Connection authorization from a communication device to an application
Connection authorization from a communication device (CD) to an application server (AS) uses an electronic device (ED) to provide a first dataset to a security server (SS) in response to a first request, the first dataset related to a certificate of the ED. The ED retrieves an intermediary certificate generated by the SS based on the first dataset and signed by the SS. When the ED is connected to a CD intended to be introduced in a secured network, the ED receives a second request from the CD including a second dataset related to a certificate of the CD. The ED then generates a third dataset related to a signature of certificate of the CD and to the intermediary certificate. The ED thereafter sends the third dataset to the CD to obtain authorization to access to the secure network from the AS by using the third dataset.
1 . A method for connection authorization from a communication device to an application server, comprising in an electronic device:
providing a first dataset to a security server in response to a first request, wherein the first dataset is related to a certificate of the electronic device,
retrieving an intermediary certificate from the security server, wherein the intermediary certificate is generated by the security server based on the first dataset and signed by the security server,
when connecting the electronic device to a communication device intended to be introduced in a secured network for the first time, receiving by the electronic device a second request from the communication device, the second request comprising a second dataset related to a certificate of the communication device,
generating a third dataset related to a signature of certificate of the communication device by the electronic device and to the intermediary certificate, and
sending the third dataset to the communication device, wherein the communication device is able to obtain authorization to access to the secure network from the application server by sending the third dataset to the application server;
wherein the electronic device is independent from the communication device and may be used with a plurality of communication devices.
2 . The method according to claim 1 , wherein the first dataset contains the certificate of the electronic device.
3 . The method according to claim 1 , wherein the second dataset contains the certificate of the communication device.
4 . The method according to claim 1 , wherein the first request inquires information about the certificate of the electronic device.
5 . The method according to claim 1 , wherein the electronic device communicates with the security server through an access device that is separate from the electronic device.
6 . The method according to claim 1 , wherein the third dataset contains the certificate of the communication device signed by the electronic device.
7 . The method according to claim 1 , wherein the signature of certificate of the communication device corresponds to a signature of a hash of the certificate of the communication device by the electronic device.
8 . The method according to claim 1 , wherein the secure network relies on a public key infrastructure.
9 . The method according to claim 1 , wherein the third dataset allows the application server to verify the intermediate certificate using a root certificate and to further verify the signature of the certificate of the communication device using the intermediate certificate.
10 . The method according to claim 1 , wherein the electronic device interacts with a hardware security module to compute and store a secret related to a certificate.
11 . The method according to claim 1 , wherein the application server is another communication device.
12 . An electronic device for connection authorization from a communication device to an application server, comprising:
one or more interfaces to communicate with at least a communication device;
a processor coupled to the interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed operable to:
provide a first dataset to a security server in response to a first request, wherein the first dataset is related to a certificate of the electronic device,
retrieve an intermediary certificate from the security server, wherein the intermediary certificate is generated by the security server based on the first dataset and signed by the security server,
when connecting the electronic device to the communication device intended to be introduced in a secured network for the first time, receive a second request from the communication device, the second request comprising a second dataset related to a certificate of the communication device,
generate a third dataset related to a signature of certificate of the communication device by the electronic device and to the intermediary certificate, and
send the third dataset to the communication device, wherein the communication device is able to obtain authorization to access the secure network from the application server by using the third dataset to the application server;
wherein the electronic device is independent from the communication device and may be used with a plurality of communication devices.
13 . A non-transitory computer-readable medium having embodied thereon a computer program for executing the method according to claim 1 .