公开(公告)号：US09130928B2

公开(公告)日：2015-09-08

申请号：US13087847

申请日：2011-04-15

申请人： Xin Qiu ,  Alexander Medvinsky ,  Stuart P. Moskovics ,  Jason A. Pasion ,  Eric J. Sprunk ,  Fan Wang ,  Ting Yao

发明人： Xin Qiu ,  Alexander Medvinsky ,  Stuart P. Moskovics ,  Jason A. Pasion ,  Eric J. Sprunk ,  Fan Wang ,  Ting Yao

IPC分类号： H04L29/06 ,  G06F21/57

CPC分类号： H04L63/0823 ,  G06F21/572 ,  H04L63/06 ,  H04L2463/102

摘要： A method for updating network-enabled devices with new identity data includes generating a plurality of new identity data records and loading the new identity data records onto an update server. A request is received at the update server for new identity data from at least one network-enabled device having a previously assigned identity linked to an identifier. The previously assigned identifier is linked to a new identifier that is linked to one of the new identity data records. One or more new identity data records are securely delivered to the network-enabled device.

摘要翻译： 用新的身份数据更新启用网络的设备的方法包括生成多个新的身份数据记录并将新的身份数据记录加载到更新服务器上。 在更新服务器处接收到来自具有链接到标识符的先前分配的身份的至少一个启用网络的设备的新身份数据的请求。 先前分配的标识符被链接到链接到新的身份数据记录之一的新标识符。 一个或多个新的身份数据记录被安全地传送到启用网络的设备。

公开(公告)号：US08627083B2

公开(公告)日：2014-01-07

申请号：US13267672

申请日：2011-10-06

申请人： Xin Qiu ,  Alexander Medvinsky ,  Stuart P. Moskovics ,  Jason A. Pasion ,  Fan Wang ,  Ting Yao

发明人： Xin Qiu ,  Alexander Medvinsky ,  Stuart P. Moskovics ,  Jason A. Pasion ,  Fan Wang ,  Ting Yao

IPC分类号： H04L9/32

CPC分类号： H04L9/006 ,  H04L9/0891 ,  H04L9/14 ,  H04L9/321

摘要： One or more servers are provided including a session manager, authentication module, authorization module, encryption module, database, and protocol handler. The session manager is configured to receive requests for new identity data from network-enabled devices. Each request is authenticated first by the update server via its authentication module by validating the signature of the request message as well as the certificate chain trusted by the update server. The authorization module is configured to determine if the network-enabled devices specified on a whitelist are authorized to be provisioned with new identity data. The database is configured to receive new identity records generated by an identity data generation system. Each of the new identity records includes a new identifier. The new identifier is not associated or linked to any previously assigned/used identifiers and identity data, thus all the new identity records are generated independently and then loaded to the update server.

摘要翻译： 提供一个或多个服务器，包括会话管理器，认证模块，授权模块，加密模块，数据库和协议处理程序。 会话管理器被配置为从网络启用的设备接收新的身份数据的请求。 通过验证请求消息的签名以及由更新服务器信任的证书链，通过其认证模块，更新服务器首先对每个请求进行认证。 授权模块被配置为确定白名单上指定的启用网络的设备是否被授权为新的身份数据提供。 数据库被配置为接收由身份数据生成系统生成的新的身份记录。 每个新的身份记录都包含一个新的标识符。 新标识符不与任何先前分配/使用的标识符和身份数据相关联或链接，因此所有新的身份记录都是独立生成的，然后加载到更新服务器。

公开(公告)号：US20120089839A1

公开(公告)日：2012-04-12

申请号：US13267672

申请日：2011-10-06

申请人： Xin Qiu ,  Alexander Medvinsky ,  Stuart P. Moskovics ,  Jason A. Pasion ,  Fan Wang ,  Ting Yao

发明人： Xin Qiu ,  Alexander Medvinsky ,  Stuart P. Moskovics ,  Jason A. Pasion ,  Fan Wang ,  Ting Yao

