Subscriber Unit Self-Provisioning via Wireless PKI Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing methods for provisioning subscriber units in communication systems are prone to human error, slow, and insecure, requiring manual processes that are costly and inefficient, with potential security breaches due to the need for physical connection and manual recording of configuration parameters.
Innovation Solution
A method for secure, remote self-provisioning of subscriber units, where the unit receives provisioning data from a field provisioning interface and generates a certificate signing request to obtain a digital certificate, enabling it to be configured and authenticated remotely through a security provisioning server, using a public key infrastructure (PKI) service provider.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual provisioning processes are used to customize and program subscriber units, then configuration accuracy and security control are improved, but provisioning speed and efficiency deteriorate
Solution Approach 1:
The subscriber unit automatically performs self-provisioning by receiving provisioning data through the radio interface and configuring itself without technician intervention. The unit autonomously receives configuration parameters, programming data, and keying materials, then self-configures to operate on the communication system, eliminating manual processes while maintaining security through automated authentication protocols.
Solution Approach 2:
The patent replaces physical mechanical connections (technician physically connecting subscriber unit to provisioning devices) with wireless radio interface communication. Provisioning data is transmitted electronically through the air interface, substituting the mechanical connection and manual data entry process with automated wireless data transmission and electronic configuration.
2Reliability
If manual provisioning processes are used to configure subscriber units, then security control is improved, but provisioning time and cost deteriorate
Solution Approach 1:
The subscriber unit autonomously completes the entire provisioning process by receiving data wirelessly and self-configuring, eliminating the time-consuming manual processes of physical connection, data entry, and configuration while maintaining security through automated authentication and encrypted data transmission.
Solution Approach 2:
The system performs preliminary authentication and authorization checks before provisioning data is transmitted, ensuring security is established in advance. The subscriber unit is authenticated against the database, and provisioning data is prepared and encrypted beforehand, allowing rapid secure provisioning without time-consuming manual verification during the actual configuration process.
3Productivity
If database is opened during initial provisioning period to allow automatic registration, then provisioning speed is improved, but security risk deteriorates
Solution Approach 1:
The patent replaces the insecure open database registration process with secure wireless transmission of provisioning data through the radio interface. Configuration parameters, programming data, and keying materials are transmitted encrypted over the air to the subscriber unit, which then self-configures autonomously, eliminating the need to open the database and automatically register devices, thus maintaining security while achieving fast provisioning.
Solution Approach 2:
The patent introduces secure encrypted communication channels and authentication protocols as intermediaries between the provisioning system and subscriber units. Instead of direct open database access, all provisioning data transmission occurs through secured wireless channels with cryptographic protection, acting as an intermediary layer that enables fast automated provisioning while preventing security breaches.
4Reliability
If physical reprogramming is required when subscriber unit is compromised, then security control is improved, but operational efficiency and cost deteriorate
Solution Approach 1:
The patent replaces physical reprogramming operations with wireless re-provisioning capability. When a subscriber unit is compromised or needs reconfiguration, provisioning data can be transmitted wirelessly through the radio interface and the unit can self-reconfigure autonomously, eliminating the need for costly and inefficient physical recall and manual reprogramming while maintaining security through encrypted transmission and authenticated access.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method to enable remote, secure, self-provisioning of a subscriber unit includes, a security provisioning server (130): receiving, from a subscriber unit, a certificate signing request having subscriber unit configuration trigger data; generating (428) provisioning data for the subscriber unit using the subscriber unit configuration trigger data; and in response to the certificate signing request, providing to the subscriber unit the provisioning data and a subscriber unit certificate having authorization attributes associated with the provisioning data, to enable the self-provisioning of the subscriber unit.