System and method for installing trust anchors in an endpoint

• US 8,312,263 B2
• Filed: 01/25/2005
• Issued: 11/13/2012
• Est. Priority Date: 01/25/2005
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Bell, Robert T., Dexter, Douglas Q.
• Primary Examiner(s): Schwartz, Darren B
• Application Number:
  US11/042,618
• Publication Number:
  US 20060174124A1
• Time in Patent Office: 2,849 Days
• Field of Search: 713/150, 713155-158, 713168-170, 713/175, 726 1- 6, 726/10, 726 18- 20
• US Class Current: 713/156
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]

Abstract

According to one embodiment of the present invention, a method of updating a certificate trust list on a first endpoint includes receiving an initial certificate trust list at the first endpoint. The initial certificate trust list includes authentication data for at least a second endpoint. Digitally signed information is received at the first endpoint and authentication is initiated against the authentication data for the at least a second endpoint. The authentication occurs only if the digital signature is complementary to the authentication data for the at least a second endpoint. After successful authentication, the initial certificate trust list is updated with the information to yield an updated certificate trust list.

Claims

1. A method of updating a certificate trust list on a first endpoint, comprising:

receiving an initial certificate trust list at the first endpoint, the initial certificate trust list comprising authentication data for at least one second endpoint, wherein the first endpoint comprises a communications device and the initial certificate trust list is authenticated at the first endpoint using a self-authentication process while the first endpoint is coupled to a secure communications network;

receiving information at the first endpoint, the information signed with a digital signature of the at least one second endpoint, the information containing updates to the certificate trust list and a configuration setting of the first endpoint;

initiating authentication of the digital signature against the authentication data for the at least one second endpoint, the authentication occurring only when the digital signature is complementary to the authentication data for the at least one second endpoint;

initiating verification of a privilege of the at least one second endpoint prior to updating at least one of the initial certificate trust list and the configuration setting at the first endpoint with the received information by determining that verification data for the at least one second endpoint falls into a particular category, wherein the initial certificate trust list is updated at the first endpoint with the received information only when the particular category indicates the privilege of an administrator, and wherein the configuration setting is updated at the first endpoint with the received information only when the particular category indicates the privilege of a configuration manager; and

after successful authentication and verification, updating at least one of the initial certificate trust list and the configuration setting with the received information to yield at least one of an updated certificate trust list and an updated configuration setting.

2. The method of claim 1, wherein updating the initial certificate trust lists further comprises:

adding authentication data corresponding to at least one third endpoint.

3. The method of claim 1, wherein updating the initial certificate trust list further comprises:

removing authentication data corresponding to the at least one second endpoint.

4. The method of claim 1, wherein updating the initial certificate trust list further comprises:

renewing authentication data corresponding to the at least one second endpoint.

5. The method of claim 1, wherein the updated configuration setting comprises an update to firmware.

6. The method of claim 1, wherein the initial certificate trust list is digitally signed with a private key of an administrator and the self-authentication process comprises authenticating the initial certificate trust list with an administrative public key included in the initial certificate trust list.

7. A method of updating a certificate trust list on a first endpoint, comprising:

digitally signing information with a digital signature of a second endpoint, the information containing updates to the certificate trust list and a configuration setting on a first endpoint;

transmitting the information across a communications network to the first endpoint at a communications device coupled to the first endpoint and coupled to the communications network, wherein;

the first endpoint comprises verification data and an initial certificate trust list comprising authentication data for the second endpoint, wherein the initial certificate trust list is authenticated at the first endpoint using a self-authentication process while the first endpoint is coupled to a secure communications network;

the first endpoint authenticates the digital signature with the authentication data for the second endpoint;

the first endpoint verifies a privilege of the second endpoint prior to updating at least one of the initial certificate trust list and the configuration setting at the first endpoint with the received information by determining that the verification data for the second endpoint falls into a particular category, wherein the initial certificate trust list is updated at the first endpoint with the received information only when the particular category indicates the privilege of an administrator, and wherein the configuration setting is updated at the first endpoint with the received information only when the particular category indicates the privilege of a configuration manager; and

after successful authentication and verification, the first endpoint updates at least one of the initial certificate trust list and the configuration setting with the received information to yield at least one of an updated certificate trust list and an updated configuration setting.

