Method for acquiring operation certificate

Abstract

A method of obtaining an operational certificate for an application (140) running on an authorized and / or authenticated host node (130) in a network (100), the method comprising: sending, by the application, a request comprising a certificate signature to a proxy engine (145) running on the authorized and / or authenticated host node; receiving, by the proxy engine, the request and submitting the certificate signature request to a certificate authority (155); signing, by the certificate authority, the operation certificate and sending a response including the signed operation certificate to the proxy engine; and forwarding, by the proxy engine, the signed operational certificate to the application.

Description

Technical Field

[0001] The present disclosure is in the field of operating credentials for devices in a network such as an Internet of Things (IoT) network, and particularly relates to a method of obtaining operating credentials for an application running on an authorized and / or authenticated host node in the network. Background Art

[0002] Networked devices, such as IoT devices and machine-to-machine (M2M) devices, may be communicatively connected to each other for inter-device communication and / or for interconnection with other networks, cloud-based devices such as servers, or the Internet. In an example, such networked devices may include smart utility meters for electricity, water, or gas.

[0003] In an example, an IoT system may include IoT devices that are communicatively coupled to each other to exchange data. An IoT system may, for example, include a set of nodes that are directly or indirectly connected to a network, such as the Internet or an intranet, either through one or more additional node layers.

[0004] Such an operation or function on an IoT device may require one or more operation certificates to ensure that the IoT device (or a user of the IoT device) is allowed to perform the operation or function. Typically, such an operation certificate may identify the functionality and operation limitations of the IoT device, such as a time period or expiration time for performing certain functions.

[0005] In an IoT system, it may be necessary to obtain an operation certificate signed by an authorized certificate authority (CA).

[0006] However, in some examples, untrusted or third-party software applications, referred to as "apps," may be executed on authorized nodes within an IoT system. For such software applications, it may be necessary to obtain their own operating certificates for secure transmission, for example, to securely communicate with another node, server, or device within the IoT system.

[0007] In order for such an untrusted or third-party software application to obtain its own operating certificate, it may be necessary to share the valid certificate of the host device with the software application so that the software application can use the CA to authorize the request. However, this may require leaking information to the software application, which may compromise the security of the host or even the IoT system.

[0008] It would therefore be desirable to provide means for obtaining operational credentials for a software application executing on a host device in an IoT or M2M system without leaking information to the software application that could compromise security.

[0009] Therefore, an object of at least one embodiment of at least one aspect of the present disclosure is to eliminate or at least alleviate at least one of the above-mentioned disadvantages of the prior art. Summary of the invention

[0010] The present disclosure is in the field of operating credentials for devices in a network, such as an IoT network, and particularly relates to a method of acquiring operating credentials for an application running on an authorized and / or authenticated host node in the network.

[0011] According to a first aspect of the present disclosure, there is provided a method for obtaining an operation certificate of an application running on an authorized and / or authenticated host node in a network, the method comprising:

[0012] Sending a request including a certificate signing request (CSR) by the application to a proxy engine running on an authorized and / or authenticated host node;

[0013] The proxy engine receives the request and submits the CSR to the certificate authority (CA);

[0014] The CA signs the operational certificate and sends a response including the signed operational certificate to the proxy engine; and

[0015] The proxy engine forwards the signed operational certificate to the application.

[0016] Advantageously, such an approach effectively proxies CSR requests for operational certificates without revealing details of the host device's signed certificate, or details of the public key infrastructure (PKI) framework, such as the IP address of a CA (certificate authority).

[0017] In an example IoT environment, it may be necessary to obtain an operational certificate (also referred to in the art as an "opcert") signed by a known and / or authorized CA server. In an environment where there are untrusted or third-party software applications (e.g., "apps") running on authorized nodes, it may be necessary for the software application to obtain one or more operational certificates of its own for secure transport. The above method can address this need.

[0018] That is, in a secure ecosystem for one or more software applications and on any host system on which one or more software applications may be running, an authorized host node can use its credentials, such as its authorization and / or authentication, to obtain one or more operating certificates on behalf of the one or more software applications.

[0019] Furthermore, the disclosed method may reduce system complexity because implementation of the method may alleviate the requirement to communicate infrastructure details to software applications that may be necessary for software applications to be able to request operating credentials themselves.

