Personal certification authority device

• US 7,386,726 B2
• Filed: 05/31/2002
• Issued: 06/10/2008
• Est. Priority Date: 11/02/2001
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Smeets, Bernard, Haartsen, Jacobus, Gehrmann, Christian, Persson, Joakim
• Primary Examiner(s): Moazzami; Nasser
• Assistant Examiner(s): YALEW, FIKREMARIAM A
• Application Number:
  US10/161,567
• Publication Number:
  US 20030088772A1
• Time in Patent Office: 2,202 Days
• Field of Search: 713/175, 713/155, 380277-285
• US Class Current: 713/175
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A method for public key certification in a local network environment, wherein a personal certification authority associated with the local network environment is connected with a first device needing to be certified. Responsive to the connection, a certificate is provided to the device to be certified from the personal certification authority. The devices receiving a certificate may then use the certificate to carry out secure information exchange within the local network environment with other devices having a similar certificate.

Claims

1. A method for public key certification in a local network environment adapted to network a plurality of devices, comprising the steps of:

establishing a public key infrastructure (PKI) in any one of a plurality of devices, said any device being deemed a personal certification authority device, the personal certification authority device adapted to internally generate a private/public keypair at the moment the device becomes the personal certification authority device;

connecting the personal certification authority device associated only with the local network environment with any other of the plurality of devices, such devices being a first device to be certified; and

providing a certificate to the first device to be certified from the personal certification device upon request from such first device said certificate enabling secure connection establishment with the local network environment, wherein each of the plurality of devices adapted to be included in the local network environment are capable of internally generating and providing to other devices within such local network environment, certificates to said other devices upon request and wherein the providing step further comprises receiving an identifier of the first device to be certified and a public key at the personal certification authority device;

confirming the first device to be certified has a private key corresponding to the received public key; and

issuing the certificate from the personal certification authority device associated only with the local network environment to the first device to be certified.

2. The method of claim 1, further including the steps of:

connecting at least, one other device to be certified with the personal certification authority device associated with the local network environment; and

providing a second certificate to the at least one other device to be certified by the personal certification authority device associated with the local network environment, upon request from such second device said second certificate enabling secure connection establishment with the local network environment.

3. The method of claim 1, wherein the local network environment comprises a personal area network.

4. The method of claim 1, further including the steps of:

receiving a second public key from the personal certification authority device at the first device; and

confirming the personal certification authority device has a second private key corresponding to the received second public key.

5. The method of claim 1, further including the step of storing data associated with the first device to be certified responsive to providing the certificate.

6. The method of claim 1, further including the step of storing a user ID of the first device.

7. The method of claim 1, further including the step of storing the certificate provided to the first device.

8. The method of claim 1 further including the step of authenticating the connection between the first device and the personal certification authority device.

9. The method of claim 1, further including the step of storing the certificate at the first device.

10. The method of claim 1, wherein the certificate further includes at least one of the public key, the identifier of the first device, a digital signature of the personal certification authority device, and a public root key of the personal certification authority device.

11. A method for public key certification in a personal network environment adapted to network a plurality of devices, comprising the steps of:

establishing a public key infrastructure (PKI) in any one of a plurality of devices, said any device being deemed a personal certification authority device, the personal certification authority device adapted to internally generate a private/public keypair at the moment the device becomes the personal certification authority device;

connecting the personal certification authority device associated only with the personal network with any other of the plurality of devices, such device being a first device to be certified;

receiving an identifier of the first device to be certified and a public key at the personal certification authority device;

confirming the first device to be certified has a private key corresponding to the received public key;

receiving a second public key from the personal certification authority device at the first device;

confirming the personal certification authority device has a second private key corresponding to the received second public key;

issuing a certificate from the personal certification authority device associated only with the personal network to the first device to be certified, upon request from such first device, said certificate enabling secure connection establishment with the personal network; and

storing data associated with the first device to be certified responsive to providing the certificate at the personal certification authority device, wherein each of the plurality of devices adapted to be included in the local network environment are capable of internally generating and providing to other devices within the local network environment, certificates to said other devices upon request.

