Unique on-line provisioning of user terminals allowing user authentication

• US 20030063750A1
• Filed: 09/26/2001
• Published: 04/03/2003
• Est. Priority Date: 09/26/2001
• Status: Abandoned Application

• Current Assignee: Google Technology Holdings LLC (Alphabet Inc.), General Instrument Corporation (CommScope Holding Company, Inc.)
• Original Assignee: Google Technology Holdings LLC (Alphabet Inc.)
• Inventors: Medvinsky, Alexander, Peterka, Petr, Moroney, Paul
• Application Number:
  US09/966,552
• Publication Number:
  US 20030063750A1
• Time in Patent Office: Days
• US Class Current: 380/277
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0457 wherein the sending and receiving network entities apply dynamic encryption, e.g. stream encryption cryptographic mechanisms or cryptographic arrangements for stream encryption H04L9/065
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 65/65 Network streaming protocols, e.g. real-time transport protocol [RTP] or real-time control protocol [RTCP]
• CPC Class Codes: H04L 65/70 Media network packetisation

Abstract

A provisioning system that secures delivery of a client'"'"'s public key to a KDC (Key Distribution Center). The provisioning system comprises a client, uniquely identifiable by one or more parameters including a user ID (identification); a provisioning server for registering the client; a key distribution center for generating a provisioning key associated with the user ID, the provisioning key being forwarded to the provisioning server; the provisioning server generating configuration parameters for initializing the client, the provisioning key being included in the configuration parameters; and upon initialization, the client provides its public key, authenticated with the provisioning key for forwarding to the key distribution center.

Claims

1. A provisioning system that secures delivery of a client public key, the provisioning system comprising:

a client to be registered;

a provisioning server for registering the client and assigning it a unique user ID (identification);

a key distribution center for generating a provisioning key associated with the user ID, the provisioning key being forwarded to the provisioning server;

the provisioning server generating configuration parameters for initializing the client, the provisioning key being included in the configuration parameters; and

upon initialization, the client provides its public key, authenticated with the provisioning key for forwarding to the key distribution center.

2. The provisioning system of claim 1 wherein the key distribution center stores the public key or generates a certificate.

3. The provisioning system of claim 1 further comprising

a provisioning ticket in which the provisioning key is also enclosed.

4. The provisioning system of claim 1 further comprising

a provisioning ticket for forwarding the provisioning key to the client.

5. The provisioning system of claim 4 further comprising

a ticket granting ticket obtained with an AS Request that is authenticated using a public key previously registered with the provisioning ticket, the ticket granting ticket used by the client for obtaining further tickets from the KDC, where each further ticket is used for obtaining access to a particular server.

6. The provisioning system of claim 1 wherein the client further provides to the provisioning system a host identifier that uniquely identifies a computer on which the client application is running.

7. A method for initially establishing trust between a KDC (Key Distribution Center) and a client having a uniquely identifiable user ID (identification) that was assigned by the provisioning server, the method comprising:

generating, by the KDC, a provisioning key associated with the user ID, the provisioning key being forwarded to the provisioning server;

forwarding the provisioning key to a provisioning server for registering the client;

generating, by the provisioning server, configuration parameters for initializing the client;

forwarding to the client, the provisioning key and the configuration parameters for initializing the client; and

upon initialization, the client provides its public key, authenticated with the provisioning key for forwarding to the key distribution center.

8. The method of claim 7 further comprising

a provisioning ticket for forwarding the provisioning key to the client.

9. The method of claim 8 further comprising

a ticket granting ticket obtained with an AS Request that is authenticated using a public key previously registered with the provisioning ticket, the ticket granting ticket used by the client for obtaining further tickets from the KDC, where each further ticket is used for obtaining access to a particular server.