US 2019/0356482 A1 · A HOSTED DYNAMIC PROVISIONING PROTOCOL WITH SERVERS AND A NETWORKED RESPONDER

Abstract

A network can operate a WiFi access point with credentials. An unconfigured device can support a Device Provisioning Protocol (DPP), and record bootstrap public keys and initiator private keys. The network can record bootstrap public and responder private keys and operate a DPP server. A responder proxy can establish a secure and mutually authenticated connection with the network. The network can (i) derive responder ephemeral public and private keys, (ii) record the initiator bootstrap public key, and (iii) select a responder mode for the responder. The network can derive an encryption key with at least the (i) recorded the initiator bootstrap public key and (ii) derived responder ephemeral private key. The network can encrypt credentials using at least the derived encryption key and send the encrypted credentials through the responder proxy to the initiator, which can forward the encrypted credentials to the device, thereby supporting a device configuration.

Claims20

Dependent claims

A method for conducting a device provisioning protocol (DPP), the method performed by a responder, the method comprising:

recording a set of cryptographic parameters and a responder network table;
receiving a DPP authentication request from an initiator, wherein the DPP authentication request includes at least an initiator ephemeral public key and a hash value for a responder bootstrap public key;
using the hash value and the responder network table to select a DPP server;
sending at least the initiator ephemeral public key and the hash value to the selected DPP server;
deriving (i) a responder ephemeral private key, (ii) a corresponding responder ephemeral public key, and (iii) a responder nonce using the set of cryptographic parameters;
receiving an initiator bootstrap public key and a secret key from the DPP server;
conducting an elliptic curve Diffie-Hellman (ECDH) key exchange using the derived responder ephemeral private key and the received initiator bootstrap public key in order to derive a first shared secret key;
conducting an elliptic curve point addition with the secret key and the derived first shared secret key in order to derive a second shared secret key;
and
encrypting at least the responder nonce using the derived second shared secret key.

7 more elements

A method for conducting a device provisioning protocol (DPP), the method performed by a responder, the method comprising:

recording a set of cryptographic parameters and a responder network table, wherein the responder network table includes at least (i) a plurality of hash values for a plurality of responder bootstrap public keys and (ii) a list of DPP servers;
receiving a DPP authentication request from an initiator wherein the DPP authentication request includes at least an initiator ephemeral public key, a hash value for a responder bootstrap public key, and a first ciphertext;
using the hash value and the responder network table to select a DPP server;
sending the DPP authentication request to the selected DPP server;
receiving a responder ephemeral public key and a second ciphertext from the DPP server, wherein the second ciphertext is encrypted using at least a responder ephemeral private key, and wherein the second ciphertext includes at least a responder nonce and a responder authentication value;
sending a DPP authentication response to the initiator, wherein the DPP authentication response includes at least the received responder ephemeral public key and the second ciphertext;
and
receiving a third ciphertext from the DPP server, wherein the third ciphertext includes network credentials for the initiator, and wherein the third ciphertext is encrypted using at least the responder ephemeral private key.

5 more elements

A method for conducting a device provisioning protocol (DPP), the method performed by a responder, the method comprising:

establishing a secure session with a DPP server using at least a certificate for the DPP server;
receiving a responder mode from the DPP server, wherein the responder mode signals the DPP server derives a responder ephemeral private key;
receiving a DPP authentication request from an initiator wherein the DPP authentication request includes at least an initiator ephemeral public key, a hash value for a responder bootstrap public key, and a first ciphertext;
sending the DPP authentication request to the DPP server;
receiving a responder ephemeral public key and a second ciphertext from the DPP server, wherein the second ciphertext is encrypted using at least the responder ephemeral private key, and wherein the second ciphertext includes at least a responder nonce and a responder authentication value;
sending a DPP authentication response to the initiator, wherein the DPP authentication response includes at least the received responder ephemeral public key and the second ciphertext;
and
receiving a third ciphertext from the DPP server, wherein the third ciphertext includes network credentials for the initiator, and wherein the third ciphertext is encrypted using at least the responder ephemeral private key.

5 more elements

Dependencies are inferred from the claim text.

A hosted dynamic provisioning protocol with servers and a networked responder

Life of this patent

A hosted dynamic provisioning protocol with servers and a networked responder

Life of this patent

Abstract

Claims20