Device introduction and access control framework

Patent metadata

Field	Value
Publication number	US-9602471-B2
Application number	US-201213430320-A
Country	US
Kind code	B2
Filing date	Mar 26, 2012
Priority date	Sep 3, 2004
Publication date	Mar 21, 2017
Grant date	Mar 21, 2017

Abstract

In an embodiment, a method includes registering applications and network services for notification of an out-of-band introduction, and using the out-of-band introduction to bootstrap secure in-band provisioning of credentials and policies that are used to control subsequent access and resource sharing on an in-band channel. In another embodiment, an apparatus implements the method.

First claim

What is claimed is:

1. A method for establishing mutual trust between a hardware circuit implemented server device and a hardware circuit implemented client device communications session, the method comprising:
conducting an invitation protocol using an out-of-band (OOB) one-way channel the invitation protocol including sending a message from the server device to the client device, the message including a certificate identifying a sender of the communication, a randomly generated secret, and in-band connection information for the server device to the client device over the OOB channel; and
conducting an identification protocol to establish the mutual trust between the server device and the client device for the communications session using in-band messages in an in-band two-way channel, wherein conducting the identification protocol includes:
sending a second message from the client device to the server device, the second message including the randomly generated secret encrypted with a server public key; and
verifying the client device using the second message, the verifying including the server device decrypting the encrypted randomly generated secret from the second message.

2. The method according to claim 1 , wherein the second message further includes a second randomly generated secret encrypted with the server public key and a client public key; and
wherein conducting the identification protocol further includes:
responsive to verifying the client device, creating, by the server device, a client certificate for the client with the client public key;
encrypting, by the server device using the client public key, the second randomly generated secret and a third randomly generated secret;
sending, by the server device, a third message including the certificate, the client public key encrypted second randomly generated secret and the client public key encrypted third randomly generated secret to the client device;
verifying, by the client device, that the second message reached the server device by decrypting the client public key encrypted second randomly generated secret from the third message;
decrypting, by the client device, the client public key encrypted third randomly generated secret from the third message;
encrypting, by the client device using the server public key, the third randomly generated secret; and
sending, by the client device, a fourth message including the server public key encrypted third randomly generated secret to the server device as a guarantee that the third message reached the client device.

3. A non-transitory machine-readable media including instructions, which when executed by a hardware circuit implemented server device, cause the server device to perform operations for establishing mutual trust between the hardware circuit implemented server device and a hardware circuit implemented client device communication session, the operations comprising:
conducting an invitation protocol using an out-of-band (OOB) one-way channel the invitation protocol including sending a message from the server device to the client device, the message including a certificate identifying a sender of the communication, a randomly generated secret, and in-band connection information for the server device to the client device over the OOB channel; and
conducting an identification protocol to establish the mutual trust between the server device and the client device for the communications session using in-band messages in an in-band two-way channel, wherein conducting the identification protocol includes:
sending a second message from the client device to the server device, the second message including the randomly generated secret encrypted with a server public key; and
verifying the client device using the second message, the verifying including the server device decrypting the encrypted randomly generated secret from the second message.

4. The machine-readable media according to claim 3 ,
wherein the second message further includes a second randomly generated secret encrypted with the server public key and a client public key; and
wherein conducting the identification protocol includes:
responsive to verifying the client device, creating, by the server device, a client certificate for the client with the client public key;
encrypting, by the server device using the client public key, the second randomly generated secret and a third randomly generated secret;
sending, by the server device, a third message including the certificate, the client public key encrypted second randomly generated secret and the client public key encrypted third randomly generated secret to the client device;
verifying, by the client device, that the second message reached the server device by decrypting the client public key encrypted second randomly generated secret from the third message;
decrypting, by the client device, the client public key encrypted third randomly generated secret from the third message;
encrypting, by the client device using the server public key, the third randomly generated secret; and
sending, by the client device, a fourth message including the server public key encrypted third randomly generated secret to the server device as a guarantee that the third message reached the client device.

5. A server device to perform operations for establishing mutual trust between the server device and a client device communication session, the server device comprising hardware circuits arranged to:
conduct an invitation protocol using an out-of-band (OOB) one-way channel, the invitation protocol including sending a message from the server device to the client device, the message including a certificate identifying a sender of the communication, a randomly generated secret, and in-band connection information for the server device to the client device over the OOB channel; and
conduct an identification protocol to establish the mutual trust between the server device and the client device for the communications session using in-band messages in an in-band two-way channel, wherein to conduct the identification protocol includes the server device arranged to:
receive a second message from the client device including the randomly generated secret encrypted with a server public key; and
verify the client device by decrypting the encrypted randomly generated secret from a second message.

6. The device of claim 5 , wherein the second message further includes a second randomly generated secret encrypted with the server public key and a client public key; and
wherein to conduct the identification protocol includes the server device arranged to:
create, responsive to verifying the client device, a client certificate for the client device with the client public key;
encrypt, using the client public key, the second randomly generated secret and a third randomly generated secret; and
send a third message including the certificate, the client public key encrypted second randomly generated secret and the client public key encrypted third randomly generated secret to the client device.

Assignees

• Lortz Victor B
• Walker Jesse R
• Hegde Shriharsha S
• Kulkarni Amol A
• Tai Tsung-Yuan C
• Intel Corp

Inventors

• Lortz Victor B
• Walker Jesse R
• Hegde Shriharsha S
• Kulkarni Amol A
• Tai Tsung-Yuan C

Classifications

• H04L63/18

  using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215) · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/105

  Multiple levels of security · CPC title

• H04L63/04 Primary

  for providing a confidential data exchange among entities communicating through data packet networks · CPC title