Patent Description:
In the so-called "Internet of things" (IoT), network devices are configured to communicate with other devices in order to receive and transmit data packages, such as measurement data or control commands. In order to avoid misuse of data sent between particular network devices and to provide for a secure communication, a reliable authentication of a particular network device is necessary.

One possibility for authentication is the use of pre-determined Pre-Shared Keys (PSK), which are known to the respective communication partners. To ensure unique authentication, the PSKs must be specific to a certain constellation of an loT device with a target system, such as an loT platform, a cloud or any other server.

When loT devices are produced, they are provided with a unique identifier, such as an International Mobile Equipment Identity (IMEI). Depositing PSK on loT devices is complex and costly.

On the one hand, an independent key must be stored on each device during production, which makes an automated process difficult. On the other hand, the keys stored on the devices must also be stored with the target system later on, which requires a secure exchange.

Further, at the time of production of an loT device, a target system is usually not yet known. This is why a reverse method of generating the keys in the target system and handing them over to the device manufacturer for storage on the device also fails.

When using public communication networks, IoT devices are equipped with SIM-cards to authenticate themselves on the public network. To prevent unauthorized persons from reading and using data stored on a SIM-card, the data on the SIM-card is encrypted and must be decrypted by entering a PIN.

PIN entry is not possible for mass commissioning of networked small devices in the loT range, as there are often no input interfaces on the device at all, making entry by a user impossible. A previous entry before delivery of the device to the customer fails at the same points as the deposit of PSK directly on the device. For this reason, PIN entry is usually deactivated on SIM-cards used in the loT area (M2M-SIM-card).

By depositing the IMEI of a device to be used in a target system, the security level can be improved and use in another device can be prevented as long as the IMEI is confidential. However, the transmission of pre-shared keys to an IoT device is insecure by writing them to a M2M-SIM-card. Due to the lack of a PIN request, information stored on a M2M-SIM-card can be read by any person who has access to the M2M-SIM-card itself or a copy of the M2M-SIM-card.

A security level based on a combination of a device-ID is limited to the level of confidentiality of the device-ID. Since the authenticity of the device-ID provided by an application cannot be verified, an authentication system can be overcome by trying different device-IDs for particular key-secret combinations read from a M2M-SIM-card.

<CIT> describes a method of dual-network communication for a communication device.

Against this background, it is a problem to be solved by the invention disclosed herein, to provide for a reliable authentication of loT-devices at a target server.

The above identified problem is solved by the subject-matter of the independent claims.

According to a first aspect, the present invention relates to an loT-authentication server for authentication of a network device with a SIM-card. The loT-authentication server comprises a processor configured to store a dataset linking a unique identification of the SIM-card and a given set of specific credentials in a memory of the loT-authentication server, to receive an authentication request comprising a candidate unique identification of the network device and a candidate set of credentials, to retrieve a unique identification of the network device specified in a network layer of a public communication network transmitting the authentication request and to generate an authentication-label for labelling the network device as authenticated only in case the unique identification of the network device specified in the network layer of the public communication network transmitting the authentication request matches the candidate unique identification of the network device specified in the authentication request, and the candidate set of credentials transmitted to the loT-authentication server from the network device using the SIM-card matches the specific credentials linked with the unique identification of the SIM-card in the dataset.

In the context of the present invention, a network device may be a so-called Internet of Things (IoT) device with a SIM-card for communication via a public wireless network, such as a GSM-network, for example. The SIM-card of a network device may be a so-called M2M-SIM-card.

In the context of the present invention, an authentication request is a message for requesting an authentication process to verify the identity of a communication partner in a communication network.

In the context of the present invention, a public communication network is a network for communication of mobile phones, such as GSM-, <NUM>-, <NUM>-network, or the like. A public communication network is accessed via a SIM-card for communication with a network server of the public communication network.

The present invention is based on an authentication of a network device by using information available to a provider of a public communication network only. Thus, any existing network device can be authenticated based on the present invention, in particular the loT-authentication server described herein.

In order to maximize the validity of an authentication label provided by the loT-authentication server described herein, two authentication procedures are implemented in the loT-authentication server that may be used in combination or independent from each other.

A first authentication procedure is based on a set of credentials, such as a key and a secret, that are specific for a particular SIM-card used by a particular network device. Thus, the set of credentials is linked with a unique identification of the SIM-card, such as an International Mobile Subscriber Identity (IMSI), for example. This link between the specific, i.e. unique and exclusive set of credentials with the unique identification of the SIM-card is stored in a dataset in a memory of the loT-authentication server described herein.

In case the loT-authentication server receives an authentication request via a public communication network using a SIM-Card, the loT-authentication server reads the unique identification of the SIM-card and a candidate set of credentials from a message transmitting the authentication request and checks whether the candidate set of credentials matches the specific credentials linked with the unique identification of the SIM-card in the dataset stored in the memory of the loT-authentication server.

