Method, apparatus, and program product for provisioning secure wireless sensors

• US 7,937,089 B2
• Filed: 09/05/2003
• Issued: 05/03/2011
• Est. Priority Date: 02/06/2002
• Status: Expired due to Term

• Current Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Original Assignee: Palo Alto Research Center, Inc. (Xerox Holdings Corp.)
• Inventors: Stewart, Paul J., Smetters, Diana K., Balfanz, Dirk, Durfee, Glenn E., Wong, Hao-Chi, Grinter, Rebecca E.
• Primary Examiner(s): Patel; Ajit
• Assistant Examiner(s): NGUYEN, KHAI MINH
• Application Number:
  US10/656,551
• Publication Number:
  US 20040266449A1
• Time in Patent Office: 2,797 Days
• Field of Search: 455/452.1, 455/452.2, 455/422.1, 455/450, 455/509, 713/186, 713/187, 713/202, 713/156, 713/158, 713/163, 713/168, 713/170, 713/171, 713/150, 726/5, 726/18, 726/19, 380/282, 380/285, 380/277, 380/207, 380/278, 340/5.72
• US Class Current: 455/452.1
• CPC Class Codes: A61B 5/0002 Remote monitoring of patients using telemetry, e.g. transmission of vital signals via a communication network A61B5/07 takes precedence; transmission systems for measured values G08C; transmission H04B; transmission of digital information H04L; wireless communication networks H04W
• CPC Class Codes: G08C 17/00 Arrangements for transmitting signals characterised by the use of a wireless electrical link
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0492 by using a location-limited connection, e.g. near-field communication or limited proximity of entities
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

We present technology that allows layman computer users to simply create, provision, and maintain secured infrastructure—an instant PKI. This technology can be used in a wide variety of applications including wired and wireless networks, secure sensor networks (such as medical networks), emergency alert networks, as well as simply and automatically provisioning network devices whether secure or not.

Claims

1. A computer controlled method comprising:

providing a security credential to a resident alert device, wherein the resident alert device is inserted in a domicile for a resident covered by a secure community alert system to receive information from an emergency operation center that transmits a set of instructions in an emergency;

establishing communication between the resident alert device and a provisioning device over a preferred channel, the resident alert device configured to send the security credential to the provisioning device over the preferred channel and to receive a commitment from the provisioning device over the preferred channel;

receiving from the provisioning device over the preferred channel at least one of provisioning information or additional application-specific information, site-specific information, network-specific information, or other information that can be used by the resident alert device, wherein the provisioning information includes a credential and wherein the credential facilitates the resident alert device to become a member of a secure credential infrastructure; and

automatically configuring the resident alert device for receiving information over a secure communication channel responsive to the provisioning information.

2. The computer controlled method of claim 1, further comprising transmitting information from the resident alert device over the secure communication channel.

3. The computer controlled method of claim 1, wherein the preferred channel comprises a single location-limited channel capable of communicating both from the wireless sensor to the provisioning device and from the provisioning device to the wireless sensor.

4. The computer controlled method of claim 1, wherein the preferred channel comprises two separate channels, including a first location-limited channel capable of communicating from the wireless sensor to the provisioning device and a second location-limited channel capable of communicating from the provisioning device to the wireless sensor.

5. The computer controlled method of claim 1, further comprising receiving the at least one of the provisioning information or additional application-specific information from the provisioning device over at least one of:

a telephone network, or the Internet.

6. The computer controlled method of claim 1, wherein receiving information over the secure communication channel further comprises receiving information from at least one of:

emergency radio station, television station, cellular phone system, wired telephone system, or the Internet.

7. The computer controlled method of claim 1, further comprising identifying an intended resident alert device at an emergency operation center, and transmitting information from the emergency operation center to the intended resident alert device.

8. The computer controlled method of claim 1, wherein each instruction corresponds to a different set of people in the emergency, and wherein the information received by the resident alert device from the emergency operation center includes the instruction corresponding to the resident.

9. The computer controlled method of claim 8, wherein the instructions include evacuation instructions, and wherein each evacuation instruction directs the corresponding set of people to a different place.

10. The computer controlled method of claim 1, wherein the emergency includes a flood emergency.

11. A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform a method comprising steps of:

providing a security credential to a resident alert device, wherein the resident alert device is inserted in a domicile for a resident covered by a secure community alert system to receive information from an emergency operation center that transmits a set of instructions in an emergency;

establishing communication between the resident alert device and a provisioning device over a preferred channel, the resident alert device configured to send the security credential to the provisioning device over the preferred channel and to receive a commitment from the provisioning device over the preferred channel;

receiving from the provisioning device over the preferred channel at least one of provisioning information or additional application-specific information, site-specific information, network-specific information, or other information that can be used by the resident alert device, wherein the provisioning information includes a credential and wherein the credential facilitates the resident alert device to become a member of a secure credential infrastructure; and

automatically configuring the resident alert device for receiving information over a secure communication channel responsive to said provisioning information.

12. The non-transitory computer-readable storage medium of claim 11, further comprising transmitting information from the resident alert device over the secure communication channel.

13. The non-transitory computer-readable storage medium of claim 11, wherein the preferred channel comprises a single location-limited channel capable of communicating both from the wireless sensor to the provisioning device and from the provisioning device to the wireless sensor.

14. The non-transitory computer-readable storage medium of claim 11, wherein the preferred channel comprises two separate channels, including a first location-limited channel capable of communicating from the wireless sensor to the provisioning device and a second location-limited channel capable of communicating from the provisioning device to the wireless sensor.

15. An apparatus comprising:

a mechanism configured to provide a security credential to a resident alert device, wherein the resident alert device is inserted in a domicile for a resident covered by a secure community alert system to receive information from an emergency operation center that transmits a set of instructions in an emergency;

at least one port configured to establish a preferred channel;

a preferred channel communication mechanism configured to establish communication with a provisioning device over the preferred channel, the preferred channel communication mechanism further configured to send the security credential to the provisioning device over the preferred channel and to receive a commitment from the provisioning device over the preferred channel;

a receiver mechanism configured to receive from the provisioning device over the preferred channel at least one of provisioning information or additional application-specific information, site-specific information, network-specific information, or other information that can be used by the resident alert device, wherein the provisioning information includes a credential and wherein the credential facilitates the resident alert device to become a member of a secure credential infrastructure; and

an automatic configuration mechanism to enable the resident alert device to receive information over a secure communication channel established responsive to said provisioning information.

16. The apparatus of claim 15, further comprising a transmission mechanism configured to transmit information from the resident alert device over the secure communication channel.

17. The apparatus of claim 15, wherein the information received by the resident alert device is information from an emergency operation center.

18. The apparatus of claim 15, wherein the preferred channel comprises a single location-limited channel capable of communicating both from the wireless sensor to the provisioning device and from the provisioning device to the wireless sensor.

19. The apparatus of claim 15, wherein the preferred channel comprises two separate channels, including a first location-limited channel capable of communicating from the wireless sensor to the provisioning device and a second location-limited channel capable of communicating from the provisioning device to the wireless sensor.