1. Field
The present invention relates generally to configuring a remote station with a digital certificate from a local root certificate authority for securing a wireless network.
2. Background
A secure private wireless network needs to authorize only legitimate devices or stations to join the network. The authorization of a device should include the authentication of the device. Authentication generally relies on a password, secret keys (challenge-response authentication), or a public key previously exchanged in a secure manner.
Digital certificates (hereinafter certificates) issued by a global certificate authority are not helpful because all devices having a certificate from the global certificate authority will be authenticated and considered legitimate. As a result, an access point of a private wireless network may not deny access to a neighbor's device based on a certificate from the global certificate authority because the certificate will be valid.
Also, the numeric values of a certificate and corresponding private key are very large. It may not be reasonable to expect a user to manually enter such values.
There is therefore a need for a technique for configuring a remote station with a certificate for securing a wireless network in an effective manner.
An aspect of the present invention may reside in a method for configuring a remote station with a certificate from a local root certificate authority for securing a wireless network. In the method, a station public key is forwarded to the local root certificate authority. The station public key is forwarded out-of-band of the wireless network. A certificate and a root public key are received from the local root certificate authority. The certificate is based on the forwarded station public key, and the certificate and the root public key are received out-of-band of the wireless network. The remote station securely communicates, using the wireless network, with another station based on the certificate and the root public key.
In more detailed aspects of the invention, the station public key may be forwarded to the local root certificate authority, and the certificate and the root public key may be received from the local root certificate authority, using a bi-directional communication channel such as a Bluetooth low energy communication channel or a near field communication channel. Also, the certificate may comprise the station public key and a device identifier. The root public key may be a root-of-trust public key included in a self-signed certificate.
In other more detailed aspects of the invention, the remote station securely communicating with the another station may be further based on another certificate configured in the another station, and the root public key configured in the remote station and in the another station, and may include the remote station verifying a validity of the another certificate of the another station. Verifying the validity of the another certificate comprises at least one of: verifying the another certificate's signature with the root public key; verifying the another certificate is not on a Certificate Revocation List; verifying the another certificate's status using an Online Certificate Status Protocol; and/or verifying the another certificate's validity dates.
In other more detailed aspects of the invention, the wireless network may consist of only the remote station and the another station communicating using Wi-Fi Direct or Peer-to-Peer. Also, the wireless network may be a long term evolution (LTE) direct communication network, or a mesh WiFi network. The local root certificate authority may be a configurator of the wireless network such as a smartphone, a tablet, or a personal computer. Such wireless station may have a key pair and an internally received certificate in order to communicate with other stations. Also, the remote station may comprise a wireless access point.
Another aspect of the invention may reside in a remote station, comprising: means for forwarding a station public key to a local root certificate authority, wherein the station public key is forwarded out-of-band of a wireless network; means for receiving a certificate and a root public key from the local root certificate authority, wherein the certificate is based on the forwarded station public key, and the certificate and the root public key are received out-of-band of the wireless network; and means for securely communicating, using the wireless network, with another station based on the certificate and the root public key.
Another aspect of the invention may reside in a remote station, comprising: a processor configured to: forward a station public key to a local root certificate authority, wherein the station public key is forwarded out-of-band of a wireless network; receive a certificate and a root public key from the local root certificate authority, wherein the certificate is based on the forwarded station public key, and the certificate and the root public key are received out-of-band of the wireless network; and securely communicate, using the wireless network, with another station based on the certificate and the root public key.
Another aspect of the invention may reside in a computer program product, comprising: computer-readable medium, comprising: code for causing a computer to forward a station public key to a local root certificate authority, wherein the station public key is forwarded out-of-band of a wireless network; code for causing a computer to receive a certificate and a root public key from the local root certificate authority, wherein the certificate is based on the forwarded station public key, and the certificate and the root public key are received out-of-band of the wireless network; and code for causing a computer to securely communicate, using the wireless network, with another station based on the certificate and the root public key.
The word “exemplary” is used herein to mean “serving as an example, instance, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.
With reference to
In addition to its public key, the remote station 310 may also forward its identity which includes at least one of its Medium Access Control (MAC) address, its Serial Number (SN), its device class, type and/or model. The device identity is included in the certificate. The certificate may be generated based on the forwarded station public key and a validity date (defined by the user).
In more detailed aspects of the invention, the station public key Kpub may be forwarded to the local root certificate authority 320, and the certificate CertKpub and the root public key CAKpub may be received from the local root certificate authority, using a bi-directional communication channel 350 such as a Bluetooth low energy (BLE) communication channel, a near field communication (NFC) channel, or similar close wireless communication channel, or using a private wired communication channel (USB, Ethernet, etc.). The certificate may be a temporary certificate having short lifetime. Also, the certificate may comprise the station public key and a device identifier. The root public key may be a root-of-trust public key included in a self-signed certificate.
In other more detailed aspects of the invention, the remote station 310 securely communicating with the second station 340 may be further based on a second certificate Cert(K2pub) configured in the second station, and the root public key CAKpub configured in the remote station and in the second station, and may include the remote station verifying a validity of the second station's certificate. Verifying the validity of the second station's certificate comprises at least one of: verifying the second certificate's signature with the root public key; verifying the second certificate is not on a Certificate Revocation List; verifying the second certificate's status using an Online Certificate Status Protocol; and/or verifying the second certificate's validity dates.
