Patent Application
20180288035
A portion of the disclosure of this patent document contains material that is subject to copyright protection. The copyright owner has not objected to the facsimile reproduction by anyone of the patent document or the patent disclosure as it appears in the Patent and Trademark Office patent files or records, but otherwise reserves all copyright rights whatsoever.
The invention relates generally to systems and methods for telecommunication components and methods and more particularly to adding trusted nodes.
In the prior art, the way that endpoints are deployed securely and sent to the customer is through a third-party reseller. Resellers sell endpoints, from the factory, that are not specific to a particular customer. The third-party creates a staging area, loads certificates, configures the endpoints specifically for a particular customer, and sends the endpoints to the customer. The third-party makes it possible for customers to be able to securely deploy endpoints by simply plugging them in to a network where the phone then self-register. It is often inefficient to have an intermediary and a staging area to set up endpoints, however, shipping endpoints directly to customers, where the endpoints then configure themselves, creates security vulnerabilities.
These and other needs are addressed by the various embodiments and configurations of the present invention. The present invention can provide a number of advantages depending on the particular configuration. These and other advantages will be apparent from the disclosure of the invention(s) contained herein.
The proposed solutions solves these and other issues by providing a secure redirection service for endpoints and thereby enable endpoints to be directly shipped to customers, including allowing service provider association and providing a provisioning Uniform Resource Locator (URL), while reducing or eliminating, the potential for misuse by a nefarious actor, whether human and/or software.
In one embodiment, systems and methods are described in order to provide a direct-to-customer solution that allows for the secure configuration, authentication, and registration of endpoints from a customer site. In one embodiment, an endpoint may be a digital telephone, such as utilizing Session Imitation Protocol (SIP) and/or other packet-based protocol, softphone (e.g., digital telephonic component embodied on a computing device, such as a personal computer), smartphone, and/or other device comprising packet-based communication components. In another embodiment, endpoints are limited to physical devices (e.g., telephones) that may be physically provided to a location for use via attachment to a location-specific network or network portion. Endpoints may utilize additional or alternative forms of digital media communication, such as video, chat, email, co-browse, etc. Endpoints may also incorporate other features, such as analog telephony, computing components, etc.
In one embodiment, a Device Enrollment Service (DES) is described and may be deployed on a private and/or public network (e.g., the Internet). The DES may have multiple interfaces, including one or more of, but not limited to:
In another embodiment, new tests/commands are introduced to perform one or more of:
In another embodiment, service providers (SP) update their profile on the DES system to allow resellers to associate endpoints with the reseller's profile. The service provider profile includes one or more, and preferably each, of:
The reseller may associate a list of endpoints with a specific SP by associating the MAC addresses of each of the endpoints with the SP profile.
In another embodiment, when a self-signed certificate expires or is compromised, the DES will remove the certificate from the DES DB, and a new locally generated self-signed certificate is then associated with the DES using the Access Key mechanism that securely introduces the certificate to the DES.
DES—Service Provider Profile Creation: In one embodiment, an SP logs into their account and creates an SP profile to allow the DES to redirect endpoints to the Service Provider Provisioning service. The SP profile includes a sp-validation-key-pair, created by DES, with the sp-validation-private-key maintained on the DES and the sp-validation-public-key maintained by the Service Provider, to later allow the Service Provider to validate signed requests from the DES. The profile may also include a sp-profile-key-pair, created by the SP, with the sp-profile-private-key maintained by the Service Provider and the sp-profile-public-key maintained on the DES, to later allow the DES to validate signed requests from the SP. In another embodiment, every change/update to the profile by the SP must be signed with their sp-profile-private-key. When the SP sells a service to a customer, and the customer orders endpoints from a reseller, the SP updates their profile to later allow the reseller to associate endpoints with the reseller's profile for a specific customer. When a SP directly sells an endpoint to a customer, the SP updates the SP's profile to associate the endpoints with the customer domain.
A benefit of using key-pairs instead of Public Key Infrastructure (PKI) certificate is to avoid the need for the PKI infrastructure and its complexities. However, in another embodiment, PKI certificates may be utilized.
DES—Reseller Endpoint Association: An enterprise creates an account for a reseller to login to and associate endpoints with particular SPs. As part of this setup process, the reseller creates a rs-profile-key-pair associated with the reseller; the rs-profile-private-key stays with the reseller, and the rs-profile-public-key is provided to the DES.
DES—First Install. In one embodiment, if the certificate provided to the DES is signed by a “non-factory” CA, the endpoint will prompt the user for approval. As a benefit, this will help avoid the potential risk of an attacker loading new CA certificates to a server and then pointing the endpoint to a malicious server in order to attempt a take-over the endpoint.
Step 1. An endpoint boots for the first time, and establishes a mutually authenticated channel with the DES using the self-signed certificate.
