Security lifecycle management of devices in a communications network
Described herein are complete lifecycle management processes for IoT/M2M devices. In an example, devices are commissioned and de-commissioned in a given system without requiring a user/human administrator. A delegated life-cycle management process is described, wherein devices rely upon a delegatee, which may have more computing and battery resources than the devices, to perform complete or partial lifecycle management operations on behalf of the devices. The delegatee may be a trusted entity that may belong to the same domain as the devices. Further, a Trust Enabling Infrastructure (TEI) is described herein, which may belong to a different trusted domain than the given device and its delegatee.
1. A method for a service providing service capabilities through a set of application programming interfaces (APIs) to a plurality of applications, the service being provided as a middleware, the method comprising:
authenticating, by a trust enabling infrastructure (TEI) in the service, a device by performing an attestation check;
receiving, by the TEI and from the device, a credential registration message;
determining, by the TEI and based on the credential registration message, one or more security policies comprising one or more rules for assigning devices to a network function in the service; and
sending, by the TEI and to the device, a response comprising an identifier of the network function and one or more parameters comprising a parameter associated with a security credential, wherein the identifier and the parameter associated with the security credential facilitate the device attaching to the network function.
2. The method as recited in claim 1 , wherein the credential registration message comprises an indication of one or more capabilities or security functionality of the device.
3. The method as recited in claim 1 , further comprising sending, by the TEI, on behalf of the device and to a third party, a message comprising an indication of a trustworthiness associated with the device.
4. The method as recited in claim 1 , wherein the determined network function comprises a first network function, and wherein the method further comprises migrating, by the TEI, the device from the first network function to a second network function in the service providing the device access to an application or service provider, wherein the migrating is based on the one or more rules of the one or more security policies.
5. The method as recited in claim 1 , wherein at least one of the one or more rules of the one or more security policies has a dependency based on a location of the device.
6. The method as recited in claim 4 , further comprising de-commissioning, by the TEI, the device from the application or service provider, whereby the device is prevented from using the application or service provider.
7. The method as recited in claim 1 , further comprising sending, by the TEI to the network function, a message comprising an identifier and a credential associated with the device.
8. The apparatus as recited in claim 1 , wherein the instructions, when executed by the one or more processors, further cause sending, by the TEI to the network function, a message comprising an identifier and a credential associated with the device.
9. A device comprising one or more processors and one or more memories storing instructions that, when executed by the one or more processors, cause the device to perform operations comprising:
establishing, based on an authentication of the device, a secure connection with a trust enabling infrastructure (TEI) in a service providing service capabilities through a set of application programming interfaces (APIs) to a plurality of applications, the service being provided as a middleware;
sending, to the TEI, a credential registration message;
receiving, from the TEI, a response to the credential registration message, wherein the response comprises an identifier of a network function in the service to which the device is to attach and one or more parameters comprising a parameter associated with a security credential, and wherein the identified network function is determined based on the credential registration message and one or more security policies comprising one or more rules for assigning devices to the network function in the service; and
attaching, based on the identifier of the network function and the parameter associated with the security credential, to the network function.
10. The device as recited in claim 9 , wherein the credential registration message comprises an indication of one or more capabilities or security functionality of the device.
11. The device as recited in claim 9 , wherein the determined network function comprises a first network function, and wherein the instructions, when executed, further cause the device to migrate, under control of the TEI, from the first network function to a second network function in the service providing an application or service provider, wherein the migrating is based on the one or more rules of the one or more security policies.
12. The device as recited in claim 9 , wherein at least one of the one or more rules of the one or more security policies has a dependency based on a location of the device.
13. The device as recited in claim 11 , wherein the instructions, when executed, further cause the device to be prevented from accessing the application or service provider based on a de-commissioning by the TEI.
14. An apparatus comprising one or more processors and memory storing instructions that, when executed by the one or more processors, cause the apparatus to implement a trust enabling infrastructure (TEI) in a service providing service capabilities through a set of application programming interfaces (APIs) to a plurality of applications, the service being provided as a middleware, the instructions further causing the apparatus to perform operations comprising:
authenticating, by the TEI in the service, a device by performing an attestation check;
receiving, by the TEI and from the device, a credential registration message;
determining, by the TEI and based on the credential registration message, one or more security policies comprising one or more rules for assigning devices to a network function in the service; and
sending, by the TEI and to the device, a response comprising an identifier of the network function and one or more parameters comprising a parameter associated with a security credential, wherein the identifier and the parameter associated with the security credential facilitate the device attaching to the network function.
15. The apparatus as recited in claim 14 , wherein the credential registration message comprises an indication of one or more capabilities or security functionality of the device.
16. The apparatus as recited in claim 14 , wherein the instructions, when executed by the one or more processors, further cause sending, by the TEI, on behalf of the device and to a third party, a message comprising an indication of a trustworthiness associated with the device.
17. The apparatus as recited in claim 14 , wherein the determined network function comprises a first network function, and wherein the instructions, when executed by the one or more processors, further cause migrating, by the TEI, the device from the first network function to a second network function in the service providing the device access to an application or service provider, wherein the migrating is based on the one or more rules of the one or more security policies.
18. The apparatus as recited in claim 14 , wherein at least one of the one or more rules of the one or more security policies has a dependency based on a location of the device.
19. The apparatus as recited in claim 17 , wherein the instructions, when executed by the one or processors, further cause de-commissioning, by the TEI, the device from the application or service provider, whereby the device is prevented from using the application or service provider.