Mechanism for dynamically binding a network computer client device to an approved internet service provider

• US 6,112,305 A
• Filed: 05/05/1998
• Issued: 08/29/2000
• Est. Priority Date: 05/05/1998
• Status: Expired due to Term

• Current Assignee: Comcast Cable Communications Management LLC (Comcast Corporation)
• Original Assignee: Liberate Technologies
• Inventors: Zmuda, James E., Dancs, Frank B.
• Primary Examiner(s): Peeso, Thomas R.
• Application Number:
  US09/073,271
• Time in Patent Office: 847 Days
• Field of Search: 380/255, 380/258, 713/161, 713/168, 713/170, 713/172, 713/173, 713/176, 713/156, 713/155
• US Class Current: 713/156
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

All network computer client device (NC) manufacturers'"'"' authorizations to connect to specific internet service providers (ISPs) are maintained in a central database associated with a relationship server. The relationship server issues digital certificates which associate various ISPs to their respective public keys. Each ISP is assigned a unique enterprise identification number by the relationship server. To authorize a specific ISP, the manufacturer begins with the relationship server'"'"'s ISP certificate. The manufacturer computes and appends its own digital signature for the relationship server'"'"'s ISP certificate, thereby creating an ISP usage certificate valid for its NCs which it sends back to the relationship server. Upon first powering on, each NC dials the relationship server and transmits its manufacturer identification number. The relationship server uses the manufacturer identification number to find the ISP usage certificates corresponding to the NC manufacturer. The relationship server then sends to the NC the ISP usage certificate corresponding to the enterprise identification number, or corresponding to the user'"'"'s selection if no enterprise identification number on the smart card is established. The NC performs a cryptographic verification of the ISP usage certificate using the manufacturer'"'"'s public key which is permanently stored in the NC in read only memory. Only if the verification of the ISP usage certificate is successful, thus indicating that the ISP usage certificate is signed by the manufacturer does the NC then attempts to connect to the ISP. When an ISP and manufacturer terminate an agreement, the relationship server disables the ISP'"'"'s managed access software; when the NC'"'"'s attempt to connect to the ISP fails, the NC then dials the relationship server to receive a new ISP usage certificate.

Claims

1. A method for connecting a network computer client device (NC) to an internet service provider (ISP), the method comprising the steps of:

(a) dialing a relationship server;

(b) transmitting an NC manufacturer identification number to the relationship server corresponding to an NC manufacturer of the NC;

(c) receiving an authorized usage certificate for the ISP from the relationship server that includes a manufacturer'"'"'s digital signature;

(d) performing a cryptographic verification of the authorized usage certificate for the ISP using an NC root public key; and

(e) connecting to the ISP if step (d) is successful.

2. A method as in claim 1, further comprising the step of:

after step (a) and before step (c),

(f) transmitting an enterprise identification number from a smart card inserted into the NC corresponding to the ISP to the relationship server.

3. A method as in claim 1, further comprising the step of:

before step (a),

(g) performing a cryptographic verification of a stale authorized usage certificate for an unauthorized ISP using the NC root public key;

(h) attempting to connect to the unauthorized ISP; and

(i) if step (h) is unsuccessful, proceeding to step (a).

4. A method as in claim 3,

wherein step (g) includes the step of reading the stale authorized usage certificate from a non-volatile memory within the NC;

wherein step (c) includes the step of writing the authorized usage certificate to the non-volatile memory within the NC; and

wherein step (d) includes the step of reading the authorized usage certificate from the non-volatile memory within the NC.

5. A method as in claim 1,

wherein step (d) includes the step of reading the NC root public key from a read only memory.

6. A method as in claim 4,

wherein step (a) includes the step of reading a relationship server telephone number from the non-volatile memory.

7. A method as in claim 5,

wherein step (b) includes the step of reading a manufacturer serial number from the non-volatile memory.

8. A method as in claim 1, further comprising the step of:

after step (b) and before step (e),

(j) receiving an ISP list of all enterprise identification numbers corresponding to all internet service providers authorized by the NC manufacturer from the relationship server.

9. A method as in claim 8, further comprising the step of:

after step (b) and before step (e),

(k) receiving an internet access provider connect matrix for each enterprise identification number in the ISP list from the relationship server.

10. A method as in claim 8, further comprising the step of:

after step (j) and before step (c),

(l) receiving an ISP selection from an NC user indicating which internet service provider from the ISP list to which to attempt connection.

