Abstract:
A method for public key certification in a local network environment, wherein a personal certification authority associated with the local network environment is connected with a first device needing to be certified. Responsive to the connection, a certificate is provided to the device to be certified from the personal certification authority. The devices receiving a certificate may then use the certificate to carry out secure information exchange within the local network environment with other devices having a similar certificate.

Description:
RELATED APPLICATION(S)  
       [0001]    This application claims priority from and incorporates herein by reference the entire disclosures of U.S. Provisional Application Ser. No. 60/350,132 filed Nov. 2, 2001. 
     
    
     
       TECHNICAL FIELD  
         [0002]    The present invention relates to public/private key certification, and more particularly, to the use of personal certification authorities within a personal network.  
         BACKGROUND OF THE INVENTION  
         [0003]    Bluetooth 1.1 cryptographic services are currently provided on the baseband level. Key exchanges, authentications and encryptions are defined to be carried out in a low rate mode. There is currently in development a high rate mode for use in Bluetooth which will provide significantly different connection protocols and cryptographic services than are available in Bluetooth 1.1. From a communications point of view, the main difference between the existing low rate Bluetooth mode and the new Bluetooth high rate mode is that in high rate mode, any participating device may set up a communications link with any other device. Thus, the typical master/slave piconet utilized within low rate Bluetooth is not used within high rate mode Bluetooth. Thus, there is a need to quickly set up a secure communications link between any two devices.  
           [0004]    Current security concepts require that secret keys be exchanged between two devices before security mechanisms may be applied to connections between devices communicating in a low rate mode. This is a rather cumbersome procedure that requires users to provide information such as a pin number. In a high rate mode, it would be necessary to find alternative ways of setting up a secure communication between devices. Additionally, current devices operating in a low rate mode would further benefit from alternative solutions that minimize the amount of user interactions required to initialize a secure link.  
           [0005]    One potential solution involves the use of digital certificates by connecting devices in order to establish proper authentication for a link. Normally, a certification authority issues a public key certificate such as X.509. The certification authority is responsible for determining that the public key in an issued certificate corresponds to a private key of a holder with whom the certificate is being issued. This is necessary in order to maintain the security of a global or a large public key infrastructure The drawback with this type of system is that a central certification authority must issue all necessary certificates used by the communication units and all units must share trusted public root keys This is a tedious process that the user of a personal communication unit would like to avoid. Furthermore, it is very costly to maintain a well-controlled highly secure certification process that can handle thousands of users On the other hand, users desiring to operate on their own local environment, such as a personal area network (PAN) have no benefits inside their PAN from having a centralized certification authority like VeriSign. The user may not wish to delegate the certification authority operation to a centralized entity outside of their personal environment for privacy reasons. Thus, there is a need for providing individuals in personal local networks an option outside of the use of a centralized certification authority such as VeriSign.  
         SUMMARY OF THE INVENTION  
         [0006]    The present invention overcomes the foregoing and other problems with a system and method using a personal certification authority device associated with a local network environment. A device needing to be certified may be connected to the personal certification authority device, and in response to the connection, a certificate is issued to the device needing to be certified. Using the certificate, the device may establish secure information exchange within the local network environment with either the personal certification authority device or other certified devices including a similar certificate. Hence, a certification procedure between the personal certification authority and each device is enough to create secure connections between any two certified device within the local network environment 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0007]    A more complete understanding of the method and apparatus of the present invention may be obtained by reference to the following Detailed Description when taken in conjunction with the accompanying Drawings wherein:  
         [0008]    [0008]FIG. 1 illustrates a number of personal communication devices associated in a personal network;  
         [0009]    [0009]FIG. 2 is a block diagram of a personal certification authority device;  
         [0010]    [0010]FIG. 3 illustrates a communication between a personal certification authority and a device being certified;  
         [0011]    [0011]FIG. 4 is a flow diagram illustrating an initialization process performed between a personal certification authority device and a device to be certified, and  
         [0012]    [0012]FIG. 5 illustrates a certificate provided by a personal certification authority according to the present invention. 
     
