ONLINE SECURE DEVICE PROVISIONING WITH ONLINE DEVICE BINDING USING WHITELISTS

• US 20120089839A1
• Filed: 10/06/2011
• Published: 04/12/2012
• Est. Priority Date: 10/06/2010
• Status: Active Grant

• Current Assignee: Google Technology Holdings LLC (Alphabet Inc.)
• Original Assignee: General Instrument Corporation (CommScope Holding Company, Inc.)
• Inventors: Qiu, Xin, Medvinsky, Alexander, Moskovics, Stuart P., Pasion, Jason A., Wang, Fan, Yao, Ting
• Granted Patent: US 8,627,083 B2
• Time in Patent Office: Days
• US Class Current: 713/171
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/0891 Revocation or update of secret information, e.g. encryption key update or rekeying
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority

Abstract

One or more servers are provided including a session manager, authentication module, authorization module, encryption module, database, and protocol handler. The session manager is configured to receive requests for new identity data from network-enabled devices. Each request is authenticated first by the update server via its authentication module by validating the signature of the request message as well as the certificate chain trusted by the update server. The authorization module is configured to determine if the network-enabled devices specified on a whitelist are authorized to be provisioned with new identity data. The database is configured to receive new identity records generated by an identity data generation system. Each of the new identity records includes a new identifier. The new identifier is not associated or linked to any previously assigned/used identifiers and identity data, thus all the new identity records are generated independently and then loaded to the update server.

Claims

1. A method for updating network-enabled devices with new identity data, comprising:

receiving requests for new identity data from a plurality of network-enabled devices, said requests including previously assigned identifiers respectively associated with the network-enabled devices;

receiving a plurality of new identity records that each include new identity data and new identifiers respectively linked to the new identity data;

determining that each of the plurality of network-enabled devices specified in the requests for new identity data are authorized to receive new identity data;

retrieving a first of the new identity records;

encrypting at least a part of a first of the new identity record with a key uniquely associated with a network-enabled device identified by a first of the previously assigned identifiers; and

sending the first encrypted new identity record to the network-enabled device identified by the first previously assigned identifier.

2. The method of claim 1 wherein each of the requests further includes an encrypted version of the key uniquely associated with the network-enabled device sending the request and further comprising decrypting the encrypted version of the key.

3. The method of claim 2 in which a decryption key used to decrypt the encrypted version of the key is able to decrypt encrypted keys included in requests received from a plurality of network-enabled devices requesting new identity data.

4. The method of claim 1 wherein the keys uniquely associated with the respective network-enabled devices sending the requests are one-time programmable keys stored in a protected memory included in the network-enabled devices.

5. The method of claim 1 wherein the requests for new identity data each include a public key uniquely associated with a respective one of the network-enabled devices, and further comprising executing a public key based agreement algorithm using the public key to obtain the key uniquely assigned to each respective network-enabled device which is used to decrypt the new identity data records respectively delivered to the network-enabled devices.

6. The method of claim 1 further comprising validating the request by at least verifying a signature of the request.

7. The method of claim 1 wherein determining that each of the plurality of network-enabled devices specified in the request for new identity data are authorized to receive the new identity data includes receiving a whitelist of network-enabled devices authorized to be provisioned with new identity data and confirming that the previously assigned identifiers included in the request are also included in the whitelist.

8. The method of claim 1 wherein, if determining that each of the plurality of network-enabled devices specified in the request for new identity data are authorized to receive the new identity data fails, sending a message requesting any information concerning missing pairs of previously assigned identifiers.

9. The method of claim 1 further comprising determining that a number of requests for new identity data is not received from a given network-enabled devices more than a maximum allowed number of times.

10. The method of claim 1 wherein the new identity data is not linked to old identity data previously provisioned in the network-enabled devices and wherein retrieving the first of the new identity records includes retrieving a next available new identity record independent of the network-enabled device to which the first identity data record is to be sent.

11. The method of claim 1 wherein retrieving, encrypting and sending are performed online upon receiving the request.

12. At least one server, comprising:

a session manager configured to receive requests for new identity data from network-enabled devices, each of said requests including a previously assigned identifiers identifying the respective network-enabled device sending the request;

an authorization module configured to determine if the network-enabled devices specified on a whitelist are authorized to be provisioned with new identity data, the whitelist including previously assigned identifiers of network-enabled devices associated with identity data records previously provisioned in the respective network-enabled devices;

a database configured to receive new identity records generated by an identity data generation system, wherein each of the new identity records includes a new identifier; and

a protocol handler configured to deliver a data response message to each of the authorized network-enabled devices requesting new identity data, each of the data response messages including a new identity record that is encrypted with a key uniquely associated with the network-enabled device to which the data response message is sent.

13. The at least one server of claim 12 wherein each of the requests further includes an encrypted version of the key uniquely associated with the network-enabled device sending the request, said protocol handler having a decryption key for decrypting the encrypted version of the key.

14. The at least one server of claim 13 in which the decryption key is able to decrypt encrypted keys included in requests received from a plurality of network-enabled devices requesting new identity data.

15. The at least one server of claim 12 wherein the keys uniquely associated with the respective network-enabled devices sending the requests are one-time programmable keys stored in a memory included in the network-enabled devices.

16. The at least one server of claim 12 wherein the requests for new identity data each include a public key uniquely associated with a respective one of the network-enabled devices, said protocol handler being further configured to execute a public key based agreement algorithm using the public key to obtain the key uniquely assigned to each respective network-enabled device which is used to encrypt the new identity data records respectively delivered to the network-enabled devices.

17. The at least one server of claim 12, further comprising a configuration manager for receiving user input specifying a maximum number of repeat requests that are allowed from a particular network-enabled device.

18. The at least one server of claim 12, wherein the authorization module is configured to determine if the network-enabled devices specified on the whitelist are authorized to be provisioned with new identity data by determining if pairing information included in the request is also in the database.

19. One or more computer-readable storage media containing instructions which, when executed by one or more processors perform a method for updating network-enabled devices with new identity data, comprising:

receiving requests for new identity data from a plurality of network-enabled devices, said requests including previously assigned identifiers respectively associated with the network-enabled devices;

binding new identity data to each of the network-enabled devices authorized to receive new identity data;

encrypting the new identity data bound to each of the network-enabled devices using an encryption key unique to each respective network-enabled device; and

sending the first encrypted new identity record to the network-enabled device identified by the first previously assigned identifier.

20. The computer-readable storage media of claim 19 further comprising authorizing the network-enabled devices to receive new identity data by determining that the previously assigned identifiers respectively associated with the network-enabled devices appear on a whitelist of network-enabled device authorized to receive new identity data.