System and method for provisioning device certificates

• US 8,943,323 B2
• Filed: 05/01/2012
• Issued: 01/27/2015
• Est. Priority Date: 07/20/2006
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Brown, Michael K., Brown, Michael S., Kirkup, Michael
• Primary Examiner(s): Pwu, Jeffrey
• Assistant Examiner(s): JHAVERI, JAYESH M
• Application Number:
  US13/461,319
• Publication Number:
  US 20120216042A1
• Time in Patent Office: 1,001 Days
• Field of Search: 713155-158, 713/173, 713/175, 380/282, 705/65
• US Class Current: 713/175
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/72 Subscriber identity
• CPC Class Codes: H04W 88/02 Terminal devices

Abstract

A method is provided for provisioning a device certificate. A device certificate request is transmitted from a communication device to a server in a communication network using an established communications channel between the communication device and the server. The device certificate request comprises at least a user identifier and a device identifier. The server provides to the communication device a device certificate that includes the user identifier and the device identifier and that is signed by a private key of a certificate authority.

Claims

1. A method at a communication device for provisioning a device certificate, the method comprising:

transmitting a device certificate request to a server in a communication network using an established communications channel between the communication device and the server, wherein the device certificate request comprises at least a user identifier and a device identifier; and

responsive to transmitting the device certificate request, receiving a device certificate that comprises a signed version of the device certificate request that is signed by a private key of a certification authority, the device certificate binding together the user identifier and the device identifier.

2. The method as recited in claim 1, further comprising:

enabling user input of the user identifier at the communication device.

3. The method as recited in claim 1, wherein the device certificate request is transmitted to the server in a communication that is encrypted with a master communication key established between the server and the communication device.

4. The method as recited in claim 3, wherein the device certificate is received from the server in a communication that is encrypted with the master communication key.

5. The method as recited in claim 1, wherein the server acts as the certification authority.

6. The method as recited in claim 1, wherein the certification authority is a third party certification authority.

7. The method as recited in claim 1, wherein the user identifier is associated with a person and comprises one or more of the following:

a number assigned by a government agency to the person, an identification of an employer of the person, a name or address or both of the person, a telephone number of the person.

8. The method as recited in claim 1, wherein the device identifier comprises one or more of the following:

a device personal identification number, a device serial number, and a device International Mobile Subscriber Identity (IMSI).

9. A method at a server in a communication network, the method comprising:

receiving a device certificate request from a communication device over an established communications channel between the communication device and the server, wherein the device certificate request comprises at least a user identifier and a device identifier; and

responsive to receiving the device certificate request, providing to the communication device a device certificate that comprises a signed version of the device certificate request that is signed by a private key of a certification authority, the device certificate binding together the user identifier and the device identifier.

10. The method as recited in claim 9, wherein the device certificate request is received by the server in a communication that is encrypted with a master communication key established between the server and the communication device.

11. The method as recited in claim 10, wherein the device certificate is provided to the communication device by the server in a communication that is encrypted with the master communication key.

12. The method as recited in claim 9, wherein the server acts as the certification authority.

13. The method as recited in claim 9, wherein the certification authority is a third party certification authority.

14. The method as recited in claim 9, wherein the user identifier is associated with a person and comprises one or more of the following:

a number assigned by a government agency to the person, an identification of an employer of the person, a name or address or both of the person, a telephone number of the person.

15. The method as recited in claim 9, wherein the device identifier comprises one or more of the following:

a device personal identification number, a device serial number, and a device International Mobile Subscriber Identity (IMSI).

16. A communication device configured:

to establish a master communication key with a server in a communication network for encryption and decryption of communication with the server;

to transmit a device certificate request to a server in a communication network using an established communications channel between the communication device and the server, wherein the device certificate request comprises at least a user identifier and a device identifier; and

responsive to transmitting the device certificate request, to receive a device certificate that comprises a signed version of the device certificate request that is signed by a private key of a certification authority, the device certificate binding together the user identifier and the device identifier.

17. The communication device as recited in claim 16, further configured to:

enable user input of the user identifier at the communication device.

18. The communication device as recited in claim 16, wherein the device certificate request is transmitted to the server in a communication that is encrypted with a master communication key established between the server and the communication device.

19. The communication device as recited in claim 18, wherein the device certificate is received from the server in a communication that is encrypted with the master communication key.

