Patent Application
20110150266
This application relates computer networking and security, and in particular, to providing for automated setup of security and networking features.
Many existing electronic devices, such as laptops, netbooks, PDAs, and smart phones allow users to modify network and security settings. This is useful to users when they desire to change their networking connections, such as when encountering new wireless networks or switching between network options. Oftentimes, however, networking can be difficult for a user to setup without introducing errors and frustration.
For example, when attempting to use a wireless network in a public space, a user may have to select from multiple Service Set Identifiers (also known as “SSIDs”) which identify available wireless networks. If multiple similarly-named SSIDs are broadcast, users may end up being confused as to which one is proper and safe for them to use. In other common scenarios, an available wireless network may not broadcast its presence, and thus forcing the user to enter an SSID by hand. If the SSID is complicated or spelled non-traditionally (or is in a language unfamiliar to the user), there is a real possibility the user will enter the SSID incorrectly. When this happens, the user may find himself or herself unable to connect, or, even worse, be connected to a different, unintended (and unsecure/untrustworthy) wireless network with a similarly-spelled SSID. This can be hazardous for lay users, who may not realize they are not properly connected.
Some networks utilize encryption, along with a password, a pass phrase, or a character string, such as a hex key, to prevent improper connections. In this scenario, a user is typically given both an indication of the SSID of the wireless network to connect to, as well as the password to type in response to a prompt. Unfortunately, this technique provides the same possibility for incorrect entry (of the password) as discussed above. This problem is compounded in the case of passwords, because frequently passwords have no inherent meaning to the user attempting to type them in. When a password is long and difficult to guess, users are more likely to enter it incorrectly and have a hard time correcting the error, even during a review. A similar issue can exist when the encryption requires entry of a character string, such as a string of hexadecimal digits. Such a string may comprise, according to various encryption implementations, 13, 26, or even 52 characters, for example. Thus, a user may find him or herself called upon to enter a string such as “6c736b64666f73766f73696468766f73646968766f7369647633343235” in order to utilize a network. Entry of such a long string without introducing errors is difficult.
Many of these same problems occur in other security and networking contexts, such as, for example, SSL, openvpn, and openssh. For example, to connect and interact with some secure networks, users are required to utilize a security certificate, such as a certificate authority (“CA”) root certificate. In one scenario, the user will use the certificate to authenticate that the user, or the user's device, is permitted access on the network. In another, the user will use a known encryption key associated with the certificate to encrypt messages for secure transmission. In some usage cases, a user may receive a copy of a certificate through two different means, such as electronic and paper-printed, to ensure that it is securely transmitted. Thus, even when a user receives an electronic certificate, the user may have to enter separately-received certificate information by hand in order to verify that the certificate is valid.
But because security certificates utilize encryption, this by-hand entry may present issues similar to those present with wireless networking. Encryption keys, especially those used in security certificates, may be as long as hundreds or even thousands of characters. It is often impractical to expect a user to correctly enter this large an amount of data, especially when the data has no apparent structure to the user, such as in encryption keys or encrypted certificate data. Some systems may attempt to mitigate this problem by taking an image of the printed version of the certificate and using optical character recognition to extract the information. However, even using these techniques, the sheer size of the data, and the inexactitude of optical character recognition, means that undesired errors are likely to be introduced.
Embodiments of the present invention will be described by way of exemplary embodiments, but not limitations, illustrated in the accompanying drawings in which like references denote similar elements, and in which:
a and 5b are examples of types of encoded security information in accordance with various embodiments;
Illustrative embodiments of the present invention include, but are not limited to, methods and apparatuses for performing automated security setup using entry of security information through a non-primary entry method, such as by scanning a multi-dimensional code to extract security information encoded therein. The techniques may use a dedicated application or computer process running on a device which extracts the security information from an image taken of a multi-dimensional code and directs setup of one or more security features for the device. Examples of security features which may be set up may include connection to a wireless network or use of a specified security certificate. By providing information in a relatively-compact multi-dimensional code, an entity that wishes to provide for secure interaction with a user can easily provide connection or security information while at the same time reducing the possibility that the information will be entered incorrectly.
Various aspects of the illustrative embodiments will be described using terms commonly employed by those skilled in the art to convey the substance of their work to others skilled in the art. However, it will be apparent to those skilled in the art that alternate embodiments may be practiced with only some of the described aspects. For purposes of explanation, specific numbers, materials, and configurations are set forth in order to provide a thorough understanding of the illustrative embodiments. However, it will be apparent to one skilled in the art that alternate embodiments may be practiced without the specific details. In other instances, well-known features are omitted or simplified in order not to obscure the illustrative embodiments.