Step 2. POST /config. In one embodiment, the endpoint sends a request to the DES to receive configuration information and configure itself with the address of the configuration server.
Step 3. SIP message “301” (“moved permanently”) with a current location header for the endpoint (e.g., a URL). The DES then redirects the endpoint to the Service Provider, and provides the endpoint with the signature of the endpoint's self-signed certificate, signed using the sp-validation-private-key in the payload.
Step 4. The endpoint establishes a server-authenticated channel with a server of the SP.
Step 5. POST /config: The endpoint then sends the self-signed certificate and the DES signature to the SP to validate that the certificate was provided by the DES using the sp-validation-public-key. As a result, the endpoint has configuration details to enable use on the Session Initiation Protocol (SIP) network.
Here to, a benefit of using key-pairs instead of a full-fledged certificate is to avoid the use of PKI infrastructure that comes with the use of a PKI certificate.
D. Public certificate authority or certification authority (CA):
Risks associated with a successful attack. If an endpoint is attacked, the endpoint may be provided with a CA that points to a malicious configuration server. The endpoint will not reach out to the expected configuration server, and will therefore not be able to obtain software to provide services. The absence of the services may then be detected by an administrator for the endpoint. As a benefit, a non-authorized and/or malicious software masquerading as an endpoint, will not be able to enroll the endpoint with the DES system.
Endpoint Enrollment in Factory State. To be able to reclaim a specific endpoint, the endpoint must be released either by the current owner, or by an enterprise's administrator. If the endpoint is reset by the administrator, then the administrator should notify the SP for that endpoint.
Disable DES Feature: In another embodiment, a new vendor-specific Dynamic Host Configuration Protocol (DHCP) allows the customer to disable the DES feature such that and endpoint will retain the disabled DES settings and cease future attempts to connect to the DES. A reset to factory defaults would be needed to change the endpoint's behavior after it obtained provisioning information.
For remote users, we have two options. First, pre-stage the endpoint and second, add a timed user prompt to allow the user to instruct the endpoint not to connect to the DES. If the user does not provide the appropriate feedback, the endpoint will continue and contact the DES service.
In one embodiment, a system is disclosed, comprising: a network interface; a data storage comprising a non-volatile portion; a processor; and wherein, the processor, upon determining a first attachment to a network: accesses a first address within the data storage; attempt mutual authentication with a first service provided at the first address; upon successfully performing mutual authentication with the first service, receiving from the first service a certificate a second address and a signed certificate; and reconfiguring the system to communicate with a second service at the second address.
In another embodiment, a system, comprising: a data storage; a processor; a network interface; and wherein the processor: receives, via the network interface, a request for mutual authentication from an endpoint; in response to the received request, performs mutual authentication with the endpoint; upon successfully performing the mutual authentication, providing the endpoint with a certificate to enable the endpoint to utilize a network.
In another embodiment, a system, comprising: a data storage; a processor; a network interface; and wherein the processor: receives, via the network, a certificate from an endpoint; upon receiving the certificate, validates the certificate utilizing a public key maintained in the data storage; and upon successfully validating the certificate, adding the endpoint to a list of trusted endpoints to thereby enable the endpoint to utilize a network.
The phrases “at least one,” “one or more,” “or,” and “and/or” are open-ended expressions that are both conjunctive and disjunctive in operation. For example, each of the expressions “at least one of A, B, and C,” “at least one of A, B, or C,” “one or more of A, B, and C,” “one or more of A, B, or C,” “A, B, and/or C,” and “A, B, or C” means A alone, B alone, C alone, A and B together, A and C together, B and C together, or A, B, and C together.
The term “a” or “an” entity refers to one or more of that entity. As such, the terms “a” (or “an”), “one or more,” and “at least one” can be used interchangeably herein. It is also to be noted that the terms “comprising,” “including,” and “having” can be used interchangeably.
The term “automatic” and variations thereof, as used herein, refers to any process or operation, which is typically continuous or semi-continuous, done without material human input when the process or operation is performed. However, a process or operation can be automatic, even though performance of the process or operation uses material or immaterial human input, if the input is received before performance of the process or operation. Human input is deemed to be material if such input influences how the process or operation will be performed. Human input that consents to the performance of the process or operation is not deemed to be “material.”
Aspects of the present disclosure may take the form of an embodiment that is entirely hardware, an embodiment that is entirely software (including firmware, resident software, micro-code, etc.) or an embodiment combining software and hardware aspects that may all generally be referred to herein as a “circuit,” “module,” or “system.” Any combination of one or more computer-readable medium(s) may be utilized. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium.
A computer-readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer-readable storage medium would include the following: an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer-readable storage medium may be any tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device.
A computer-readable signal medium may include a propagated data signal with computer-readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer-readable signal medium may be any computer-readable medium that is not a computer-readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer-readable medium may be transmitted using any appropriate medium, including, but not limited to, wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.