According to the first procedure, only in case the candidate set of credentials matches the specific credentials linked with the unique identification of the SIM-card in the dataset stored in the memory of the loT-authentication server, an authentication label is created for the network device and the network device is allowed to communicate with a respective target server, for example.

A second authentication procedure is based on information of a message transmitting an authentication request itself. Therefore, a unique identification of the network device specified in a network layer of a public communication network transmitting the authentication request is extracted by the loT-authentication server and compared with a candidate unique identification of the network device specified in the authentication request, i.e. in the message itself. In other words, a candidate unique identification of the network device specified in an application layer of a public communication network is compared with a unique identification of the network device used for the network device in a network layer of the public communication network.

According to the second procedure, only in case the candidate unique identification of the network device specified in the authentication request, i.e. in the message transmitted from the network device to the loT-authentication server matches the unique identification of the network device specified in the network layer of the public communication network, an authentication label is created for the network device and the network device is allowed to communicate with a respective target server, for example.

According to an embodiment, the first procedure and the second procedure may be carried out in combination and/or exclusively by the loT-authentication server.

According to an embodiment, the processor of the loT-authentication server may be configured to enable a communication between a respective target server and the network device only in case the network device is labelled as authenticated.

To prevent access on the target server by unauthenticated entities the loT-authentication server may be configured to allow a communication with a target server only for network devices that have been labelled as authenticated. Thus, every network device has to register at the loT-authentication server in order to get an authentication-label before a communication with the target server is established.

In order to exclude network devices that have not been labelled by the loT-authentication server yet, from a communication with the target server, the loT-authentication server may be configured to work as a relay or gateway between a communication interface for communication with a network device and the target server.

According to an embodiment, the processor of the loT-authentication server is further configured to communicate with the public communication network device via a gateway such as a network server.

A network server is a server that registers a SIM-card for communication via a public communication network, such a GSM-network, for example. Thus, a SIM-card has to be registered at the network server before any communication via the public communication network can be established. As the network server requests and stores unique identification of a particular SIM-card, the information, in particular the unique identification of a particular SIM-card stored in the network server can be used by the loT-authentication server. Accordingly, a registration process at a network server may be linked with an authentication process at the loT-authentication server.

For executing an authentication process, the network server may forward a unique identification of a particular SIM-card to the loT-authentication server. Alternatively, the loT-authentication server may request a unique identification of a particular SIM-card at the network server in case an authentication label is requested by a target server or a network device starts an authentication process at the loT-authentication server.

According to a further embodiment, the unique identification of the network device comprises an IMEI and/or a MAC-address of the network device.

According to still a further embodiment, the unique identification of the SIM-card comprises at least an International Mobile Subscriber Identity (IMSI), and/or a Mobile Station Integrated Services Digital Network Number (MS-ISDN) and/or an integrated circuit card identifier (ICCID).

According to a second aspect, the present invention relates to an authentication system for authentication of a network device. The authentication system comprises an embodiment of the loT-authentication server, and a target server. The target server comprises a processor configured to request an authentication process at the loT-authentication server or at a network server which is in communicative connection with the loT-authentication server, in case a network device contacting the target server has not been labelled by the loT-authentication server yet, and to allow a registration for a network device at the target server only in case the loT-authentication server labelled the network device as authenticated.

The target server of the authentication system may be connected to the loT-authentication server by a communication interface and may exchange information with the loT-authentication server in order to request for an authentication-label of a network device, for example.

According to a third aspect, the present invention relates to a computer implemented authentication method for authentication of a network device having a SIM-card with a unique identification. The authentication method comprises the following steps:.

The computer implemented authentication method may be carried out by the loT-authentication server or the authentication system described herein.

According to a fourth aspect, the present invention relates to a computer implemented credential authentication method for authentication of a network device having a SIM-card, the credential authentication method comprising the following steps:.

According to a fifth aspect, the present invention relates to a computer implemented network authentication method for authentication of a network device having a SIM-card, the network authentication method comprising the following steps:.

According to a sixth aspect, the present invention relates to a non-transitory computer readable medium having stored thereon software instructions that, when executed by a processor, cause the processor to generate control signals for controlling an loT-authentication server for authentication of a network device having a SIM-card with a unique identification, by executing the steps according to any of the authentication method, the credential authentication method, and the network authentication method.

The foregoing features and advantages of the present invention will be appreciated still more precisely from the following description, with reference to the accompanying drawings in which:.

In <FIG>, an authentication system <NUM> is shown. The authentication system <NUM> comprises an loT-authentication server <NUM> and a network server <NUM>.

The network server <NUM> manages account details of a SIM-card <NUM> used by a network device <NUM> for communication with a target server <NUM> via a public communication network.

For communication via the public communication network, the SIM-card <NUM> has to be registered at the network server <NUM> in a registration process, where a unique identification (IdSIM) <NUM> of the SIM-card <NUM> is registered at the network server <NUM>. Thus, the network server <NUM> is configured to communicate with the SIM-card <NUM> via the public communication network, such as a GSM-network, for example.