    
     DETAILED DESCRIPTION  
       [0013]    Referring now to the drawings, and more particularly to FIG. 1, wherein there is illustrated a number of personal communication devices communicating with each other using, for example, the Bluetooth Wireless Technology. While the present description is made with respect to the use of the Bluetooth Wireless Technology, it should be realized by those skilled in the art that the present invention is applicable to any wireless or wireline communication system or protocol used for communicating among a number of personal communication devices  10 . The system is applicable to personal communication devices using high rate Bluetooth. High rate Bluetooth operates at a bit speed of up to approximately 12 Mb/s The personal communication devices  10  include a personal certification authority device  5 . A personal certification authority enables a user within a home or small office environment to utilize a public key infrastructure within a local, smaller personal network  20 , such as a personal area network. Each unit within the personal network  20  shares a common root public key  25  in addition to a unique private key  30  associated with each personal communication device  10 .  
         [0014]    The personal certification authority device  5  issues certificates. A certificate certifies the public key of the private-public key pair and the identify of a device  10 . The certificate is signed by the personal certification authority device  5 . The public root key of the personal certification authority device  5  is used to verify a personal certification authority device  5  signature for any certificate issued by the personal certification authority device  5 . All personal devices  10  share the same public root key All personal devices  10  are able to verify a certificate issued by the personal certification authority device  5  and consequently the public keys and identities of the other devices  10  in the local network Hence, by exchanging certificates secure communication can be established between any two devices in the local personal network.  
         [0015]    A public/private key communication infrastructure enables a transmitting device to encode a message using a private key. A receiving device decodes the message using a known public key in order to reconstitute the received message. Information enabling decryption and encryption using the public and private keys is provided via the certificate issued by the personal certification authority device  15 . The public and private keys are mathematically linked to one another enabling a message to be encrypted with the private key and decrypted with the public key. The public key is made available to all users and the private key is kept confidential by the individual to whom it is associated.  
         [0016]    Referring now to FIG. 2, there is illustrated the personal certification authority device  15  described in FIG. 1. The personal certification authority device  15  may be any personal communication device, including, but limited to a mobile phone, personal digital assistant, PC, pager, etc. The personal certification authority device  15  includes a display  45  for displaying relevant information to a user and a keypad  50  for enabling a user to interface with the personal certification authority device  15 . The personal certification authority device  15  further includes a private/public keypair  55  enabling encryption and decryption of communications. The private/public keypair  55  may be preconfigured at the manufacturer, or alternatively, the personal certification authority  15  may have the ability to generate a private/public keypair internally. A wireless interface  60  enables the personal certification authority device  15  to interact with other personal devices  10  (FIG. 1) in order to provide certificates thereto as will be more fully described in a moment. The wireless interface  60  preferably implements a Bluetooth connection according to the Bluetooth Wireless Technology. It should be realized that other than a wireless interface  60 , a wireline interface may be implemented according to the system and method of the present invention  
         [0017]    Initialization logic  65  controls a process wherein the personal certification authority device  15  connects with a corresponding personal device  10  and provides a certificate to that device, after authentication of the personal device  10 , enabling secure communication from the personal device  10  to the personal certification authority device  15  or any other personal device  10  also having a provided certificate from the personal certification authority device  15 . In the initialization phase, the user of the personal certification authority device  15  confirms the initialization of a new personal device  10 . This can be done by a special key on the keypad  50  of the personal certification authority device  15 . A memory  70  stores information relating to certificates and/or the ID&#39;s of personal communication device  10  for which the personal certification authority device  15  has issued a certificate.  
         [0018]    Referring now to FIGS. 3 and 4, there is illustrated a situation wherein a personal certification authority device  15  establishing a connection with and initializes a personal device  10  via a wireless communications link  40 . After the personal device  10  has established a conection  40  with the personal certification authority device  15  at step  75 , the personal device  10  transmits at step  80  its identity together with a public key to the personal certification authority  15 , and the personal certificate authority device  15  sends its public key (certificate authority root key) to the personal device  15 . After this has been done, the connection  40  between the personal device  10  and the personal certification authority device  15  may be authenticated at step  85 . However, this step is not required. As part of the authentication, a user of the personal device  10  may be asked to enter one or more pass key values into the personal device  10  or the personal certification authority device  15 . The values entered will be displayed by either or both of the personal device  10  and personal certification authority  15 .  
         [0019]    The personal certification authority requests at step  90  that the personal device  10  prove that the personal device  10  possesses a private key corresponding to the public key sent to the personal certification authority device  15  at step  80 . This may be done, for example, using a challenge response scheme. Additionally, the personal device  15  at step  90  might request the personal CA device  10  to prove that the personal CA device  10  possesses a private key corresponding to the private key sent to the personal device  10  at step  80  Once the personal device  10  has proved that it possesses the private key corresponding to the public key, the personal certification authority device  15  generates a certificate for device  10  at step  95 . The certificate certifies the public key and the identity of the device  10 . Referring now also to FIG. 5, the certificate  115  contains among other information, the identity  120  of the personal device  10 , the public key  125  of the personal device  10  and a digital signature  130  of the personal certification authority device  15 . This list of information is intended to be exemplary and other information may be included within the certificate  115 . It should be understood that any certificate format known in the art, such as X.509, may be used.  
         [0020]    The certificate  115  is forwarded to the personal device  10  at step  100  along with the public root key of the personal certification authority  15  The personal device  10  stores at step  105  the new certificate as well as the new personal certification authority public root key within a memory in the personal device  10 . Preferably, the certificate and the public root key are stored in a tamper resistant memory or other secure storing means. The personal certification authority device  15  stores at step  110  the certificate or an ID of the personal device  10  in a memory  70  containing all the certificates or ID&#39;s for which the personal certification authority  15  has issued a certificate  115 .  
         [0021]    After the initialization has been completed, the personal device  10  possesses a certificate  115  that it can present to all other personal devices  10  attempting to generate a connection  40  with the personal device  10 . The keys in the certificate  15  can be used to authenticate personal device  10 , exchange session keys, sign information or encrypt information. This method makes it possible to create end to end secure relationships between two personal devices  10 . In particular, bonding with other personal devices  10  that have been certified by the personal certification authority device  15  can easily be automated without user interaction The only requirement is that all personal devices  10  are initialized with the same personal certification authority device  15 . This is useful for secure or peer to peer communications and small personal networks like Bluetooth, Bluetooth high rate (HR), or IEEE 802.11 networks.  
         [0022]    The previous description is of a preferred embodiment for implementing the invention, and the scope of the invention should not necessarily be limited by this description. The scope of the present invention is instead defined by the following claims