences) of the server node. The server node may also register information about a resource that the server node hosts. The client node determines, from the resource directory node, the security information (e.g., security capabilities and/or security preferences) of the server node. The client node then sets up a secured connection with the server node using the determined security information (e.g., security capabilities and/or security preferences).
1. A method performed by a client node configured to assume a client role in a particular message exchange with a server node, the method comprising:
determining, from a resource directory node that stores information about resources, at least one of security capabilities and security preferences of the server node that hosts a resource, wherein the at least one of security capabilities and security preferences indicates one or more cipher suites preferred by the server node, wherein the server node indicates its preference of the cipher suites by specifying one or more identifiers for a CipherSuite parameter, in ascending or descending order of the preference, and wherein each cipher suite of the one or more cipher suites corresponds to an authenticated encryption with associated data (AEAD) algorithm or a hash-based messaged authentication (HMAC)-based key derivation function (HKDF) hash pair; and
setting up a secured connection with the server node using the determined at least one of security capabilities and security preferences.
2. The method of claim 1 , wherein setting up the secured connection comprises initiating setup of the secured connection according to the at least one of security capabilities and security preferences of the server node.
3. The method of claim 1 , wherein said determining comprises:
transmitting, from the client node to the resource directory node, a request for information about resources or server node associated with one or more certain target attributes, wherein the target attributes include the at least one of security capabilities and security preferences; and
receiving a response from the resource directory node identifying the server node, or one or more resources hosted by the server node, as being associated with the one or more certain target attributes.
4. The method of claim 1 , wherein said determining comprises:
transmitting, from the client node to the resource directory node, a request for information about resources or server nodes associated with one or more certain target attributes; and
receiving a response from the resource directory node that identifies the server node, or one or more resources hosted by the server node, as being associated with the one or more certain target attributes and that includes information indicating the at least one of security capabilities and security preferences of the server node.
5. The method of claim 1 , wherein the at least one of the client node and the server node is a machine-to-machine device or an internet-of-things (IoT) node.
6. The method of claim 1 , wherein the client node and the server node are configured to communicate using a constrained application protocol (CoAP).
7. A method performed by a server node configured to assume a server role in a particular message exchange with a client node, the method comprising:
registering, with a resource directory node, at least one of security capabilities and security preferences of the server node, as well as information about a resource that the server node hosts, wherein the at least one of security capabilities and security preferences indicates one or more cipher suites preferred by the server node, wherein the server node indicates its preference of the cipher suites by specifying one or more identifiers for a CipherSuite parameter, in ascending or descending order of the preference, and wherein each cipher suite of the one or more cipher suites corresponds to an authenticated encryption with associated data (AEAD) algorithm or a hash-based messaged authentication (HMAC)-based key derivation function (HKDF) hash pair.
8. The method of claim 7 , wherein the at least one of security capabilities and security preferences indicate at least one of a type or a version of a security protocol that the server node supports.
9. The method of claim 7 , wherein the at least one of security capabilities and security preferences indicate a version of a Transport Layer Security (TLS) protocol or Datagram TLS (DTLS) protocol that the server node supports.
10. The method of claim 7 , wherein the at least one of security capabilities and security preferences indicate one or more key agreement protocols preferred by the server node.
11. The method of claim 7 , wherein the at least one of security capabilities and security preferences indicate at least one of one or more key exchange algorithms, one or more encryption algorithms, one or more signature algorithms, or one or more message authentication code (MAC) algorithms.
12. A client node configured to assume a client role in a particular message exchange with a server node, the client node configured to:
determine, from a resource directory node that stores information about resources, at least one of security capabilities and security preferences of the server node that hosts a resource, wherein the at least one of security capabilities and security preferences indicates one or more cipher suites preferred by the server node, wherein the server node indicates its preference of the cipher suites by specifying one or more identifiers for a CipherSuite parameter, in ascending or descending order of the preference, and wherein each cipher suite of the one or more cipher suites corresponds to an authenticated encryption with associated data (AEAD) algorithm or a hash-based messaged authentication (HMAC)-based key derivation function (HKDF) hash pair; and
set up a secured connection with the server node using the at least one of determined security capabilities and the security preferences.
13. A server node configured to assume a server role in a particular message exchange with a client node, the server node configured to:
register, with a resource directory node, at least one of security capabilities and security preferences of the server node, as well as information about a resource that the server node hosts, wherein the at least one of security capabilities and security preferences indicates one or more cipher suites preferred by the server node, wherein the server node indicates its preference of the cipher suites by specifying one or more identifiers for a CipherSuite parameter, in ascending or descending order of the preference, and wherein each cipher suite of the one or more cipher suites corresponds to an authenticated encryption with associated data (AEAD) algorithm or a hash-based messaged authentication (HMAC)-based key derivation function (HKDF) hash pair.