IoT Device Certificate Issuance Using Signed Attestation Requests
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Issuing certificates for edge devices in IoT systems requires significant labor on the user side, complicating secure communication with server devices.
Innovation Solution
A communication system that includes a communication device, terminal device, and certificate authority, where the communication device generates a certificate signing request with device information and an electronic signature, which is verified by a paired public key, and the certificate authority issues the certificate based on this verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a certificate is issued to ensure security for communication between edge device and server device, then security is improved, but labor required on user side increases
Solution Approach 1:
The patent applies preliminary action by pre-registering device information (such as device identifiers, public keys, or other authentication data) in the communication device before actual certificate issuance. This pre-prepared information enables the certificate authority to quickly verify and issue certificates without requiring extensive user-side preparation work, thus maintaining security while reducing user labor.
Solution Approach 2:
The patent introduces an intermediary mechanism where the communication device itself generates or prepares the necessary authentication information (certificate signing requests, device identifiers, or cryptographic keys) locally. This intermediary preparation step eliminates the need for users to manually configure complex security parameters, allowing the certificate authority to issue certificates efficiently based on the pre-prepared device information.
2Ease of operation
If certificate issuance process is simplified to reduce user labor, then ease of operation is improved, but security verification may be compromised
Solution Approach 1:
The patent applies self-service by enabling the communication device to autonomously generate and prepare its own authentication information (such as device identifiers, public keys, or certificate signing requests) without requiring user intervention. The device uses its inherent characteristics or pre-stored information to create verification data that the certificate authority can automatically validate, thus simplifying the process while maintaining security through device-level self-verification.
Solution Approach 2:
The patent uses preliminary action by having the communication device pre-generate and store verification information (such as device identifiers, cryptographic keys, or authentication tokens) before the certificate issuance process begins. This pre-prepared information enables automated verification by the certificate authority without requiring manual security configuration by users, thus achieving both ease of operation and security verification.
Data Source
AI summary
According to one embodiment, a communication system includes a communication device, a terminal device, and a certificate authority. The communication device sends, to the terminal device, a certificate signing request which includes device information, an attestation nonce, and an electronic signature generated using a private key. The terminal device sends the certificate signing request to the certificate authority. Verification of the electronic signature included in the certificate signing request is executed using a public key. The certificate authority issues a certificate in response to the verification result.