The terms “determine,” “calculate,” “compute,” and variations thereof, as used herein, are used interchangeably and include any type of methodology, process, mathematical operation or technique.
The term “means” as used herein shall be given its broadest possible interpretation in accordance with 35 U.S.C., Section 112(f) and/or Section 112, Paragraph 6. Accordingly, a claim incorporating the term “means” shall cover all structures, materials, or acts set forth herein, and all of the equivalents thereof. Further, the structures, materials or acts and the equivalents thereof shall include all those described in the summary, brief description of the drawings, detailed description, abstract, and claims themselves.
The preceding is a simplified summary of the invention to provide an understanding of some aspects of the invention. This summary is neither an extensive nor exhaustive overview of the invention and its various embodiments. It is intended neither to identify key or critical elements of the invention nor to delineate the scope of the invention but to present selected concepts of the invention in a simplified form as an introduction to the more detailed description presented below. As will be appreciated, other embodiments of the invention are possible utilizing, alone or in combination, one or more of the features set forth above or described in detail below. Also, while the disclosure is presented in terms of exemplary embodiments, it should be appreciated that an individual aspect of the disclosure can be separately claimed.
The present disclosure is described in conjunction with the appended figures:
The ensuing description provides embodiments only and is not intended to limit the scope, applicability, or configuration of the claims. Rather, the ensuing description will provide those skilled in the art with an enabling description for implementing the embodiments. It will be understood that various changes may be made in the function and arrangement of elements without departing from the spirit and scope of the appended claims.
Any reference in the description comprising an element number, without a subelement identifier when a subelement identifier exists in the figures, when used in the plural, is intended to reference any two or more elements with a like element number. When such a reference is made in the singular form, it is intended to reference one of the elements with the like element number without limitation to a specific one of the elements. Any explicit usage herein to the contrary or providing further qualification or identification shall take precedence.
The exemplary systems and methods of this disclosure will also be described in relation to analysis software, modules, and associated analysis hardware. However, to avoid unnecessarily obscuring the present disclosure, the following description omits well-known structures, components, and devices that may be shown in block diagram form, and are well known or are otherwise summarized.
For purposes of explanation, numerous details are set forth in order to provide a thorough understanding of the present disclosure. It should be appreciated, however, that the present disclosure may be practiced in a variety of ways beyond the specific details set forth herein.
Furthermore, the term “certificate,” refers cryptographic digital data files utilized to certify, at least in part, an electronic computational device.
The term, “signature,” as used herein, is a data scheme or the result of other algorithmic operation such as to generate a hash, at least in part, from a private key and may be validated using a certificate associated with the private key.
At no point does the term “signature” or “certificate,” as used herein, refer to the act a human signing or the presence of a human signature on a physical document.
System 200 depicts, in part, endpoint 102B being not trusted. Endpoint 102B may be determined to be untrusted upon attempted to communicate with an unauthorized (e.g., blacklisted) component on public network 106, store known or suspected malware, or otherwise exhibit a behavior that is associated with endpoint 102B being an unacceptable risk. Accordingly, DES 202 may disallow endpoint 102B from utilizing private network 104 and, therefore, be disallowed from further access to public network 106. For example, a switch or other component of private network 104 may logically and/or physically block communications having an origination and/or destination address associated with endpoint 102B.
In another embodiment, endpoints 102A, 102C are untrusted, or otherwise indicated has being capable of being trusted, but not yet becoming trusted. For example, being unauthenticated. Accordingly, endpoints 102A, 102C may be permitted to engaged in communications with components on private network 104 and/or public network 106, including but not limited to DES 202, for the purpose of becoming trusted.
Reseller 602 then queries endpoint DB 604 to obtain the MAC address (and/or other unique identifier), which is provided in step 708. Reseller 602 provides the MAC address and a hash of the MAC address to service provider 504 in step 710. Reseller 602 may “claim” an endpoint as one of its own in step 712, such as by providing an identifier (e.g., MAC address, serial number) or other identifier (such as an enrollment code) that DES 202 then associates endpoint 102 with reseller 602. Service provider 504, in step 714, then causes DEC 202 to associate the endpoint, service provider, and customer. Reseller then ships endpoint to customer 502 in step 716. It should be appreciated that step 716 may be performed at any point after step 702.
Reseller 602, at step 814, then causes DES 202 to associate the endpoint with service provider 504 and customer 502. Reseller 602 then ships the endpoint to customer 502 in step 816. It should be appreciated that step 816 may occur at any point following step 802.
While certain embodiments incorporate shipping endpoints to a particular customer (e.g., customer 502), in other embodiments, the endpoint may be sent in advance of an order, such as to allow customer 502 to become familiar with certain aspects of the endpoint or in advance of a known or anticipated request for the endpoint. Therefore, in addition to or as an alternative to shipping, embodiments herein shipping may comprise activating endpoints or activating endpoints already on-site without departing from the scope of the embodiments herein.
