Automated Certificate Enrollment for Industrial Control Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Industrial control systems face challenges in automating the certificate enrollment process for devices, particularly when integrating devices into systems that require public key certificates from unknown certification authorities, as existing methods often necessitate manual password transfer over secure channels, which is impractical for large-scale deployments.
Innovation Solution
The solution involves an automated method where devices can enroll for public key certificates by digitally signing certificate requests using pre-existing certificates, allowing certification authorities to verify these requests and transmit the necessary certificates without the need for a secure channel, utilizing protocols like SCEP and EST, and optionally employing device whitelisting for enhanced security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If manual password transfer over secure channels is used for certificate enrollment, then security is maintained, but automation is lost and scalability deteriorates
Solution Approach 1:
The system performs preliminary actions by pre-configuring devices with manufacturer certificates during manufacturing, and pre-establishing trust relationships between CAs. This allows automated enrollment without manual password transfer, as the device already possesses the necessary credentials to authenticate itself to the target CA
Solution Approach 2:
The patent introduces an intermediary mechanism where the manufacturer certificate acts as a trusted intermediary between the device and the target CA. The device uses its manufacturer-issued certificate to authenticate itself, eliminating the need for direct password-based authentication between the device and CA
2Productivity
If automated certificate enrollment is implemented without secure channels, then scalability improves, but security verification becomes more challenging
Solution Approach 1:
The system implements feedback mechanisms where the CA verifies the device's manufacturer certificate and responds with enrollment approval or rejection. This automated verification feedback loop ensures security requirements are met while maintaining high-speed automated enrollment, as the CA can immediately validate credentials without manual intervention
Solution Approach 2:
The device performs self-service by automatically generating certificate signing requests, transmitting them to the CA, and receiving certificates without human intervention. The entire enrollment process is self-contained and automated, achieving both high productivity and reliable verification through systematic automated procedures
3Reliability
If device whitelisting is implemented for enhanced security, then security is improved, but system complexity and setup time increase
Solution Approach 1:
The system performs preliminary whitelisting actions during manufacturing or system setup, where authorized device identifiers are pre-configured in the CA's whitelist. This preliminary configuration enables automated security verification during enrollment without adding complexity to the actual enrollment process, as the whitelist check is automatically performed
Data Source
Figure 1
Figure 2~5
Figure 3
AI summary
A method includes receiving (610, 712), from a device (302), (i) a certificate request for a certification authority (304) and (ii) a first digital certificate (404). The certificate request is digitally signed by the first device, and the first digital certificate is stored in the device. The method also includes verifying (612, 714), at the certification authority, the first digital certificate using a second digital certificate of another certification authority (320). The method further includes verifying (614, 718) a digital signature of the certificate request using the first digital certificate. In addition, the method includes, after verifying the first digital certificate and the digital signature, transmitting (618, 722) a second digital certificate (406) to the device.