For communication in an authenticated system with the target server <NUM>, the SIM-card <NUM> has to be authenticated at the loT-authentication server <NUM> in an authentication process. Thus, the loT-authentication server <NUM> is configured to accept traffic from the SIM-card <NUM> via the network server <NUM> of the public communication network, such as a GSM-network, for example.

In order to communicate with the target server <NUM>, the network device <NUM> itself needs to be authenticated as well. For authentication of the network device <NUM>, the network device <NUM> registers at the network server <NUM> during a first connection with the public communication network and submits the IdSIM <NUM> to the network server <NUM>. For this submission of the IdSIM <NUM>, an IdN <NUM> of the network device <NUM> is transmitted in a network layer of a public communication network used by the SIM-card <NUM>. This IdN <NUM> is only accessible and ed-itable by a provider of the public communication network.

For authentication of the network device <NUM>, the network device <NUM> submits an authentication request to the loT-authentication server <NUM> via a message comprising a set of candidate credentials <NUM>, such as a key and a secret, for example, and a candidate IdN <NUM> as specified by the network device <NUM> itself in an application layer of the message. Additionally, the network server <NUM> provides the loT-authentication server <NUM> with the IdSIM <NUM> and the IdN <NUM> for transmission of the message according to the authentication request.

In response to receiving the authentication request, the loT-authentication server <NUM> generates an authentication-label for labelling the network device <NUM> as authenticated in case the IdN <NUM> specified in the network layer of the public communication network transmitting the authentication request matches the candidate IdN <NUM> specified in the application layer of the authentication request by the network device <NUM> itself.

Additionally, or alternatively, the loT-authentication server <NUM> generates an authentication-label for labelling the network device <NUM> as authenticated in case the candidate set of credentials <NUM> matches a specific set of credentials linked with the IdSIM <NUM> in a dataset <NUM> stored in a memory <NUM> of the loT-authentication server <NUM> in a production process of the SIM-card <NUM>.

In case the network device <NUM> has been labelled as authenticated by the loT-authentication server <NUM>, an authentication label <NUM> is transmitted to the target server <NUM> specifying that the candidate set of credentials <NUM> matches the specific set of credentials linked with the IdSIM <NUM> in the dataset <NUM> and/or the IdN <NUM> matches the candidate IdN <NUM>.

The network server <NUM> may be configured to provide the IdSIM <NUM> and the IdN <NUM> automatically every time the network device <NUM> tries to register at the target server <NUM>. Alternatively, the loT-authentication server <NUM> may be configured to ask for the IdSIM <NUM> and the IdN <NUM> every time the network device <NUM> tries to register at the target server <NUM> and sends an authentication request comprising the candidate set of credentials <NUM> and the candidate IdN <NUM>.

For executing logic operations underlying the operations carried out by the loT-authentication server <NUM>, the loT-authentication server <NUM> comprises a processor <NUM>, which may a central processing unit, an application-specific integrated circuit (ASIC) or any other programmable hardware device interacting with the memory <NUM> of the loT-authentication server <NUM>.

In <FIG> a method <NUM> for authentication of a network device having a SIM-card is shown.

Claim 1:
loT-authentication server (<NUM>) for authentication of a network device (<NUM>) with a SIM-card (<NUM>), the loT-authentication server (<NUM>) comprising:
- a processor (<NUM>) configured to:
- store a dataset (<NUM>) linking a unique identification (<NUM>) of the SIM-card (<NUM>) and a given set of specific credentials in a memory (<NUM>) of the loT-authentication server (<NUM>),
- receive an authentication request comprising a candidate unique identification (<NUM>) of the network device (<NUM>) and a candidate set of credentials (<NUM>);
- retrieve a unique identification (<NUM>) of the network device (<NUM>) specified in a network layer of a public communication network transmitting the authentication request; and
- generate an authentication-label (<NUM>) for labelling the network device (<NUM>) as authenticated only in case the unique identification (<NUM>) of the network device (<NUM>) specified in the network layer of the public communication network transmitting the authentication request matches the candidate unique identification (<NUM>) of the network device (<NUM>) specified in the authentication request, and the candidate set of credentials (<NUM>) transmitted to the loT-authentication server (<NUM>) from the network device (<NUM>) using the SIM-card (<NUM>) matches the specific credentials linked with the unique identification (<NUM>) of the SIM-card (<NUM>) in the dataset (<NUM>),
wherein the processor (<NUM>) is further configured to:
- enable a communication between a target server (<NUM>) and the network device (<NUM>) only in case the network device is labelled as authenticated, and
- communicate with the network device (<NUM>) via a gateway (<NUM>) of the public communication network,
wherein the gateway (<NUM>) is a network -server (<NUM>) that is configured to register the SIM-card for communication via the public communication network.