[0020] The CA can be an authorized CA server. The CA can be an authorized CA agent.

[0021] A proprietary protocol may be used to transmit a request including a certificate signing request (CSR) by an application to a proxy engine running on an authorized and / or authenticated host node.

[0022] Prior to receiving a signed operational certificate, the application may be an untrusted application or an application client running on an authorized and / or authenticated host node.

[0023] The network may include a public key infrastructure (PKI) configured to implement an a priori method of authenticating / authorizing host nodes.

[0024] That is, the above-mentioned signed certificate of the host device can be a so-called "birth certificate", for example, a signed certificate issued at the factory and loaded into the host device, which provides authentication for the unique host device.

[0025] Authentication / authorization of the host node may be based on a signed certificate issued during production of the host node and / or assigned to the host node and / or installed on the host node.

[0026] That is, a "birth certificate" can be used as an authentication mechanism to obtain operational certificates for normal secure transport stream operations.

[0027] The application can be configured to generate a public / private key pair. The request can include the public key used to encrypt the response from the CA.

[0028] The response from the CA may include an operational certificate encrypted using the public key.

[0029] The method may include using the private key to decrypt an operations certificate encrypted using the public key.

[0030] The request may include a parameter, such as data, indicating the type of operation certificate.

[0031] The request may include prior operating credentials.

[0032] That is, the payload of the request may include a "cert type" indicating one or more types of operational certificates, such as TLS or signature, etc. The payload of the request may include a CSR. The payload of the request may include one or more previous operational certificates, such as if the request is for an update of one or more operational certificates. The payload of the request may include a public key used to encrypt a response with a signed operational certificate returned.

[0033] The proxy engine may be a certificate manager configured to receive a requested authentication from an application requesting a CSR.

[0034] That is, the proxy engine can receive an operational certificate request, and using its own authentication, can create a connection to the CA (or CA proxy) and submit the CSR.

[0035] The network may be an Internet of Things (IoT) network.

[0036] According to a second aspect of the present disclosure, there is provided a method for authenticating / authorizing an application in an IoT network, the method comprising obtaining an operation certificate of the application according to the method of any one of the preceding claims.

[0037] Advantageously, the disclosed method may allow software applications running on a host to obtain operating certificates without having to manually add authentication permissions to each software application individually, while also protecting and / or shielding the details of any PKI framework.

[0038] According to a third aspect of the present disclosure, there is provided a computer-readable storage medium comprising instructions, which, when executed by a computer on an authorized and / or authenticated host node in a network, causes the computer to:

[0039] configuring the application to send a request including a certificate signing request (CSR) to a proxy engine running on an authorized and / or authenticated host node;

[0040] Configure the proxy engine to receive the request and submit the CSR to the certificate authority (CA);

[0041] configuring the proxy engine to receive a response from the CA including an operational certificate signed by the CA;

[0042] Configure the proxy engine to forward the signed operational certificate to the application.

[0043] According to a fourth aspect of the present disclosure, there is provided a node device communicatively coupled to a network, the node device comprising and / or coupled to the computer-readable storage medium of the third aspect.

[0044] The node device may be configured as a smart utility meter for metering the consumption of electricity, water, or gas.

[0045] The above summary is intended to be merely illustrative and not restrictive. The present disclosure includes one or more corresponding aspects, embodiments or features alone or in various combinations, regardless of whether they are specifically stated (including claimed) in the combination or individually. It should be understood that the features defined above according to any aspect of the present disclosure or the features related to any specific embodiment of the present disclosure below can be utilized in any other aspect or embodiment alone or in combination with any other defined features, or form other aspects or embodiments of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] These and other aspects of the present disclosure will now be described, by way of example only, with reference to the accompanying drawings, in which:

[0047] Figure 1 An example of a network for implementing a method for obtaining an operation certificate according to an embodiment of the present disclosure is depicted;

[0048] Figure 2 is a sequence diagram corresponding to a method of acquiring an operation certificate according to an embodiment of the present disclosure; and

[0049] Figure 3 A flowchart of a method for acquiring an operation certificate according to an embodiment of the present disclosure is depicted. DETAILED DESCRIPTION

[0050] Figure 1 An example of a network 100 for implementing a method of acquiring an operation certificate according to an embodiment of the present disclosure is depicted. The network includes a plurality of nodes 105, 110, 115, 120, 125, 130.

