UPNP authentication and authorization

• US 20080092211A1
• Filed: 10/13/2006
• Published: 04/17/2008
• Est. Priority Date: 10/13/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Klemets, Anders, da Costa, Bruno Kraychete, Srinivas, Kasy, Walter, James T.
• Granted Patent: US 7,882,356 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response

Abstract

A secure handshake service is implemented among a plurality of UPnP (Universal Plug and Play) portable media devices and endpoints in an open network hosting one or more UPnP services. A first portable media device receives a first request for a hosted service from a second portable media device via the network. The first portable media device authenticates authorizes the second portable media device as a function of the certificate of the request. The second portable media device is allowed to access the requested service hosted on the first portable media device if the second portable media device has been authenticated and authorized by the first portable media device.

Claims

1. A method for establishing a secure connection between a UPnP (Universal Plug and Play) device and a UPnP endpoint in an open network wherein the UPnP device and UPnP endpoint can dynamically join and leave said network, said method comprising:

receiving, by a UPnP device, a request for a UPnP service, said request being received from a UPnP endpoint via the network, said request including identification information and a digital signature associated with the UPnP endpoint;

authenticating the UPnP endpoint by the UPnP device as a function of the received digital signature of the UPnP endpoint to verify the identity of the UPnP endpoint;

authorizing the UPnP endpoint by the UPnP device as a function of the received identification information to permit access to one or more services implemented by the UPnP device;

sending a response to the UPnP endpoint from the UPnP device indicating if the UPnP endpoint has been authenticated and authorized by the UPnP device.

2. The method of claim 1, wherein the identification information comprises a certificate provided by a trusted authority, said trusted authority providing the digital signature of the request.

3. The method of claim 2, wherein the certificate includes a public key of the UPnP endpoint and further comprising encrypting at least a portion of the response provided by the UPnP device with the public key of the UPnP endpoint.

4. The method of claim 1, wherein the identification information includes one or more of the following:

a device model number of the UPnP endpoint, a serial number of the UPnP endpoint, and a list of media formats supported by the UPnP endpoint.

5. The method of claim 1, wherein the response includes a certificate of the UPnP device, and further comprising authenticating the UPnP device by the UPnP endpoint with the certificate of the UPnP device.

6. The method of claim 1, wherein the response includes a session identifier, the session identifier being included in subsequent requests.

7. The method of claim 1, wherein the request includes a first random number generated by the UPnP endpoint and the response includes a second random number generated by the UPnP device, said response being encrypted with a public key of the UPnP endpoint, and further comprising:

receiving a confirmation from the UPnP endpoint by the UPnP device, said confirmation including a security token generated by the UPnP endpoint as a function of the first random number and a decrypted second random number, the second random number being decrypted with a private key of the UPnP endpoint, said private key of the UPnP endpoint corresponding to the public key of the UPnP endpoint; and

confirming, in response to receiving the confirmation, the authentication and authorization of the UPnP endpoint by the UPnP device as a function of the security token.

8. The method of claim 7, further comprising:

generating, by the UPnP endpoint, a shared secret as a function of the first and second random numbers; and

generating, by the UPnP endpoint, the security token as a function of the shared secret.

9. The method of claim 8, wherein the security token is one or more of the following:

a digest of the shared secret; and

a value known to the UPnP endpoint and the UPnP device encrypted using an encryption key derived from the shared secret.

10. The method of claim 7, further comprising:

generating, by the UPnP device, a session identifier, said session identifier being included in the response to the UPnP endpoint, said session identifier further being included in subsequent requests from the UPnP endpoint and in subsequent responses from the UPnP device.

11. The method of claim 10, wherein the session identifier includes a session token, and further comprising generating said session token as a function of the first and second random numbers such that a first generated session token is not equal to a second generated session token.

12. The method of claim 11, wherein the session identifier and session token are embedded in at least one of the following:

an XML request and a HTTP header of an UPnP request.

13. The method of claim 1, further comprising:

recording an address associated with the UPnP endpoint by the UPnP device as a function the authorization and authentication of the UPnP endpoint, said address being used by the UPnP device to identify subsequent requests from the UPnP endpoint.

14. The method of claim 1, wherein one or more computer-readable media have computer-executable instructions for performing the method of claim 1.

15. A method for establishing a new secure handshake service among a plurality of UPnP (Universal Plug and Play) portable media devices in an open network wherein one or more of the UPnP portable media devices can dynamically join and leave said network, comprising:

sending a message via the network announcing the availability of UPnP services hosted by a first portable media device, said services including the handshake service and at least one additional UPnP service;

receiving a first request initiating the handshake service from a second portable media device via the network by the first portable media device, said request including an initiating message, said initiating message including identification information of the second portable media device and a digital signature;

authenticating the second portable media device by the first portable media device as a function of the digital signature of the second portable media device, said authenticating establishing the identity of the second portable media device;

authorizing the second portable media device by the first portable media device as a function of the identification information of the request, said authorizing determining if the second portable media device is permitted to communicate with the first portable media device;

sending a response to the second portable media device by the first portable media device via the network indicating if the second portable media device has been authenticated and authorized by the first portable media device;

receiving a second request via the network from the second portable media device by the first portable media device for the at least one additional UPnP service hosted by the first portable;

wherein the second portable media device is allowed to access the at least one additional UPnP service hosted on the first portable media device if the second portable media device is authenticated and authorized by the first portable media device; and

wherein the second portable media device is not allowed to the access at least one additional UPnP service hosted on the first portable media device if the second portable media device is not authenticated and authorized by the first portable media device.

16. The method of claim 15, wherein the first portable media device comprises a UPnP Control Point and the second portable media device comprises a UPnP Media Renderer.

17. The system of claim 15, wherein the first portable media device comprises a UPnP Media Renderer and the second portable media device comprises a UPnP Control Point.

18. One or more computer-readable media having computer-executable components for authorizing and authenticating a media renderer by a media server wherein the media server implements one or more UPnP services in an open network, comprising:

an interface component for;

receiving a request via the network from the media renderer, said request including an initiating message, said initiating message including identification information of the media renderer and a digital signature; and

sending a response via the network to media renderer device indicating if the media renderer has been authenticated and authorized by the media server;

a validation component for;

authenticating the media renderer as a function of the digital signature of the media renderer, said authenticating establishing the identity of the media renderer; and

authorizing the media renderer as a function of the identification information of the request, said authorizing determining if the media renderer is permitted to communicate with the media server; and

a security component for;

granting access to the media renderer to one or more services implemented by the media server if the media renderer was authorized and authenticated by the validation component; and

denying access to the media renderer to one or more services implemented by the media server if the media renderer was not authorized and authenticated by the validation component.

19. The computer-readable media of claim 18, further comprising computer-executable instructions for authenticating and authorizing the media server by the media renderer in response to a request sent by the media server.

20. The computer-readable media of claim 18, wherein the media server and the media renderer are portable media devices.