Granted Patent B2

US 12,549,365 · App. 18/447,098 · Granted Feb 10, 2026

Inventors: Markus Staufer (Munich, DE); Peter Schneider (Munich, DE); Ranganathan Mavureddi Dhanasekaran (Munich, DE)

Assignee: Nokia Technologies Oy

H04L9/321H04L9/0819

Abstract

Claims (50)

1 . A method, performed by a first apparatus, comprising:

obtaining an identifier of a cryptographic key according to a first security communication protocol;

receiving a first authentication request from a second apparatus, wherein the first apparatus is a Personal Internet of Things network element with gateway capability (PEGC) and the second apparatus is a Personal Internet of Things network element (PINE);

signaling, in response to the first authentication request, a second authentication request according to a second security communication protocol to a third apparatus, the second authentication request comprising the identifier of the cryptographic key and a first verifying information according to the second security communication protocol, wherein the first verifying information comprises a first value calculated using the cryptographic key, wherein the third apparatus is an Authentication, Authorization, and Accounting (AAA) server, wherein the first security communication protocol is an Authentication and Key Management for Applications (AKMA) protocol and the second security communication protocol is an Internet Protocol (IP)-based security communication protocol, and wherein the IP-based security communication protocol is at least one of a Remote Authentication Dial-In User Service (RADIUS) protocol, an Internet Key Exchange (IKE) protocol, and an IP Security (IPSec) protocol;

receiving, from the third apparatus, a first authentication response according to the second security communication protocol, the first authentication response comprising a second verifying information according to the second security communication protocol, wherein the second verifying information comprises a second value;

verifying the first authentication response using the second value and the cryptographic key; and

signaling, in response to the received first authentication response, a second authentication response to the second apparatus.

2 . The method of claim 1 , further comprising, prior to the step of signaling the second authentication request to the third apparatus:

signaling, to the third apparatus using signaling according to the second security communication protocol, a request to use signaling according to the second security communication protocol to exchange verifying information associated with the first security communication protocol; and

receiving, from the third apparatus using signaling according to the second security communication protocol, an acceptance of the request to use the signaling according to the second security communication protocol to exchange verifying information associated with the first security communication protocol.

3 . A method for exchanging authentication and authorization messages in a Personal Internet of Things Network (PIN), the method performed by a third apparatus, the method comprising:

receiving, from a first apparatus, a second authentication request according to a second security communication protocol in response to the first apparatus receiving a first authentication request from a second apparatus, the second authentication request comprising an identifier of a cryptographic key according to a first security communication protocol and a first verifying information according to the second security communication protocol, wherein the first verifying information comprises a first value, wherein the first apparatus is a Personal Internet of Things network element with gateway capability (PEGC), the second apparatus is a Personal Internet of Things network element (PINE), and the third apparatus is an Authentication, Authorization, and Accounting (AAA) server;

obtaining the cryptographic key using the identifier of the cryptographic key;

verifying the first value using the cryptographic key identified by the identifier of the cryptographic key;

deriving a second verifying information according to the second security communication protocol, wherein the second verifying information comprises a second value calculated using the cryptographic key identified by the identifier of the cryptographic key, wherein the first security communication protocol is an Authentication and Key Management for Applications (AKMA) protocol and the second security communication protocol is an Internet Protocol (IP)-based security communication protocol, and wherein the IP-based security communication protocol is at least one of a Remote Authentication Dial-In User Service (RADIUS) protocol, an Internet Key Exchange (IKE) protocol, and an IP Security (IPSec) protocol; and

signaling, to the first apparatus, an authentication response that comprises at least the second verification information.

4 . The method of claim 3 , wherein the step of obtaining the cryptographic key comprises:

providing the identifier of the cryptographic key with a request for the cryptographic key to a key storage server configured to operate according to the first security communication protocol; and

receiving, from the key storage server, the cryptographic key corresponding to the identifier of the cryptographic key.

5 . The method of claim 4 , further comprising using the cryptographic key to verify the first value prior to using the received cryptographic key to derive the second verifying information.

6 . The method of claim 3 , further comprising, prior to the step of receiving the second authentication request:

receiving, from the first apparatus using signaling according to the second security communication protocol, a request to use signaling according to the second security communication protocol to exchange verifying information according to the first security communication protocol; and

signaling, to the first apparatus using signaling according to the second security communication protocol, an acceptance of the request to use the signaling according to the second security communication protocol to exchange verifying information associated with the first security communication protocol.

