Using device certificates for automated authentication of communicating devices
First Claim
1. A computer program product embodied on computer readable media readable by a computing system in a computing environment, for using device certificates to authenticate communicating devices, comprising:
- computer-readable program code means for creating a public key, private key pair for a first device, said key pair adapted for use in public key cryptography systems;
computer-readable program code means for creating a first device certificate for said first device, wherein said first device certificate identifies said first device as owning said first device certificate using a globally-unique device identifier associated with a network adapter card directly attached to said first device and wherein said public key is stored in said first device certificate, thereby associating said public key with said globally-unique device identifier;
computer-readable program code means for securely storing said private key on said first device in protected store that is readable only by hardware or firmware of said first device and not by software of said first device;
computer-readable program code means for digitally signing, by said hardware or firmware, a first message using said private key of said key pair and sending said digitally-signed first message, from said first device to a second device;
computer-readable program code means for receiving said digitally-signed first message at said second device;
computer-readable program code means for authenticating, by said second device, said first device as having sent said digitally-signed first message by authenticating said first device'"'"'s digital signature thereupon;
computer-readable program code means for processing said first message, by said second device, only if said computer-readable program code means for authenticating determines that said first device is authentic, resulting in creation of a second message;
computer-readable program code means for returning said second message from said second device to said first device, only if said computer-readable program code means for authenticating determines that said first device is authentic; and
computer-readable program code means for receiving said returned second message at said first device.
1 Assignment
0 Petitions
Accused Products
Abstract
A device certificate identifies a particular device using a globally-unique device identifier and contains a public key associated therewith. A private key stored in protected storage of the device is used to digitally sign outbound messages, enabling communicating devices to authenticate one another using the associated device certificate and public key, before returning a response. Devices functioning as servers can thereby securely participate in dynamic, automatic address assignment services using a service such as a Boot Protocol or Dynamic Host Configuration Protocol, and/or to update address information stored in a Domain Name System (DNS) server, ensuring that the update is authentic, and when the DNS is also authenticated, ensuring that a legitimate DNS has been contacted.
312 Citations
47 Claims
-
1. A computer program product embodied on computer readable media readable by a computing system in a computing environment, for using device certificates to authenticate communicating devices, comprising:
-
computer-readable program code means for creating a public key, private key pair for a first device, said key pair adapted for use in public key cryptography systems;
computer-readable program code means for creating a first device certificate for said first device, wherein said first device certificate identifies said first device as owning said first device certificate using a globally-unique device identifier associated with a network adapter card directly attached to said first device and wherein said public key is stored in said first device certificate, thereby associating said public key with said globally-unique device identifier;
computer-readable program code means for securely storing said private key on said first device in protected store that is readable only by hardware or firmware of said first device and not by software of said first device;
computer-readable program code means for digitally signing, by said hardware or firmware, a first message using said private key of said key pair and sending said digitally-signed first message, from said first device to a second device;
computer-readable program code means for receiving said digitally-signed first message at said second device;
computer-readable program code means for authenticating, by said second device, said first device as having sent said digitally-signed first message by authenticating said first device'"'"'s digital signature thereupon;
computer-readable program code means for processing said first message, by said second device, only if said computer-readable program code means for authenticating determines that said first device is authentic, resulting in creation of a second message;
computer-readable program code means for returning said second message from said second device to said first device, only if said computer-readable program code means for authenticating determines that said first device is authentic; and
computer-readable program code means for receiving said returned second message at said first device. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11)
said computer-readable program code means for digitally signing sending said first message creates a first digital signature over one or more fields of said first message, wherein said one or more fields includes at least said globally-unique device identifier, and wherein said first device certificate is sent along with said digitally-signed first message;
said computer-readable program code means for receiving said digitally-signed first message further comprises computer-readable program code means for receiving said first device certificate, in addition to said digitally-signed first message; and
said computer-readable program code mean for authenticating said first device further comprises;
computer-readable program code means for decrypting said first digital signature using said public key stored in said first device certificate;
computer-readable program code means for obtaining a certificate authority (CA) public key associated with a CA which created a second digital signature stored in said first device certificate;
computer-readable program code means for decrypting said second digital signature using said obtained CA public key;
computer-readable program code means or concluding that said first device certificate is authentic if said decrypted second digital signature is authentic; and
computer-readable program code means for concluding that said first device is authentic if (1) said decrypted first digital signature is authentic, (2) a device identifier value covered by said decrypted first digital signature matches a globally-unique device identifier which identifies a sender of said first message, and (3) said first device certificate is authentic.