Further, various operations will be described as multiple discrete operations, in turn, in a manner that is most helpful in understanding the illustrative embodiments; however, the order of description should not be construed as to imply that these operations are necessarily order dependent. In particular, these operations need not be performed in the order of presentation.
The phrase “in one embodiment” or “in an embodiment” is used repeatedly. The phrase generally does not refer to the same embodiment; however, it may. The terms “comprising,” “having,” and “including” are synonymous, unless the context dictates otherwise. The phrase “A/B” means “A or B”. The phrase “A and/or B” means “(A), (B), or (A and B)”. The phrase “at least one of A, B and C” means “(A), (B), (C), (A and B), (A and C), (B and C) or (A, B and C)”.
As discussed above, embodiments of the present techniques and systems include a wireless setup application which may facilitate setup of a wireless network through the use of a multi-dimensional code, such as a two-dimensional QR code. After the QR code is imported into a device, such as, for example, by capturing an image of the code, the application may extract structured information which may be encoded in the QR code. This information may then direct the application to set up the device to use a specified wireless network. Additionally, if the wireless network requires specific settings, including, for example, the use of a password or pass phrase, the application may include the setup of this information. In various embodiments, setup of a wireless network may be performed through the use of known APIs which are provided by security and networking services on the device, such as APIs provided by an operating system.
Embodiments of the present techniques and systems may also include a security certificate setup application which may facilitate setup and use of a security certificate, such as, for example, a root certificate. In various embodiments, certificate information may be encoded in a multi-dimensional code, such as a two-dimensional QR code.. After an image of the code is scanned, the certificate information may be extracted and used in future communication where security or trust is desired. Alternatively, in various embodiments the application may use encoded printed certificate information to verify an already-received security certificate known to a device.
While techniques and apparatuses discussed herein are discussed with reference to the setup of “security,” this terminology may be understood to encompass various forms of security and networking which utilizes additional information for its setup, and in particular lengthy and/or difficult-to-input information. For example, “security” may encompass, in various embodiments, networking, wireless networking, encryption, and security certificates, and other forms of data. Such data, may be provided in a difficult-to-enter form or in other ways which are difficult or complex to transfer to a security-associated system. Additionally, in various embodiments, security-related information may not be information used to set up, modify, or maintain security protocols, but may instead be secure information used for other purposes. Thus, security information may include data that uses security-related technologies to prevent unauthorized reading, interception, tampering, or modification of the data itself or of other data transmitted that uses data contained in the security information to achieve a goal associated with the information. For example, in addition to the descriptions of security-related information discussed above, such information may include coded information related to online payments.
While for the purposes of illustration, a QR code is used which displays a URL, in various embodiments the multi-dimensional code 120 may display different or more or less complex information, including formatted information. For example, XML code may be encoded in the multi-dimensional code 120. Additionally, in various embodiments meta data may be included in the information encoded in the multi-dimensional code including, but not limited to, descriptions of data encoded therein, version numbers, and/or error correction checksums (not illustrated). In various embodiments, the multi-dimensional code may take other forms as well and is not limited solely to the use of QR codes.
As illustrated in
While in the illustrated embodiment, the computing device 140 would comprise one or more networking capabilities, including a card or other device for wireless networking, in various embodiments, the computing device 140 may not include such capabilities and may utilize various embodiments of the present techniques toward setup of security or other services outside of wireless networks.
As illustrated in
Various embodiments of the present techniques are performed with relation to applications and services which operate on the computing device 210. For example, the illustrated computing device 210 may comprise a camera application 230. This camera application 230 may be used to direct operation of the camera 220. Thus, when a user desires to capture an image of the multi-dimensional code 225, the user may direct the camera application to cause the camera to acquire the code image 235. This code image 235 may then, in various embodiments, be shared or transferred to a wireless setup application 240.
In various embodiments, the wireless setup application 240 itself may direct the camera application 230 to capture the image. In various alternative embodiments, the camera application 230 may capture the image 235 of the multi-dimensional code 225 without direction of the wireless setup application 240. In some such embodiments, the camera application may, after capturing the image, request direction from a user as to whether the wireless setup application should be launched and used to decode the information contained in the multi-dimensional code 225. In various embodiments, the camera application 230 may itself posses some capability of decoding the multi-dimensional code 225. In various embodiments, information in the multi-dimensional code 225 may direct the camera application to launch or otherwise communicate with the wireless setup application. Additionally, in various embodiments, the wireless setup application may comprise an independent application, an independent process, and/or one or more subroutines or libraries which are executed as subordinate to one or more other applications or processes.
