ADMINISTRATIVE PROCEDURES FOR THE RENEWAL OF AUTHENTICATION CERTIFICATES OF COMPONENTS

Description

[Technical field]

[0001] The invention relates to a management method for renewing authentication certificates of connected components.

[0002] It relates more specifically to a management process allowing the renewal of an authentication certificate of a connected component when said authentication certificate has exceeded its validity date.

[0003] The invention finds a favorite application in the renewal of authentication certificates of connected components of a construction vehicle, for example a crane, but can be extended to any system having an authentication certificate used in a given application context. [State of the art]

[0004] By definition, an authentication certificate is comparable to an attestation or identity card used by an entity (which can be a person or a system) to identify itself to a computer server in order to access the data and / or applications contained on that computer server, download updates, etc. The authentication certificate is therefore a security measure to prevent an unauthorized entity from accessing the server's content, this entity potentially being malicious (for example, wanting to steal the data contained on the server).

[0005] Certificates issued to entities typically have a validity period of one year. Therefore, if an entity wishes to continue using the services offered by the IT system for which the authentication certificate is required, it must renew its authentication certificate during a renewal period within the validity period (for example, if the authentication certificate is valid for one year, the twelfth month). Once renewed, the certificate is then valid for a new validity period. Renewal can be performed either by the instance that generated and issued the authentication certificate to the entity or by a different instance.

[0006] In the application context of construction sites, authentication certificates can be assigned to connected components of a piece of construction equipment, for example a crane, so that they can connect to a remote IT infrastructure, for example a remote update manager server to download updates related to their operation.

[0007] However, after being used on a construction site, a crane (or any piece of construction equipment in general) may remain stored and unpowered for several months, meaning its connected components are no longer able to connect. Therefore, when it is put back into operation and powered again, the authentication certificates of the connected components may have expired, meaning that when they restart and attempt to connect to the remote IT infrastructure for updates, access to the updates is denied by the remote IT infrastructure.

[0008] US Patent 2011 / 113239 discloses a method for renewing component authentication certificates, regardless of whether their renewal date has passed. The method is implemented by a certificate manager comprising remote infrastructures configured to: generate and assign authentication certificates to components; verify whether, when a certificate renewal request is issued, the certificate's expiration date has passed; and renew valid or expired authentication certificates. Such remote infrastructures have the disadvantage of being vulnerable to external attacks and intrusion attempts, implying a potential risk of malicious actors retrieving sensitive data related to authentication certificates or their associated components. [Summary of the invention]

[0009] The invention aims to solve such a problem, by providing a solution that allows an expired authentication certificate to be renewed following a temporary disconnection, while maintaining a high level of security.

[0010] The invention relates to a method for managing the renewal of an authentication certificate uniquely assigned to a connected component, wherein said authentication certificate is valid for a period of validity until an expiry date and expires beyond the expiry date, said authentication certificate serving as a means of authenticating the connected component to a remote update management server as long as said authentication certificate is valid, the method implementing a renewal phase comprising at least the following successive steps: a remote connection step during which the connected component connects to a remote certificate renewal server for a new validity period, a renewal request step during which the connected component issues a certificate renewal request to the remote certificate renewal server, a verification step during which the remote certificate renewal server checks whether the authentication certificate is valid or expired; and in which if the authentication certificate is valid at the verification stage, then the remote certificate renewal server automatically renews the authentication certificate for a new validity period; however, if the authentication certificate has expired at the verification stage, then: the remote certificate renewal server transmits to a remote database an identifier of the connected component associated with its certificate renewal request; the identifier of the connected component and its certificate renewal request are manually checked by a control operator with access to the remote database; the authentication certificate is renewed or not for the new validity period by the control operator based on its manual check;the process implementing, prior to the renewal phase, a certification phase during which the connected component is physically linked to a local server, and said local server generates, signs, and then assigns the authentication certificate to said connected component.

[0011] Thus, the invention solves the problem described above by enabling the renewal of a connected component's authentication certificate, regardless of whether its validity period has expired. This authentication certificate is used by the connected component to authenticate itself with a remote update management server and download updates. To renew its authentication certificate, the connected component connects to a remote certificate renewal server and sends a certificate renewal request. This remote certificate renewal server then verifies whether the authentication certificate is still valid.

[0012] According to one possibility, the renewal phase may include a security step in which the remote certificate renewal server verifies an identifier of the connected component and / or that the connected component has the authentication certificate, before the renewal request step.