Following step 1304, endpoint 102 (via information stored within endpoint 102) initiates communication with DES 202 and performs steps 1306 and 1308 whereby endpoint 102 is validated to DES 202 and DES 202 is validated to endpoint 102, respectively. Steps 1306 and 1308 may be performed, as ordered, or alternatively, step 1308 then step 1306. Once endpoint 102 and DES 202 are authenticated to each other, DES 202 provides endpoint 102 with a DES signed certificate in step 1310. In one embodiment, the signature utilized in step 1310 is the public key of service provider 504 maintained in the profile of service provider 504 by DES 202.
Endpoint 102 provides the DES signed certificate to service provider 504 which, at step 1314, validates the certification utilizing the public key of service provider 504. With validation proven at step 1314, step 1316 then adds endpoint 102 to a list of trusted endpoints operable to utilize the network of a particular customer.
As a benefit of embodiments provided herein, a trusted endpoint 102 may be allowed to be redirected to other servers, such as a server of service provider 504 and/or reseller 602. An untrusted, or not-trusted endpoint 102, may have malware attempting to redirect endpoint 102 to a malicious or otherwise unauthorized address, however, absent validation and trust of endpoint 102, end point 102 may remain isolated and unable to communicate. Similarly, service provider 504 and/or reseller 602 receiving a communication from an endpoint that has not been verified (e.g., is unknown) may have such communications ignored (e.g., blacklisted) and assumed to be malicious or at least unauthorized or untrusted.
In the foregoing description, for the purposes of illustration, methods were described in a particular order. It should be appreciated that in alternate embodiments, the methods may be performed in a different order than that described. It should also be appreciated that the methods described above may be performed by hardware components or may be embodied in sequences of machine-executable instructions, which may be used to cause a machine, such as a general-purpose or special-purpose processor (e.g., GPU, CPU), or logic circuits programmed with the instructions to perform the methods (e.g., FPGA). In another embodiment, a processor may be a system or collection of processing hardware components, such as a processor on a client device and a processor on a server, a collection of devices with their respective processor, or a shared or remote processing service (e.g., “cloud” based processor). A system of processors may comprise task-specific allocation of processing tasks and/or shared or distributed processing tasks. In yet another embodiment, a processor may execute software to provide the services to emulate a different processor or processors. As a result, first processor, comprised of a first set of hardware components, may virtually provide the services of a second processor whereby the hardware associated with the first processor may operate using an instruction set associated with the second processor.
These machine-executable instructions may be stored on one or more machine-readable mediums, such as CD-ROMs or other type of optical disks, floppy diskettes, ROMs, RAMs, EPROMs, EEPROMs, magnetic or optical cards, flash memory, or other types of machine-readable mediums suitable for storing electronic instructions. Alternatively, the methods may be performed by a combination of hardware and software.
While machine-executable instructions may be stored and executed locally to a particular machine (e.g., personal computer, mobile computing device, laptop, etc.), it should be appreciated that the storage of data and/or instructions and/or the execution of at least a portion of the instructions may be provided via connectivity to a remote data storage and/or processing device or collection of devices, commonly known as “the cloud,” but may include a public, private, dedicated, shared and/or other service bureau, computing service, and/or “server farm.”
Examples of the processors as described herein may include, but are not limited to, at least one of Qualcomm® Snapdragon® 800 and 801, Qualcomm® Snapdragon® 610 and 615 with 4G LTE Integration and 64-bit computing, Apple® A7 processor with 64-bit architecture, Apple® M7 motion coprocessors, Samsung® Exynos® series, the Intel® Core™ family of processors, the Intel® Xeon® family of processors, the Intel® Atom™ family of processors, the Intel Itanium® family of processors, Intel® Core® i5-4670K and i7-4770K 22 nm Haswell, Intel® Core® i5-3570K 22 nm Ivy Bridge, the AMD® FX™ family of processors, AMD® FX-4300, FX-6300, and FX-8350 32 nm Vishera, AMD® Kaveri processors, Texas Instruments® Jacinto C6000™ automotive infotainment processors, Texas Instruments® OMAP™ automotive-grade mobile processors, ARM® Cortex™-M processors, ARM® Cortex-A and ARIVI926EJS™ processors, other industry-equivalent processors, and may perform computational functions using any known or future-developed standard, instruction set, libraries, and/or architecture.
Any of the steps, functions, and operations discussed herein can be performed continuously and automatically.
The present application claims the benefit of Provisional Patent Application No. 62/479,089, filed on Mar. 30, 2017, and is incorporated herein by reference in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| 62479089 | Mar 2017 | US |
