Securely Accessing An Advertised Service

• US 20120054848A1
• Filed: 08/24/2010
• Published: 03/01/2012
• Est. Priority Date: 08/24/2010
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Salowey, Joseph A., Stephenson, David Sheldon, Cam-Winget, Nancy, Ersoy, Chetin
• Granted Patent: US 8,543,471 B2
• Time in Patent Office: Days
• US Class Current: 726/10
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

In one embodiment, a method includes sending by an endpoint a request for information about available services to a network device; receiving by the endpoint a message from the network device, the message including information associated with a first service provider; determining by the endpoint whether the first address is certified by a trusted third party as being associated with the first service provider; if the first address is certified by the trusted third party, communicating by the endpoint with the first service provider using the information; and, in response to communicating with the first service provider using the information, receiving by the endpoint access to a service from the first service provider through the network device.

Claims

1. A method comprising:

sending by an endpoint a request for information about available services to a network device;

receiving by the endpoint a message from the network device, the message comprising information associated with a first service provider;

determining by the endpoint whether the information is certified by a trusted third party as being associated with the first service provider;

if the information is certified by the trusted third party, communicating by the endpoint with the first service provider; and

in response to communicating with the first service provider, receiving by the endpoint access to a service from the first service provider through the network device.

2. The method of claim 1, wherein the message comprises a first service declaration, the first service declaration comprising a first service-provider identifier, a first address, a first service description, and a first service-provider signature.

3. The method of claim 1, wherein determining whether the information is certified by the trusted third party comprises:

retrieving by the endpoint a trusted certificate associated with the trusted third party using a first address, the message comprising the first address, the trusted certificate comprising a trusted third party key;

authenticating by the endpoint a service provider key with the trusted third party key, the message comprising the service provider key; and

in response to authenticating the service provider key with the trusted third party key, validating that a first service-provider identifier associated with the first address was created by the service provider key.

4. The method of claim 1, wherein:

the trusted third party is a first trusted third party;

the message comprises a first service-provider identifier associated with the first service provider, information associated with a second service provider, and a second service-provider identifier;

the endpoint determines whether the information associated with the first service provider is certified by the trusted third party at least in part by;

determining whether the first service-provider identifier is associated with a first trusted identifier certified by the first trusted third party; and

attempting to validate the first trusted identifier; and

the method further comprises;

determining by the endpoint whether the information associated with the second service provider is certified with a second trusted third party by;

determining whether the second service-provider identifier is certified by a second trusted identifier certified by the second trusted third party; and

attempting to validate the second trusted identifier;

if the information associated with the first service provider is certified by the first trusted third party and the information associated with the second service provider is certified with the second trusted third party, presenting by the endpoint the first and second service-provider identifiers to a user; and

in response to presenting the first and second service-provider identifiers to the user, receiving by the endpoint a user selection of either the first service provider or the second service provider.

5. The method of claim 4, wherein:

the first trusted identifier and the second trusted identifier are the same; and

the first trusted third party and the second trusted third party are the same.

6. The method of claim 1, wherein:

the message comprises a first service-provider identifier associated with a first address, the first service-provider identifier comprising an icon;

the message comprises a trusted identifier of the trusted third party, the trusted identifier comprising a logotype certificate; and

the trusted third party comprises a certificate authority.

7. The method of claim 1, wherein communicating, by the endpoint, with the first service provider comprises:

providing requested information from the endpoint to the first service provider, the requested information comprising payment information;

receiving credentials for access to the service; and

receiving configuration information for access to the service.

8. The method of claim 1, further comprising:

receiving by the endpoint a second message from the network device, the second message comprising a service declaration and a service advertiser identifier;

determining whether the service advertiser identifier is authenticated as belonging to a service advertiser; and

if the service advertiser identifier is authenticated as belonging to the service advertiser, accessing, by the endpoint, a second service provided by the service advertiser.

9. The method of claim 1, further comprising:

receiving by the endpoint a second message from the network device, the second message comprising a service declaration and a service provider certificate, the service declaration comprising an address, the service provider certificate comprising a second key;

determining by the endpoint whether the service provider certificate is certified by a second trusted third party;

if the service provider certificate is certified by the second trusted third party, determining by the endpoint whether the service declaration is signed by the second key; and

if the service declaration is signed by the second key, accessing by the endpoint a second service using the address.

