METHOD AND APPARATUS FOR INTEGRATED PROVISIONING OF A NETWORK DEVICE WITH CONFIGURATION INFORMATION AND IDENTITY CERTIFICATION

• US 20080222413A1
• Filed: 05/23/2008
• Published: 09/11/2008
• Est. Priority Date: 03/12/2003
• Status: Active Grant

• Current Assignee: Jan Vilhuber, Max Pritikin
• Original Assignee: Jan Vilhuber, Max Pritikin
• Inventors: Vilhuber, Jan, Pritikin, Max
• Granted Patent: US 8,095,788 B2
• Time in Patent Office: Days
• US Class Current: 713/156
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

According to one aspect, a provisioning server comprises a configuration module that configures a network device and an identification certification module that certifies the identity of the network device. With use of the provisioning server, the network device does not require configuration with network connectivity in order to obtain its certified identity. In one embodiment, configuration module configures the device for operation at the device'"'"'s point of deployment in a network. In one embodiment, the identity certification module is configured to generate a digital certificate for the network device and the configuration module is configured to automatically configure the network device based on its digital certificate. The provisioning server is coupled to the network device with a secure communication link. As a result, a more trusted network device is ultimately deployed into its network of operation.

Claims

1. A provisioning server for provisioning a network device, comprising:

a configuration module that is adapted for configuring the network device; and

an identification certification module that is configured for certifying the identity of the network device;

wherein the provisioning server is physically co-located with and securely coupled to the network device;

wherein the provisioning server is configured to read and write configuration information and parameters, key information and identity certification information to and from the network device; and

wherein the identification certification module is configured for obtaining certification of the network device'"'"'s identity without a network connection between the network device and an external certificate authority.

2. The server of claim 1, wherein the provisioning server is securely coupled to the network device using a serial cable.

3. The server of claim 1, wherein a computer on which the server executes is mechanically and electrically coupled to the network device with an electrical cable.

4. The server of claim 1, wherein the server resides on a portable computer-readable volatile or non-volatile medium that is mechanically and electrically coupled to the network device.

5. The server of claim 4, wherein the computer-readable volatile or non-volatile medium comprises a removable flash memory.

6. The server of claim 4, wherein the computer-readable volatile or non-volatile medium comprises a smart card.

7. The server of claim 1, wherein the configuration module is configured to configure the network device for operation at the device'"'"'s point of deployment in a network.

8. The server of claim 1, wherein the identification certification module is configured to:

generate a digital certificate that is associated with a public key that is associated with the network device; and

wherein the configuration module is configured to;

configure the network device based on the digital certificate.

9. The server of claim 8, wherein the identification module is configured to:

read, from the network device, the public key that is associated with the network device.

10. The server of claim 1, wherein the identification certification module comprises an identity registrar for verifying information associated with a request for a digital certificate.

11. The server of claim 10, wherein the identity registrar is a PKI registration authority.

12. The server of claim 1, wherein the identification certification module comprises an identity registrar for verifying information associated with a request for a digital certificate and a certificate authority for issuing a digital certificate.

13. A method for provisioning a network device, the method comprising the computer-implemented steps of:

in a provisioning server, configuring the network device; and

in the provisioning server, certifying the identity of the network device;

wherein the provisioning server is physically co-located with and securely coupled to the network device;

wherein the provisioning server is configured to read and write configuration information and parameters, key information and identity certification information to and from the network device; and

wherein the provisioning server is configured for obtaining certification of the network device'"'"'s identity without a network connection between the network device and an external certificate authority.

14. The method of claim 13, wherein the step of certifying comprises the steps of:

reading a public key associated with the network device;

obtaining a digital certificate associated with the public key; and

wherein the step of configuring includes configuring the network device based on the digital certificate.

15. The method of claim 14, wherein the step of obtaining a digital certificate includes generating the digital certificate.

16. The method of claim 14, wherein the step of obtaining a digital certificate includes the steps of:

verifying the identity of the network device based on information provided regarding the network device; and

generating the digital certificate associated with the network device in response to verifying the identity of the network device.