11. A computer readable storage medium comprising:

computer readable program code embodied on said computer readable storage medium, said computer readable program code for programming a computer to perform a method for connecting said computer (NC) to an internet service provider (ISP), the method comprising the steps of;

(a) dialing a relationship server;

(b) transmitting an NC manufacturer identification number to the relationship server corresponding to an NC manufacturer of the NC;

(c) receiving an authorized usage certificate for the ISP from the relationship server that includes a manufacturer'"'"'s digital signature;

(d) performing a cryptographic verification of the authorized usage certificate for the ISP using an NC root public key; and

(e) connecting to the ISP if step (d) is successful.

12. A computer readable storage medium comprising computer readable program code as in claim 11, further comprising the step of:

after step (a) and before step (c),

(f) transmitting an enterprise identification number from a smart card inserted into the NC corresponding to the ISP to the relationship server.

13. A computer readable storage medium comprising computer readable program code as in claim 11, further comprising the step of:

before step (a),

(g) performing a cryptographic verification of a stale authorized usage certificate for an unauthorized ISP using the NC root public key;

(h) attempting to connect to the unauthorized ISP; and

(i) if step (h) is unsuccessful, proceeding to step (a).

14. A computer readable storage medium comprising computer readable program code as in claim 13,

wherein step (g) includes the step of reading the stale authorized usage certificate from a non-volatile memory within the NC;

wherein step (c) includes the step of writing the authorized usage certificate to the non-volatile memory within the NC; and

wherein step (d) includes the step of reading the authorized usage certificate from the non-volatile memory within the NC.

15. A computer readable storage medium comprising computer readable program code as in claim 11,

wherein step (d) includes the step of reading the NC root public key from a read only memory.

16. A computer readable storage medium comprising computer readable program code as in claim 14,

wherein step (a) includes the step of reading a relationship server telephone number from the non-volatile memory.

17. A computer readable storage medium comprising computer readable program code as in claim 15,

wherein step (b) includes the step of reading a manufacturer serial number from the non-volatile memory.

18. A computer readable storage medium comprising computer readable program code as in claim 11, further comprising the step of:

after step (b) and before step (e),

(j) receiving an ISP list of all enterprise identification numbers corresponding to all internet service providers authorized by the NC manufacturer from the relationship server.

19. A computer readable storage medium comprising computer readable program code as in claim 18, further comprising the step of:

after step (b) and before step (e),

(k) receiving an internet access provider connect matrix for each enterprise identification number in the ISP list from the relationship server.

20. A computer readable storage medium comprising computer readable program code as in claim 18, further comprising the step of:

after step (j) and before step (c),

(l) receiving an ISP selection from an NC user indicating which internet service provider from the ISP list to which to attempt connection.

21. An apparatus for connecting a network computer client device (NC) to an internet service provider (ISP), the apparatus comprising:

(a) means for dialing a relationship server;

(b) means for transmitting an NC manufacturer identification number to the relationship server corresponding to an NC manufacturer of the NC;

(c) means for receiving an authorized usage certificate for the ISP from the relationship server that includes a manufacturer'"'"'s digital signature;

(d) means for performing a cryptographic verification of the authorized usage certificate for the ISP using an NC root public key; and

(e) means for connecting to the ISP responsive to means (d).

22. An apparatus as in claim 21, further comprising:

(f) means for transmitting an enterprise identification number from a smart card inserted into the NC corresponding to the ISP to the relationship server.

23. An apparatus as in claim 21, further comprising the step of:

(g) means for performing a cryptographic verification of a stale authorized usage certificate for an unauthorized ISP using the NC root public key;

(h) means for attempting to connect to the unauthorized ISP; and

(i) means for invoking means (a) responsive to means (h).

24. An apparatus as in claim 23,

wherein means (g) includes means for reading the stale authorized usage certificate from a non-volatile memory within the NC;

wherein means (c) includes means for writing the authorized usage certificate to the non-volatile memory within the NC; and

wherein means (d) includes means for reading the authorized usage certificate from the non-volatile memory within the NC.

25. An apparatus as in claim 21,

wherein means (d) includes means for reading the NC root public key from a read only memory.

26. An apparatus as in claim 24,

wherein means (a) includes means for reading a relationship server telephone number from the non-volatile memory.

27. An apparatus as in claim 25,

wherein means (b) includes means for reading a manufacturer serial number from the non-volatile memory.

28. An apparatus as in claim 21, further comprising:

(j) means for receiving an ISP list of all enterprise identification numbers corresponding to all internet service providers authorized by the NC manufacturer from the relationship server.

29. An apparatus as in claim 28, further comprising:

(k) means for receiving an internet access provider connect matrix for each enterprise identification number in the ISP list from the relationship server.

30. An apparatus as in claim 28, further comprising the step of:

(l) means for receiving an ISP selection from an NC user indicating which internet service provider from the ISP list to which to attempt connection.