On-line signup server for provisioning of certificate credentials to wireless devices

• US 9,992,671 B2
• Filed: 04/24/2017
• Issued: 06/05/2018
• Est. Priority Date: 12/27/2012
• Status: Active Grant

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Gupta, Vivek G., Canpolat, Necati
• Primary Examiner(s): Taha, Shaq
• Application Number:
  US15/495,404
• Publication Number:
  US 20170230823A1
• Time in Patent Office: 407 Days
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 9/0643 Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
• CPC Class Codes: H04L 9/0847 involving identity based encryption [IBE] schemes
• CPC Class Codes: H04L 9/3239 involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/73 Access point logical identity
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

Embodiments of a mobile device and method for secure online sign-up and provisioning of credentials for Wi-Fi hotspots are generally described herein. In some embodiments, provisioning occurs using a service set identifier (SSID) to associate with a hotspot and retrieve a virtual LAN (VLAN) identifier. The VLAN identifier is used to complete the signup and provisioning process. In some embodiments, a hotspot may implement a primary SSID and a dependent SSID. The mobile device associates with the hotspot using the dependent SSID to perform the secure online signup and provisioning process. Once credentials are obtained using the signup and provisioning process, the device can connect to the hotspot using the primary SSID and the already provisioned credentials. The provisioned credentials may include certificates, username/password, or SIM-type credentials.

Claims

1. A non-transitory computer-readable storage medium that stores instructions for execution by one or more processors to perform operations for operating an online signup (OSU) server in a wireless network, the operations to configure the OSU to:

receive a request from a device in the wireless network to initiate an Extensible Authentication Protocol Transport Layer Security (EAP-TLS) connection;

perform a certificate enrollment on behalf of the device to enroll a credential; and

provide, subsequent to the certificate enrollment, a device management (DM) package 4 message including a management object that includes subscription parameters, wherein the subscription parameters include a parameter to indicate the date on which the credential was created or last updated, and a parameter to indicate a realm associated with the credential.

2. The non-transitory computer-readable storage medium of claim 1, wherein the subscription parameters include the date that the credential expires.

3. The non-transitory computer-readable storage medium of claim wherein the subscription parameters include a digital certificate type for the credential, and wherein the digital certificate type includes a value selected from a list including “

802.1ar” and

“

x509v3”

.

4. An apparatus including one or more processors, the one or more processors having logic to:

receive a request from a requesting apparatus to initiate an Extensible Authentication Protocol Transport Layer Security (EAP-TLS) connection;

perform a certificate enrollment on behalf of the requesting apparatus to enroll a credential; and

provide, subsequent to the certificate-enrollment, a device management (DM) package 4 message including a management object that includes subscription parameters, wherein the subscription parameters include a parameter to indicate the date on which the credential was created or last updated, and a parameter to indicate a realm associated with the credential.

5. The apparatus of claim 4, wherein the subscription parameters include the date that the credential expires.

6. The apparatus of claim 5, wherein the subscription parameters include a digital certificate type for the credential, and wherein the digital certificate type includes a value selected from a list including “

802.1ar” and

“

x509v3”

.

7. The apparatus of claim 5, wherein the apparatus further includes:

a memory.

8. A method performed by an online signup (OSU) server in a wireless communication network, the method comprising:

receiving a request from a device in the wireless communication network to initiate an Extensible Authentication Protocol Transport Layer Security (EAP-TLS) connection;

performing a certificate enrollment with the device to enroll a credential; and

providing, subsequent to the certificate-enrollment, a device management (DM) package 4 message including a management object that includes subscription parameters, wherein the subscription parameters include a parameter to indicate the date on which the credential was created or last updated, and a parameter to indicate a realm associated with the credential.

9. The method of claim 8, wherein the subscription parameters include the date that the credential expires.

10. The method of claim 9, wherein the subscription parameters include a digital certificate type for the credential, and wherein the digital certificate type includes a value selected from a list including “

802.1ar” and

“

x509v3”

.