IPC分类号： H04L9/32 ,  H04L9/30

CPC分类号： H04L9/006 ,  H04L9/0891 ,  H04L9/14 ,  H04L9/321

摘要： One or more servers are provided including a session manager, authentication module, authorization module, encryption module, database, and protocol handler. The session manager is configured to receive requests for new identity data from network-enabled devices. Each request is authenticated first by the update server via its authentication module by validating the signature of the request message as well as the certificate chain trusted by the update server. The authorization module is configured to determine if the network-enabled devices specified on a whitelist are authorized to be provisioned with new identity data. The database is configured to receive new identity records generated by an identity data generation system. Each of the new identity records includes a new identifier. The new identifier is not associated or linked to any previously assigned/used identifiers and identity data, thus all the new identity records are generated independently and then loaded to the update server.

摘要翻译： 提供一个或多个服务器，包括会话管理器，认证模块，授权模块，加密模块，数据库和协议处理程序。 会话管理器被配置为从网络启用的设备接收新的身份数据的请求。 通过验证请求消息的签名以及由更新服务器信任的证书链，通过其认证模块，更新服务器首先对每个请求进行认证。 授权模块被配置为确定白名单上指定的启用网络的设备是否被授权为新的身份数据提供。 数据库被配置为接收由身份数据生成系统生成的新的身份记录。 每个新的身份记录都包含一个新的标识符。 新标识符不与任何先前分配/使用的标识符和身份数据相关联或链接，因此所有新的身份记录都是独立生成的，然后加载到更新服务器。

公开(公告)号：US20110258685A1

公开(公告)日：2011-10-20

申请号：US13087847

申请日：2011-04-15

申请人： Xin Qiu ,  Alexander Medvinsky ,  Stuart P. Moskovics ,  Jason A. Pasion ,  Eric J. Sprunk ,  Fan Wang ,  Ting Yao

发明人： Xin Qiu ,  Alexander Medvinsky ,  Stuart P. Moskovics ,  Jason A. Pasion ,  Eric J. Sprunk ,  Fan Wang ,  Ting Yao

IPC分类号： H04L9/32 ,  G06F21/00

CPC分类号： H04L63/0823 ,  G06F21/572 ,  H04L63/06 ,  H04L2463/102

摘要： A method for updating network-enabled devices with new identity data includes generating a plurality of new identity data records and loading the new identity data records onto an update server. A request is received at the update server for new identity data from at least one network-enabled device having a previously assigned identity linked to an identifier. The previously assigned identifier is linked to a new identifier that is linked to one of the new identity data records. One or more new identity data records are securely delivered to the network-enabled device.

摘要翻译： 用新的身份数据更新启用网络的设备的方法包括生成多个新的身份数据记录并将新的身份数据记录加载到更新服务器上。 在更新服务器处接收到来自具有链接到标识符的先前分配的身份的至少一个启用网络的设备的新身份数据的请求。 先前分配的标识符被链接到链接到新的身份数据记录之一的新标识符。 一个或多个新的身份数据记录被安全地传送到启用网络的设备。

公开(公告)号：US20110258434A1

公开(公告)日：2011-10-20

申请号：US13087972

申请日：2011-04-15

申请人： Xin Qiu ,  Alexander Medvinsky ,  Stuart P. Moskovics ,  Greg N. Nakanishi ,  Jason A. Pasion ,  Fan Wang ,  Ting Yao

发明人： Xin Qiu ,  Alexander Medvinsky ,  Stuart P. Moskovics ,  Greg N. Nakanishi ,  Jason A. Pasion ,  Fan Wang ,  Ting Yao

