Device Identity Certificate Chains for Multi-Stage Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for verifying device identity in industrial automation systems fail to efficiently consider the authenticity of devices along multi-stage value chains, particularly from component suppliers to end customers, and lack secure mechanisms for certificate management and verification.
Innovation Solution
A method involving the creation and management of certificate chains, where initial and additional device certificates are generated and managed to ensure authenticity, with only the most recent certificate being verified during identity validation, and access to private keys is checked, allowing selective reading and verification by authorized entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If certificates are generated and transferred regularly to devices via Certification Authority, then security and authentication are improved, but system complexity and transmission security risks increase
Solution Approach 1:
The device autonomously manages its own certificate lifecycle by generating self-signed initial certificates and subsequently obtaining additional certificates from registration instances without requiring external Certification Authorities. This self-service approach eliminates the complexity of CA-based certificate management while maintaining security through device-controlled certificate issuance.
Solution Approach 2:
The patent extracts the certificate issuance function from centralized CAs and relocates it to individual devices and registration instances. Devices generate their own initial certificates, and registration instances issue additional certificates locally, eliminating the need for external CA infrastructure and reducing transmission security risks.
2Measurement precision
If multiple device certificates are managed in the device memory, then identity validation accuracy is improved, but validation time and processing complexity increase
Solution Approach 1:
The certificate management system is segmented into distinct types: initial self-signed certificates generated at device creation and additional certificates issued by registration instances for specific network environments. This segmentation allows the device to maintain multiple certificates organized by purpose and timing, enabling accurate identity validation while managing processing complexity through structured storage and retrieval.
Solution Approach 2:
The device preliminarily organizes certificates in device memory with clear identification of which certificates are for identity validation versus network access authorization. By pre-organizing certificates according to their specific purposes and temporal validity, the system enables rapid accurate validation without processing all stored certificates, thus reducing validation time.
3Productivity
If only the most recent certificate is verified during identity validation, then validation efficiency is improved, but authentication comprehensiveness may be reduced
Solution Approach 1:
The system applies partial action by verifying only the most recent additional certificate issued by the registration instance for the specific network environment, rather than validating all historical certificates. This partial validation approach maintains high efficiency while ensuring sufficient authentication comprehensiveness for the current operational context, as the most recent certificate reflects the current authorized state.
Solution Approach 2:
The validation process focuses on the locally relevant most recent certificate issued by the specific registrationinstance for the current network environment, rather than performing global validation of all certificates. This local quality approach optimizes validation efficiency by concentrating on the certificate most relevant to the current operational context while maintaining adequate authentication for that specific scenario.
Data Source
AI summary
To provide and validate cryptographically secured device identity information, an initial device certificate is created as device identity information and stored in a device memory. This initial device certificate includes manufacturer-selected and signed device information, comprising at least a device identifier, a device attribute or property, and a reference to a manufacturer-assigned public key. Only after successful device authentication is an additional device certificate created based on the initial device certificate as further device identity information and stored in the device memory. This additional device certificate contains user-selected and signed device information and forms a certificate chain with the initial device certificate.After successful device authentication, at least one further additional device certificate can be generated using the additional device certificate. This additional certificate contains device information selected and signed by a subsequent user or processor and can be stored in the device memory. During identity validation of the device, only the most recently generated device certificate or one specified for identity validation is read from the device memory and verified.