Secure bootstrapping of client device with trusted server provided by untrusted cloud service
AssigneeCisco Technology, Inc.
InventorsOwen Brendan Friel, Jason Cresswell, Pandit Panburana
Life of this patent
Estimating the term…
Abstract
A client device bootstraps against a trusted server by obtaining an activation code that includes an identifier and a one time password. The client device sends a message to a public server requesting an address of a trusted server associated with the identifier. The client device receives the address of the trusted server from the public server and initiates a communication session with the trusted server at the address provided by the public server. The one time password is used as a shared secret to secure the communication session. The client device downloads cryptographic information from the trusted server.
Claims20
A method comprising:
- at a client device, generating a one time password;
- combining the one time password with an identifier to create an activation code;
- sending a message to a public server, the message comprising a request for an address of a trusted server associated with the identifier;
- providing the activation code to a provisioning client that notifies the public server to associate the address of the trusted server with the identifier;
- receiving the address of the trusted server from the public server;
- initiating a communication session with the trusted server at the address of the trusted server provided by the public server, wherein the one time password is used as a shared secret to secure the communication session;
- and
- downloading trusted cryptographic information from the trusted server.
An apparatus comprising:
- a network interface unit that enables network communications;
- and
- a processor, coupled to the network interface unit, and configured to:
- generate a one time password;
- combine the one time password with an identifier to create an activation code;
- send a message via the network interface unit to a public server, the message comprising a request for an address of a trusted server associated with the identifier;
- provide the activation code to a provisioning client that notifies the public server to associate the address of the trusted server with the identifier;
- receive the address of the trusted server from the public server via the network interface unit;
- cause the network interface unit to initiate a communication session with the trusted server at the address of the trusted server provided by the public server, wherein the one time password is used as a shared secret to secure the communication session;
- and
- cause the network interface unit to download trusted cryptographic information from the trusted server.
A system comprising:
- a trusted server configured to store cryptographic information;
- a provisioning client configured to communicate with a public server to associate an identifier with the trusted server;
- and
- a client device configured to:
- generate a one time password;
- combine the one time password with the identifier to create an activation code
- send a message to the public server, the message comprising a request for an address of the trusted server;
- provide the activation code to the provisioning client;
- receive the address of the trusted server from the public server;
- initiate a communication session with the trusted server at the address of the trusted server provided by the public server, wherein the one time password is used as a shared secret to secure the communication session;
- and
- download the cryptographic information from the trusted server.
Dependencies are inferred from the claim text.