-
-
3. The computer program product as claimed in claim 2, wherein:
-
said computer-readable program code means for processing said first message further comprises computer-readable program code means for digitally signing, by said second device, one or more fields of said resulting second message, using a second private key associated with said second device and resulting in creation of a third digital signature;
said computer-readable program code means for returning said second message further comprises computer-readable program code means for returning along with said second message;
(1) a second device certificate, wherein said second device certificate comprises (a) a second globally-unique device identifier associated with a network adapter card of said second device, thereby identifying said second device as owning said second device certificate and (b) a second public key, said second public key associated with said second private key and adapted for use in public key cryptography systems, thereby associating said second public key with said second globally-unique device identifier, and (2) said thud digital signature; and
said computer-readable program code means for receiving said returned second message at said fist device also receives said second device certificate and said third digital signature; and
further comprising;
computer-readable program code means for decrypting, by said first device, said received third digital signature using said second public key stored in said received second device certificate;
computer-readable program code means for obtaining, by said first device, a second CA public key associated with a second CA which created a fourth digital signature stored in said second device certificate;
computer-readable program code means for decrypting, by said first device, said fourth digital signature using said obtained second CA public key;
computer-readable program code means for concluding that said second device certificate is authentic if said decrypted fourth digital signature is authentic;
computer-readable program code means for concluding that said second device is authentic if (1) said decrypted third digital signature is authentic, (2) a third device identifier value covered by said decrypted third digital signature matches a globally-unique device identifier which identifies a sender of said second message, and (3) said second device certificate is authentic; and
computer-readable program code means for using said received second message at said first device only if said second device is authentic.
-
-
4. The computer program product as claimed in claim 2, wherein:
-
a CA certificate containing said CA public key is sent, along with said digitally-signed first message and said first device certificate, to said second device using a copy of said CA certificate stored at said first device; and
said computer-readable program code means for obtaining said CA public key uses said sent CA certificate.
-
-
5. The computer program product as claimed in claim 3, wherein:
-
said computer-readable program code means for returning said second message, said second device certificate, and said third digital signature also returns a second CA certificate containing said second CA public key to said first device using a second device copy of said second CA certificate; and
said computer-readable program code means for obtaining said second CA public key uses said returned CA certificate.
-
-
6. The computer program product as claimed in claim 3, further comprising:
-
computer-readable program code means for creating a handshaking message by said first device, wherein said handshaking message comprises one or more message fields and a further digital signatures wherein said one or more message fields include a time stamp, said fourth digital signature computed over said one or more message fields;
computer-readable program code means for sending said handshaking message from said first device to said second device;
computer-readable program code means for receiving said handshaking message at said second device;
computer-readable program code means for decrypting said fourth digital signature using said public key of said first device; and
computer-readable program code means for completing a message exchange initiated by said first message and said second message if said decrypted fourth digital signature is valid and said time stamp is not stale.
-
-
7. The computer program product as claimed in claim 1, wherein said protected storage is a write-only memory of said first device, said write-only memory having an ability to perform computations using data values previously stored therein.
-
8. The computer program product as claimed in claim 1, wherein said protected storage is a read-write memory of said first device, said read-write memory being readable only by means of a shared secret key.
-
9. The computer program product as claimed in claim 1, wherein said address identifying said first device in said first device certificate is a medium access control (MAC) address of said network adapter card.
-
10. The computer program product as claimed in claim 3, further comprising:
-
computer-readable program code means for generating, by said first device, a first challenge;
computes-readable program code means for including, by said first device, said first challenge in said one or more fields of said first message; and
computer-readable program code means for including, by said second device, said first challenge in said one or more fields of said second message; and
wherein said computer-readable program code means for using said received second message further comprises using said received second message only if said signed first challenge is valid.
-
-
11. The computer program product as claimed in claim 6, further comprising:
-
computer-readable program code mean for generating, by said first device, a first challenge;
computer-readable program code means or including, by said first device, said first challenge in said one or more fields of said first message;
computer-readable program code means for generating, by said second device, a second challenge;
computer-readable program code means for including said first challenge and said second challenge in said one or more fields of said second message; and
computer-readable program code means for including, by said first device, said second challenge in said one or more message fields of said handshaking message; and
wherein;
said computer-readable program code means for using said received second message further comprises using said received second message only if said signed first challenge is valid; and
said computer-readable program code means for completing said message exchange farther copses completing said message exchange only if said signed second challenge is valid.
