Short message service security for zero touch deployments

• US 10,108,435 B2
• Filed: 07/12/2016
• Issued: 10/23/2018
• Est. Priority Date: 07/12/2016
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Dumov, Leo, Persaud, Andrew
• Primary Examiner(s): Chen, Xuxing
• Application Number:
  US15/208,050
• Publication Number:
  US 20180018184A1
• Time in Patent Office: 833 Days
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/14 Short messaging services, e.g. short message services [SMS] or unstructured supplementary service data [USSD]
• CPC Class Codes: H04W 84/042 Public Land Mobile systems, e.g. cellular systems

Abstract

Presented herein are techniques for enabling the zero touch deployment of devices having an integrated wireless wide area network (WWAN) interface. In one example, a method includes initializing a device with a WWAN interface such that the device attaches to a WWAN, receiving, via the WWAN interface of the device, a data message that includes encrypted bootstrap configuration information, obtaining a key stored in a subscriber identification module (SIM) card of the WWAN interface, decrypting the encrypted bootstrap configuration information using the key, establishing communication with a remote server using the bootstrap configuration information and obtaining configuration data from the remote server, and performing self-configuration of the device using the configuration data.

Claims

1. A method comprising:

initializing a device with an integrated wireless wide area network (WWAN) interface such that the device attaches to a WWAN;

receiving, via the WWAN interface of the device, a data message that includes encrypted bootstrap configuration information;

obtaining a key stored in a phone book portion of a subscriber identification module (SIM) card of the WWAN interface;

decrypting the encrypted bootstrap configuration information using the key;

establishing communication with a remote server using the bootstrap configuration information and obtaining configuration data from the remote server; and

performing self-configuration of the device using the configuration data.

2. The method of claim 1, wherein initializing the device comprising powering on the device.

3. The method of claim 1, wherein receiving a data message comprises receiving a short message service (SMS) message that includes the encrypted bootstrap configuration information.

4. The method of claim 1, wherein establishing communication with the remote server comprises contacting the remote server at an internet protocol (IP) address provided in the bootstrap configuration information.

5. The method of claim 4, further comprising transmitting, to the remote server, a one time password provided in the bootstrap configuration information to authenticate the device.

6. The method of claim 1, further comprising decrypting, with the key, a card holder verification 1 (CHV1) code received in the data message to enable access to the remote server.

7. The method of claim 1, further comprising unlocking a storage portion of the SIM card using a card holder verification 2 (CHV2) code to enable access to the key stored in the (SIM) card.

8. The method of claim 1, further comprising obtaining the key from multiple entries in the phone book portion.

9. A device comprising:

a wireless wide area network (WWAN) interface;

a memory, and

a processor coupled to the memory and configured to;

initialize the device with the WWAN interface such that the device attaches to a WWAN;

receive, via the WWAN interface, a data message that includes encrypted bootstrap configuration information;

obtain a key stored in a phone book portion of a subscriber identification module (SIM) card of the WWAN interface;

decrypt the encrypted bootstrap configuration information using the key;

establish communication with a remote server using the bootstrap configuration information and obtain configuration data from the remote server; and

perform self-configuration of the device using the configuration data.

10. The device of claim 9, wherein the processor is configured to receive a short message service (SMS) message that includes the encrypted bootstrap configuration information.

11. The device of claim 9, wherein the processor is further configured to establish communication with the remote server by contacting the remote server at an internet protocol (IP) address provided in the bootstrap configuration information.

12. The device of claim 11, wherein the processor is further configured to transmit, to the remote server, a one time password provided in the bootstrap configuration information to authenticate the device.

13. The device of claim 9, wherein the processor is further configured to decrypt, with the key, a card holder verification 1 (CHV1) code received in the data message to enable access to the remote server.

14. The device of claim 9, wherein the processor is further configured to unlock a storage portion of the SIM card using a card holder verification 2 (CHV2) code to enable access to the key stored in the (SIM) card.

15. The device of claim 9, wherein the processor is configured to obtain the key from multiple entries in the phone book portion.

16. One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:

initialize a device with an integrated wireless wide area network (WWAN) interface such that the device attaches to a WWAN;

receive, via the WWAN interface of the device, a data message that includes encrypted bootstrap configuration information;

obtain a key stored in a phone book portion of a subscriber identification module (SIM) card of the WWAN interface;

decrypt the encrypted bootstrap configuration information using the key;

establish communication with a remote server using the bootstrap configuration information and obtain configuration data from the remote server; and

perform self-configuration of the device using the configuration data.

17. The non-transitory computer readable storage media of claim 16, wherein the instructions operable to receive a data message comprise instructions to receive a short message service (SMS) message that includes the encrypted bootstrap configuration information.

18. The non-transitory computer readable storage media of claim 16, wherein the instructions operable to establish communication with the remote server comprise instructions to contact the remote server at an internet protocol (IP) address provided in the bootstrap configuration information.

19. The non-transitory computer readable storage media of claim 16, wherein the instructions are further operable to transmit, to the remote server, a one time password provided in the bootstrap configuration information to authenticate the device.

20. The non-transitory computer readable storage media of claim 16, wherein the instructions are further operable to obtain the key from multiple entries in the phone book portion.