Motorola Solutions, Inc.

Arris Enterprises LLC

Shanthi E Thomas

Anthony R Metke

Erwin Himawan

Adam Cory Lewis

George Popovich

Ananth Ignaci

Donald G Newberg

Matthew C Keller

Thomas J Senese

Tyrone D Bekiares

Scott James Pappas

Michael W Bright

Katrin Reitsma

Chris A Kruegel

Peter E Thomas

Ramandeep Ahuja

Gregory D Bishop

Ibrahima Niass

Robert J Milausnic

Tyrong D Bekiares

Adam C Lewis

System and method of providing administrative access to an endpoint server. In one example, the method includes receiving, at an admin server, a request for performing an admin operation on the endpoint server and a first portion of an admin key from a microservice server. The method also includes receiving, at the admin server, a second portion of the admin key. The method further includes generating, at the admin server, a copy of the admin key based at least in part on the first portion and the second portion of the admin key. The method also includes performing, via the admin server, the admin operation on the endpoint server using the copy of the admin key. The method further includes deleting the copy of the admin key on the admin server after performing the admin operation on the endpoint server.

System and method for providing least privilege access in a microservices architecture

A method and is provided for obtaining a vetted certificate for a microservice in an elastic cloud environment. The microservice receives a one-time authentication credential. The microservice utilizes the one-time authentication credential to obtain a client secret. The microservice obtains an access token and CSR (Certificate Signing Request) attributes using the client secret and constructs a CSR utilizing the CSR attributes. The microservice requests a vetted certificate from a Certificate Authority (CA) and includes the access token and the CSR in the request. If the access token and the CSR pass vetting at the CA, the CA sends a vetted certificate to the microservice.

Method for obtaining vetted certificates by microservices in elastic cloud environments

A method and apparatus for issuing an incident-issued credential for an incident area network. One embodiment provides an identity server including an electronic processor configured to receive an agency-issued credential and retrieve a first set of attributes from the agency-issued credential. The electronic processor is also configured to map the first set of attributes to a scope of a service available through an incident area network. The electronic processor is further configured to generate the incident-issued credential for the incident area network including the scope and issue the incident-issued credential to a user device.

Method and apparatus for issuing a credential for an incident area network

A method of enabling a lock screen of an electronic device operating an electronic device that includes an electronic processor and a display screen. The method includes receiving, by the electronic processor, a request to unlock the electronic device. The method further includes determining, by the electronic processor, an authentication state for the electronic device. The method further includes, determining, by the electronic processor, a lock screen authentication mode based on the authentication state, and displaying, on the display screen, a lock screen including the lock screen authentication mode. The electronic device includes a display screen and an electronic processor. The electronic processor is configured to receive a request to unlock the electronic device. The electronic processor is further configured to determine an authentication state for the electronic device, determine a lock screen authentication mode based on the authentication state and display on the display screen, a lock screen including the lock screen authentication mode.

Systems and methods for enabling a lock screen of an electronic device

A certificate issuer () can periodically request, receive, and store current server-based certificate validation protocol (SCVP) staples () for supported relying parties () from at least one server-based certificate validation protocol (SCVP) responder (). The certificate issuer () can receive a contact initiation request () from one of the relying parties (). Responsive to receiving the contact initiation request (), the certificate issuer () can identify a current SCVP staple from the saved staples that is applicable to the relying party (). The certificate issuer () can conveying a response to the contact initiation request () to the relying party (). The response can comprise the identified SCVP staple and a public key infrastructure (PKI) certificate () of the certificate issuer. The SCVP staple can validate a certification path between the PKI certificate () and a different certificate trusted by the relying party ().

Utilizing a stapling technique with a server-based certificate validation protocol to reduce overhead for mobile communication devices

A first communication device having a secure access to a security module establishes a collaborative network by forming a collaborative security association with a second communication device associated with a user of the first communication device. The first communication device (a) sends an advertisement of services associated with the security module to the second communication device and receives an advertisement response from the second communication device or (b) receives a solicitation request for services associated with the security module from the second communication device. Responsive to receiving one of the advertisement response and the solicitation request, the first communication device determines whether the second communication device is authorized to access the security module. The first communication device processes and forwards security service messages between the second communication device and the security module, in response to determining that the second communication device is authorized to access the security module.

Apparatus and method for sharing a hardware security module interface in a collaborative network

Methods, systems and apparatus are provided for distributing wireless local area network (WLAN) access information to a wireless communication device based on a current coverage area that the wireless communication device is located in. A location services server can determine, based on a current location of the wireless communication device, a current coverage area of the wireless communication device, and transmit information identifying the current coverage area to a directory services server. Based on the current coverage area, the public safety directory services server can determine relevant WLAN access information for the current coverage area, and transmit a message to the wireless communication device that includes the relevant WLAN access information.

