System and Method for Provisioning Device Certificates

• US 20080022103A1
• Filed: 07/20/2006
• Published: 01/24/2008
• Est. Priority Date: 07/20/2006
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Brown, Michael S., Brown, Michael K., Kirkup, Michael
• Granted Patent: US 8,527,770 B2
• Time in Patent Office: Days
• US Class Current: 713/175
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/72 Subscriber identity
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A method is provided for provisioning a device certificate on a device. The device is configured to communicate wirelessly with a plurality of backend servers via a communication network. The communication network includes a mobile data server. An activation request is initiated to the mobile data server for activating the device on the communication network. During activation, a device certificate request is provided to the mobile data server for the device. The device certificate request includes at least a user identifier, a device identifier and a device public key. The device certificate request is forwarded from the mobile data server to a predefined certification authority. A device certificate from the predefined certification authority is received at the device in response to the device certificate request.

Claims

1. A method for provisioning a device certificate on a device configured to communicate wirelessly with a plurality of backend servers via a communication network including a mobile data server, the method comprising the steps of:

a. initiating an activation request to the mobile data server for activating the device on the communication network;

b. during activation of the device, providing a device certificate request to the mobile data server for the device, the device certificate request including at least a user identifier, a device identifier and a device public key, wherein the device certificate request is forwarded from the mobile data server to a predefined certification authority; and

c. receiving a device certificate from the predefined certification authority in response to the device certificate request.

2. The method of claim 1, wherein the user identifier is an email address.

3. The method of claim 1, wherein the device identifier is a device personal identification number.

4. The method of claim 1, wherein the device identifier is a device serial number.

5. The method of claim 1, wherein the device identifier is a device IMSI.

6. The method of claim 1, wherein the device certificate request is in the form of a Public-Key Cryptography Standards No. 10 certificate signing request.

7. The method of claim 1, wherein the predefined certification authority is maintained by the mobile data server.

8. The method of claim 1, wherein the predefined certification authority is a third party certification authority.

9. The method of claim 1, wherein the predefined certification authority is maintained by an administrator of the mobile data server.

10. The method of claim 1, further comprising the step of establishing a secure communications tunnel between the device and the mobile data server before requesting the device certificate.

11. The method of claim 10, wherein the device and the mobile data each generate and exchange a pair of public encryption keys.

12. The method of claim 11, wherein the device and the mobile data each use the public encryption key pairs and a shared secret to generate and verify a master encryption key.

13. The method of claim 12, where in the shared secret is an authentication password.

14. A method for provisioning a device certificate on a device configured to communicate wirelessly with a plurality of backend servers via a communication network including a mobile data server, the method comprising the steps of:

a. receiving an activation request at the mobile data server for activating the device on the communication network;

b. during activation of the device, receiving a device certificate request at the mobile data server for the device, the device certificate request including at lease a user identifier, a device identifier and a device public key; and

c. forwarding the device certificate request from the mobile data server to a predefined certification authority;

wherein a device certificate is forwarded from the predefined certification authority to the device in response to the device certificate request.

15. A wireless communication device configured to:

a. initiate an activation request to a mobile data server for activating the device on a communication network;

b. during activation of the device, provide a device certificate request to the mobile data server for the device, the device certificate request including at lease a user identifier, a device identifier and a device public key, wherein the device certificate request is forwarded from the mobile data server to a predefined certification authority; and

c. receive a device certificate from the predefined certification authority in response to the device certificate request.

16. The device of claim 15, wherein the user identifier is an email address.

17. The device of claim 15, wherein the device identifier is a device personal identification number.

18. The device of claim 15, wherein the device identifier is a device serial number.

19. The device of claim 15, wherein the device identifier is a device IMSI.

20. The device of claim 15, wherein the device certificate request is in the form of a Public-Key Cryptography Standards No. 10 certificate signing request.

21. The device of claim 15, wherein the predefined certification authority is maintained by the mobile data server.

22. The device of claim 15, wherein the predefined certification authority is a third party certification authority.

23. The device of claim 15, wherein the predefined certification authority is maintained by an administrator of the mobile data server.

24. The device of claim 15, further configured to establish a secure communications tunnel with a mobile data server before requesting the device certificate.

25. The method of claim 24, wherein the device generates and exchanges a pair of public encryption keys with the mobile data server.

26. The device of claim 25, configure to use the public encryption key pairs and a shared secret to generate and verify a master encryption key.

27. The device of claim 26, where in the shared secret is an authentication password.

28. A computer program product for provisioning a device certificate on a device configured to communicate wirelessly with a plurality of backend servers via a communication network including a mobile data server, the computer program product comprising instructions which, when executed on the device, cause the device to implement the steps of:

a. initiating an activation request to the mobile data server for activating the device on the communication network;

b. during activation of the device, providing a device certificate request to the mobile data server for the device, the device certificate request including at lease a user identifier, a device identifier and a device public key, wherein the device certificate request is forwarded from the mobile data server to a predefined certification authority; and

c. receiving a device certificate from the predefined certification authority in response to the device certificate request.