Device introduction and access control framework

Abstract

In an embodiment, a method includes registering applications and network services for notification of an out-of-band introduction, and using the out-of-band introduction to bootstrap secure in-band provisioning of credentials and policies that are used to control subsequent access and resource sharing on an in-band channel. In another embodiment, an apparatus implements the method.

1 . (canceled) 
     
     
         2 . An apparatus of a station (STA), configured to operate as an enrollee and implement at least part of a registration protocol, the apparatus comprising:
 processing circuitry configured to:
 configure the STA to send a first registration protocol message (M1), for transmission to a registrar device, the processing circuitry being configurable to send the M for transmission on an out-of-band (OOB) channel and being configurable to send the M1 for transmission on an in-band channel, the M1 being part of a registration protocol and indicating that the STA is an enrollee seeking to join a wireless local area network (WLAN) domain, wherein the M1 includes a public key associated with the enrollee; 
 receive a second registration protocol message (M2), the processing circuitry being configurable to cause the STA to receive the M2 on the in-band channel and being configurable to cause the STA to receive the M2 on an OOB channel, to determine a shared secret, wherein the shared secret is to authenticate an in-band communication between the enrollee and the registrar device, the in-band communication including domain credential issuance for the enrollee; and 
 encode a third registration protocol message (M3), wherein the M3 includes one or more indications to confirm knowledge of the shared secret by the enrollee device; and 
 memory configured to store at least the shared secret. 
   
     
     
         3 . The apparatus of  claim 2 , wherein the shared secret is randomly generated. 
     
     
         4 . The apparatus of  claim 2 , wherein the processing circuitry is configured to configure the STA to generate at least one master session key to protect at least one of M1, M2, and M3. 
     
     
         5 . The apparatus of  claim 4 , wherein the master session key is a symmetric key. 
     
     
         6 . The apparatus of  claim 2 , wherein the processing circuitry is configured to configure the STA to generate a key wrap function to protect at least one of M1, M2, and M3. 
     
     
         7 . The apparatus of  claim 2 , wherein the processing circuitry is configured to: generate a first random number, and wherein the M1 further includes the first random number. 
     
     
         8 . The apparatus of  claim 2 , wherein the M2 further includes a second random number, the second random number generated by the registrar device. 
     
     
         9 . The apparatus of  claim 8 , wherein the M2 further includes the first random number. 
     
     
         10 . The apparatus of  claim 9 , wherein the first random number is a first nonce and the second random number is a second nonce. 
     
     
         11 . The apparatus of  claim 2 , wherein the M2 further includes a public key associated with the registrar device. 
     
     
         12 . The apparatus of  claim 2 , wherein the domain credential issuance includes the issuance to the enrollee of WLAN credentials. 
     
     
         13 . The apparatus of  claim 2 , wherein the processing circuitry is configured to generate a hash of at least the public key associated with the registrar device. 
     
     
         14 . The apparatus of  claim 2 , wherein the OOB channel for transmission of M1 is the same as the OOB channel for reception of the M2. 
     
     
         15 . The apparatus of  claim 2 , wherein the OOB channel for transmission of M1 is different from the OOB channel for reception of the M2. 
     
     
         16 . The apparatus of  claim 2 , wherein the processing circuitry is configured to configure the STA to receive the M2 over the OOB channel, and wherein the M2 includes an indication of the shared secret encrypted according to the public key associated with the enrollee. 
     
     
         17 . The apparatus of  claim 2 , wherein the one or more indications to confirm knowledge of the shared secret by the enrollee device are encrypted according to a public key associated with the registrar device. 
     
     
         18 . The apparatus of  claim 2 , wherein the M2 includes an indication of in-band connection information for the in-band communication between the enrollee and the registrar device. 
     
     
         19 . The apparatus of  claim 18 , wherein the processing circuitry is configured to configure the STA to transmit the M3 to the registrar device over an in-band channel, according to the in-band connection information. 
     
     
         20 . The apparatus of  claim 19 , wherein the processing circuitry is configured to receive a fourth registration protocol message (M4), from the registrar device over the in-band channel, to determine a client certificate associated with the domain credential issuance for the enrollee. 
     
     
         21 . The apparatus of  claim 20 , wherein the processing circuitry is configured to configure the STA to receive the M4 from the registrar device in response to a verification of the enrollee, wherein the verification of the enrollee is based on the M3. 
     
     
         22 . The apparatus of  claim 20 , wherein client certificate is encrypted according to the public key associated with the enrollee. 
     
     
         23 . An apparatus of a registrar device configured to implement at least part of a registration protocol, the apparatus comprising:
 processing circuitry configured to:
 receive a first registration protocol message (M1), the processing circuitry being configurable to cause the registrar device to receive the M1 on an in-band channel and being configurable to cause the registrar device to receive the M1 on an out-of-band (OOB) channel, the M1 being part of a registration protocol and indicating that a station (STA) is an enrollee seeking to join a wireless local area network (WLAN) domain, wherein the M1 includes a public key associated with the enrollee; 
 configure the STA to send a second registration protocol message (M2), for transmission to the STA, the processing circuitry being configurable to send the M2 for transmission on an OOB channel and being configurable to send the M2 for transmission on the in-band channel, to determine a shared secret, wherein the shared secret is to authenticate an in-band communication between the enrollee and the registrar device, the in-band communication including domain credential issuance for the enrollee; and 
 receive a third registration protocol message (M3), wherein the M3 includes one or more indications to confirm knowledge of the shared secret by the enrollee device; and 
 memory configured to store at least the shared secret. 
   