[0013] In other words, prior to this renewal request step, a security step can be implemented to prevent any attempted access by a malicious entity during which the remote certificate renewal server: The system checks the identifier of the connected component, for example, by verifying whether it is included in a list of connected component identifiers that must be known to the remote certificate renewal server. Thus, a connected component that has an authentication certificate but whose identifier is unknown to the remote certificate renewal server cannot issue a request to renew the authentication certificate, or continue communicating with the remote certificate renewal server in general. This is because the connected component could potentially be malicious and possess a forged authentication certificate created by fraudsters who may have gained illegal access to the certificate format; and / or it checks whether the connected component has an authentication certificate.Thus, a connected component that should be known to the remote certificate renewal server but does not possess an authentication certificate cannot issue a certificate renewal request.

[0014] In the case where the renewal request is made by the connected component for an authentication certificate that is still valid, the renewal is automatically carried out by the remote certificate renewal server.

[0015] Otherwise, as mentioned above, the remote certificate renewal server transmits the identifier of the connected component seeking to renew its authentication certificate to a remote database. This identifier is verified by a control operator (a physical person) with access to the remote database. Therefore, in this scenario, the certificate renewal is performed manually by the control operator.

[0016] In order for manual certification renewal to be carried out quickly, it is conceivable that the remote certificate renewal server could alert the control operator, for example by sending an automatic email to the control operator's email address simultaneously with the transmission in the remote database of the identifier of the connected component and its certification renewal request.

[0017] In one embodiment of the invention, the certificate renewal request cannot be made before a predefined renewal period, which occurs at the end of the validity period, has been reached. In other words, if the connected component connects to the remote certificate renewal server and submits its certificate renewal request too early, i.e., before the start of the renewal period, the certificate renewal is not accepted.

[0018] If certification renewal is performed remotely, the generation, assignment, and signing of an authentication certificate are done locally, using the local server installed, for example, in a production facility. Thus, the local server acts as the certification authority. More specifically, authentication certificates are generated, signed, and assigned to the connected components after manufacturing and once they have been programmed to perform their intended tasks. To receive their authentication certificate, the connected components are physically connected to the local server, for example, using an Ethernet cable.

[0019] Advantageously, using a local server limits the risk of malicious remote intrusion and data leaks, whether related to the programming and operation of connected components or to certificates. Generating and assigning authentication certificates locally also reduces the risk of intrusion attempts on the remote certificate renewal server.

[0020] According to one feature of the invention, the authentication certificate contains an identifier of the local server.

[0021] In other words, if the process relies on multiple local servers, each local server will generate authentication certificates containing its identifier (also called a server identifier). Advantageously, this allows a control operator to easily and quickly trace and identify all certificates that have been generated and issued by a given local server / certification authority.

[0022] In another embodiment of the invention, it is the format of the authentication certificates that makes it possible to determine the local server(s) that generated them.

[0023] According to one feature of the invention, before accessing the remote update manager server, the connected component is connected to a remote provisioning server which contains a list of identifiers of several local servers authorized to generate and sign authentication certificates; and in which said remote provisioning server checks the validity of the authentication certificate of the connected component before giving it access to the remote update manager server.

[0024] Advantageously, the remote provisioning server strengthens security for access to the remote update manager server, thus minimizing the risk of intrusion by a malicious entity, by checking if the authentication certificate held by the connected component wishing to connect to the remote update manager server contains an identifier included in a list of identifiers from several authorized / known local servers.

[0025] In one embodiment of the invention, the remote certificate renewal server checks, during the security step for the certificate renewal request, whether the authentication certificate held by the connected component contains the identifier of the local server that issued it, and similarly to the remote provisioning service, whether the identifier is contained in the list of identifiers of several authorized local servers (meaning that the two servers share the same list). Depending on the result of this check, the connected component may or may not issue a certificate renewal request.

[0026] According to one feature of the invention, the control of the validity of the authentication certificate of the connected component by the remote provisioning server includes a check of the identifier of the local server contained in the authentication certificate, and if said local server is classified as a revoked server, then the remote provisioning server denies access to the remote update manager server for said connected component.