IPC分类号： H04L9/00

CPC分类号： H04L63/062 ,  H04L9/006 ,  H04L9/0825 ,  H04L9/0866 ,  H04L9/0891 ,  H04L63/0823

摘要： A system for generating new identity data for network-enabled devices includes a whitelist reader configured to extract attributes from a whitelist. The whitelist includes, for each device specified in the whitelist, a previously assigned identifier of the first type. The previously assigned identifiers of the first type are linked to identity data previously provisioned in each of the respective devices. A data retrieval module is configured to receive the identifiers of the first type from the whitelist reader and, based on each of the identifiers, retrieve each of the previously provisioned identity data records linked thereto. A new data generation module is configured to (i) obtain a cryptographic key associated with the identity data previously provisioned in the devices specified on the whitelist and the corresponding identifiers of the first type, (ii) generate new identity data records each linked to a new identifier and (iii) encrypt each of the new identity data records with one of the cryptographic keys and link each new identity data record to the identifier of the first type corresponding to each respective cryptographic key. A data output module is configured to load onto an external source the encrypted new identity data records along with their respective new identifiers and their respective previously assigned identifiers of the first type.

摘要翻译： 用于为启用网络的设备生成新的身份数据的系统包括被配置为从白名单中提取属性的白名单阅读器。 对于白名单中指定的每个设备，白名单包括先前分配的第一类型的标识符。 先前分配的第一类型的标识符被链接到先前在每个相应设备中提供的标识数据。 数据检索模块被配置为从白名单读取器接收第一类型的标识符，并且基于每个标识符，检索与之相关联的先前提供的身份数据记录中的每一个。 新的数据生成模块被配置为（i）获得与先前在白名单上指定的设备中提供的身份数据和第一类型的相应标识符相关联的密码密钥，（ii）生成新的身份数据记录， 新标识符和（iii）使用密码密钥之一加密每个新的身份数据记录，并将每个新的身份数据记录链接到与每个相应密码密钥对应的第一类型的标识符。 数据输出模块被配置为将加密的新身份数据记录及其各自的新标识符及其各自先前分配的第一类型的标识符加载到外部源上。

公开(公告)号：US08370626B2

公开(公告)日：2013-02-05

申请号：US12854922

申请日：2010-08-12

申请人： Jiajing Liu ,  Thomas J. Barbour ,  Liqiang Chen ,  Ying Chen ,  Wei Lin Chou ,  Christopher P. Gardner ,  Stuart P. Moskovics ,  Xin Qiu ,  Chia Ling Tsai ,  Ting Yao

发明人： Jiajing Liu ,  Thomas J. Barbour ,  Liqiang Chen ,  Ying Chen ,  Wei Lin Chou ,  Christopher P. Gardner ,  Stuart P. Moskovics ,  Xin Qiu ,  Chia Ling Tsai ,  Ting Yao

IPC分类号： H04L9/00

CPC分类号： H04L9/3265 ,  H04L9/007

摘要： A method and apparatus are provided for generating identity data to be provisioned in product devices that are a part of a project. The method includes establishing a template associated with each CA in a hierarchical chain of CAs having a root CA at a highest level in the chain and a signing CA at a lowest level in the chain. The template associated with the signing CA inherits mandatory attribute fields specified in the root CA and any intermediate CA in the hierarchical chain. The mandatory attribute fields are user-specifiable fields to be populated with PKI data. A configuration file is generated upon receipt of an order for digital certificates using PKI data provided by a user to populate the mandatory attribute fields of the template associated with the signing CA. The digital certificates requested in the order are generated using the PKI data in the configuration file.

摘要翻译： 提供了一种用于生成作为项目的一部分的产品设备中提供的身份数据的方法和装置。 该方法包括在具有链中最高级别的根CA的CA的分级链中建立与每个CA相关联的模板以及链中最低级的签名CA。 与签名CA相关联的模板继承根CA中指定的强制属性字段和层级链中的任何中间CA。 强制属性字段是要填充PKI数据的用户指定字段。 使用由用户提供的PKI数据接收到数字证书的订单时，生成配置文件来填充与签名CA相关联的模板的强制属性字段。 使用配置文件中的PKI数据生成订单中请求的数字证书。