The wireless setup application 240 may then use the information encoded in the image 235, illustrated as wireless setup data 245, to control one or more wireless networking APIs 250. These APIs 250 may, in turn control wireless networking services 260 to provide wireless networking capabilities to the computing device 210 according to the wireless setup data 245.
Various embodiments of the present techniques are performed with relation to applications and services which operate on the computing device 310. For example, the illustrated computing device 310 may comprise a camera application 330. This camera application 330 may be used to direct operation of the camera 320. Thus, when a user desires to capture an image of the multi-dimensional code 325, the user may direct the camera application to cause the camera to acquire the code image 335. This code image 335 may then, in various embodiments, be shared or transferred to a certificate setup application 340.
In various embodiments, the certificate setup application 340 itself may direct the camera application 330 to capture the image. In various alternative embodiments, the camera application 330 may capture the image 335 of the multi-dimensional code 325 without direction of the certificate setup application 340. In some such embodiments, the camera application may, after capturing the image, request direction from a user as to whether the wireless setup application should be launched and used to decode the information contained in the multi-dimensional code 325. In various embodiments, the camera application 330 may itself posses some capability of decoding the multi-dimensional code 325. In various embodiments, information in the multi-dimensional code 325 may direct the camera application to launch or otherwise communicate with the certificate setup application. Additionally, in various embodiments, the certificate setup application may comprise an independent application, an independent process, and/or one or more subroutines or libraries which are executed as subordinate to one or more other applications or processes.
The wireless setup application 340 may then use the information encoded in the image 335, illustrated in
The first illustrated data element is an indication of intended use element 412. In various embodiments, this indication may comprise a code or other data which indicates the purpose for which data is presently encoded in a multi-dimensional code. For example, the two-dimensional QR code 225 illustrated in
Next,
Next, a description of data types element 416 may be included. In various embodiments, this description may comprise a list of data types encoded in the multi-dimensional code itself. In other embodiments, the description of data types may be a reference to another document or specification which itself describes a set of data types. In various embodiments, the description of data types may be combined with the version number element 414.
Next, the security/networking data element 418 is illustrated. In various embodiments, the description of data types element 416 and the security/networking data element 418 may be combined into a single element or a hierarchical structure which is self-descriptive. For example, the data may be encoded in the form of XML code which describes the data as it is presenting it. Next, error detection data element 420 is illustrated. This element may be used to help verify the correctness of data which is decoded from the multi-dimensional code. In various embodiments, error detection code may be implemented as a checksum or as more complex error detection data. In various embodiments, the error detection data may exist in lieu of, or in addition to, checksum or other error detection data which is provided in a multi-dimensional code specification and created at the time the multi-dimensional code is encoded and displayed.
a and 5b illustrate example implementations of structures of data elements which may be encoded in a multi-dimensional code according to various usage embodiments. For example, the data structure illustrated in
a begins by illustrating a data element 532 which indicates that the data is to be used for wireless setup. This may be followed by data element 534, which illustrates a wireless setup version number. In various implementations, and as illustrated in
Next,
b begins by illustrating a data element 562 which indicates that the data is to be used for certificate setup. This is followed by data element 564, which illustrates a certificate setup version number. As discussed above with reference to
Next,
The process begins at block 610 where a user or computer may start up a security application. In various embodiments, the user may start up the application by directing it to execute; in others, the application may be executed automatically upon startup or in association with the activation of a camera or other device. Next, at block 620, a user may turn on a camera to allow for multi-dimensional codes to be input into the system. In various embodiments the camera may be associated with the computing device, such as, for example, being incorporated into or otherwise attached to the computing device.
The illustrated process may then proceed to take an image of multi-dimensional code at block 630. As discussed above, this image may be taken at direction of the security setup application in accordance with various embodiments. Next, at block 640, the security setup application may decode the code and use the information encoded therein to perform a security setup such as, for example, the setup of a device to interact on a wireless network or to use a security certificate in networked communications.
As illustrated, in various embodiments, processes performed at the blocks illustrated in
The process begins at block 710, where a user or computer may turn on a camera to capture an image of the multi-dimensional code. In various embodiments the camera may be associated with the computing device, such as, for example, being incorporated into or otherwise attached to the computing device. Next, at block 720, the user may direct the camera, using, in various embodiments, a camera application, to capture an image of the multi-dimensional code. Then, at block 730, the code may be decoded. In various embodiments, this decoding may be performed by the camera application with no input from a security setup application. In alternative embodiments, a multi-dimensional code reading application, such as a QR code reader application, may be employed to decode some or all of the information in the multi-dimensional code before utilizing the security setup application.