Method and apparatus for distributing wireless local area network access information

Methods and apparatuses for validating the status of digital certificates include a relying party receiving at least one digital certificate and determining if the at least one digital certificate is to be validated against a private certificate status database. The relying party accesses the private certificate status database and cryptographically validates the authenticity of data in the private certificate status database. The relying party also validates the at least one digital certificate based on information in at least one of the private certificate status database and a public certificate status database.

Private certificate validation method and apparatus

A method and apparatus for attaching a wireless device to a foreign wireless domain of a 3GPP communication system using an alternative authentication mechanism, wherein wireless device performs the method, which includes: sending a first attach request message to an infrastructure device in the foreign wireless domain; receiving an attach reject message from the infrastructure device upon an unsuccessful attempt to obtain authentication credentials for the wireless device from a home wireless domain of the wireless device using a standard 3GPP authentication mechanism; responsive to the attach reject message sending a second attach request message to the infrastructure device, wherein the second attach request message indicates an alternative authentication mechanism to the standard 3GPP authentication mechanism; and receiving an attach accept message from the infrastructure device when the wireless device is successfully authenticated using the alternative authentication mechanism.

Method and apparatus for attaching a wireless device to a foreign 3GPP wireless domain using alternative authentication mechanisms

A relying party obtains a certificate of a certificate subject and acquires a status information object for the certificate. The relying party validates the certificate using information in the status information object and compares authorization attributes present in the status information object with policy attributes associated with the requested service. A policy attribute is a set of constraints used by the relying party to determine if the authorization attributes associated with the certificate subject are sufficient to allow the certificate subject to access the requested service. If the authorization attributes present in the status information object match the policy attributes associated with the requested service, the relying party may grant the certificate subject access to the requested service.

Method and apparatus for authenticating a digital certificate status and authorization credentials

A method and device for confirming authenticity of a public key infrastructure (PKI) transaction event between a relying node and a subject node in a communication network enables improved network security. According to some embodiments, the method includes establishing at a PKI event logging (PEL) server a process to achieve secure communications with the relying node (step). Next, the PEL server processes reported PKI transaction event data received from the relying node (step). The reported PKI transaction event data describe the PKI transaction event between the relying node and the subject node. The reported PKI transaction event data are then transmitted from the PEL server to the subject node (step). The subject node can thus compare the reported PKI transaction event data with corresponding local PKI transaction event data to confirm the authenticity of the PKI transaction event.

Method and device for confirming authenticity of a public key infrastructure (PKI) transaction event

Methods for establishing secure point-to-point communications in a trunked radio system include receiving, at a trunking controller, a request from a source endpoint for a traffic channel for confidential communications between the source endpoint and a destination endpoint using a shared unique first symmetric key. The trunking controller provides keying material related to the symmetric key over the secured control channel to at least one of the source or destination endpoints and assigns a traffic channel. Moreover, in response to the request, the controller assigns a traffic channel. The keying material enables the unique first symmetric key to be securely established between the source and destination endpoints.

Methods for establishing a secure point-to-point call on a trunked network

A method for obtaining authentication credentials for attaching a wireless device to a foreign wireless domain in a 3rd Generation Partnership Project (3GPP) communication system, which includes: receiving an attach request message from the wireless device; and responsive to the attach request message, authenticating the wireless device and retrieving a set of authentication vectors, wherein the authentication vectors are for authenticating the wireless device to the foreign wireless domain. The method further includes encrypting the set of authentication vectors using a first security key of a home wireless domain of the wireless device. In addition, the method includes encrypting the first security key using a second security key of the foreign wireless domain and sending the encrypted set of authentication vectors and the encrypted first security key to the wireless device.

Methods for obtaining authentication credentials for attaching a wireless device to a foreign 3GPP wireless domain

A method and device for distributing public key infrastructure (PKI) certificate path data enables relying nodes to efficiently authenticate other nodes in an autonomous ad-hoc network. The method includes compiling, at a certificate path management unit (CPMU), the PKI certificate path data (step). One or more available certificate paths are then determined at the CPMU for at least one relying node (step). Next, the PKI certificate path data are distributed by transmitting a certificate path data message from the CPMU to the at least one relying node (step). The certificate path data message includes information identifying one or more trusted certification authorities associated with the one or more available certificate paths.

Growing community of inventors

Carpentersville, IL, United States of America

Shanthi E Thomas