Method for implementing secure corporate communication

• US 7,448,080 B2
• Filed: 06/30/2003
• Issued: 11/04/2008
• Est. Priority Date: 06/30/2003
• Status: Expired due to Fees

• Current Assignee: WSOU Investments, LLC (WSOU Holdings, LLC)
• Original Assignee: Nokia, Inc. (Nokia Corporation)
• Inventors: Karjala, Jari, Palojärvi, Jari
• Primary Examiner(s): NGUYEN, MINH DIEU T
• Application Number:
  US10/609,011
• Publication Number:
  US 20040268148A1
• Time in Patent Office: 1,954 Days
• Field of Search: 726/3, 726 11- 12, 726 14- 15, 713/156, 713/162, 709/220, 709/223, 370/351, 379/901, 455/410, 455/411
• US Class Current: 726/15
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/082 the condition being updates or upgrades of network functionality
• CPC Class Codes: H04L 41/0856 by backing up or archiving configuration information
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 Policy-based network configuration management
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: Y10S 379/901 Virtual networks or virtual private networks

Abstract

A mobile or other device connects to a server via a publicly accessible network such as the Internet. After installation upon the device, a virtual private network (VPN) client connects to the server and downloads a VPN profile. In one embodiment the device creates public/private key pairs and requests enrollment of a digital certificate. In another embodiment a digital certificate and public/private key pairs are provided. The device also receives a digital certificate from the server and verifies the server certificate by requesting the user to supply a portion of a fingerprint for the certificate. The invention further includes an automatic content updating (ACU) client that downloads a user profile for the VPN, requests certificate enrollment, and updates the VPN client and other applications when new content is available. A security service manager (SSM) server includes, or is in communication with, a Web server, multiple databases, an enrollment gateway and an internal certification authority (CA). A VPN policy manager application creates and manages VPN profiles and/or policies and communicates with the SSM server. The SSM server, which may reside on an enterprise intranet, may further communicate with one or more external CAs.

Claims

1. A method comprising:

(a) initiating a connection via a publicly accessible network from a wireless device, wherein

the wireless device includes an unprovisioned virtual private network (VPN) program and an unprovisioned automatic content updating (ACU) program, and

the ACU program is configured, upon provisioning, to communicate with one or more remotely-located devices on behalf of at least one additional program that is distinct from the ACU and VPN programs;

(b) prior to step (c), validating and storing a returned certificate corresponding to one of the one or more remotely-located devices so as to create a trust relationship with that remotely-located device, wherein said validating and storing includes requiring input of multiple characters from a user of the wireless devices, wherein the multiple characters are a portion of an identifier for the certificate corresponding to one of the one or more remotely-located devices;

(c) receiving, in the wireless device and using the connection, information for provisioning the ACU program;

(d) provisioning the ACU program based upon the information received in step (c);

(e) receiving in the wireless device, via the publicly accessible network and using the provisioned ACU program, information for provisioning the VPN program;

(f) provisioning the VPN program based upon the information received in step (e); and

(g) creating a secure communication link using the provisioned VPN program.

2. The method of claim 1, wherein the information received in step (c) comprises an ACU certificate corresponding to the wireless device and the information received in step (e) comprises a VPN certificate corresponding to the wireless device.

3. The method of claim 1, further comprising:

(h) determining whether an update to the VPN program is available;

(i) receiving the update; and

(j) implementing the update.

4. The method of claim 1, further comprising:

(h) sending, prior to step (e), a certificate enrollment request for forwarding to an external certification authority (CA).

5. The method of claim 1, further comprising:

(h) determining whether an update is available for the at least one additional program; and

(i) receiving an update for the at least one additional program.

6. The method of claim 1, further comprising:

(h) fetching, from one of the one or more remotely-located devices, content or content metadata applicable to the at least one additional program; and

(i) storing, by the at least one additional program, the fetched content or content metadata.

7. The method of claim 1, wherein the ACU program communicates using a SyncML protocol.

8. The method of claim 1, further comprising:

(h) storing, in a configuration record for the VPN program, an Internet Access Point (IAP) to be used when communicating with one of the one or more remotely-located devices on behalf of the VPN program.

9. The method of claim 1, wherein the ACU program communicates using a simple request-response protocol, and wherein a protocol transaction consists of a single request-response pair.

10. The method of claim 1, further comprising:

(h) fetching, from one of the one or more remotely-located devices, content metadata applicable to the at least one additional program;

(i) comparing fetched metadata to locally stored metadata; and

(j) fetching new or updated content from the one of the one or more remotely-located devices based upon the comparison.

11. The method of claim 10, wherein the ACU program includes in fetch requests in steps (h) and (j) content identifications (IDs) required by the one of the one or more remotely-located devices.

12. The method of claim 1, further comprising:

(h) fetching, from multiple databases in one of the one or more remotely-located devices, metadata about multiple types of content.

13. The method of claim 1, wherein the ACU program transmits requests containing properties used by one of the one or more remotely-located devices to filter requests.

