Setting a password on a device

Patent metadata

Field	Value
Publication number	US-10298397-B2
Application number	US-201615168373-A
Country	US
Kind code	B2
Filing date	May 31, 2016
Priority date	May 28, 2015
Publication date	May 21, 2019
Grant date	May 21, 2019

Abstract

Embodiments disclosed herein provide a server, a device and methods for providing security data to a device requiring a password for use in protecting a function of the device. An example method comprises communicating a device identifier to the server; the server communicating security data to the device, wherein the password is derivable, at least in part, from the security data; the device deriving the password, at least in part, from the security data and storing the password as the access code for the protected function; and the server storing the device identifier with an association to the password.

First claim

The invention claimed is:

1. A server for providing security data to a device requiring a password for use in providing access to a protected function of the device, the server being configured to:
receive a device identifier;
communicate with the device to determine how the password is to be derived using the security data such that the server and the device agree to use an agreed-upon derivation process to derive the password;
communicate the security data to the device, wherein the password is derivable by applying the agreed-upon derivation process on the security data;
derive the password by applying the agreed-upon derivation process on the security data, wherein deriving the password includes applying the agreed-upon derivation process in at least two different ways to generate at least two different passwords, one of which is the password used to access the protected function and another of which is separate password used to access a separate protected function of the device, such that multiple different passwords are generated using the same security data; and
store the device identifier with an association to the password,
wherein the protected function is provided on the device and is not accessible without access to the password.

2. The server of claim 1 , wherein the security data comprises data from which a shared key is derivable by the device according to a bootstrapping process, and wherein the password is derivable from the shared key, and the bootstrapping process is based on Generic Bootstrapping Architecture (GBA).

3. The server of claim 1 , further configured to:
establish a secure interface between the device and the server; and
communicate the security data to the customer device via the secure interface;
use a bootstrapping process to establish the secure interface between the device and the server, and
wherein the bootstrapping process is based on Generic Bootstrapping Architecture (GBA).

4. The server of claim 3 , wherein the security data comprises the password or an indication of which of a plurality of codes stored on the device is to be used as the password.

5. The server of claim 1 , further configured to:
receive a first user contact identifier;
store the first user contact identifier with an association to the device identifier and/or the password;
recognise that a password reset trigger on the device has been actuated; and
communicate a password reset alert to the first user contact identifier.

6. The server of claim 5 , further configured to, on receipt of a confirmation of password reset in response to the password reset alert:
communicate new security data to the device, wherein a new password is derivable from new security data; and
store the device identifier with an association to the new password.

7. The server of claim 6 , further configured to:
suspend the function on the device until the confirmation of password reset is received in response to the password reset alert; and
on receipt of an indication in response to the password reset alert that a password reset is not desired:
suspend the function of the device.

8. The server of claim 1 , further configured to:
recognise that a password reset trigger on the device has been actuated;
set a multiple resets flag if the number of password reset trigger actuations in a reset period of time exceeds a reset threshold.

9. The server of claim 5 , further configured to:
receive a second user contact identifier to replace the stored first user contact identifier;
communicate a contact change alert to the first user contact identifier; and on receipt of a confirmation of contact change in response to the contact change alert:
replace the first user contact identifier with the second user contact identifier.

10. The server of claim 9 , further configured to:
suspend the function on the device until a confirmation of contact change is received in response to the contact change alert.

11. The server of claim 9 , further configured to, on receipt of an indication in response to the contact change alert that a contact change is not desired:
suspend the function of the device.

12. The server of claim 5 , wherein the first user contact identifier and/or second user contact identifier each comprise at least one of an email address, a mobile telephone number, a fixed line telephone number and/or a postal address.

13. A device for obtaining a password for use in providing access to a protected function of the device, the device being configured to:
communicate with a server to determine how the password is to be derived using security data such that the device and the server agree to use an agreed-upon derivation process to derive the password;
receive the security data from a server;
derive the password from the security data by applying the agreed-upon derivation process on the security data, wherein deriving the password includes applying the agreed-upon derivation process in at least two different ways to generate at least two different passwords, one of which is the password used to access the protected function and another of which is a separate password used to access a separate protected function of the device, such that multiple different passwords are generated using the same security data; and
store the password as an access code for the protected function of the device,
wherein the protected function is provided on the device and is not accessible without access to the password.

14. The device of claim 13 , wherein the security data comprises data using which a shared key is derivable according to a bootstrapping process, wherein the device is further configured to:
derive the shared key using the security data, and
derive the password, at least in part, from the shared key,
wherein the bootstrapping process is based on Generic Bootstrapping Architecture (GBA).

Assignees

• Vodafone Ip Licensing Ltd

Inventors

• Bone Nicholas
• Snape Tim

Classifications

• H04W4/005

  Electricity · mapped topic

• H04L9/3226 Primary

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• H04W4/70

  Services for machine-to-machine communication [M2M] or machine type communication [MTC] · CPC title

• G06F21/575

  Secure boot · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title