17. A computer-readable storage medium storing one or more sequences of instructions for provisioning a network device, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

in a provisioning server, configuring the network device; and

in the provisioning server, certifying the identity of the network device;

wherein the provisioning server is physically co-located with and communicates with the network device;

wherein the provisioning server is configured to read and write configuration information and parameters, key information and identity certification information to and from the network device; and

wherein the provisioning server is configured for obtaining certification of the network device'"'"'s identity without a network connection between the network device and an external certificate authority.

18. The computer-readable storage medium of claim 17, wherein the one or more sequences of instructions cause the one or more processors to carry out the step of certifying by:

reading a public key associated with the network device;

obtaining a digital certificate associated with the public key; and

cause the one or more processors to carry out the step of certifying by configuring the network device based on the digital certificate.

19. The computer-readable storage medium of claim 18, wherein the one or more sequences of instructions cause the one or more processors to carry out the step of obtaining a digital certificate by generating the digital certificate.

20. The computer-readable storage medium of claim 18, wherein the one or more sequences of instructions cause the one or more processors to carry out the step of obtaining a digital certificate by carrying out the steps of:

verifying the identity of the network device based on information provided regarding the network device; and

generating the digital certificate associated with the network device in response to verifying the identity of the network device.

21. The computer-readable storage medium of claim 17, wherein the computer-readable storage medium is mechanically and electrically coupled to the network device.

22. The computer-readable storage medium of claim 21, wherein the computer-readable storage medium comprises a removable flash memory.

23. The computer-readable storage medium of claim 21, wherein the computer-readable storage medium comprises a smart card.

24. A system for provisioning a network device, the system comprising:

means for configuring the network device; and

means for certifying the identity of the network device;

wherein the system is physically co-located with and securely coupled to the network device;

wherein the system is configured to read and write configuration information and parameters, key information and identity certification information to and from the network device;

wherein the system is configured for obtaining certification of the network device'"'"'s identity without a network connection between the network device and an external certificate authority.

25. The system of claim 24, further comprising:

means for reading a public key associated with the network device;

means for obtaining a digital certificate associated with the public key; and

wherein the means for configuring the network device further comprises means for configuring the network device based on the digital certificate.

26. The system of claim 25, wherein the means for obtaining a digital certificate further comprises means for generating the digital certificate.

27. The system of claim 25, wherein the means for obtaining a digital certificate further comprises:

means for verifying the identity of the network device based on information provided regarding the network device; and

means for generating the digital certificate associated with the network device in response to verifying the identity of the network device.

28. A device for providing a network device, the device comprising:

one or more processors;

a computer-readable storage medium comprising one or more stored sequences which, when executed by the one or more processors, cause the one or more processors to carry out the steps of;

configuring the network device; and

certifying the identity of the network device;

wherein the device is physically co-located with and securely coupled to the network device;

wherein the device is configured to read and write configuration information and parameters, key information and identity certification information to and from the network device over the link; and

wherein the device is configured for obtaining certification of the network device'"'"'s identity without a network connection between the network device and an external certificate authority.

29. The device of claim 28, wherein the one or more sequences of instructions cause the one or more processors to carry out the step of certifying by:

reading a public key associated with the network device;

obtaining a digital certificate associated with the public key; and

cause the one or more processors to carry out the step of certifying by configuring the network device based on the digital certificate.

30. The device of claim 29, wherein the one or more sequences of instructions cause the one or more processors to carry out the step of obtaining a digital certificate by generating the digital certificate.

31. The device of claim 29, wherein the one or more sequences of instructions cause the one or more processors to carry out the step of obtaining a digital certificate by carrying out the steps of:

verifying the identity of the network device based on information provided regarding the network device; and

generating the digital certificate associated with the network device in response to verifying the identity of the network device.

32. The device of claim 28, wherein the device is mechanically and electrically coupled to the network device.

33. The device of claim 32, wherein the device comprises a removable flash memory.

34. The device of claim 32, wherein the device comprises a smart card.