Flexible system and method to manage digital certificates in a wireless network

1. A system, comprising:

a digital storage device; and

one or more processors in communication with the digital storage device, the one or more processors being configured to implement:

a root certificate management system (root CMS) configured to process requests for digital certificates and to issue root certificates, and configured to automatically authenticate surrogate certificate management systems (sur-CMSs), and configured to automatically process certificate requests and to issue certificate bundles to sur-CMSs that are successfully authenticated; and

two or more sur-CMSs, each of said two or more sur-CMSs having one or more base stations assigned to it within a respective region;

wherein each of said two or more sur-CMSs is configured to automatically authenticate its own base stations, and configured to automatically process certificate requests and to issue certificate bundles to base stations that are successfully authenticated;

wherein each certificate bundle issued to a base station includes: a digital certificate, signed by an issuing sur-CMS, of a public key of such base station; and at least one further digital certificate, including a self-signed certificate of the root CMS; and

wherein each of said two or more sur-CMSs is configured to receive a signal from a base station indicating a success or failure of an authenticating transaction relating to a certificate bundle.

2. The system of claim 1 , wherein the root CMS and at least one of said two or more sur-CMSs are further configured to automatically authenticate at least one security gateway aggregator (SEG) in one or more of the respective regions and to automatically process certificate requests and to issue certificate bundles to SEGs that are successfully authenticated.

3. The system of claim 1 , wherein the root CMS is configured to be authenticated by a certification authority (CA) and to receive a digital certificate issued by the CA, wherein the digital certificate binds a public key to the root CMS.

4. The system of claim 3 , wherein each certificate bundle issued to a base station further includes said digital certificate that binds a public key to the root CMS, and further includes a self-signed certificate of the CA.

5. The system of claim 3 , wherein the root CMS is configured to authenticate the CA and to process certificate requests and to issue a digital certificate to the CA, wherein the digital certificate binds a public key to the CA.

6. A method to be performed in a wireless network of the kind that uses a certificate management system (CMS) to distribute digital certificates, comprising:

performing, by a surrogate CMS (sur-CMS), an authentication procedure that results in the sur-CMS obtaining a digital certificate from a root CMS;

automatically authenticating, by the sur-CMS, one or more base stations; and

automatically issuing, by the sur-CMS, a digital certificate bundle to each authenticated base station, wherein the bundle includes a digital certificate, signed by the issuing sur-CMS, of a public key of such base station; and at least one further digital certificate, including a self-signed certificate of the root CMS, and

wherein the sur-CMS is configured to receive a signal from a base station indicating a success or failure of an authenticating transaction relating to a certificate bundle.

7. The method of claim 6 , further comprising:

automatically authenticating, by the sur-CMS, at least one security gateway aggregator (SEG), and

automatically issuing, by the sur-CMS, a digital certificate bundle to each authenticated SEG.

8. The method of claim 6 , wherein the digital certificate bundle issued to each authenticated base station further includes a digital certificate, issued by the root CMS, of a Certification Authority distinct from the root CMS.

9. A method to be performed in a wireless network of the kind that uses a certificate management system (CMS) to distribute digital certificates, comprising:

performing, by a base station, an authentication procedure that results in the base station receiving a digital certificate bundle from a surrogate CMS (sur-CMS); and

performing, by the base station, an authentication procedure that results in the base station setting up a secure tunnel with a security gateway aggregator (SEG);

wherein the certificate bundle received from the sur-CMS includes a digital certificate signed by the sur-CMS, and a digital certificate self-signed by a root CMS; and

wherein the base station is configured to transmit to the sur-CMS a signal indicating a success or failure of an authenticating transaction relating to a certificate bundle.

10. The method of claim 9 , wherein:

the certificate bundle received from the sur-CMS further includes a digital certificate, issued by the root CMS, of a Certification Authority (CA) distinct from the root CMS; and

the authentication procedure between the base station and the SEG uses at least:

the digital certificate self-signed by the root CMS, and

the digital certificate issued by the root CMS of a CA distinct from the root CMS.