Back to results
US 2018/0007011 A1Published application
Device introduction and access control framework
AssigneeIntel Corporation
InventorsVictor B. Lortz, Jesse R. Walker, Shriharsha S. Hegde, Amol A. Kulkarni, Tsung-Yuan C. Tai
Life of this patent
Estimating the term…
Abstract
In an embodiment, a method includes registering applications and network services for notification of an out-of-band introduction, and using the out-of-band introduction to bootstrap secure in-band provisioning of credentials and policies that are used to control subsequent access and resource sharing on an in-band channel. In another embodiment, an apparatus implements the method.
Claims30
(canceled)
An apparatus of a station (STA), configured to operate as an enrollee and implement at least part of a registration protocol, the apparatus comprising:
- processing circuitry configured to:
- configure the STA to send a first registration protocol message (M1), for transmission to a registrar device, the processing circuitry being configurable to send the M for transmission on an out-of-band (OOB) channel and being configurable to send the M1 for transmission on an in-band channel, the M1 being part of a registration protocol and indicating that the STA is an enrollee seeking to join a wireless local area network (WLAN) domain, wherein the M1 includes a public key associated with the enrollee;
- receive a second registration protocol message (M2), the processing circuitry being configurable to cause the STA to receive the M2 on the in-band channel and being configurable to cause the STA to receive the M2 on an OOB channel, to determine a shared secret, wherein the shared secret is to authenticate an in-band communication between the enrollee and the registrar device, the in-band communication including domain credential issuance for the enrollee;
- and
- encode a third registration protocol message (M3), wherein the M3 includes one or more indications to confirm knowledge of the shared secret by the enrollee device;
- and
- memory configured to store at least the shared secret.
4 more elements
An apparatus of a registrar device configured to implement at least part of a registration protocol, the apparatus comprising:
- processing circuitry configured to:
- receive a first registration protocol message (M1), the processing circuitry being configurable to cause the registrar device to receive the M1 on an in-band channel and being configurable to cause the registrar device to receive the M1 on an out-of-band (OOB) channel, the M1 being part of a registration protocol and indicating that a station (STA) is an enrollee seeking to join a wireless local area network (WLAN) domain, wherein the M1 includes a public key associated with the enrollee;
- configure the STA to send a second registration protocol message (M2), for transmission to the STA, the processing circuitry being configurable to send the M2 for transmission on an OOB channel and being configurable to send the M2 for transmission on the in-band channel, to determine a shared secret, wherein the shared secret is to authenticate an in-band communication between the enrollee and the registrar device, the in-band communication including domain credential issuance for the enrollee;
- and
- receive a third registration protocol message (M3), wherein the M3 includes one or more indications to confirm knowledge of the shared secret by the enrollee device;
- and
- memory configured to store at least the shared secret.
4 more elements
A computer-readable hardware storage device that stores instructions for execution by one or more processors of a station (STA), the instructions to configure the one or more processors to:
- configure the STA to send a first registration protocol message (M1), for transmission to a registrar device, the instructions to configure the processing circuitry to be configurable to send the M1 for transmission on an out-of-band (OOB) channel and being configurable to send the M1 for transmission on an in-band channel, the M1 being part of a registration protocol and indicating that the STA is an enrollee seeking to join a wireless local area network (WLAN) domain, wherein the M1 includes a public key associated with the enrollee;
- receive a second registration protocol message (M2), the instructions to configure the processing circuitry to be configurable to cause the STA to receive the M2 on the in-band channel and to be configurable to cause the STA to receive the M2 on an OOB channel, to determine a shared secret, wherein the shared secret is to authenticate an in-band communication between the enrollee and the registrar device, the in-band communication including domain credential issuance for the enrollee;
- and
- encode a third registration protocol message (M3), wherein the M3 includes one or more indications to confirm knowledge of the shared secret by the enrollee device.
1 more element
A computer-readable hardware storage device that stores instructions for execution by one or more processors of a registrar device, the instructions to configure the one or more processors to:
- receive a first registration protocol message (M1), the instructions to configure the processing circuitry to be configurable to cause the registrar device to receive the M1 on an in-band channel and to be configurable to cause the registrar device to receive the M1 on an out-of-band (OOB) channel, the M1 being part of a registration protocol and indicating that a station (STA) is an enrollee seeking to join a wireless local area network (WLAN) domain, wherein the M1 includes a public key associated with the enrollee;
- configure the STA to send a second registration protocol message (M2), for transmission to the STA, the instructions to configure the processing circuitry to be configurable to send the M2 for transmission on an OOB channel and to be configurable to send the M2 for transmission on the in-band channel, to determine a shared secret, wherein the shared secret is to authenticate an in-band communication between the enrollee and the registrar device, the in-band communication including domain credential issuance for the enrollee;
- and
- receive a third registration protocol message (M3), wherein the M3 includes one or more indications to confirm knowledge of the shared secret by the enrollee device.
1 more element
An apparatus of a station (STA), the apparatus comprising:
- processing circuitry configured to:
- encode a first registration protocol message (M1), for transmission to a registrar device, the processing circuitry being configurable to encode the M1 for transmission on an out-of-band (OOB) channel and being configurable to encode the M1 for transmission on an in-band channel, the M1 being part of a registration protocol and indicating that the STA is an enrollee seeking to join a wireless local area network (WLAN) domain, wherein the M1 includes a public key associated with the enrollee;
- decode a second registration protocol message (M2), the processing circuitry being configurable to decode the M2 received on the in-band channel and being configurable to decode the M2 received on an OOB channel, to determine a shared secret, wherein the shared secret is to authenticate an in-band communication between the enrollee and the registrar device, the in-band communication including domain credential issuance for the enrollee;
- and
- encode a third registration protocol message (M3), wherein the M3 includes one or more indications to confirm knowledge of the shared secret by the enrollee device;
- and
- memory configured to store at least the shared secret.
4 more elements
An apparatus of a registrar device, the apparatus comprising:
- processing circuitry configured to:
- decode a first registration protocol message (M1), the processing circuitry being configurable to decode the M1 received on an in-band channel and being configurable to decode the M1 received over an out-of-band (OOB) channel, the M1 being part of a registration protocol and indicating that a station (STA) is an enrollee seeking to join a wireless local area network (WLAN) domain, wherein the M1 includes a public key associated with the enrollee;
- encode a second registration protocol message (M2), for transmission to the STA, the processing circuitry being configurable to encode the M2 for transmission on an OOB channel and being configurable to encode the M2 for transmission on the in-band channel, to determine a shared secret, wherein the shared secret is to authenticate an in-band communication between the enrollee and the registrar device, the in-band communication including domain credential issuance for the enrollee;
- and
- decode a third registration protocol message (M3), wherein the M3 includes one or more indications to confirm knowledge of the shared secret by the enrollee device;
- and
- memory configured to store at least the shared secret.
4 more elements
Dependencies are inferred from the claim text.