Mobile certificate distribution in a PKI

• US 8,064,879 B2
• Filed: 08/06/2010
• Issued: 11/22/2011
• Est. Priority Date: 02/06/2001
• Status: Expired due to Fees

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Certicom Corporation (Blackberry Limited)
• Inventors: Blake-Wilson, Simon, Willey, William Daniel
• Primary Examiner(s): Nguyen; Lee
• Application Number:
  US12/852,308
• Publication Number:
  US 20100306546A1
• Time in Patent Office: 473 Days
• Field of Search: 455 412- 413, 455410-411, 380/247, 380/270, 713168-172
• US Class Current: 455/410
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/06 Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A method of providing certificate issuance and revocation checks involving mobile devices in a mobile ad-hoc network (MANET). The wireless devices communicate with each other via Bluetooth wireless technology in the MANET, with an access point (AP) to provide connectivity to the Internet. A Certificate authority (CA) distributes certificates and certification revocation lists (CRLs) to the devices via the access point (AP). Each group of devices has the name of the group associated with the certificate and signed by the CA. A device that is out of the radio range of the access point may still connect to the CA to validate a certificate or download the appropriate CRL by having all the devices participate in the MANET.

Claims

1. A method of a first wireless device validating a second wireless device, wherein the first and second wireless devices are operable to communicate with each other, the method comprising:

the first wireless device obtaining a certificate for the second wireless device;

said first wireless device determining if the certificate has expired; and

if said certificate has expired, the first wireless device obtaining another certificate for the second wireless device using a pointer provided by the second wireless device and validating the second wireless device using the other certificate.

2. The method according to claim 1, wherein the certificate is obtained from the second wireless device.

3. The method according to claim 1, wherein if the certificate has not expired, the first wireless device uses the certificate to validate the second wireless device.

4. The method according to claim 1, wherein the certificate and the pointer are provided by the second wireless device at the same time.

5. The method according to claim 1, wherein the first wireless device detects the second wireless device approaching it to join an ad-hoc network, the ad-hoc network including the first wireless device.

6. The method according to claim 1, wherein the pointer comprises a uniform resource locator (URL).

7. The method according to claim 6, wherein the URL comprises a time.

8. The method according to claim 6, wherein the pointer further comprises an internet protocol (IP) address associated with a certificate authority (CA).

9. The method according to claim 1, wherein the pointer comprises an internet protocol (IP) address associated with a certificate authority (CA).

10. A first wireless device operable to communicate with at least a second wireless device, the first wireless device comprising a processor operable to:

obtain a certificate for the second wireless device;

determine if the certificate has expired; and

if said certificate has expired, obtain another certificate for the second wireless device using a pointer provided by the second wireless device, and validate the second wireless device using the other certificate.

11. The first wireless device according to claim 10, wherein the certificate is obtained from the second wireless device.

12. The first wireless device according to claim 10, wherein if the certificate has not expired, the processor is further operable to use the certificate to validate the second wireless device.

13. The first wireless device according to claim 10, wherein the certificate and the pointer are provided by the second wireless device at the same time.

14. The first wireless device according to claim 10, wherein the processor is further operable to obtain a detection of the second wireless device approaching it to join an ad-hoc network, the ad-hoc network including the first wireless device.

15. The first wireless device according to claim 10, wherein the pointer comprises a uniform resource locator (URL).

16. The first wireless device according to claim 15, wherein the URL comprises a time.

17. The first wireless device according to claim 15, wherein the pointer further comprises an internet protocol (IP) address associated with a certificate authority (CA).

18. The first wireless device according to claim 10, wherein the pointer comprises an internet protocol (IP) address associated with a certificate authority (CA).