US 11,601,288 B1Granted

On-demand security certificates for improved home router security

AssigneeCox Communications, Inc.

InventorsKinney Chapman Bacon, David Adam Taylor

Life of this patent

Estimating the term…

Loading patent…

Abstract

A secure connection to a router web UI is provided. In one implementation, responsive to a client request to securely connect to a router web server (RWS), the RWS generates and sends a certificate signing request (CSR) to a remote-security certificate server (R-SCS). Upon validation of the RWS, the R-SCS signs and transmits a router web UI certificate (RWUIC) to the RWS to present to the client. In another implementation, the router includes a local-SCS (L-SCS) that periodically obtains a short-lived intermediate certification authority (ICA) certificate from the R-SCS. Responsive to a client request for secure access to the RWS, the RWS generates and sends a CSR to the L-SCS for the RWUIC. The L-SCS signs the RWUIC and passes the ICA certificate and RWUIC to the RWS, which presents the certificate(s) to the client. Upon validation of the certificate(s), a secure channel between the client and RWS is established.

Claims20

Dependent claims

A router device configured to provide secure access to a router web user interface, the router device comprising:

at least one processor;
a memory storage device including instructions that when executed by the at least one processor control the secure access to the router web user interface by a web browser of a client computing device without the web browser presenting a security warning notification, the instructions when executed to:
receive a request from the web browser of the client computing device for a secure connection;
receive a list of cipher suites supported by the web browser in order of preference from the client computing device;
select a cipher and a hash function from the list;
notify the client computing device of the cipher and the hash function;
establish a transport layer security (TLS) connection with a remote security certificate server;
generate a first certificate signing request for obtaining an intermediate certification authority certificate from the remote security certificate server;
send the first certificate signing request to the remote security certificate server;
receive a signed intermediate certification authority certificate from the remote security certificate server after the first certificate signing request is validated by the remote security certificate server;
generate a second certificate signing request for obtaining a signed router web user interface security certificate locally at the router device;
store the signed router web user interface security certificate locally at the router device after the second certificate signing request is validated locally at the router device;
transmit a certificate chain to the web browser, the certificate chain comprising the signed router web user interface security certificate validated locally at the router device and the signed intermediate certification authority certificate validated by the remote security certificate server;
when the certificate chain is validated by the web browser, establish the secure connection with the web browser;
receive a request from the web browser for the router web user interface via the secure connection;
and
responsive to the request, provide the router web user interface to the web browser via the secure connection.

14 more elements

A method for providing secure access to a router web user interface without a web browser of a client computing device presenting a security warning notification, the method comprising:

receiving a request from the web browser for a secure connection;
receiving a list of cipher suites supported by the web browser in order of preference from the client computing device;
selecting a cipher and a hash function from the list;
notifying the client computing device of the cipher and the hash function;
establishing a transport layer security (TLS) connection with a remote security certificate server;
generating a first certificate signing request for obtaining an intermediate certification authority certificate from the remote security certificate server;
sending the first certificate signing request to the remote security certificate server;
receiving a signed intermediate certification authority certificate from the remote security certificate server after the first certificate signing request is validated by the remote security certificate server;
generating a second certificate signing request for obtaining a signed router web user interface security certificate locally at the router device;
storing the signed router web user interface security certificate locally at the router device after the second certificate signing request is validated locally at the router device;
transmitting a certificate chain to the web browser, the certificate chain comprising the signed router web user interface security certificate validated locally at the router device and the signed intermediate certification authority certificate validated by the remote security certificate server;
when the certificate chain is validated by the web browser, establishing the secure connection with the web browser;
receiving a request from the web browser for the router web user interface via the secure connection;
and
responsive to the request, providing the router web user interface to the web browser via the secure connection.

12 more elements

A system comprising:

a remote security certificate server;
a computing device including a web browser;
and
a router device configured to control secure access to a router web user interface by the web browser without the web browser presenting a security warning notification, the router device to:
receive a request from the web browser of the computing device for a secure connection;
receive a list of cipher suites supported by the web browser in order of preference from the computing device;
select a cipher and a hash function from the list;
notify the computing device of the cipher and the hash function;
establish a transport layer security (TLS) connection with the remote security certificate server;
generate a first certificate signing request for obtaining an intermediate certification authority certificate from the remote security certificate server;
send the first certificate signing request to the remote security certificate server;
receive a signed intermediate certification authority certificate from the remote security certificate server after the first certificate signing request is validated by the remote security certificate server;
generate a second certificate signing request for obtaining a signed router web user interface security certificate locally at the router device;
store the signed router web user interface security certificate locally at the router device after the second certificate signing request is validated locally at the router device;
transmit a certificate chain to the web browser, the certificate chain comprising the signed router web user interface security certificate validated locally at the router device and the signed intermediate certification authority certificate validated by the remote security certificate server;
when the certificate chain is validated by the web browser, establish the secure connection with the web browser;
receive a request from the web browser for the router web user interface via the secure connection;
and
responsive to the request, provide the router web user interface to the web browser via the secure connection.

16 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/546,788Filed 21 Aug 2019
Granted: 7 Mar 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 9/3265
Involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements: using…
H04L 9/3268
Involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements: using…
H04L 63/0823
For authentication of entities: using certificates
H04L 63/205
For managing network security; network security policies in general: involving negotiation or determination of the one or more network security…