System and method for field provisioning of credentials using qr codes
A system and method for authenticating a user device is disclosed. In one embodiment, the method comprises: transmitting a request for credentials from the user device, wherein the request comprises a user device identifier and the credentials comprise an asymmetric key pair having a public key and an associated private key, the private key being encrypted; receiving the credentials in the user device, the credentials comprising the encrypted private key and the public key; retrieving quick response (QR) code data associated with the user device identifier from a QR code data directory, the QR code data generated from the public key and stored in the QR code data directory according to the user device identifier by a secure online service; extracting the public key from the QR code data; and establishing an authenticated and encrypted communication session with the user device according to the extracted public key.
1 . A method of authenticating a user device, comprising:
transmitting a request for credentials from the user device, wherein:
the request comprises a user device identifier;
the credentials comprise an asymmetric key pair having a public key and an associated private key, the private key being encrypted, where the private key is encrypted according to an inner key pre-provisioned to the user device and the encrypted private key is decrypted according to the inner key and stored in the user device;
receiving the credentials in the user device, the credentials comprising the encrypted private key and the public key;
retrieving quick response (QR) code data associated with the user device identifier from a QR code data directory, the QR code data generated from the public key and stored in the QR code data directory according to the user device identifier by a secure online service;
extracting the public key from the QR code data; and
establishing an authenticated and encrypted communication session with the user device according to the extracted public key.
2 . The method of claim 1 , wherein:
the public key and associated encrypted private key is one of a plurality public keys and associated encrypted private keys, generated by:
generating, in an off-line system, a plurality of asymmetric key pairs, each asymmetric key pair having a generated public key and an associated generated private key;
encrypting each private key of each symmetric key pair; and
storing public keys and encrypted private key in the secure online service; and
the encrypted private key and the public key is received from the secure online service in response to the request for personalization data.
3 . The method of claim 2 , wherein:
the user device identifier is provided to the secure online service as part of a request for credentials, and
the QR code data is generated by the secure online service based on the public key and forwarded to the QR code directory along with the associated user device identifier for storage.
4 . The method of claim 2 , wherein the QR code data is retrieved at least in part via a user interface (UI) enabled device for displaying a QR code generated from the QR code data.
5 . The method of claim 4 , wherein:
retrieving the QR code data associated with the user device identifier from the QR code data directory comprises:
accepting a request for the QR code data, the request comprising the user device identifier;
providing the QR code data to the UI enabled device; and
scanning a QR code presented on the UI enabled device, the QR code generated from the QR code data.
6 . The method of claim 5 , wherein:
the request for credentials further comprises at least one of a media access control (MAC) address of the user device or a Wi-Fi channel of the user device; and
the request for the QR code data further comprises the at least one of the MAC address of the user device or the Wi-Fi channel of the user device.
7 . The method of claim 6 , wherein the QR code data generated by the secure online service is based on the public key and the at least one of the MAC address of the user device and the Wi-Fi channel of the user device.
8 . The method of claim 5 , wherein:
the request for the QR code data is accepted in a user registration portal and forwarded from the user registration portal to the QR code data directory; and
the QR code data is provided by the QR code data directory to the UI enabled device via the user registration portal.
9 . The method of claim 4 , wherein:
a communication path between the user device and the secure online service is selected from a group comprising:
a mobile operator network; and
a temporary Wi-Fi connection established by password-based authentication.
10 . The method of claim 2 , wherein:
the user device identifier is inaccessible to prohibited users;
retrieving the QR code data associated with the user device identifier from the QR code data directory comprises:
accepting the request for the QR code data from a configurator via an encrypted and authenticated communication session, the request for the QR code data including the user device identifier; and
transmitting the QR code data from the QR code data directory to the configurator.
11 . An apparatus for authenticating a user device, comprising
a processor; and
a memory, communicatively coupled to the processor, the memory storing processor instructions comprising processor instructions for:
transmitting a request for credentials from the user device, wherein:
the request comprises a user device identifier;
the credentials comprise an asymmetric key pair having a public key and an associated private key, the private key being encrypted, where the private key is encrypted according to an inner key pre-provisioned to the user device and the encrypted private key is decrypted according to the inner key and stored in the user device;
receiving the credentials in the user device, the credentials comprising the encrypted private key and the public key;
retrieving quick response (QR) code data associated with the user device identifier from a QR code data directory, the QR code data generated from the public key and stored in the QR code data directory according to the user device identifier by a secure online service;
extracting the public key from the QR code data; and
establishing an authenticated and encrypted communication session with the user device according to the extracted public key.
12 . The apparatus of claim 11 , wherein:
the public key and associated encrypted private key is one of a plurality public keys and associated encrypted private keys, generated by:
generating, in an off-line system, a plurality of asymmetric key pairs, each asymmetric key pair having a public key and an associated private key;
encrypting each private key of each symmetric key pair; and
storing public keys and encrypted private key in the secure online service; and
the encrypted private key and the public key is received from the secure online service in response to the request for personalization data.
13 . The apparatus of claim 12 , wherein:
the user device identifier is provided to the secure online service as part of a request for credentials, and
the QR code data is generated by the secure online service based on the public key and forwarded to the QR code directory along with the associated user device identifier for storage.
14 . The apparatus of claim 11 , wherein the QR code data is retrieved at least in part via a user interface (UI) enabled device for displaying a QR code generated from the QR code data.
15 . The apparatus of claim 14 , wherein:
the processor instructions for retrieving the QR code data associated with the user device identifier from the QR code data directory comprise processor instructions for:
accepting a request for the QR code data, the request comprising the user device identifier;
providing the QR code data to the UI enabled device; and
scanning a QR code presented on the UI enabled device, the QR code generated from the QR code data.
16 . The apparatus of claim 15 , wherein:
the request for the QR code data is accepted in a user registration portal and forwarded from the user registration portal to the QR code data directory; and
the QR code data is provided by the QR code data directory to the UI enabled device via the user registration portal.
17 . The apparatus of claim 12 , wherein:
the user device identifier is inaccessible to prohibited users;
the processor instructions for retrieving the QR code data associated with the user device identifier from the QR code data directory comprise processor instructions for:
accepting the request for the QR code data from a configurator via an encrypted and authenticated communication session, the request for the QR code data including the user device identifier; and
transmitting the QR code data from the QR code data directory to the configurator.