20. The communication device as recited in claim 16, wherein the server acts as the certification authority.

21. The communication device as recited in claim 16, wherein the certification authority is a third party certification authority.

22. The communication device as recited in claim 16, wherein the user identifier is associated with a person and comprises one or more of the following:

a number assigned by a government agency to the person, an identification of an employer of the person, a name or address or both of the person, a telephone number of the person.

23. The communication device as recited in claim 16, wherein the device identifier comprises one or more of the following:

a device personal identification number, a device serial number, and a device International Mobile Subscriber Identity (IMSI).

24. A server comprising:

a processor; and

a communication interface coupled to the processor;

wherein the server is configured;

to receive, via the communication interface, a device certificate request from a communication device over an established communications channel between the communication device and the server, wherein the device certificate request comprises at least a user identifier and a device identifier; and

responsive to receiving the device certificate request, to provide, via the communication interface, to the communication device a device certificate that comprises a signed version of the device certificate request that is signed by a private key of a certification authority, the device certificate binding together the user identifier and the device identifier.

25. The server as recited in claim 24, wherein the device certificate request is received, via the communication interface, by the server in a communication that is encrypted with a master communication key established between the server and the communication device.

26. The server as recited in claim 25, wherein the device certificate is provided, via the communication interface, to the communication device by the server in a communication that is encrypted with the master communication key.

27. The server as recited in claim 24, wherein the server acts as the certification authority.

28. The server as recited in claim 24, wherein the certification authority is a third party certification authority.

29. The server as recited in claim 24, wherein the user identifier is associated with a person and comprises one or more of the following:

a number assigned by a government agency to the person, an identification of an employer of the person, a name or address or both of the person, a telephone number of the person.

30. The server as recited in claim 24, wherein the device identifier comprises one or more of the following:

a device personal identification number, a device serial number, and a device International Mobile Subscriber Identity (IMSI).

31. A non-transitory computer-readable medium having stored thereon executable instructions which, when executed by a processor of a communication device, cause the communication device to:

transmit a device certificate request to a server in a communication network using an established communications channel between the communication device and the server, wherein the device certificate request comprises at least a user identifier and a device identifier; and

responsive to transmitting the device certificate request, receive a device certificate that comprises a signed version of the device certificate request that is signed by a private key of a certification authority, the device certificate binding together the user identifier and the device identifier.

32. The non-transitory computer-readable medium as recited in claim 31, wherein the device certificate request is transmitted to the server in a communication that is encrypted with a master communication key established between the server and the communication device.

33. The non-transitory computer-readable medium as recited in claim 32, wherein the device certificate is received from the server in a communication that is encrypted with the master communication key.

34. The non-transitory computer-readable medium as recited in claim 31, wherein the user identifier is associated with a person and comprises one or more of the following:

a number assigned by a government agency to the person, an identification of an employer of the person, a name or address or both of the person, a telephone number of the person.

35. The non-transitory computer-readable medium as recited in claim 31, wherein the device identifier comprises one or more of the following:

a device personal identification number, a device serial number, and a device International Mobile Subscriber Identity (IMSI).

36. A non-transitory computer-readable medium having stored thereon executable instructions which, when executed by a processor of a server in a communication network, cause the server to:

receive a device certificate request from a communication device over an established communications channel between the communication device and the server, wherein the device certificate request comprises at least a user identifier and a device identifier; and

responsive to receiving the device certificate request, provide to the communication device a device certificate that comprises a signed version of the device certificate request that is signed by a private key of a certification authority, the device certificate binding together the user identifier and the device identifier.

37. The non-transitory computer-readable medium as recited in claim 36, wherein the device certificate request is received by the server in a communication that is encrypted with a master communication key established between the server and the communication device.

38. The non-transitory computer-readable medium as recited in claim 37, wherein the device certificate is provided to the communication device by the server in a communication that is encrypted with the master communication key.

39. The non-transitory computer-readable medium as recited in claim 36, wherein the user identifier is associated with a person and comprises one or more of the following:

a number assigned by a government agency to the person, an identification of an employer of the person, a name or address or both of the person, a telephone number of the person.

40. The non-transitory computer-readable medium as recited in claim 36, wherein the device identifier comprises one or more of the following:

a device personal identification number, a device serial number, and a device International Mobile Subscriber Identity (IMSI).