[0027] In other words, generating an authentication certificate that includes the identifier of the certificate authority (here, the local server) that generated it allows the remote provisioning server to easily and quickly revoke all authentication certificates generated by one or more specific local servers without revoking those generated and issued by others. These revocations might, for example, be triggered by data leaks observed by operators on these specific local servers. Connected components whose authentication certificates have been revoked can then no longer access the services of the remote update management server.

[0028] In one embodiment of the invention, the operator has the ability to reverse the revocation of a revoked local server. Following this reversal, the authentication certificates issued by that local server become valid again. If the revocation of an authentication certificate occurred before the connected component could download an update from the remote update manager server, and the reversal is performed after the authentication certificate's validity period has expired, then the connected component must renew the certificate following the steps of the process described above (ultimately, the certificate renewal will therefore be performed manually by the controlling operator).

[0029] According to one embodiment of the invention, the connected component is a component of a piece of construction equipment, for example a crane.

[0030] According to one embodiment of the invention, the certificate renewal server, the remote database, the remote provisioning service, and the remote update management system are included in a remote IT infrastructure.

[0031] According to one embodiment of the invention, the remote infrastructure is a cloud infrastructure, i.e., "cloud" infrastructures. [Brief description of the figures]

[0032] Other features and advantages of the present invention will become apparent from the following detailed description, of a non-limiting example of implementation, made with reference to the accompanying figures in which: [ Fig 1] is a schematic view showing all the entities involved in implementing the process, and the steps implemented during the certification phase during which the connected component is physically connected to a certification authority, which is a local server, to receive a signed and valid authentication certificate for the entire validity period; Fig 2 ] is a schematic view of the process similar to that of the Figure 1 , which illustrates the steps implemented during the authentication certificate renewal phase, when the connected component connects to the remote certificate renewal server, and in the case where the validity period has not yet expired. Fig 3 ] is a schematic view of the process similar to those of Figure 1 and Figure 2, which illustrates the steps implemented during the authentication certificate renewal phase, when the connected component connects to the remote certificate renewal server, and in the event that the validity period of the authenticity certificate has expired. Fig 4 ] is a schematic view of the process similar to those of Figure 1 to Figure 3 , which illustrates the steps implemented when the connected component wants to connect to the remote update manager server to download updates. [Detailed description of one or more embodiments of the invention]

[0033] The proposed P process allows the authentication certificates 1 of connected components 2 to be renewed, whether or not their validity period has expired.

[0034] In the embodiment of the invention presented, the connected components 2 are connected components of a construction machine, for example a crane 10, each using an authentication certificate 1 to authenticate itself to a remote update manager server 3 in order to download updates relating, for example, to new features.

[0035] Prior to the renewal phase, process P implements a certification phase during which the connected component 2 connects to a certification authority which will generate, sign and deliver to the connected component 2 its authentication certificate 1.

[0036] While the renewal phase is performed with the connected component 2 connecting to a remote IT infrastructure, which is a remote certificate renewal server 4, the certification phase is implemented locally. With reference to the Figure 1 This could be a local server 7 installed in a production plant 9 where the connected components are manufactured and then programmed to perform their functions. During a connection step S1, the connected component 2, once manufactured and programmed, is physically connected (using an Ethernet cable, for example) and communicates with the local server 7, which generates, signs, and transmits, during a transmission step S2, to the connected component 2, the authentication certificate 1 which has a validity period.

[0037] As explained previously, using a local server 7 helps limit the risks of malicious remote intrusion and data leakage, whether related to: the programming and operation of connected components 2; and / or authentication certificates. Furthermore, generating and assigning authentication certificates locally 1 reduces the risk of attempted intrusions on the remote certificate renewal server 4 and / or the remote update management server 3.

[0038] In a first embodiment of the invention, the authentication certificates 1 generated by a local server 7 contain its server identifier. Using this identifier, a person and / or an IT infrastructure can easily and quickly trace all connected components possessing an authentication certificate generated and signed by this local server 7.

[0039] In a second embodiment of the invention, the distinction between authentication certificates 1 generated by different local servers 7 is based on their format. In other words, each local server 7 produces authentication certificates 1 in a given format.

[0040] In a third embodiment, all authentication certificates 1 are generated in the same format. However, the arrangement and / or nature of the data contained in the authentication certificate 1 (such as the certificate expiry date, the local server signature, the public key for data encryption, etc.) may differ depending on the local server 7 that generated it.

[0041] The connected component is programmed, after being powered on, to connect to the remote update manager server 3 to download updates, and to the remote certificate renewal server 4 to renew its authentication certificate 1.