8. A system for updating a certificate trust list on a first endpoint, the system comprising:

a communication medium, operable to transmit information to the first endpoint, the information signed with a digital signature of at least one second endpoint and containing updates to the certificate trust list and a configuration setting on a first endpoint; and

the first endpoint comprising;

memory operable to store a certificate trust list and verification data, the certificate trust list comprising authentication data corresponding to the at least one second endpoint; and

logic encoded in a computer readable media, operable to;

authenticate the certificate trust list at the first endpoint using a self-authentication process while the first endpoint is coupled to a secure communications network;

initiate authentication of the digital signature against authentication data for the at least one second endpoint, the authentication occurring only when the digital signature is complementary to the authentication data for the at least one second endpoint,

initiate verification of privilege of the at least one second endpoint at the first endpoint with the received information by determining that the verification data for the at least one second endpoint falls into a particular category, wherein the initial certificate trust list is updated at the first endpoint with the received information only when the particular category indicates the privilege of an administrator, and wherein the configuration setting is updated at the first endpoint with the received information only when the particular category indicates the privilege of a configuration manager; and

after successful authentication and verification, update at least one of the initial certificate trust list and the configuration setting with the received information to yield at least one of an updated certificate trust list and an updated configuration setting.

9. Logic encoded in a non-transitory computer readable media such that when executed is operable to:

digitally sign information with a digital signature of a second endpoint, the information containing updates to a certificate trust list and a configuration setting on a first endpoint; and

transmit the information across a communications network to the first endpoint at a communications device coupled to the first endpoint and coupled to the communications network, wherein;

the first endpoint comprises verification data and an initial certificate trust list comprising authentication data for the second endpoint, wherein the initial certificate trust list is authenticated at the first endpoint using a self-authentication process while the first endpoint is coupled to a secure communications network;

the first endpoint authenticates the digital signature with the authentication data for the second endpoint;

the first endpoint verifies a privilege of the second endpoint prior to updating at least one of the initial certificate trust list and the configuration setting at the first endpoint with the received information by determining that the verification data for the second endpoint falls into a particular category, wherein the initial certificate trust list is updated at the first endpoint with the received information only when the particular category indicates the privilege of an administrator, and wherein the configuration setting is updated at the first endpoint with the received information only when the particular category indicates the privilege of a configuration manager; and

after successful authentication and verification, the first endpoint updates at least one of the initial certificate trust list and the configuration setting with the received information to yield at least one of an updated certificate trust list and an updated configuration setting.

10. An apparatus comprising:

means for digitally signing information with a digital signature of a second endpoint, the information containing updates to a certificate trust list and a configuration setting on a first endpoint; and

means for transmitting the information to the first endpoint wherein;

the first endpoint comprises verification data and an initial certificate trust list comprising authentication data for the second endpoint, wherein the initial certificate trust list is authenticated at the first endpoint using a self-authentication process while the first endpoint is coupled to a secure communications network;

the first endpoint authenticates the digital signature with the authentication data for the second endpoint;

the first endpoint verifies a privilege of the second endpoint prior to updating at least one of the initial certificate trust list and the configuration setting at the first endpoint with the received information by determining that the verification data for the second endpoint falls into a particular category, wherein the initial certificate trust list is updated at the first endpoint with the received information only when the particular category indicates the privilege of an administrator, and wherein the configuration setting is updated at the first endpoint with the received information only when the particular category indicates the privilege of a configuration manager; and

after successful authentication and verification, the first endpoint updates at least one of the initial certificate trust list and the configuration setting with the received information to yield at least one of an updated certificate trust list and an updated configuration setting.

11. Logic encoded in a non-transitory computer readable media such that when executed is operable to:

receive an initial certificate trust list at a first endpoint, the initial certificate trust list comprising authentication data for at least one second endpoint and information to update the certificate trust list and a configuration setting on the first endpoint, wherein the first endpoint comprises a communications device and the initial certificate trust list is authenticated at the first endpoint using a self-authentication process while the first endpoint is coupled to a secure communications network;

receive updates at the first endpoint, the updates signed with a digital signature;

initiate authentication of the digital signature against authentication data for the at least one second endpoint, the authentication occurring only when the digital signature is complementary to the authentication data for the at least one second endpoint;

initiate verification of a privilege of the at least one second endpoint prior to the update of at least one of the initial certificate trust list and the configuration setting at the first endpoint with the received information by determining that verification data for the at least one second endpoint falls into a particular category, wherein the initial certificate trust list is updated at the first endpoint with the received information only when the particular category indicates the privilege of an administrator, and wherein the configuration setting is updated at the first endpoint with the received information only when the particular category indicates the privilege of a configuration manager; and

after successful authentication and verification, update at least one of the initial certificate trust list and the configuration setting with the received updates to yield at least one of an updated certificate trust list and an updated configuration setting.