In other more detailed aspects of the invention, the wireless network 330 may consist of only the remote station 310 and the second station 340 communicating using Wi-Fi Direct or Peer-to-Peer. Also, the wireless network 330 may be a long term evolution (LTE) direct communication network, or a mesh WiFi network. The local root certificate authority 320 may be a configurator of the wireless network such as a smartphone, a tablet, or a personal computer (PC). The remote station may have a wireless interface. Also, the remote station may comprise a wireless access point.
With further reference to
Another aspect of the invention may reside in a remote station 310, comprising: means 410 for forwarding a station public key Kpub to a local root certificate authority 320, wherein the station public key is forwarded out-of-band of a wireless network 330; means 410 for receiving a certificate Cert(Kpub) and a root public key CAKpub from the local root certificate authority, wherein the certificate is generated by the local root certificate authority based on the forwarded station public key, and the certificate and the root public key are received out-of-band of the wireless network; and means 410 for securely communicating, using the wireless network, with a second station 340 based on the certificate and the root public key.
Another aspect of the invention may reside in a remote station 310, comprising: a processor 410 configured to: forward a station public key Kpub to a local root certificate authority 320, wherein the station public key is forwarded out-of-band of a wireless network 330; receive a certificate Cert(Kpub) and a root public key CAKpub from the local root certificate authority, wherein the certificate is generated by the local root certificate authority based on the forwarded station public key, and the certificate and the root public key are received out-of-band of the wireless network; and securely communicate, using the wireless network, with a second station 340 based on the certificate and the root public key.
Another aspect of the invention may reside in a computer program product, comprising: computer-readable medium 420, comprising: code for causing a computer 400 to forward a station public key Kpub to a local root certificate authority 320, wherein the station public key is forwarded out-of-band of a wireless network 330; code for causing a computer to receive a certificate Cert(Kpub) and a root public key CAKpub from the local root certificate authority, wherein the certificate is generated by the local root certificate authority based on the forwarded station public key, and the certificate and the root public key are received out-of-band of the wireless network; and code for causing a computer to securely communicate, using the wireless network, with a second station 340 based on the certificate and the root public key.
With reference to
User X purchases device C 510 and desires to configure it to join the secure private wireless network of devices A and B. In an enrollment process, device C, as an enrollee, forwards its public key KCpub to the configurator 520 of user X, which returns its root public key KXroot and a certificate Cert(KCpub,X) signed by its private key KXpri. The new device C is now able to securely communicate with devices A and B using the certificate Cert(KCpub,X) and the root public key. Device C uses the root public key to verify the certificates of devices A and B.
Thus, device C may now establish a secure link at level L2 with devices A and B (direct or infrastructure mode). However, device C cannot communicate with device D 570 owned by user Y because device C cannot authenticate device D. Likewise, device D's certificate Cert(KDpub,Y), which is signed using the private key KYpri, cannot be used to authenticate with devices A, B and C.
The certificates issued by the local root certificate authority (e.g., 320 in
In the enrollment process, the enrollee requires an out-of-band bi-directional communication channel 550 with the configurator. The enrollee also requires key storage, including its device private key, and is required to be able to perform certificate verification. The configurator requires an out-of-band bi-directional communication channel 550 with the enrollee. The configurator also requires key storage, including its certificate authority/root private key, and is required to be able to perform certificate generation.
The user may provide guest access to the secure private wireless network by providing a temporary certificate to the guest which is valid for a limited period of time such as an hour, a day, a week, etc. If a device is lost or stolen, the user may put the device's certificate on a revocation list (another PM feature). An application on the user's smartphone, PC, tablet, etc., may provide all of the functions of the local root certificate authority, including: certificate generation, certificate revocation, authorization, CRL management and/or Online Certificate Status Protocol service. The process of providing parameters to and/or receiving parameters from a device may be considered “configuration.”
The device hosting the local root CA, i.e., the configurator 320, may also be a wireless station with its own key pair and certificate in order to communicate in-band (using the primary wireless interface) with any of the devices already part of the wireless network 330.
A certificate 600 that may be generated by the local root certificate authority 320 is shown in
A method 700 for generating the signature of the certificate 600 is shown in
With reference to
Those of skill in the art would understand that information and signals may be represented using any of a variety of different technologies and techniques. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the above description may be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof
Those of skill would further appreciate that the various illustrative logical blocks, modules, circuits, and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both. To clearly illustrate this interchangeability of hardware and software, various illustrative components, blocks, modules, circuits, and steps have been described above generally in terms of their functionality. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the overall system. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present invention.
The various illustrative logical blocks, modules, and circuits described in connection with the embodiments disclosed herein may be implemented or performed with a general purpose processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in the alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. A processor may also be implemented as a combination of computing devices, e.g., a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration.
The steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of the two. A software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such the processor can read information from, and write information to, the storage medium. In the alternative, the storage medium may be integral to the processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a user terminal. In the alternative, the processor and the storage medium may reside as discrete components in a user terminal
In one or more exemplary embodiments, the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software as a computer program product, the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium. Computer-readable media includes both non-transitory computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another. A storage media may be any available media that can be accessed by a computer. By way of example, and not limitation, such computer-readable media can comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer. Also, any connection is properly termed a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium. Disk and disc, as used herein, includes compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and blu-ray disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above should also be included within the scope of computer-readable media.
The previous description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the generic principles defined herein may be applied to other embodiments without departing from the spirit or scope of the invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.
This application claims the benefit of U.S. Provisional Application No. 61/881,355, filed Sep. 23, 2013, which application is incorporated herein by reference.
Number | Date | Country | |
---|---|---|---|
61881355 | Sep 2013 | US |