[0042] Since renewing authentication certificate 1 at a date / period relatively close to its generation would be of little use, the request for renewal of certification in an embodiment of the invention cannot be made before a predefined renewal period is reached, which is the expiry date of authentication certificate 1. For example, if the validity period of the authentication certificate is one year, the renewal period can correspond to the last month of the validity period (i.e. the twelfth month).

[0043] In other words, if the connected component connects to the remote certificate renewal server 4 and issues its certificate renewal request too early, i.e. before the start of the renewal period, the certificate renewal is not carried out.

[0044] In one embodiment of the invention, the connected component 2 is programmed to determine whether it is powered on when the start date of the renewal period has passed, and if so, to automatically connect to the remote certificate renewal server 4.

[0045] With reference to the Figure 2 , the connected component 2 connects during an S3 connection step to the remote certificate renewal server 4.

[0046] In one embodiment of the invention, it is conceivable that, after connection of the connected component 2, a security step may be implemented to prevent any access attempt by a malicious entity, during which the remote certificate renewal server 4 verifies: if the connected component 2 is indeed the holder of an authentication certificate 1, meaning that otherwise it cannot issue a renewal request; and the authenticity of said authentication certificate 1.

[0047] In different embodiments of the invention, the remote certificate renewal server 4 can check: whether the authentication certificate 1 contains the identifier of the local server 7 that generated it, and whether this identifier is known or not; and / or the format of the authentication certificate 1; and / or the arrangement and / or nature of the data included in the authentication certificate 1.

[0048] It is also conceivable that the remote certificate renewal server 4 can also control a reference / identifier of the connected component 2, by comparing it for example with a list listing all the references of all connected components belonging to the entity (for example a crane manufacturer 10) implementing process P. Thus, a connected component 2 which has an authentication certificate 1 but whose reference is unknown to the remote certificate renewal server 4 cannot issue a renewal request.

[0049] Following the S3 connection step, and possibly the optional security step, the connected component 2 issues its certification renewal request for a new validity period (which may be of the same or different duration as the initial validity period depending on different embodiments).

[0050] The remote certificate renewal server 4 then checks, during a verification step, whether the authentication certificate 1 of the connected component is still valid, that is, whether its validity period has expired. As explained previously, a connected component 2 of a crane 10 may not be used or powered for extended periods (sometimes several months) if it does not meet the needs of an ongoing construction project. If the connected component 2 is powered back on after the renewal period has expired, it will connect to the remote certificate renewal server 4, regardless of whether the validity period of the authentication certificate 1 has expired.

[0051] In the event that the certificate renewal request is made during the renewal period, the remote certificate renewal server 4 automatically renews the authentication certificate 1 during an automatic renewal step S4 ( Figure 2 ).

[0052] If the application for renewal of certification is made after the expiry of the validity period, with reference to the Figure 3 , the remote certificate renewal server 4 transmits it during an S5 transmission step to a remote database 5. It also transmits to the remote database 5 a reference / identifier of the connected component 2.

[0053] Following this S5 transmission step, a control operator 6 with access to the remote database 5 verifies, during an S6 control step, the identifier of the connected component 2 and its certification renewal request. The control operator 6 is a natural person.

[0054] If the identifier of the connected component 2 is known and the certificate renewal request is valid, the control operator 6 manually renews the validity period of the authentication certificate 1 during a manual renewal step S7. In a first embodiment of the invention, the manual renewal is performed from the remote database 5, and the remote renewal server, communicating with it, is notified of said manual renewal. In a second embodiment of the invention, the control operator 6 connects directly to the remote certificate renewal server 4 to perform the manual renewal.

[0055] In order for manual certification renewal to be carried out quickly, it is conceivable that the remote certificate renewal server 4 alerts the control operator 6, for example by sending an automatic email to the control operator 6's email address simultaneously with the transmission of the identifier of the connected component 2 and its certification renewal request in the remote database 5.

[0056] When it has a valid authentication certificate 1, the connected component 2 can, as previously stated, connect to the remote update manager server 3.

[0057] With reference to the Figure 4In the described embodiment, before accessing the remote update manager server 3, the connected component 2, during an S8 connection step, connects to a remote provisioning server 8 which contains a list of identifiers 81 of several local servers 7 authorized to generate and sign authentication certificates 1.