12. The logic of claim 11, wherein the logic in the update to the initial certificate trust list is further operable to:

add authentication data corresponding to at least a third endpoint in the update to the initial certificate trust list.

13. The logic of claim 11, wherein the logic in the update to the initial certificate trust list is further operable to:

remove authentication data corresponding to the at least one second endpoint in the update to the initial certificate trust list.

14. The logic of claim 11, wherein the logic in the updated to the initial certificate trust list is further operable to:

renew authentication data corresponding to the at least one second endpoint the at least one of the plurality of additional endpoints in the update to the initial certificate trust list.

15. The logic of claim 11, wherein the updated configuration setting comprises an update to firmware.

16. The logic of claim 11, wherein the initial certificate trust list is digitally signed with a private key of an administrator and the self-authentication process comprises authenticating the initial certificate trust list with an administrative public key included in the initial certificate trust list.

17. An apparatus comprising:

means for receiving an initial certificate trust list at a first endpoint, the initial certificate trust list comprising authentication data for at least one second endpoint, wherein the initial certificate trust list is authenticated at the first endpoint using a self-authentication process while the first endpoint is coupled to a secure communications network;

means for receiving information at the first endpoint, the information signed with a digital signature and containing updates to the certificate trust list and a configuration setting;

means for initiating authentication of the digital signature against the authentication data for the at least one second endpoint, the authentication occurring only when the digital signature is complementary to the authentication data for the at least one second endpoint;

means for initiating verification of a privilege of the at least one second endpoint prior to updating at least one of the initial certificate trust list and the configuration setting at the first endpoint with the received information by determining that verification data for the at least one second endpoint falls into a particular category, wherein the initial certificate trust list is updated at the first endpoint with the received information only when the particular category indicates the privilege of an administrator, and wherein the configuration setting is updated at the first endpoint with the received information only when the particular category indicates the privilege of a configuration manager; and

after successful authentication and verification, means for updating at least one of the initial certificate trust list and the configuration setting with the received information to yield at least one of an updated certificate trust list and an updated configuration setting.

18. The apparatus of claim 17, wherein the means for updating the initial certificate trust lists further comprises:

means for adding authentication data corresponding to at least a third endpoint.

19. The apparatus of claim 17, wherein the means for updating the initial certificate trust list further comprises:

means for removing authentication data corresponding to the at least one second endpoint.

20. The apparatus of claim 17, wherein the means for updating the initial certificate trust list further comprises:

means for renewing authentication data corresponding to the at least one second endpoint.

21. The apparatus of claim 17, wherein the updated configuration setting comprises an update to firmware.

22. The apparatus of claim 17, wherein the initial certificate trust list is digitally signed with a private key of an administrator and the self-authentication process comprises authenticating the initial certificate trust list with an administrative public key included in the initial certificate trust list.

23. A method of updating a certificate trust list on a first endpoint, comprising:

receiving an initial certificate trust list at the first endpoint, the initial certificate trust list comprising authentication data for at least one second endpoint and containing information to update the certificate trust list and a configuration setting on the first endpoint, wherein the first endpoint comprises a communications device and the initial certificate trust list is authenticated at the first endpoint using a self-authentication process while the first endpoint is coupled to a secure communications network;

receiving updates at the first endpoint, the updates signed with a digital signature;

initiating authentication of the digital signature against the authentication data for the at least one second endpoint, the authentication occurring only when the digital signature is complementary to the authentication data for the at least one second endpoint;

initiating verification of a privilege of the at least one second endpoint by determining that verification data for the at least one second endpoint falls into a particular category, wherein the initial certificate trust list is updated at the first endpoint with the received information only when the particular category indicates the privilege of an administrator, and wherein the configuration setting is updated at the first endpoint with the received information only when the particular category indicates the privilege of a configuration manager; and

after successful authentication and verification, updating at least one of the initial certificate trust list and the configuration setting with the received updates to yield at least one of an updated certificate trust list and an updated configuration setting, wherein updating the initial certificate trust lists comprises;

adding authentication data corresponding to at least a third endpoint; and

a selected one of removing authentication data corresponding to the at least one second endpoint and renewing authentication data corresponding to the at least one second endpoint.