Security certificate management

• US 20070028095A1
• Filed: 07/28/2005
• Published: 02/01/2007
• Est. Priority Date: 07/28/2005
• Status: Active Grant

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Allen, David, Loving, Kent, Pollock, Bruce, Savage, David, Cloutier, John, Smith, Denise
• Granted Patent: US 7,827,400 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273

Abstract

A system and method for establishing a mutually authenticated secure link between a mobile platform system and a remote system is provided. An onboard computer system (OCS) generates a dynamic certificate and digitally signs the dynamic certificate with a static certificate. The dynamic certificate is transmitted to a remote central computer system (CCS). The CCS verifies that the dynamic certificate is from a trusted source and sends a return dynamic certificate electronically signed with the static certificate to the OCS. The OCS verifies the return dynamic certificate is from the CCS, thereby establishing a mutually authenticated secure link between the OCS and the CCS.

Claims

1. A method for initiating a secure link between a mobile platform system and a remote system without manual intervention, said method comprising:

generating and digitally signing a static certificate;

issuing the static certificate to at least one onboard computer system (OCS) of the mobile platform;

automatically generating a dynamic certificate utilizing the OCS and digitally signing the dynamic certificate with the static certificate;

transmitting the dynamic certificate to at least one central computer system (CCS) located remotely from the mobile platform over a communications link between the OCS and the CCS; and

verifying that the dynamic certificate is from a trusted source utilizing the CCS, thereby initiating a secure link between the OCS and the CCS.

2. The method of claim 1, wherein issuing the static certificate to the OCS comprises encoding the static certificate into a configuration file.

4. The method of claim 1, wherein generating the dynamic certificate comprises:

obtaining pertinent OCS identification information and including the OCS identification information in the dynamic certificate; and

configuring the CCS to communicate with the OCS using the OCS identification information.

5. The method of claim 1, wherein generating the dynamic certificate comprises:

automatically providing an electronic signature for the dynamic certificate using the static certificate; and

automatically storing the dynamic certificate in the OCS.

6. The method of claim 1, wherein verifying that the dynamic certificate is from a trusted source comprises executing a second portion of a authentication software application (ASA2) stored in the CCS to verify that the dynamic certificate was digitally signed with the static certificate.

7. The method of claim 1, wherein the method further comprises sending a return dynamic certificate electronically signed with the static certificate from the CCS to the OCS;

and

8. The method of claim 7, wherein the method further comprises verifying that the return dynamic certificate is from the CCS, utilizing the OCS, thereby establishing a mutually authenticated secure link between the OCS and the CCS.

9. The method of claim 8, wherein the method further comprises utilizing the mutually authenticated secure link as a virtual private network (VPN) for communication between the mobile platform and the CCS.

3. The method of 2, wherein issuing the static certificate further comprises executing a first portion of an authentication software application (ASA1) stored in the OCS upon turning on the OCS to delete preexisting pertinent authorization, authentication and static certificate data stored in the OCS, and load the configuration file into the OCS.

10. A method for establishing a mutually authenticated secure link between a mobile platform system and a remote system, said method comprising:

generating and digitally signing a static certificate;

storing the static certificate in an electronic storage device (ESD) of at least one central computer system (CCS) located remotely from the mobile platform;

issuing the static certificate to at least one onboard computer system (OCS) of the mobile platform;

automatically generating a dynamic certificate utilizing the OCS and digitally signing the dynamic certificate with the static certificate;

transmitting the dynamic certificate to the CCS over a communications link initiated between the OCS and the CCS; and

verifying, utilizing the CCS, that the dynamic certificate is from a trusted source;

sending a return dynamic certificate electronically signed with the static certificate from the CCS to the OCS; and

verifying, utilizing the OCS, that the return dynamic certificate is from the CCS, thereby establishing a mutually authenticated link between the OCS and the CCS.

11. The method of claim 10, wherein issuing the static certificate comprises:

encoding the static certificate into a configuration file; and

loading the configuration file including the static certificate into the OCS.

12. The method of claim 11, wherein loading the configuration file comprises executing a first portion of a first portion of an authentication software application (ASA1) to delete preexisting pertinent authorization, authentication and static certificate data stored in the OCS, and load the configuration file in the OCS upon turning on the OCS.

13. The method of claim 10, wherein generating the dynamic certificate comprises:

automatically obtaining pertinent OCS identification information and including the OCS identification information in the dynamic certificate; and

storing the dynamic certificate in the OCS.

14. The method of claim 10, wherein verifying that the dynamic certificate is from a trusted source comprises execution of a second portion of an authentication software application (ASA2) stored in the CCS to verify that the dynamic certificate was digitally signed with the static certificate.

19. The system of claim 14, wherein execution of the ASA1 is further adapted to:

automatically send a return dynamic certificate electronically signed with the static certificate to the OCS; and

verify that the return dynamic certificate is signed with the static certificate, thereby establishing the mutually authenticated secure link between the OCS and the CCS, wherein the mutually authenticated secure link provides a virtual private network (VPN) for communication between the mobile platform and the CCS.

15. A system for establishing a mutually authenticated secure communications link between a mobile platform and a remote computer network, said system comprising:

at least one onboard computer system (OCS) of the mobile platform including a OCS processor adapted to execute a first portion of an authentication software application (ASA1) stored in the OCS; and

at least one central computer system (CCS) located remotely from the mobile platform adapted to wirelessly communicate with the OCS, the CCS including a CCS processor adapted to execute a second portion of the authentication software application (ASA2) stored in the CCS;

wherein execution of the ASA1 is adapted to;

automatically generate and digitally sign a dynamic certificate with a static certificate created by a mobile platform provider computer system and issued by the CCS; and

automatically transmit the dynamic certificate to the CCS via a wireless communication link between the OCS and the CCS; and

wherein execution of the ASA1 is adapted to;

store the static certificate in an electronic storage device (ESD) of the CCS;

issue the static certificate to OCS;

verify that the dynamic certificate is signed with the static certificate; and

send a return dynamic certificate electronically signed with the static certificate to the OCS to establish a mutually authenticated link between the OCS and the CCS.

16. The system of claim 15, wherein execution of the ASA1 is further adapted to verify that the return dynamic certificate is signed with the static certificate.

17. The system of claim 15, wherein to issue the static certificate to the OCS, execution of the ASA2 is further adapted to encode the static certificate into a configuration file.

18. The system of claim 17, wherein to generate and digitally sign a dynamic, execution of the ASA1 is further adapted to automatically delete preexisting pertinent authorization, authentication and static certificate data stored in the OCS, and load the configuration file into the OCS upon turning on the OCS.