Next, at block 740, the application which decoded the multi-dimensional code may determine that a security setup is to be facilitated by the code. In one embodiment, this may be done by identifying an intended use identifier located within the multi-dimensional code or an application identifier which points to an automated security setup application. This may be done, in some embodiments, though the use of URLs or other information which identify that setup information is included, along with a mapping on the computing device that causes the automated security setup application to be executed to process this information. In various embodiments, the computing device may then request permission from a user to launch the security setup application at block 750 in order to continue with modification or setup of various security features. The process may then continue, if such permission is requested and given, to block 760, where the security setup application is launched and is passed the encoded information to process. In various embodiments, the passed information may still be in the form of a multi-dimensional image, or may be decoded in whole or in part for processing by the security setup application.
The process begins at block 810, where the security setup application may extract an indicator of the intended use of the code. Next, at block 820, the security setup application may extract a version number for the code, followed by extracting a description of the data contained in the code at block 830. In various embodiments, using the information extracted at blocks 810-830, the security setup application can determine what the structure of the information contained in the code is, and can know to what parameters and settings the actual data payload of the multi-dimensional code will apply, as well as APIs which may be used to control the computing device to perform the desired security setup. Next, at block 840, the security setup application may extract data values for the data types which were determined earlier after the processes of blocks 810-830. Additionally, at block 840, the security setup application may operate networking and/or security APIs using the extracted data values and the knowledge of their meaning gained in the previous actions. For example, the security setup application may modify values used by one or more security features or provide new values for these features; alternatively, security features, protocols, or processes may be turned on or off, or may be stopped or started. After performing the setup using these APIs, the process may end.
The techniques and apparatuses described herein may be implemented into a system using suitable hardware and/or software to configure as desired.
System control logic 908 for one embodiment may include any suitable interface controllers to provide for any suitable interface to at least one of the processor(s) 904 and/or to any suitable device or component in communication with system control logic 908.
System control logic 908 for one embodiment may include one or more memory controller(s) to provide an interface to system memory 912. System memory 912 may be used to load and store data and/or instructions, for example, for system 900. System memory 912 for one embodiment may include any suitable volatile memory, such as suitable dynamic random access memory (DRAM), for example.
System control logic 908 for one embodiment may include one or more input/output (I/O) controller(s) to provide an interface to NVM/storage 916 and communications interface(s) 920.
NVM/storage 916 may be used to store data and/or instructions, for example. NVM/storage 916 may include any suitable non-volatile memory, such as flash memory, for example, and/or may include any suitable non-volatile storage device(s), such as one or more hard disk drive(s) (HDD(s)), one or more solid-state drive(s), one or more compact disc (CD) drive(s), and/or one or more digital versatile disc (DVD) drive(s) for example.
The NVM/storage 916 may include a storage resource physically part of a device on which the system 900 is installed or it may be accessible by, but not necessarily a part of, the device. For example, the NVM/storage 916 may be accessed over a network via the communications interface(s) 920.
System memory 912 and NVM/storage 916 may include, in particular, temporal and persistent copies of security setup logic 924, respectively. The security setup logic 924 may include instructions that when executed by at least one of the processor(s) 904 result in the system 900 performing automated security setup actions as described in conjunction with, for example, the wireless setup or certificate setup applications described herein. In some embodiments, the security setup logic 924 may additionally/alternatively be located in the system control logic 908.
Communications interface(s) 920 may provide an interface for system 400 to communicate over one or more network(s) and/or with any other suitable device. Communications interface(s) 920 may include any suitable hardware and/or firmware. Communications interface(s) 920 for one embodiment may include, for example, a network adapter, a wireless network adapter, a telephone modem, and/or a wireless modem. For wireless communications, communications interface(s) 920 for one embodiment may use one or more antenna(s).
For one embodiment, at least one of the processor(s) 904 may be packaged together with logic for one or more controller(s) of system control logic 908. For one embodiment, at least one of the processor(s) 904 may be packaged together with logic for one or more controllers of system control logic 908 to form a System in Package (SiP). For one embodiment, at least one of the processor(s) 904 may be integrated on the same die with logic for one or more controller(s) of system control logic 908. For one embodiment, at least one of the processor(s) 904 may be integrated on the same die with logic for one or more controller(s) of system control logic 908 to form a System on Chip (SoC).
In various embodiments, system 900 may have more or less components, and/or different architectures.
Although specific embodiments have been illustrated and described herein, it will be appreciated by those of ordinary skill in the art that a wide variety of alternate and/or equivalent implementations may be substituted for the specific embodiments shown and described, without departing from the scope of the embodiments of the present invention. This application is intended to cover any adaptations or variations of the embodiments discussed herein. Therefore, it is manifestly intended that the embodiments of the present invention be limited only by the claims and the equivalents thereof.