-
-
12. A computer program product embodied on computer readable media readable by a coring system in a computing environment, for using device certificates to automatically authenticate a communicating device, comprising:
-
computer-readable program code means for creating a public key, private key pair for a device that will function as a device, said key pair adapted for use in public key cryptography systems;
computer-readable program code means for creating a device certificate for said server device, wherein said device certificate identifies said server device as owning said device certificate using a globally-unique device identifier associated with a network adapter card directly attached to said server device and wherein said public key is stored in said device certificate, thereby associating said public key with said globally-unique device identifier;
computer-readable program code means for securely storing said private key on said server device in protected storage that is readable only by hardware or firmware of said server device and not by software of said server device;
computer-readable program code means for sending a first message from a client device to said server device;
computer-readable program code means for receive said first message at said server device;
computer-readable program code means for processing, by said server device, said first massage, resulting in creation of a second message;
computer-readable program code means for digitally signing, by said hardware or firmware, said second message, using said private key of said key pair, and returning said digitally-signed second message to said client device;
computer-readable program code means for receiving said returned digitally-signed second message at said client device;
computer-readable program code means for authenticating said server device, by said client device, as having sent said digitally-signed second message by authenticating said server device'"'"'s digital signature thereupon, responsive to receiving said returned digitally-signed second message; and
computer-readable program code means for using said received second message at said client device only if said computer-readable program code means for authenticating determines that said server device is authentic. - View Dependent Claims (13, 14, 15)
said computer-readable program code means for digitally signing said second message creates a first digital signature over one or more fields of said second message, and wherein said device certificate is sent along with said digitally-signed second message; and
said computer-readable program code mean for receiving said returned digitally-signed second message also receives said device certificate; and
said computer-readable program code means for authenticating further comprising;
computer-readable program code means for decrypting, by said client device, said first digital signature using said public key stored in said received device certificate;
computer-readable program code means for obtaining by said client device, a certificate authority (CA) public key associated with a CA which created a second digital signature stored in said device certificate;
computer-readable program code means for decrypting, by said client device, said second digital nature using said obtained CA public key;
computer-readable program code means for concluding that said device certificate is authentic if said decrypted second digital size is authentic; and
computer-readable program code means for concluding that said server device is authentic if (1) said decrypted first digital signature is authentic, (2) a device identifier value covered by said decrypted first digital signature matches a globally-unique device identifier which identifies a sender of said second message, and (3) said device certificate is authentic.
-
-
14. The computer program product as claimed in claim 13, wherein said server device is executing a Dynamic Host Configuration Protocol (DHCP) service.
-
15. The computer program product as claimed in claim 13, wherein said server device is executing a Domain Name System (DNS) service.
-
16. A system for using device certificates to authenticate communicating devices in a computing environment, comprising:
-
means for creating a public key, private key pair for a first device, said key pair adapted for use in public key cryptography systems;
means for creating a first device certificate for said first device, wherein said first device certificate identifies said first device as owning said first device certificate using a globally-unique device identifier associated with a network adapter card directly attached to said first device and wherein said public key is stored in said first device certificate, thereby associating said public key with said globally-unique device identifier;
means for securely storing said private key on said first device in protected storage that is readable only by hardware or firmware of said first device and not by software of said first device;
means for digitally signing, by said hardware or firmware, a first message using said private key of said key pair and sending said digitally-signed first message from said first device to a second device;
means for receiving said digitally-signed first message at said second device;
means for authenticating by said second device, said first device as having sent said digitally-signed first message by authenticating said first device'"'"'s digital signature thereupon;
means for processing said first message, by said second device, only if said means for authenticating determines that said first device is authentic, resulting in creation of a second message;
means for returning said second message from said second device to said first device, only if said means for authenticating determines that said first device is authentic; and
means for receiving said returned second message at said first device. - View Dependent Claims (17, 18, 19, 20, 21, 22, 23, 24, 25, 26)
said means for digitally signing said first message creates a first digital signature over one or more fields of said first message, wherein said one or more fields includes at least said globally-unique device identifier, and wherein said first device certificate is sent along with said digitally-signed first message;
said means for receiving said digitally-signed first message further comprises means for receiving said first device certificate, in addition to said digitally-signed first message; and
said means for authenticating said first device further comprises;
means for decrypting said first digital signature using said public key stored in said first device certificate;
means for obtaining a certificate authority (CA) public key associated a CA which created a second digital signature stored in said first device certificate;
means for decrypting said second digital signature using said obtained CA public key;
means for concluding that said first device certificate is authentic if said decrypted second digital signature is authentic; and
means for concluding that said first device is authentic if (1) said decrypted first digital signature is authentic, (2) a device identifier value covered by said decrypted first digital signature matches a globally-unique device identifier which identifies a sender of said first message, and (3) said first device certificate is authentic.
