Mobile certificate distribution in a PKI

• US 8,320,879 B2
• Filed: 10/10/2011
• Issued: 11/27/2012
• Est. Priority Date: 02/06/2001
• Status: Expired due to Term

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Certicom Corporation (Blackberry Limited)
• Inventors: Willey, William Daniel, Blake-Wilson, Simon
• Primary Examiner(s): Nguyen, Lee
• Application Number:
  US13/270,080
• Publication Number:
  US 20120030461A1
• Time in Patent Office: 414 Days
• Field of Search: 455 412- 413, 455410-411, 380/247, 380/270, 713168-172
• US Class Current: 455/410
• CPC Class Codes: H04L 2209/80 Wireless
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/06 Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A method of providing certificate issuance and revocation checks involving mobile devices in a mobile ad-hoc network (MANET). The wireless devices communicate with each other via Bluetooth wireless technology in the MANET, with an access point (AP) to provide connectivity to the Internet. A Certificate authority (CA) distributes certificates and certification revocation lists (CRLs) to the devices via the access point (AP). Each group of devices has the name of the group associated with the certificate and signed by the CA. A device that is out of the radio range of the access point may still connect to the CA to validate a certificate or download the appropriate CRL by having all the devices participate in the MANET.

Claims

1. A method for distributing certificates in a mobile ad hoc network (MANET), the MANET comprising an online client in communication with a certificate authority and a plurality of mobile devices, the method comprising:

the online client sending a request to the certificate authority to provide an indication of whether a key pair of at least one of the plurality of mobile devices is valid; and

after receiving from the certificate authority an indication that the key pair is valid, the online client providing a precomputed response to at least one of the certificate authority and the at least one of the plurality of mobile devices, the precomputed response comprising a validity period of a certificate of the at least one of the plurality of the mobile devices.

2. The method of claim 1 wherein the online client provides the precomputed response to the certificate authority, and the method further comprising the certificate authority providing the certificate and the precomputed response to the at least one of the plurality of mobile devices.

3. The method of claim 1 wherein the MANET is established at periodic predetermined times, and the validity period of the certificate is correlated to the periodic predetermined times.

4. The method of claim 1 further comprising, after receiving the precomputed response, the at least one of the plurality of mobile devices sends an acknowledgement of receipt to the certificate authority.

5. The method of claim 1 wherein the at least one of the plurality of mobile devices has received the certificate from the certificate authority, and after requesting an up-to-date certificate, the at least one of the plurality of mobile devices receives another precomputed response comprising an up-to-date validity period of the certificate.

6. A system for distributing certificates in a mobile ad hoc network (MANET), the system comprising:

an online client in communication with a certificate authority and a plurality of mobile devices;

the online client configured to send a request to the certificate authority to provide an indication of whether a key pair of at least one of the plurality of mobile devices is valid; and

after receiving from the certificate authority an indication that the key pair is valid, the online client configured to provide a precomputed response to at least one of the certificate authority and the at least one of the plurality of mobile devices, the precomputed response comprising a validity period of a certificate of the at least one of the plurality of the mobile devices.

7. The system of claim 6 wherein the online client is configured to provide the precomputed response to the certificate authority, and the certificate authority is configured to provide the certificate and the precomputed response to the at least one of the plurality of mobile devices.

8. The system of claim 6 wherein the MANET is established at periodic predetermined times, and the validity period of the certificate is correlated to the periodic predetermined times.

9. The system of claim 6 further comprising, after receiving the precomputed response, the at least one of the plurality of mobile devices is configured to send an acknowledgement of receipt to the certificate authority.

10. The system of claim 6 wherein the at least one of the plurality of mobile devices is configured to receive the certificate from the certificate authority, and after requesting an up-to-date certificate, the at least one of the plurality of mobile devices is configured to receive another precomputed response comprising an up-to-date validity period of the certificate.

11. A method of a mobile device determining if another mobile device is a member of an ad hoc group, the method comprising:

the mobile device receiving a certificate from a certificate authority in a mobile ad hoc network (MANET), the certificate including a name of the ad hoc group;

the mobile device obtaining another certificate from the other mobile device;

the mobile device determining if the other certificate has expired; and

if the other certificate has not expired, and if the other certificate comprises the name of the ad hoc group, the mobile device using the other certificate to validate the other mobile device and to confirm that the other mobile device is a member of the ad hoc group.

12. The method of claim 11, wherein after confirming that the mobile device and the other mobile device are members of the ad hoc group, and if the other mobile device is not in communication with the certificate authority for a predetermined time, the method further comprising:

the mobile device receiving a new certificate from the certificate authority;

the mobile device sending the new certificate to the other mobile device.

13. The method of claim 11, wherein after confirming that the mobile device and the other mobile device are members of the ad hoc group, the method further comprising the mobile device storing a record of at least one encounter with the other mobile device.

14. The method of claim 13 further comprising:

the mobile device providing the record to the certificate authority; and

the mobile device receiving a pre-determined time from the certificate authority of when to attempt to establish the MANET, the pre-determined time determined dynamically based upon the record.

15. A mobile device capable of communicating with another mobile device, the mobile device comprising a non-volatile memory and a processor for determining if another mobile device is a member of an ad hoc group, the processor configured to:

receive a certificate from a certificate authority in a mobile ad hoc network (MANET), the certificate including a name of the ad hoc group;

obtain another certificate from the other mobile device;

determine if the other certificate has expired; and

if the other certificate has not expired, and if the other certificate comprises the name of the ad hoc group, the processor further configured to use the other certificate to validate the other mobile device and to confirm that the other mobile device is a member of the ad hoc group.

16. The mobile device of claim 15, wherein after confirming that the mobile device and the other mobile device are members of the ad hoc group, and if the other mobile device is not in communication with the certificate authority for a predetermined time, the processor further configured to:

receive a new certificate from the certificate authority;

send the new certificate to the other mobile device.

17. The mobile device of claim 15, wherein after confirming that the mobile device and the other mobile device are members of the ad hoc group, the processor further configured to store a record of at least one encounter with the other mobile device in the non-volatile memory.

18. The mobile device of claim 17 wherein the processor is further configured to:

provide the record to the certificate authority; and

receive a pre-determined time from the certificate authority of when to attempt to establish the MANET, the pre-determined time determined dynamically based upon the record.