10. The method of claim 1, wherein:

the message comprises an address associated with the first service provider; and

communicating by the endpoint with the first service provider comprises communicating using the address by;

contacting, by the endpoint, a server associated with the address;

receiving, at the endpoint, authentication information from the server;

validating, by the endpoint, the authentication information; and

in response to validating that the authentication information is consistent with the first address, sending requested information from the endpoint to the server.

11. A computer-readable non-transitory storage medium embodying software that is operable when executed to:

send a request for information about available services to a network device;

receive a message from the network device, the message comprising information associated with a first service provider;

determine whether the information is certified by a trusted third party as being associated with the first service provider;

if the information is certified by the trusted third party, communicate with the first service provider using the information; and

in response to communicating with the first service provider using the information, receive access to a service from the first service provider through the network device.

12. The medium of claim 11, wherein the message comprises a first service declaration, the first service declaration comprising a first service-provider identifier, a first address, a first service description, and a first service-provider signature.

13. The medium of claim 11, wherein determining whether the information is certified by the trusted third party comprises:

retrieving a trusted certificate associated with the trusted third party using an address, the message comprising the address, the trusted certificate comprising a trusted third party key;

authenticating a service provider key with the trusted third party key, the message comprising the service provider key;

in response to authenticating the service provider key with the trusted third party key, validating that a first service-provider identifier associated with the first address was created by the service provider key.

14. The medium of claim 11, wherein:

the trusted third party is a first trusted third party;

the message comprises a first service-provider identifier associated with the first service provider, information associated with a second service provider, and a second service-provider identifier;

the endpoint determines whether the information associated with the first service provider is certified by the trusted third party at least in part by;

determining whether the first service-provider identifier is associated with a first trusted identifier certified by the first trusted third party; and

attempting to validate the first trusted identifier; and

the software is further operable when executed to;

determine whether the second address is associated with a second trusted third party by;

determining whether the information associated with the second service provider is certified with a second trusted third party by;

determining whether the second service-provider identifier is certified by a second trusted identifier certified by the second trusted third party; and

attempting to validate the second trusted identifier;

if the information associated with the first service provider is certified by the first trusted third party and the information associated with the second service provider is certified with the second trusted third party, present the first and second service-provider identifiers to a user; and

in response to presenting the first and second service-provider identifiers to the user, receive a user selection of either the first service provider or the second service provider.

15. The medium of claim 14, wherein:

the first trusted identifier and the second trusted identifier are the same; and

the first trusted third party and the second trusted third party are the same.

16. The medium of claim 11, wherein:

the message comprises a first service-provider identifier associated with a first address, the first service-provider identifier comprising an icon;

the message comprises a trusted identifier of the trusted third party, the trusted identifier comprising a logotype certificate; and

the trusted third party comprises a certificate authority.

17. The medium of claim 11, wherein communicating with the first service provider comprises:

providing requested information from the endpoint to the first service provider, the requested information comprising payment information;

receiving credentials for access to the service; and

receiving configuration information for access to the service.

18. The medium of claim 11, wherein the software is further operable when executed to:

receive a second message from the network device, the second message comprising a service declaration and a service advertiser identifier;

determine whether the service advertiser identifier is authenticated as belonging to a service advertiser;

if the service advertiser identifier is authenticated as belonging to the service advertiser, access a second service provided by the service advertiser.

19. The medium of claim 11, wherein the software is further operable when executed to:

receive a second message from the network device, the second message comprising a service declaration and a service provider certificate, the service declaration comprising an address, the service provider certificate comprising a second key;

determine whether the service provider certificate is certified by a second trusted third party;

if the service provider certificate is certified by the second trusted third party, determine whether the service declaration is signed by the second key; and

if the service declaration is signed by the second key, access a second service using the address.

20. The medium of claim 11, wherein:

the message comprises an address associated with the first service provider; and

communicating by the endpoint with the first service provider comprises communicating using the address by;

contacting, by the endpoint, a server associated with the address;

receiving, at the endpoint, authentication information from the server;

validating, by the endpoint, the authentication information; and

in response to validating that the authentication information is consistent with the first address, sending requested information from the endpoint to the server.

21. An apparatus comprising:

a communication interface;

a memory storing software for execution by one or more processors; and

one or more processors coupled to the memory, the processors being operable when executing the software to;

send a request via the communication interface for information about available services to a network device;

receive a message via the communication interface from the network device using the communication interface, the message comprising information associated with a first service provider;

determine whether the information is certified by a trusted third party as being associated with the first service provider;

if the information is certified by the trusted third party, communicate via the communication interface with the first service provider using the information; and

in response to communicating with the first service provider using the information, receive via the communication interface access to a service from the first service provider through the network device.