Back to results
US 11,770,373 B2Granted
Provisioning of vendor credentials
AssigneeTelefonaktiebolaget LM Ericsson (publ)
InventorsBernard Smeets, Lina Palsson
Life of this patent
Estimating the term…
Abstract
There is provided mechanisms for obtaining a VC certificate from a server. A method is performed by network equipment. The method comprises performing, by an enclave of the network equipment, measurements on at least one property of the network equipment. The method comprises providing, by the enclave, a request for the VC certificate from the server upon having attested the measurements. The method comprises receiving, from the server, the VC certificate in response to the request and storing the VC certificate in the network equipment.
Claims30
A method for obtaining a Vendor Credential (VC) certificate from a server, the method being performed by network equipment, the method comprising:
- performing, by an enclave of the network equipment, measurements on at least one property of the network equipment, the at least one property relating to configuration parameters relating to hardware of the network equipment, the enclave being a process space and memory area within the network equipment and the enclave being arranged to execute software within the enclave without other processes being able to inspect, alter and replay associated data, the measurements being performed according to a whitelist, the whitelist comprising boot measurement recordings to which the measurements are compared;
- providing, by the enclave, a request for the VC certificate from the server upon having attested the measurements, the request for the VC certificate comprising an indication of the attested measurements, the measurements only being attested while being within a threshold value from the boot measurement recordings;
- and
- receiving, from the server, the VC certificate in response to the request and storing the VC certificate in the network equipment.
1 more element
A method for providing a Vendor Credential (VC) certificate to network equipment, the method being performed by a server, the method comprising:
- receiving a request for the VC certificate from an enclave of the network equipment, the enclave being a process space and memory area within the network equipment and the enclave being arranged to execute software within the enclave without other processes being able to inspect, alter and replay associated data and the request comprising an indication of measurements on at least one property of the network equipment attested by the enclave, the at least one property relating to configuration parameters relating to hardware of the network equipment, the measurements being performed according to a first whitelist, the whitelist comprising boot measurement recordings to which the measurements are compared, the measurements only being attested while being within a threshold value from the boot measurement recordings;
- and
- providing the VC certificate to the enclave.
A network equipment for obtaining a Vendor Credential (VC) certificate from a server, the network equipment comprising processing circuitry, the processing circuitry being configured to cause the network equipment to:
- perform, by an enclave of the network equipment, measurements on at least one property of the network equipment, the at least one property relating to configuration parameters relating to hardware of the network equipment, the enclave being a process space and memory area within the network equipment and the enclave being arranged to execute software within the enclave without other processes being able to inspect, alter and replay associated data, the measurements being performed according to a whitelist, the whitelist comprising boot measurement recordings to which the measurements are compared;
- provide, by the enclave, a request for the VC certificate from the server upon having attested the measurements, the request for the VC certificate comprising an indication of the measurements of the network equipment as attested by the enclave, the measurements only being attested while being within a threshold value from the boot measurement recordings;
- and
- receive, from the server, the VC certificate in response to the request and to store the VC certificate in the network equipment.
1 more element
A network equipment for obtaining a Vendor Credential (VC) certificate from a server, the network equipment comprising:
- processing circuitry;
- and
- a storage medium storing instructions that, when executed by the processing circuitry, cause the network equipment to:
- perform, by an enclave of the network equipment, measurements on at least one property of the network equipment, the at least one property relating to configuration parameters relating to hardware of the network equipment, the enclave being a process space and memory area within the network equipment and the enclave being arranged to execute software within the enclave without other processes being able to inspect, alter and replay associated data, the measurements being performed according to a whitelist, the whitelist comprising boot measurement recordings to which the measurements are compared;
- provide, by the enclave, a request for the VC certificate from the server upon having attested the measurements, the request for the VC certificate comprising an indication of the measurements of the network equipment as attested by the enclave, the measurements only being attested while being within a threshold value from the boot measurement recordings;
- and
- receive, from the server, the VC certificate in response to the request and to store the VC certificate in the network equipment.
