Secure delivery of trust credentials

Patent metadata

Field	Value
Publication number	US-9009463-B2
Application number	US-201213544252-A
Country	US
Kind code	B2
Filing date	Jul 9, 2012
Priority date	Jul 9, 2012
Publication date	Apr 14, 2015
Grant date	Apr 14, 2015

Abstract

A system is configured to receive, by one or more servers, a request for a certificate from a user device. The request may include a first parameter, a second parameter, and a third parameter. The system is further configured to identify a key based on the first parameter, generate a fourth parameter based on the key and the third parameter, authenticate the user device based on the fourth parameter and the second parameter, generate the certificate based on authenticating the user device, store information associated with the certificate, and send the certificate to the user device. The user device may use the certificate to establish a session to interact with an application server.

First claim

What is claimed is:

1. A method comprising:
receiving, by one or more servers, a request for a certificate from a user device,
the request including a first parameter, a second parameter, and a third parameter, and
the first parameter including an application identifier of an application;

identifying, by the one or more servers, a key based on the application identifier;
generating, by the one or more servers, a fourth parameter based on the key and the third parameter;
authenticating, by the one or more servers, the user device based on the fourth parameter and the second parameter;
generating, by the one or more servers, the certificate based on authenticating the user device;
storing, by the one or more servers, information associated with the certificate; and
sending, by the one or more servers, the certificate to the user device,
the user device using the certificate to establish a session to interact with an application server.

2. The method of claim 1 , further comprising:
encrypting the certificate, based on the key and the second parameter, to form an encrypted certificate,
where sending the certificate to the user device includes sending the encrypted certificate to the user device.

3. The method of claim 1 , where receiving the request for the certificate from the user device is based on the user device receiving the application from a verified source and selecting the application.

4. A method comprising:
receiving, by a user device, an application from a first server;
receiving, by the user device, an instruction to open the application;
determining, by the user device, whether the user device is storing a certificate associated with the application based on opening the application,
the certificate including information to receive credentials;

requesting, by the user device, the certificate from a second server when the user device is not storing the certificate;
receiving, by the user device, the certificate from the second server based on requesting the certificate,
the certificate being an encrypted certificate;

decrypting, by the user device, the certificate based on a key associated with the application;
storing, by the user device, the certificate in a secure storage, associated with the user device, based on receiving and decrypting the certificate;
requesting, by the user device and based on the certificate, the credentials from the second server,
the credentials including information to authenticate the user device to access a third server;

receiving, by the user device, the credentials from the second server;
storing, by the user device, the credentials in the secure storage associated with the user device; and
requesting a session with the third server using the credentials.

5. The method of claim 4 ,
where the application includes an identifier, and
where the key is associated with the identifier.

6. The method of claim 4 , where the application includes credential parameters embedded within the application.

7. A system comprising:
one or more processors to:
receive, from a user device, a request for a certificate,
the request including a first parameter, a second parameter, and a third parameter, and
the first parameter including an application identifier of an application;

identify a key based on the application identifier;
generate a fourth parameter based on the key and the third parameter; authenticate the user device based on the fourth parameter and the second parameter;
generate the certificate based on authenticating the user device; and
send the certificate to the user device.

8. The system of claim 7 ,
where the fourth parameter comprises an encrypted random number, and
where, when authenticating the user device based on the fourth parameter and the second parameter, the one or more processors are to:
decrypt the fourth parameter to obtain a decrypted random number,
determine that the fourth parameter matches the second parameter, and
authenticate the user device based on determining that the fourth parameter matches the second parameter.

9. The system of claim 7 , where the one or more processors are further to:
embed a security version number in the certificate before sending the certificate to the user device.

10. The system of claim 7 , where the one or more processors are further to:
encrypt the certificate based on the key before sending the certificate to the user device.

11. The system of claim 7 , where, when sending the certificate to the user device, the one or more processors are to:
send the certificate to the user device by using a secure transfer protocol.

12. A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by at least one processor of a device, cause the at least one processor to:
receive an application from a first server;
receive an instruction to open the application;
request, after receiving the instruction to open the application and from a second server, a certificate for the application;
receive, from the second server, the certificate based on requesting the certificate,
the certificate being an encrypted certificate; and

decrypt the certificate based on a key associated with the application.

13. The non-transitory computer-readable medium of claim 12 , where the one or more instructions to request the certificate for the application comprise:
one or more instructions that, when executed by the at least one processor, cause the at least one processor to:
determine, after receiving the instruction to open the application, that the device does not store the certificate, and
request the certificate for the application based on determining that the device does not store the certificate.

14. The non-transitory computer-readable medium of claim 12 , where the instructions further comprise:
one or more instructions that, when executed by the at least one processor, cause the at least one processor to:
store the certificate in a secure storage after decrypting the certificate.

15. The non-transitory computer-readable medium of claim 12 , where the instructions further comprise:
one or more instructions that, when executed by the at least one processor, cause the at least one processor to:
request, from the second server, credentials by using the certificate,
the credentials including information to authenticate the device to access a third server, and

receive the credentials from the second server.

16. The non-transitory computer-readable medium of claim 15 , where the instructions further comprise:
one or more instructions that, when executed by the at least one processor, cause the at least one processor to:
requesting a session with the third server using the credentials.

17. The non-transitory computer-readable medium of claim 12 , where the instructions further comprise:
one or more instructions that, when executed by the at least one processor, cause the at least one processor to:
determine that the certificate is not up-to-date based on a security version number of the certificate; and
request, from the second server, another certificate for the application based on determining that the certificate is not up-to-date.

18. A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions that, when executed by at least one processor of a device, cause the at least one processor to:
receive a request for a certificate from a user devi

Assignees

• Yin Fenglin
• Verizon Patent & Licensing Inc

Inventors

• Yin Fenglin

Classifications

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/062

  for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819) · CPC title

• H04W12/068

  using credential vaults, e.g. password manager applications or one time password [OTP] applications · CPC title

• H04L63/0815

  providing single-sign-on or federations · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title