公开(公告)号：US20110047374A1

公开(公告)日：2011-02-24

申请号：US12854922

申请日：2010-08-12

申请人： Jiajing Liu ,  Thomas J. Barbour ,  Liqiang Chen ,  Ying Chen ,  Wei Lin Chou ,  Christopher P. Gardner ,  Stuart P. Moskovics ,  Xin Qiu ,  Chia Ling Tsai ,  Ting Yao

发明人： Jiajing Liu ,  Thomas J. Barbour ,  Liqiang Chen ,  Ying Chen ,  Wei Lin Chou ,  Christopher P. Gardner ,  Stuart P. Moskovics ,  Xin Qiu ,  Chia Ling Tsai ,  Ting Yao

IPC分类号： H04L9/00

CPC分类号： H04L9/3265 ,  H04L9/007

摘要： A method and apparatus are provided for generating identity data to be provisioned in product devices that are a part of a project. The method includes establishing a template associated with each CA in a hierarchical chain of CAs having a root CA at a highest level in the chain and a signing CA at a lowest level in the chain. The template associated with the signing CA inherits mandatory attribute fields specified in the root CA and any intermediate CA in the hierarchical chain. The mandatory attribute fields are user-specifiable fields to be populated with PKI data. A configuration file is generated upon receipt of an order for digital certificates using PKI data provided by a user to populate the mandatory attribute fields of the template associated with the signing CA. The digital certificates requested in the order are generated using the PKI data in the configuration file.

摘要翻译： 提供了一种用于生成作为项目的一部分的产品设备中提供的身份数据的方法和装置。 该方法包括在具有链中最高级别的根CA的CA的分级链中建立与每个CA相关联的模板以及链中最低级的签名CA。 与签名CA相关联的模板继承根CA中指定的强制属性字段和层级链中的任何中间CA。 强制属性字段是要填充PKI数据的用户指定字段。 使用由用户提供的PKI数据接收到数字证书的订单时，生成配置文件来填充与签名CA相关联的模板的强制属性字段。 使用配置文件中的PKI数据生成订单中请求的数字证书。

公开(公告)号：US20120143766A1

公开(公告)日：2012-06-07

申请号：US13238850

申请日：2011-09-21

申请人： Jinsong Zheng ,  Tat Keung Chan ,  Liqiang Chen ,  Greg N. Nakanishi ,  Jason A. Pasion ,  Xin Qiu ,  Ting Yao

发明人： Jinsong Zheng ,  Tat Keung Chan ,  Liqiang Chen ,  Greg N. Nakanishi ,  Jason A. Pasion ,  Xin Qiu ,  Ting Yao

IPC分类号： G06F21/22

CPC分类号： G06F21/105 ,  G06Q30/06 ,  G06Q2220/18

摘要： Disclosed is a manufacturing process and feature licensing system for provisioning personalized (device-unique) licenses to devices. The secure system uses a secure key wrapping mechanism to deliver the LSK to LPS. Another feature is that various network communication links are secured using standard security protocol. Application messages, license templates, licenses are digitally signed. The system is flexible, configured to allow multiple manufacturers and to allow various feature configurations via the use of License Template; scalable, as it is possible to use multiple LPS hosts to serve multiple programming stations; and available in that the delegation of license signing capability from CLS to LPS eliminates the dependency on unreliable Internet connections. Redundant LPS hosts provide high level of availability required for high volume license provisioning. The system is traceable: license and device association are replicated back to the CLS to provide full license request and generation traceability.