[0051] In the example network 100, a plurality of nodes 105, 110, 115, 120, 125, 130 are communicatively coupled to the Internet 135. Although Figure 1 The example depicts connectivity to the Internet 135, but in other examples, multiple nodes 105, 110, 115, 120, 125, 130 may be connected to an intranet. Furthermore, connectivity may be through any known medium, such as wirelessly, optically, conductively, via one or more routers or gateways, etc. That is, it will be understood that Figure 1 An implementation of network 100 is depicted for purposes of illustration, and various other configurations of networks may implement the disclosed invention.

[0052] Furthermore, nodes of network 100 may be indirectly connected to Internet 135 , such as node 110 connecting to Internet 135 via another node 105 .

[0053] In an example, the network 100 may be an IoT network, such as a network 100 in which a plurality of nodes 105, 110, 115, 120, 125, 130 may be embedded with sensors, software, and other technologies for connecting and exchanging data with other devices and systems over the Internet.

[0054] For example, one or more of the plurality of nodes 105 , 110 , 115 , 120 , 125 , 130 may be configured as a smart utility meter for metering consumption of electricity, water, or gas and for transmitting consumption information to a utility company and / or pricing information to consumers via the Internet 135 .

[0055] The first node 130 includes processing capabilities for executing one or more software applications. In an example, a software application 140 runs on the first node 130. Thus, the first node 130 is a host device for the software application 140.

[0056] The first node 130 may be an authorized and / or authenticated host node in the network 100. That is, the first node 130 may be authorized to communicate over the network 100, such as with one or more other nodes of the plurality of nodes 105, 110, 115, 120, 125, 130 via the Internet 135.

[0057] The first node 130 may include a signed certificate 150, which may be a so-called “birth certificate” as described above, e.g., during generation of the first node 130, the signed certificate is issued and loaded into / installed in the first node 130 to provide authentication of the unique first node 130 in the network 100.

[0058] In use, the software application 140 may be an untrusted and / or third party application.

[0059] In order for a software application 140 running on an authorized and / or authenticated first node 130 to be able to communicate over the network 100, the software application 140 may be required to obtain a signed operating certificate.

[0060] In use, the software application 140 may be configured to send a request including a CSR to a proxy engine 145 running on the authorized and / or authenticated first node 130. In an example, a proprietary protocol may be used to transmit a request including a certificate signing request (CSR) by the software application 140 to the proxy engine 145 running on the authorized and / or authenticated first node 130. The software application 140 may be configured to generate a public / private key pair. The request may include a public key.

[0061] In some examples, the payload of the request may include a "certificate type" indicating one or more types of operational certificates, such as TLS or signature, etc. The payload of the request may include a CSR. The payload of the request may include one or more previous operational certificates, such as if the request is for an update of one or more previously issued and / or signed operational certificates. The payload of the request may include a public key used to encrypt a response with a signed operational certificate returned.

[0062] The proxy engine 145 may receive the request and submit the CSR to a certificate authority (CA) 155 .

[0063] For purposes of example only, CA 155 is depicted as running on second node 125 coupled to Internet 135. However, it will be understood that this is exemplary only, and CA 155 may be implemented on a server, a cloud-based device, an edge device, or another portion of network 100, including portions of network 100 that are not depicted. CA 155 may be an authorized CA server. CA 155 may be an authorized CA agent.

[0064] The CA 155 may be configured to sign the operational certificate and then send a response including the signed operational certificate to the proxy engine 145. The response from the CA 155 may include the operational certificate encrypted using the public key.

[0065] The proxy engine 145 may be configured to forward the signed operational certificate to the software application 140 .

[0066] In some examples, software application 140 may be configured to use the private key to decrypt an operational certificate encrypted using the public key.

[0067] Figure 2 A sequence diagram corresponding to a method for obtaining an operation certificate according to an embodiment of the present disclosure is depicted. The sequence diagram also corresponds to Figure 3 Flowchart of the process.

[0068] In the first event 205, a software application denoted as "app" (which may be Figure 1 The software application 140) sends the request including the payload to a proxy engine (denoted as "proxy"). The proxy engine can be Figure 1 The proxy engine 145 running on the first node 130 of the network 100 is used for authorization and / or authentication.

