Method for configuring a remote station with a certificate from a local root certificate authority for securing a wireless network

Patent metadata

Field	Value
Publication number	US-9288672-B2
Application number	US-201414207005-A
Country	US
Kind code	B2
Filing date	Mar 12, 2014
Priority date	Sep 23, 2013
Publication date	Mar 15, 2016
Grant date	Mar 15, 2016

Abstract

A remote station is configured with a certificate from a local root certificate authority for securing a wireless network. To configure the certificate, the remote station forwards a station public key to the local root certificate authority. The station public key is forwarded out-of-band of the wireless network. The remote station receives a certificate and a root public key from the local root certificate authority. The certificate is generated by the local root certificate authority based on the forwarded station public key, and the certificate and the root public key are received out-of-band of the wireless network. The remote station securely communicates, using the wireless network, with another station based on the certificate and the root public key.

First claim

What is claimed is:

1. A method for configuring a remote station with a certificate from a local root certificate authority for securing a wireless network, comprising:
forwarding a station public key to the local root certificate authority, wherein the station public key is forwarded out-of-band of the wireless network;
receiving a certificate and a root public key from the local root certificate authority, wherein the certificate comprises the forwarded station public key and a device identifier, and the certificate and the root public key are received out-of-band of the wireless network; and
securely communicating, using the wireless network, with another station based on the certificate and the root public key configured in the another station, and based on verifying, using the root public key configured in the remote station, a validity of another certificate received from the another station.

2. The method of claim 1 , wherein the station public key is forwarded to the local root certificate authority, and the certificate and the root public key are received from the local root certificate authority, using a bi-directional communication channel.

3. The method of claim 1 , wherein the station public key is forwarded to the local root certificate authority, and the certificate and the root public key are received from the local root certificate authority, using a Bluetooth low energy communication channel.

4. The method of claim 1 , wherein the station public key is forwarded to the local root certificate authority, and the certificate and the root public key are received from the local root certificate authority, using a near field communication channel.

5. The method of claim 1 , wherein the root public key is a root-of-trust public key included in a self-signed certificate.

6. The method of claim 1 , wherein the root public key is included in a self-signed certificate.

7. The method of claim 6 , wherein verifying the validity of the another certificate comprises at least one of:
verifying a signature of the another certificate with the root public key;
verifying the another certificate is not on a Certificate Revocation List;
verifying a status of the another certificate using an Online Certificate Status Protocol; and/or
verifying validity dates of the another certificate.

8. The method of claim 1 , wherein the wireless network consists of only the remote station and the another station communicating using Wi-Fi Direct or Peer-to-Peer.

9. The method of claim 1 , wherein the wireless network is a long term evolution (LTE) direct communication network.

10. The method of claim 1 , wherein the wireless network is a mesh WiFi network.

11. The method of claim 1 , wherein the local root certificate authority is a configurator of the wireless network.

12. The method claim 11 , wherein the configurator is also a wireless station with a key pair.

13. The method of claim 12 , wherein the wireless station received internally a certificate from the local root certificate authority in order to communicate with other stations.

14. The method of claim 1 , wherein the remote station comprises a wireless access point.

15. A remote station, comprising:
means for forwarding a station public key to a local root certificate authority, wherein the station public key is forwarded out-of-band of a wireless network;
means for receiving a certificate and a root public key from the local root certificate authority, wherein the certificate comprises the forwarded station public key and a device identifier, and the certificate and the root public key are received out-of-band of the wireless network; and
means for securely communicating, using the wireless network, with another station based on the certificate and the root public key configured in the another station, and based on verifying, using the root public key configured in the remote station, a validity of another certificate received from the another station.

16. The remote station of claim 15 , wherein the root public key is a root-of-trust public key included in a self-signed certificate.

17. The remote station of claim 15 , wherein the root public key is included in a self-signed certificate.

18. The remote station of claim 17 , wherein the means for verifying the validity of the another certificate comprises at least one of:
means for verifying a signature of the another certificate with the root public key;
means for verifying the another certificate is not on a Certificate Revocation List;
means for verifying a status of the another certificate using an Online Certificate Status Protocol; and/or
means for verifying validity dates of the another certificate.

19. A remote station, comprising:
a hardware processor configured to:
forward a station public key to a local root certificate authority, wherein the station public key is forwarded out-of-band of a wireless network;
receive a certificate and a root public key from the local root certificate authority, wherein the certificate comprises the forwarded station public key and a device identifier, and the certificate and the root public key are received out-of-band of the wireless network; and
securely communicate, using the wireless network, with another station based on the certificate and the root public key configured in the another station, and based on verifying, using the root public key configured in the remote station, a validity of another certificate received from the another station.

20. The remote station of claim 19 , wherein the root public key is included in a self-signed certificate.

21. The remote station of claim 20 , wherein to verify the validity of the another certificate comprises at least one of:
verify a signature of the another certificate with the root public key;
verify the another certificate is not on a Certificate Revocation List;
verify a status of the another certificate using an Online Certificate Status Protocol; and/or
verify validity dates of the another certificate.

22. A non-transitory computer-readable medium, comprising:
code for causing a computer to forward a station public key to a local root certificate authority, wherein the station public key is forwarded out-of-band of a wireless network;
code for causing a computer to receive a certificate and a root public key from the local root certificate authority, wherein the certificate comprises the forwarded station public key and a device identifier, and the certificate and the root public key are received out-of-band of the wireless network; and
code for causing a computer to securely communicate, using the wireless network, with another station based on the certificate and the root public key configured in the another station, and based on verifying, using the root public key configured in the computer, a validity of another certificate received from the another station.

23. The non-transitory computer-readable medium of claim 22 , wherein the root public key is included in a self-signed certificate.

24. The non-transitory computer-readable medium of claim 23 , wherein to verify the validity of the another certificate comprises at least one of:
verify a signature of the another certificate with the root public key;
verify the another certificate is not on a Certificate Revocation List;
verify a status of the another certificate using an Online Certificate Status Protocol; and/or
verify validity dates of the another c

Assignees

• Qualcomm Inc

Inventors

• Benoit Olivier Jean
• Mcdonald Cameron Allen George

Classifications

• H04L9/321 Primary

  involving a third party or a trusted authority · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L9/3265 Primary

  using certificate chains, trees or paths; Hierarchical trust model · CPC title

• H04W12/06 Primary

  Authentication · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title