摘要翻译： 公开了一种用于向设备提供个性化（设备唯一）许可证的制造过程和特征许可系统。 安全系统使用安全的钥匙包装机构将LSK传送到LPS。 另一个特征是使用标准安全协议来保护各种网络通信链路。 应用程序消息，许可证模板，许可证都经过数字签名。 该系统灵活，配置为允许多个制造商通过使用许可证模板来允许各种功能配置; 可扩展的，因为可以使用多个LPS主机来服务多个编程站; 并且可用于从CLS到LPS的许可证签名能力的授权消除了对不可靠的因特网连接的依赖。 冗余LPS主机为高容量许可证配置提供了高水平的可用性。 系统是可追溯的：许可证和设备关联被复制回CLS以提供完整的许可证请求和生成可追溯性。

公开(公告)号：US09646332B2

公开(公告)日：2017-05-09

申请号：US13238850

申请日：2011-09-21

申请人： Jinsong Zheng ,  Tat Keung Chan ,  Liqiang Chen ,  Greg N. Nakanishi ,  Jason A. Pasion ,  Xin Qiu ,  Ting Yao

发明人： Jinsong Zheng ,  Tat Keung Chan ,  Liqiang Chen ,  Greg N. Nakanishi ,  Jason A. Pasion ,  Xin Qiu ,  Ting Yao

IPC分类号： G06F21/00 ,  G06Q30/06

CPC分类号： G06F21/105 ,  G06Q30/06 ,  G06Q2220/18

摘要： Disclosed is a manufacturing process and feature licensing system for provisioning personalized (device-unique) licenses to devices. The secure system uses a secure key wrapping mechanism to deliver the LSK to LPS. Another feature is that various network communication links are secured using standard security protocol. Application messages, license templates, licenses are digitally signed. The system is flexible, configured to allow multiple manufacturers and to allow various feature configurations via the use of License Template; scalable, as it is possible to use multiple LPS hosts to serve multiple programming stations; and available in that the delegation of license signing capability from CLS to LPS eliminates the dependency on unreliable Internet connections. Redundant LPS hosts provide high level of availability required for high volume license provisioning. The system is traceable: license and device association are replicated back to the CLS to provide full license request and generation traceability.

公开(公告)号：US20110197061A1

公开(公告)日：2011-08-11

申请号：US12854920

申请日：2010-08-12

申请人： Wei Lin Chou ,  Thomas J. Barbour ,  Liqiang Chen ,  Ying Chen ,  Christopher P. Gardner ,  Jiajing Liu ,  Oscar Jiang ,  Xin Qiu ,  Kyle W. Stewart ,  Chia Ling Tsai ,  Fan Wang ,  Ting Yao

发明人： Wei Lin Chou ,  Thomas J. Barbour ,  Liqiang Chen ,  Ying Chen ,  Christopher P. Gardner ,  Jiajing Liu ,  Oscar Jiang ,  Xin Qiu ,  Kyle W. Stewart ,  Chia Ling Tsai ,  Fan Wang ,  Ting Yao

IPC分类号： H04L29/06

CPC分类号： H04L9/006 ,  H04L9/3265

摘要： A method and apparatus is provided for establishing a process for provisioning a digital certificate service delivered by a PKI system. The method includes receiving a request for a digital certificate service and receiving data specifying a project that includes at least one product to be provisioned with a digital certificate. Data specifying an identification of an owner organization of the project and at least one participant organization participating in the project is also received. Attributes with which PKI data to be included in the digital certificates is to comply is received from the owner organization. Based on the received data and attributes, an account is established for each of the organizations associated with the project through which users associated with each of the organizations can respectively request digital certificates for the at least one product in accordance with the attributes received from the owner organization.

摘要翻译： 提供了一种用于建立用于提供由PKI系统提供的数字证书服务的过程的方法和装置。 该方法包括接收对数字证书服务的请求，并且接收指定项目的数据，所述项目包括至少一个要被提供数字证书的产品。 还收到了指定项目所有者组织的标识和参与该项目的至少一个参与组织的数据。 从所有者组织收到要包含在数字证书中的PKI数据符合的属性。 根据接收到的数据和属性，为与项目相关联的每个组织建立一个帐户，通过该帐户，与每个组织相关联的用户可以根据从所有者接收的属性分别为至少一个产品请求数字证书 组织。