Device introduction and access control framework
AssigneeIntel Corporation
InventorsVictor Lortz, Jesse Walker, Shriharsha Hegde, Amol Kulkarni, Tsung-Yuan Tai
Life of this patent
Estimating the term…
Abstract
In an embodiment, a method includes registering applications and network services for notification of an out-of-band introduction, and using the out-of-band introduction to bootstrap secure in-band provisioning of credentials and policies that are used to control subsequent access and resource sharing on an in-band channel. In another embodiment, an apparatus implements the method.
Claims33
A method for bootstrapping applications and services at different layers in a communications stack, comprising:
- registering applications and network services for notification of an out-of-band introduction;
- and
- using the out-of-band introduction to bootstrap secure in-band provisioning of credentials and policies to be used to control subsequent access and resource sharing on an in-band channel.
An apparatus that provides a device introduction framework that is extensible to bootstrap multiple applications and services at different layers in a communications stack of a platform, comprising:
- an out-of-band (OOB) introduction mechanism and data structure for conveying keying material, names for user display, and in-band addressing information for a next phase of a credential and policy bootstrapping process for newly-introduced devices;
- an extensible data structure for conveying across an in-band channel additional credentials, domain policy, and configuration data associated with a domain to which one of the newly-introduced devices belongs;
- a protocol that confirms knowledge of the out-of-band keying material and derives a secure in-band channel for exchanging data structures used to provision credentials and domain policy;
- and
- a processing framework structured to maintain credentials and associated domain policy and to make credentials and associated domain policy available to a trusted application and driver components on the device platform.
A method for an introduction process that provides a device introduction framework that is extensible to bootstrap multiple applications and services at different layers in a communications stack, comprising the steps of:
- registering applications and network services for notification of out-of-band (OOB) introductions;
- OOB introducing at least one of shared secret, in-band addressing info, and public key;
- receiving, by the applications, callback with OOB channel characteristics, domain identifier, and peer device name, and providing an opportunity to pass policy data to peer over an in-band channel;
- conducting at least one of in-band credential establishment and in-band policy exchange;
- establishing subsequent secure interaction based on identities and keys;
- and
- consulting, by multiple software components, with introduction framework to determine domain and use appropriate credentials and policies.
A method for introducing two devices, comprising the steps of:
- activating each device of two devices to initiate an introduction;
- reducing a respective strength of each device to an effective range of about five inches or less;
- moving the devices toward each other to form an out-of-band channel;
- each device detecting a signal of the other device, and simultaneously measuring a signal gradient by simultaneously measuring the signals received on both antennas;
- determining if any of the signals diminish according to an acceptable profile;
- and
- rejecting the introduction if any of the signals are not so diminished, and if a signal does have a correct strength gradient, receiving cryptographic material (such as public keys or key identifiers, but not precluding symmetric keys) across the out-of-band channel and subsequently using the cryptographic material to establish secure connection on an in-band channel after introduction.
A method for establishing trust between a server and a client, comprising the steps of:
- initiating an introductory process for the server and the client using an out-of-band (OOB) message in an OOB channel;
- and
- using in-band messages in an in-band channel to complete the introduction process for the server and the client.
A method for bootstrapping trust between two communicating devices, comprising the steps of:
- connecting the two devices via a two-way out-of-band (OOB) channel for the bootstrapping;
- exchanging information between the devices on the OOB channel;
- connecting the two devices to each other on an in-band channel;
- proving to the two devices, using the information exchanged on the OOB channel, that the two devices are intended peers;
- and
- exchanging encrypted messages between the two devices for secure communication.
Dependencies are inferred from the claim text.