14. The method of claim 1, wherein messages generated by the ACU program and communicated to one of the one or more remotely-located devices include a message identifier, a target database identifier, and a security level.

15. The method of claim 14, wherein a first security level is required to receive configuration information for the VPN program and a second security level is required to receive another type of information.

16. The method of claim 14, wherein at least one message generated by the ACU program includes an element indicating that the at least one message is a last message relating to a specific task.

17. The method of claim 14, wherein the ACU program requests configuration information in a single message.

18. The method of claim 1, further comprising:

(h) using the certificate stored in step (b) to validate subsequent responses from that remotely-located device.

19. The method of claim 18, wherein:

the certificate corresponding to the one of the one or more remotely-located devices is validated based on a hash calculated over an entire ACU message, except for a signature element of that ACU message,

the hash is signed with a private key held by the one of the one or more remotely-located devices, and

the certificate corresponding to the one of the one or more remotely-located devices is included in a first response from the one of the one or more remotely-located devices and is used by the wireless device to verify the signature and identify and authenticate a sender.

20. An apparatus comprising:

a transceiver configured to provide a wireless interface to a publicly accessible network; and

a processor configured to perform steps that include

(a) initiating a connection via the publicly accessible network, wherein

the apparatus includes an unprovisioned virtual private network (VPN) program and an unprovisioned automatic content updating (ACU) program, and

the ACU program is configured, upon provisioning, to communicate with one or more remotely-located devices on behalf of at least one additional program that is distinct from the ACU and VPN programs,

(b) prior to step (c), validating and storing a returned certificate corresponding to one of the one or more remotely-located devices so as to create a trust relationship with that remotely-located device, wherein said validating and storing includes requiring input of multiple characters from a user of the wireless devices, wherein the multiple characters are a portion of an identifier for the certificate corresponding to one of the one or more remotely-located devices;

(c) receiving, using the connection, information for provisioning the ACU program,

(d) provisioning the ACU program based upon the information received in step (c),

(e) receiving, via the publicly accessible network and using the provisioned ACU program, information for provisioning the VPN program,

(f) provisioning the VPN program based upon the information received in step (e), and

(g) creating a secure communication link using the provisioned VPN program.

21. The apparatus of claim 20, wherein the information received in step (c) comprises an ACU certificate corresponding to the apparatus and information received in step (e) comprises a VPN certificate corresponding to the apparatus.

22. The apparatus of claim 20, wherein the processor is further configured to perform steps that include

(h) determining whether an update to the VPN program is available,

(i) receiving the update, and

(j) implementing the update.

23. The apparatus of claim 20, wherein the processor is further configured to perform steps that include

(h) sending, prior to step (c), a certificate enrollment request for forwarding to an external certification authority (CA).

24. The apparatus of claim 20, wherein the processor is further configured to perform steps that include

(h) determining whether an update is available for the at least one additional program, and

(j) receiving an update for the at least one additional program.

25. The apparatus of claim 20, wherein the processor is further configured to perform steps that include

(h) fetching, from one of the one or more remotely-located devices, content or content metadata applicable to the at least one additional program, and

(i) storing, by the at least one additional program, the fetched content or content metadata.

26. The apparatus of claim 20, wherein the ACU program communicates using a SyncML protocol.

27. The apparatus of claim 20, wherein the processor is further configured to perform steps that include

(h) storing, in a configuration record for the VPN program, an Internet Access Point (IAP) to be used when communicating with one of the one or more remotely-located devices on behalf of the VPN program.

28. The apparatus of claim 20, wherein the ACU program communicates using a simple request-response protocol, and wherein a protocol transaction consists of a single request-response pair.

29. The apparatus of claim 20, wherein the processor is further configured to perform steps that include

(h) fetching, from one of the one or more remotely-located devices, content metadata applicable to the at least one additional program,

(i) comparing fetched metadata to locally stored metadata, and

(j) fetching new or updated content from the one of the one or more remotely-located devices based upon the comparison.

30. The apparatus of claim 29, wherein the ACU program includes in fetch requests in steps (h) and (j) content identifications (IDs) required by the one of the one or more remotely-located devices.

31. The apparatus of claim 20, wherein the processor is further configured to perform steps that include

(h) fetching, from multiple databases in one of the one or more remotely-located devices, metadata about multiple types of content.

32. The apparatus of claim 20, wherein the ACU program transmits requests containing properties used by one of the one or more remotely-located devices to filter requests.

33. The apparatus of claim 20, wherein messages generated by the ACU program and communicated one of the one or more remotely-located devices include a message identifier, a target database identifier, and a security level.

34. The apparatus of claim 33, wherein a first security level is required to receive configuration information for the VPN program and a second security level is required to receive another type of information.

35. The apparatus of claim 33, wherein at least one message generated by the ACU program includes an element indicating that the at least one message is a last message relating to a specific task.

36. The apparatus of claim 33, wherein the ACU program requests configuration information in a single message.

37. The apparatus of claim 20, wherein the processor is further configured to perform steps that include

(h) using the certificate stored in step (b) to validate subsequent responses from that remotely-located device.