[0069] The payload of the request includes a certificate signing request (CSR). As described above, in other examples, the payload may also include one or more of the following: "certificate type"; one or more previous operation certificates; and / or a public key used to encrypt a response with a signed operation certificate returned. The first event corresponds to Figure 3 The first step 305 of the flow chart.

[0070] In the second event 210, corresponding to Figure 3 In the second step 310 of the flowchart, the proxy engine submits the CSR to a certificate authority (CA). The CA may be Figure 1 The network is 100 CA 155.

[0071] In the third event 215, corresponding to Figure 3 In the third step 315 of the flowchart, the CA signs the operation certificate and sends a response including the signed operation certificate to the proxy engine.

[0072] In the fourth event 220, corresponding to Figure 3 In the fourth step 320 of the flowchart of FIG. 1 , the proxy engine forwards the signed operational certificate to the software application.

[0073] Although the present disclosure has been described in terms of specific embodiments as described above, it should be understood that these embodiments are illustrative only and that the claims are not limited to those embodiments. Those skilled in the art will be able to make modifications and substitutions in light of the present disclosure, which are considered to fall within the scope of the appended claims. Each feature disclosed or shown in this specification may be combined in any embodiment, either alone or in any appropriate combination with any other features disclosed or shown herein.

[0074] Reference numerals list

[0075] 100 network 150 signature certificate

[0076] 105 nodes 155 certificate authority

[0077] 110 Node 205 First Event

[0078] 115 Node 210 Second Event

[0079] 120 Node 215 Third Event

[0080] 125 Node 220 Fourth Event

[0081] 130 First Node 305 First Step

[0082] 135 Internet 310 Second Step

[0083] 140 Software Application 315 Third Step

[0084] 145 Proxy Engine 320 Fourth Step

Claims

1. A method for obtaining an operating certificate for an application running on an authorized and / or authenticated host node in a network, the method comprising: Sending, by the application, a request including a certificate signing request (CSR) to a proxy engine running on the authorized and / or authenticated host node; The proxy engine receives the request and submits the CSR to a certificate authority (CA); The CA signs the operation certificate and sends a response including the signed operation certificate to the proxy engine; The signed operational certificate is forwarded by the proxy engine to the application.

2. The method of claim 1, wherein: The CA is an authorized CA server or an authorized CA agent.

3. The method according to claim 1 or 2, wherein: Prior to receiving the signed operational certificate, the application is an untrusted application or application client running on the authorized and / or authenticated host node.

4. A method as claimed in any one of the preceding claims, wherein: The network includes a public key infrastructure (PKI) configured to implement an a priori method of authenticating / authorizing the host nodes.

5. The method of claim 4, wherein: The authentication / authorization of the host node is based on a signed certificate issued during production of the host node and / or assigned to the host node and / or installed on the host node.

6. A method as claimed in any one of the preceding claims, wherein: The application is configured to generate a public / private key pair, and wherein the request includes the public key used to encrypt the response from the CA.

7. The method of claim 6, wherein: The response from the CA includes the operational certificate encrypted using the public key.

8. The method of claim 7, comprising using the private key to decrypt the operational certificate encrypted using the public key.

9. A method as claimed in any one of the preceding claims, wherein: The request includes one or more of the following: a parameter indicating the type of operation certificate; and / or Previous operating certificate.

10. A method as claimed in any one of the preceding claims, wherein: The proxy engine is a certificate manager configured to receive authentication of a request from the application requesting the CSR.

11. A method as claimed in any one of the preceding claims, wherein: The network is an Internet of Things (IoT) network.

12. A method for authenticating / authorizing an application in an IoT network, the method comprising obtaining an operation certificate of the application according to any one of the preceding claims.

13. A computer-readable storage medium comprising instructions which, when executed by a computer on an authorized and / or authenticated host node in a network, cause the computer to: configuring the application to send a request including a certificate signing request (CSR) to a proxy engine running on the authorized and / or authenticated host node; Configuring the proxy engine to receive the request and submit the CSR to a certificate authority (CA); configuring the proxy engine to receive a response from the CA including an operational certificate signed by the CA; The proxy engine is configured to forward the signed operational certificate to the application.

14. A node device communicatively coupled to a network, the node device comprising and / or coupled to the computer-readable storage medium of claim 13.

15. The node device of claim 14, configured as a smart utility meter for metering consumption of electricity, water or gas.

Images