4 more elements
A network equipment for obtaining a Vendor Credential (VC) certificate from a server, the network equipment comprising:
- a measurement module configured to perform, by an enclave of the network equipment, measurements on at least one property of the network equipment, the at least one property relating to configuration parameters relating to hardware of the network equipment, the enclave being a process space and memory area within the network equipment and the enclave being arranged to execute software within the enclave without other processes being able to inspect, alter and replay associated data, the measurements being performed according to a whitelist, the whitelist comprising boot measurement recordings to which the measurements are compared;
- a providing module configured to provide, by the enclave, a request for the VC certificate from the server upon having attested the measurements, the request for the VC certificate comprising an indication of the measurements of the network equipment as attested by the enclave, the measurements only being attested while being within a threshold value from the boot measurement recordings;
- and
- a receiving module configured to receive, from the server, the VC certificate in response to the request and to store the VC certificate in the network equipment.
1 more element
A server for providing a Vendor Credential (VC) certificate to network equipment, the server comprising processing circuitry, the processing circuitry being configured to cause the server to:
- receive a request for the VC certificate from an enclave of the network equipment, the enclave being a process space and memory area within the network equipment and the enclave being arranged to execute software within the enclave without other processes being able to inspect, alter and replay associated data and the request comprising an indication of measurements on at least one property of the network equipment attested by the enclave, the at least one property relating to configuration parameters relating to hardware of the network equipment, the measurements being performed according to a whitelist, the whitelist comprising boot measurement recordings to which the measurements are compared, the measurements only being attested while being within a threshold value from the boot measurement recordings;
- and
- provide the VC certificate to the enclave.
A server for providing a Vendor Credential (VC) certificate to network equipment, the server comprising:
- processing circuitry;
- and
- a storage medium storing instructions that, when executed by the processing circuitry, cause the server to:
- receive a request for the VC certificate from an enclave of the network equipment, the enclave being a process space and memory area within the network equipment and the enclave being arranged to execute software within the enclave without other processes being able to inspect, alter and replay associated data and the request comprising an indication of measurements on at least one property of the network equipment attested by the enclave, the at least one property relating to configuration parameters relating to hardware of the network equipment, the measurements being performed according to a whitelist, the whitelist comprising boot measurement recordings to which the measurements are compared, the measurements only being attested while being within a threshold value from the boot measurement recordings;
- and
- provide the VC certificate to the enclave.
3 more elements
A server for providing a Vendor Credential (VC) certificate to network equipment, the server comprising:
- a receiving module configured to receive a request for the VC certificate from an enclave of the network equipment, the enclave being a process space and memory area within the network equipment and the enclave being arranged to execute software within the enclave without other processes being able to inspect, alter and replay associated data and the request comprising an indication of measurements on at least one property of the network equipment attested by the enclave, the at least one property relating to configuration parameters relating to hardware of the network equipment, the measurements being performed according to a whitelist, the whitelist comprising boot measurement recordings to which the measurements are compared, the measurements only being attested while being within a threshold value from the boot measurement recordings;
- and
- a providing module configured to provide the VC certificate to the enclave.
A non-transitory computer readable storage medium comprising a computer program for obtaining a VC certificate from a server, the computer program comprising computer code which, when run on processing circuitry of network equipment, causes the network equipment to:
- perform, by an enclave of the network equipment, measurements on at least one property of the network equipment, the at least one property relating to configuration parameters relating to hardware of the network equipment, the enclave being a process space and memory area within the network equipment and the enclave being arranged to execute software within the enclave without other processes being able to inspect, alter and replay associated data, the measurements being performed according to a whitelist, the whitelist comprising boot measurement recordings to which the measurements are compared;
- provide, by the enclave, a request for the VC certificate from the server upon having attested the measurements, the request for the VC certificate comprising an indication of the measurements of the network equipment as attested by the enclave, the measurements only being attested while being within a threshold value from the boot measurement recordings;
- and
- receive, from the server, the VC certificate in response to the request and to store the VC certificate in the network equipment.
1 more element
A non-transitory computer readable storage medium comprising a computer program for providing a VC certificate to network equipment, the computer program comprising computer code which, when run on processing circuitry of a server, causes the server to:
- receive a request for the VC certificate from an enclave of the network equipment, the enclave being a process space and memory area within the network equipment and the enclave being arranged to execute software within the enclave without other processes being able to inspect, alter and replay associated data and the request comprising an indication of measurements on at least one property of the network equipment attested by the enclave, the at least one property relating to configuration parameters relating to hardware of the network equipment, the measurements being performed according to a whitelist, the whitelist comprising boot measurement recordings to which the measurements are compared, the measurements only being attested while being within a threshold value from the boot measurement recordings;
- and
- provide the VC certificate to the enclave.
Dependencies are inferred from the claim text.