Ticket-based configuration parameters validation

• US 8,548,467 B2
• Filed: 09/12/2008
• Issued: 10/01/2013
• Est. Priority Date: 09/12/2008
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Vanderveen, Michaela, Tsirtsis, George, Park, Vincent D., Corson, M. Scott
• Primary Examiner(s): MATHARU, MANPREET S
• Application Number:
  US12/209,440
• Publication Number:
  US 20100069067A1
• Time in Patent Office: 1,845 Days
• Field of Search: 455/435.1, 455/410, 713/151, 713/156, 713/171, 370/313, 370/400, 370/410, 370/353, 709/203, 709/204, 709/229, 709/231
• US Class Current: 455/435.1
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 28/18 Negotiating wireless communication parameters
• CPC Class Codes: H04W 74/00 Wireless channel access
• CPC Class Codes: H04W 76/14 Direct-mode setup
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks
• CPC Class Codes: H04W 92/18 between terminal devices

Abstract

Aspects describe spectrum authorization, access control, and configuration parameters validation. Devices in an ad-hoc or peer-to-peer configuration can utilize a licensed spectrum if the devices are authorized to use the spectrum, which can be determined automatically. Aspects relate to distribution of authorization tickets by an authorization server as a result of validating a device'"'"'s credentials and services to which the device is entitled. An exchange and verification of authorization tickets can be performed by devices as a condition for enabling a validated wireless link using the spectrum.

Claims

1. A method for validation of ticket-based configuration parameters, comprising:

obtaining, in a first peer device, an authorization ticket from a second peer device, the authorization ticket including one or more validated information elements associated with the second peer device, the one or more validated information elements including at least one of a broadcastable expression of the second peer device, an Internet Protocol address assigned to the second peer device, or a type of services allowed to the second peer device for a communication link between the first peer device and the second peer device, wherein the authorization ticket includes the type of services allowed to the second peer device for the communication link between the first peer device and the second peer device;

validating the authorization ticket;

utilizing the authorization ticket to establish a validated peer-to-peer communication with the second peer device based on the type of services allowed to the second peer device for the communication link between the first peer device and the second peer device; and

using a subset of the one or more validated information elements to perform a configuration operation.

2. The method of claim 1, wherein at least one of the validated information elements includes the Internet Protocol address.

3. The method of claim 1, wherein the configuration operation comprises configuring an interface.

4. The method of claim 1, wherein the configuration operation comprises adding a route.

5. The method of claim 1, wherein the validated communication is broadcast or multicast.

6. The method of claim 1, wherein the authorization ticket includes an identifier of the first peer device or second peer device, a validity range, and a signature of a trusted party that issued the authorization ticket.

7. A wireless communications apparatus, comprising:

a memory that retains instructions related to obtaining, in a first peer device, an authorization ticket from a second peer device, the authorization ticket including one or more validated information elements associated with the second peer device, the one or more validated information elements including at least one of a broadcastable expression of the second peer device, an Internet Protocol address assigned to the second peer device, or a type of services allowed to the second peer device for a communication link between the first peer device and the second peer device, wherein the authorization ticket includes the type of services allowed to the second peer device for the communication link between the first peer device and the second peer device;

validating the authorization ticket;

utilizing the authorization ticket to establish a validated peer-to-peer communication with the second peer device based on the type of services allowed to the second peer device for the communication link between the first peer device and the second peer device; and

using a subset of the one or more validated information elements to perform a configuration operation; and

a processor, coupled to the memory, configured to execute the instructions retained in the memory.

8. The wireless communications apparatus of claim 7, wherein the authorization ticket includes an identifier of the first peer device or second peer device, a validity range, and a signature of a trusted party that issued the authorization ticket.

9. The wireless communications apparatus of claim 7, wherein the configuration operation comprises at least one of configuring an interface or adding a route.

10. The wireless communications apparatus of claim 7, wherein the validated communication is broadcast or multicast.

11. A wireless communications apparatus that validates ticket-based configuration parameters, comprising:

means for acquiring, in a first peer device, an authorization ticket from a second peer device, the authorization ticket including one or more validated information elements associated with the second peer device, the one or more validated information elements including at least one of a broadcastable expression of the second peer device, an Internet Protocol address assigned to the second peer device, or a type of services allowed to the second peer device for a communication link between the first peer device and the second peer device, wherein the authorization ticket includes the type of services allowed to the second peer device for the communication link between the first peer device and the second peer device;

means for validating the authorization ticket;

means for establishing a validated peer-to-peer communication with the second peer device based in part on the authorization ticket based on the type of services allowed to the second peer device for the communication link between the first peer device and the second peer device; and

means for performing a configuration operation with a subset of the one or more validated information elements.

12. The wireless communications apparatus of claim 11, wherein the means for acquiring the authorization ticket requests the authorization ticket from a nearby device.

13. The wireless communications apparatus of claim 11, wherein the authorization ticket includes an identifier of the first peer device or second peer device, a validity range, and a signature of a trusted party that issued the authorization ticket.

14. The wireless communications apparatus of claim 11, wherein the validated communication with the device is an ad-hoc configuration.

15. A computer program product, comprising:

a non-transitory computer-readable medium comprising;

a first set of codes for causing a computer to obtain, in a first peer device, an authorization ticket from a second peer device, the authorization ticket including one or more validated information elements associated with the second peer device, the one or more validated information elements including at least one of a broadcastable expression of the second peer device, an Internet Protocol address assigned to the second peer device, or a type of services allowed to the second peer device for a communication link between the first peer device and the second peer device, wherein the authorization ticket includes the type of services allowed to the second peer device for the communication link between the first peer device and the second peer device;

a second set of codes for causing the computer to validate the authorization ticket;

a third set of codes for causing the computer to utilize the authorization ticket to establish a validated peer-to-peer communication with the second peer device based on the type of services allowed to the second peer device for the communication link between the first peer device and the second peer device; and

a fourth set of codes for causing the computer to use a subset of the one or more validated information elements to perform a configuration operation.

16. The computer program product of claim 15, wherein the authorization ticket includes an identifier of the first peer device or second peer device, a validity range, and a signature of a trusted party that issued the authorization ticket.

17. At least one processor configured to provide spectrum authorization and access control, comprising:

a first module for acquiring, in a first peer device, an authorization ticket from a second peer device, the authorization ticket including one or more validated information elements associated with the second peer device, the one or more validated information elements including at least one of a broadcastable expression of the second peer device, an Internet Protocol address assigned to the second peer device, or a type of services allowed to the second peer device for a communication link between the first peer device and the second peer device, wherein the authorization ticket includes the type of services allowed to the second peer device for the communication link between the first peer device and the second peer device;

a second module for validating the authorization ticket;

a third module for employing the authorization ticket to establish a validated peer-to-peer communication with the second peer device based on the type of services allowed to the second peer device for the communication link between the first peer device and the second peer device; and

a fourth module for utilizing a subset of the one or more validated information elements to perform a configuration operation.

18. The at least one processor of claim 17, wherein the authorization ticket includes an identifier of the first peer device or second peer device, a validity range, and a signature of a trusted party that issued the authorization ticket.