     
     
         24 . The apparatus of  claim 23 , wherein the M1 further includes a first random number, the first random number generated by the enrollee. 
     
     
         25 . The apparatus of  claim 23 , wherein the processing circuitry is configured to:
 generate a second random number, and wherein the M2 further includes the second random number and the first random number.   
     
     
         26 . The apparatus of  claim 23 , wherein the processing circuitry is configured to generate a hash of at least the public key associated with the enrollee. 
     
     
         27 . A computer-readable hardware storage device that stores instructions for execution by one or more processors of a station (STA), the instructions to configure the one or more processors to:
 configure the STA to send a first registration protocol message (M1), for transmission to a registrar device, the instructions to configure the processing circuitry to be configurable to send the M1 for transmission on an out-of-band (OOB) channel and being configurable to send the M1 for transmission on an in-band channel, the M1 being part of a registration protocol and indicating that the STA is an enrollee seeking to join a wireless local area network (WLAN) domain, wherein the M1 includes a public key associated with the enrollee;   receive a second registration protocol message (M2), the instructions to configure the processing circuitry to be configurable to cause the STA to receive the M2 on the in-band channel and to be configurable to cause the STA to receive the M2 on an OOB channel, to determine a shared secret, wherein the shared secret is to authenticate an in-band communication between the enrollee and the registrar device, the in-band communication including domain credential issuance for the enrollee; and   encode a third registration protocol message (M3), wherein the M3 includes one or more indications to confirm knowledge of the shared secret by the enrollee device.   
     
     
         28 . A computer-readable hardware storage device that stores instructions for execution by one or more processors of a registrar device, the instructions to configure the one or more processors to:
 receive a first registration protocol message (M1), the instructions to configure the processing circuitry to be configurable to cause the registrar device to receive the M1 on an in-band channel and to be configurable to cause the registrar device to receive the M1 on an out-of-band (OOB) channel, the M1 being part of a registration protocol and indicating that a station (STA) is an enrollee seeking to join a wireless local area network (WLAN) domain, wherein the M1 includes a public key associated with the enrollee;   configure the STA to send a second registration protocol message (M2), for transmission to the STA, the instructions to configure the processing circuitry to be configurable to send the M2 for transmission on an OOB channel and to be configurable to send the M2 for transmission on the in-band channel, to determine a shared secret, wherein the shared secret is to authenticate an in-band communication between the enrollee and the registrar device, the in-band communication including domain credential issuance for the enrollee; and   receive a third registration protocol message (M3), wherein the M3 includes one or more indications to confirm knowledge of the shared secret by the enrollee device.   
     
     
         29 . An apparatus of a station (STA), the apparatus comprising:
 processing circuitry configured to:
 encode a first registration protocol message (M1), for transmission to a registrar device, the processing circuitry being configurable to encode the M1 for transmission on an out-of-band (OOB) channel and being configurable to encode the M1 for transmission on an in-band channel, the M1 being part of a registration protocol and indicating that the STA is an enrollee seeking to join a wireless local area network (WLAN) domain, wherein the M1 includes a public key associated with the enrollee; 
 decode a second registration protocol message (M2), the processing circuitry being configurable to decode the M2 received on the in-band channel and being configurable to decode the M2 received on an OOB channel, to determine a shared secret, wherein the shared secret is to authenticate an in-band communication between the enrollee and the registrar device, the in-band communication including domain credential issuance for the enrollee; and 
 encode a third registration protocol message (M3), wherein the M3 includes one or more indications to confirm knowledge of the shared secret by the enrollee device; and 
 memory configured to store at least the shared secret. 
   
     
     
         30 . An apparatus of a registrar device, the apparatus comprising:
 processing circuitry configured to:
 decode a first registration protocol message (M1), the processing circuitry being configurable to decode the M1 received on an in-band channel and being configurable to decode the M1 received over an out-of-band (OOB) channel, the M1 being part of a registration protocol and indicating that a station (STA) is an enrollee seeking to join a wireless local area network (WLAN) domain, wherein the M1 includes a public key associated with the enrollee; 
 encode a second registration protocol message (M2), for transmission to the STA, the processing circuitry being configurable to encode the M2 for transmission on an OOB channel and being configurable to encode the M2 for transmission on the in-band channel, to determine a shared secret, wherein the shared secret is to authenticate an in-band communication between the enrollee and the registrar device, the in-band communication including domain credential issuance for the enrollee; and 
 decode a third registration protocol message (M3), wherein the M3 includes one or more indications to confirm knowledge of the shared secret by the enrollee device; and 
 memory configured to store at least the shared secret.