12. The method of claim 11, further including the steps of:

connecting at least one other device to be certified with the personal certification authority device associated with the local network environment; and

providing a second certificate to the at least one other device to be certified with the personal certification device associated with the local network environment, upon request from such other device said second certificate enabling secure connection establishment with the personal network.

13. The method of claim 11, further comprising the step of connecting a personal certification authority device associated only with a personal area network.

14. The method of claim 11, further comprising storing a user ID of the first device associated with the first device to be certified responsive to providing the certificate at the personal certification authority device.

15. The method of claim 11, further comprising storing the certificate provided to the first device.

16. The method of claim 11, further including the step of mutually authenticating the connection between the first device and the personal certification authority.

17. The method of claim 11, further including the step of storing the certificate at the first device.

18. The method of claim 11, further including the step of storing a certificate authority root key at the first device.

19. The method of claim 11, wherein the certificate further includes at least one of the public key, the identifier of the first device, a digital signature of the personal certification authority device, and a public root key of the personal certification authority device.

20. A personal communications device having a public key infrastructure (PKI) for performing as a personal certification device for a first device, comprising:

a means within the personal communications device adapted to internally generate a private/public keypair;

an interface for establishing a local connection in a personal network environment adapted to network a plurality of devices, with the first device to be certified;

control logic adapted to connect the personal communications device with a first device to be certified and provide a certificate to the first device to be certified upon request of such first device, to enable secure data exchange within a personal network , wherein the control logic is further adapted to;

receive an identifier of the first device to be certified and a public key at the personal communications device;

confirm the first device to be certified has a private key corresponding to the received public key; and

issue the certificate and a certificate authority root key to the first device to be certified; and

a memory for storing data relating to the certificate provided to the first device to be certified.

21. The device of claim 20, in combination with a personal network, wherein the personal network comprises a personal area network.

22. The device of claim 20, wherein the data comprises a user ID of the first device.

23. The device of claim 20, wherein the data comprises the certificate provided to the first device.

24. The device of claim 20, wherein the control logic is further adapted to mutually authenticate the connection between the first device and the personal certification device.

25. The device of claim 20, wherein the certificate further includes at least one of the public key, the identifier of the first device, a digital signature of the personal certification device, and a public root key of the personal certification device.

26. A personal network, comprising:

a plurality of personal communications devices, and

a personal certification authority device being any one of the plurality of personal communications devices, said personal certification authority having a public key infrastructure (PKI) which internally generates a private/public keypair and issue, upon request, a certificate to a first personal communications device being any one of the other of the plurality of personal communications devices said certificate enabling the first personal communications device and any other personal communication device having a certificate to perform secure information exchanges locally in the personal network, wherein each of the plurality of personal communications devices adapted to be included in the personal network are capable of internally generating and providing to other personal communication devices within such personal environment, certificates to said other personal communication devices upon request, wherein the personal certification authority device further receives an identifier of the first personal communication device and a public key at the personal certification authority device;

confirms the first personal communications device has a private key corresponding to the received public key; and

issues the certificate from the personal certification authority device to the first personal communications device.

27. The personal network of claim 26, wherein the personal certification authority device stores data associated with the first personal communications device responsive to issuing the certificate.

28. The personal network of claim 27, wherein the data comprises a user ID of the first personal communications device.

29. The personal network of claim 27, wherein the data comprises the certificate provided to the first personal communications device.

30. The personal network of claim 26, wherein the personal certification authority device authenticates the connection between the first personal communications device and the personal certification authority device.

31. The personal network of claim 26, wherein the first personal communications device stores the certificate at the first personal communications device.

32. The personal network of claim 26, wherein the certificate further includes at least one of the public key, the identifier of the first device, a digital signature of the personal certification device, and a public root key of the personal certification device.

33. The personal network of claim 26, wherein the personal network comprises a personal area network.

34. The personal network of claim 26, wherein the personal network comprises a Bluetooth network.

35. The personal network of claim 26, wherein the personal network comprises a Bluetooth high rate network.

36. The personal network of claim 26, wherein the personal network comprises an IEEE 802.11 network.