[0058] Thus, the remote provisioning server 8 helps to strengthen security for access to the remote update manager server 3, and thus minimize the risk of intrusion by a malicious entity, by checking whether the authentication certificate 1 that the connected component 2 has when it wants to connect to the remote update manager server 3 contains a local server identifier 7 included or not in the list of identifiers 81.

[0059] Note that this list of identifiers 81 can also be used by the remote certificate renewal server 4 in the embodiment where the security step is implemented and that the control of the authenticity of the authentication certificate is based on a control of the identifier of the local server 7 that generated and issued it.

[0060] The remote provisioning server 8, if it recognizes the identifier of the local server 7, authorizes the connected component 2 to connect to the remote update manager server 3 during a connection authorization confirmation step S9.

[0061] The connected component 2 can then, during an S10 connection step, connect to the remote update manager server 3.

[0062] In the event of a malicious intrusion and / or data leak directly or indirectly affecting a local server 7, the provisioning server 8 has the ability to revoke all authentication certificates 1 generated and signed by it without impacting those generated by one or more other local servers 7. This also means that the provisioning server 8 can also perform mass revocations if several local servers 7 are impacted by attacks.

[0063] The connected components 2 having a revoked authentication certificate 1 can no longer access either the services of the remote update manager server 3, or the remote certificate renewal server 4 for an authentication certificate renewal.

[0064] It is expected that the revocation of a local server 7 can be reversed by a control operator 6. Following this reversal, the authentication certificates 1 produced by this local server 7 become valid again. If the revocation is reversed after the expiry of the validity period of an authentication certificate 1, the connected component 2 that owns it connects to the remote certificate renewal server 4 and waits for it to be manually renewed.

[0065] With reference to Figure 1 to Figure 4 In the embodiments presented, the certificate renewal server 4, the remote database 5, the remote provisioning service 8, and the remote update management system 3 are all cloud infrastructures (i.e., cloud infrastructures).

Claims

1. A method (P) for managing a renewal of an authentication certificate (1) uniquely assigned to a connected component (2), in which said authentication certificate (1) is valid for a validity period until an expiration date and is expired beyond the expiration date, said authentication certificate (1) serving as a means of authenticating the connected component (2) to a remote update manager server (3) as long as said authentication certificate (1) is valid, the method (P) implementing a renewal phase comprising at least the following successive steps: - a remote connection step (S3) during which the connected component (2) is connected to a remote certificate renewal server (4), - a renewal request step during which the connected component (2) issues a certification renewal request to the remote certificate renewal server (4) for a new validity period, - a checking step during which the remote certificate renewal server (4) checks whether the authentication certificate (1) is valid or expired; and wherein if the authentication certificate (1) is valid at the checking step, then the remote certificate renewal server (4) automatically renews the authentication certificate (1) for the new validity period; otherwise, if the authentication certificate (1) has expired at the checking step, then: - the remote certificate renewal server (4) transmits to a remote database (5) an identifier of the connected component (2) associated with its certification renewal request, - the identifier of the connected component (2) and its certification renewal request are manually controlled by a control operator (6) having access to the remote database (5); - the authentication certificate (1) is renewed or not for the new validity period by the control operator (6) depending on its manual control; the method (P) implementing, before the renewal phase, a certification phase during which the connected component (2) is physically connected to a local server (7), and said local server (7) generates, signs, then assigns the authentication certificate (1) to said connected component (2).

2. The method (P) according to claim 1, wherein the authentication certificate (2) contains an identifier of the local server (7).

3. The method (P) according to claim 2, wherein, before accessing the remote update manager server (4), the connected component (2) is connected to a remote provisioning server (8) which contains a list of identifiers (81) of several local servers (7) authorized to generate and sign authentication certificates (1); and in which said remote provisioning server (8) controls the validity of the authentication certificate (1) of the connected component (2) before giving it access to the remote update manager server (3).

4. The method (P) according to claim 3, wherein the control of the validity of the authentication certificate (1) of the connected component (2) by the remote provisioning server (8) comprises a control of the identifier of the local server (7) contained in the authentication certificate (1), and if said local server (7) is classified as a revoked server, then the remote provisioning server (8) prohibits access to the remote update manager server (3) for said connected component (2).

5. The method (P) according to any one of the preceding claims, wherein the connected component (2) is a component of a construction machine, for example a crane (10).