7 . A first apparatus comprising:

at least one processor; and

at least one memory storing instructions that, when executed by the at least one processor, causes the first apparatus to perform:

obtaining an identifier of a cryptographic key according to a first security communication protocol;

receiving a first authentication request from a second apparatus, wherein the first apparatus is a Personal Internet of Things network element with gateway capability PEGC) and the second apparatus is a Personal Internet of Things network element PINE);

signaling, in response to the first authentication request, a second authentication request according to a second security communication protocol to a third apparatus, the second authentication request comprising the identifier of the cryptographic key and a first verifying information according to the second security communication protocol, wherein the first verifying information comprises a first value calculated using the cryptographic key, wherein the third apparatus is an Authentication, Authorization, and Accounting (AAA) server, wherein the first security communication protocol is an Authentication and Key Management for Applications (AKMA) protocol and the second security communication protocol is an Internet Protocol (IP)-based security communication protocol, and wherein the IP-based security communication protocol is at least one of a Remote Authentication Dial-In User Service (RADIUS) protocol, an Internet Key Exchange (IKE) protocol, and an IP Security (IPSec) protocol;

receiving, from the third apparatus, a first authentication response according to the second security communication protocol, the first authentication response comprising a second verifying information according to the second security communication protocol, wherein the second verifying information comprises a second value;

verifying the first authentication response using the second value and the cryptographic key; and

signaling, in response to the received first authentication response, a second authentication response to the second apparatus.

8 . The first apparatus of claim 7 , further caused to perform, prior to the step of signaling the second authentication request to the third apparatus:

signaling, to the third apparatus using signaling according to the second security communication protocol, a request to use signaling according to the second security communication protocol to exchange verifying information associated with the first security communication protocol; and

receiving, from the third apparatus using signaling according to the second security communication protocol, an acceptance of the request to use the signaling according to the second security communication protocol to exchange verifying information associated with the first security communication protocol.

9 . A third apparatus comprising:

at least one processor; and

at least one memory storing instructions that, when executed by the at least one processor, causes the third apparatus to perform:

receiving, from a first apparatus in a Personal Internet of Things Network (PIN), a second authentication request according to a second security communication protocol in response to the first apparatus receiving a first authentication request from a second apparatus, the second authentication request comprising an identifier of a cryptographic key according to a first security communication protocol and a first verifying information according to the second security communication protocol, wherein the first verifying information comprises a first value, wherein the first apparatus is a Personal Internet of Things network element with gateway capability (PEGC), the second apparatus is a Personal Internet of Things network element (PINE), and the third apparatus is an Authentication, Authorization, and Accounting (AAA) server;

obtaining the cryptographic key using the identifier of the cryptographic key;

verifying the first value using the cryptographic key identified by the identifier of the cryptographic key;

deriving a second verifying information according to the second security communication protocol, wherein the second verifying information comprises a second value calculated using the cryptographic key identified by the identifier of the cryptographic key, wherein the first security communication protocol is an Authentication and Key Management for Applications (AKMA) protocol and the second security communication protocol is an Internet Protocol (IP)-based security communication protocol, and wherein the IP-based security communication protocol is at least one of a Remote Authentication Dial-In User Service (RADIUS) protocol, an Internet Key Exchange (IKE) protocol, and an IP Security (IPSec) protocol; and

signaling to the first apparatus an authentication response that comprises at least the second verification information.

10 . The third apparatus of claim 9 , wherein obtaining the cryptographic key comprises:

providing the identifier of the cryptographic key with a request for the cryptographic key to a key storage server configured to operate according to the first security communication protocol; and

receiving, from the key storage server, the cryptographic key corresponding to the identifier of the cryptographic key.

11 . The third apparatus of claim 10 , further caused to perform using the cryptographic key to verify the first value prior to using the received cryptographic key to derive the second verifying information.

12 . The third apparatus of claim 9 , further caused to perform, prior to receiving the second authentication request:

receiving, from the first apparatus using signaling according to the second security communication protocol, a request to use signaling according to the second security communication protocol to exchange verifying information according to the first security communication protocol; and

signaling, to the first apparatus using signaling according to the second security communication protocol, an acceptance of the request to use the signaling according to the second security communication protocol to exchange verifying information associated with the first security communication protocol.

Assignments (2)

Continuity (2)

References Cited (27)