-
-
18. The system as claimed in claim 17, wherein:
-
said means for processing said first message further comprises means for digitally signing, by said second device, one or more fields of said resuming second message, using a second private key associated with said second device and resulting in creation of a third digital signature;
said means for returning said second message further comprises means for returning, along with said second message;
(1) a second device certificate, wherein said second device certificate comprises (a) a second globally-unique device identifier associated with a network adapter card of said second device, thereby identifying said second device as owning said second device certificate and (b) a second public key, said second public key associated with said second private key and adapted for use in public key cryptography systems, thereby associating said second public key with said second globally-unique device identifier, and (2) said third digital signature; and
said men for receiving said returned second message at said first device also receives said second device certificate and said third digital signature; and
further comprising;
means for decrypting, by said first device, said received third digital signature said second public key stored in said received second device certificate;
means for obtaining, by said first device, a second CA public key associated with a second CA which created a fourth digital signature stored in said second device certificate;
means for decrypting, by said first device, said fourth digital signature using said obtained second CA public key;
means for concluding that said second device certificate is authentic if said decrypted fourth digital signature is authentic;
means for concluding that said second device is authentic if (1) said decrypted third digital signature is authentic, (2) a third device identifier value covered by said decrypted third digital signature matches a globally-unique device identifier which identifies a sender of said second message, and (3) said second device certificate is authentic; and
means for using said received second message at said first device only if said second device is authentic.
-
-
19. The system as claimed in claim 17, wherein:
-
a CA certificate containing said CA public key is sent, along with said digitally-signed first message and said first device certificate to said second device using a copy of said CA certificate stored at said first device; and
said means for obtaining said CA public key uses said sent CA certificate.
-
-
20. The system as claimed in claim 18, wherein:
-
said means for ret said second message, said second device certificate, and said third digital signature also returns a second CA certificate containing said second CA public key to said first device using a second device copy of said second CA certificate; and
said means for obtaining said second CA public key uses said returned CA certificate.
-
-
21. The system as claimed in claim 18, further comprising:
-
means for creating a handshaking message by said first device, wherein said handshaking message comprises one or more message fields and a fourth digital signature, wherein said one or more message fields include a time stamp, said fourth digital signature computed over said one or more message fields;
means for sending said handshaking message from said first device to said second device;
means for receiving said handshaking message at said second device;
means for decrypting said fourth digital signature using said public key of said first device; and
means for completing a message exchange initiated by said first message and said second message if said decrypted fourth digital signature is valid and said time stamp is not stale.
-
-
22. The system as claimed in claim 16, wherein said protected storage is a write-only memory of said first device, said write-only memory having an ability to perform computations using data values previously stored therein.
-
23. The system as claimed in claim 16, wherein said protected storage is a read-write memory of said first device, said read-write memory being readable only by means of a shared secret key.
-
24. The system as claimed in claim 16, wherein said address identifying said first device in said first device certificate is a medium access control (MAC) address of said network adapter card.
-
25. The system as claimed in claim 18, further comprising:
-
means for generating, by said first device, a first challenge;
means for including, by said first device, said first challenge in said one or more fields of said first message; and
means for including, by said second device, said first challenge in said one or more fields of said second message; and
wherein said means for using said received second message further comprises using said received second message only if said signed first challenge is valid.
-
-
26. The system as claimed in claim 21, further comprising:
-
means for generating, by said first device, a first challenge;
means for including, by said first device, said fist challenge in said one or more fields of said first message;
means for generating, by said second device, a second challenge;
means for including said first challenge and said second challenge in said one or more fields of said second message; and
means for including, by said first device, said second challenge in said one or more message fields of said handshaking message; and
wherein;
said means for using said received second message further comprises using said received second message only if said signed first challenge is valid; and
said means for completing said message exchange further comprises completing said message exchange only if said signed second challenge is valid.
-
-
27. A system for using device certificates to automatically authenticate a communicating device in a computing environment, comprising:
-
means for creating a public key, private key pair for a device that will function as a server device, said key pair adapted for use in public key cryptography systems;
means for creating a device certificate for said server device, wherein said device certificate identifies said sever device as owning said device certificate using a globally-unique device identifier associated with a network adapter card directly attached to said server device and wherein said public key is stored in said device certificate, thereby associating said public key with said globally-unique device identifier;
means for securely storing said private key on said server device in protected storage that is readable oil by hardware or firmware of said server device and not by software of said server device;
means for sending a first message from a client device to said server device;
means for receiving said first message at said server device;
means for processing, by said server device, said first message, resulting in creation of a second message;
means for digitally signing, by said hardware or firmware, said second message, using said private key of said key pair, and returning said digitally-signed second message to said client device;
means for receiving said returned digitally-signed second message at said client device;
means for authenticating said server device, by said client device, as having sent thereupon, responsive to receiving said returned digitally-signed second message; and
means for using said received second message at said client device if said means for authenticating determines that said server device is authentic. - View Dependent Claims (28, 29, 30)
said means for digitally signing said second message creates a first digital signature over one or more fields of said second message, and wherein said device certificate is sent along with said digitally-signed second message; and
said means for receiving said returned digitally-signed second message also receives said device certificate; and
said means for receiving said returned digitally-signed second message also receives said device certificate; and
said means for authenticating further comprises;
means for decrypting, by said client device, said first digital signature using said public key stored in said received device certificate;
means for obtaining, by said client device, a certificate authority (CA) public key associated with a CA which created a second digital signature stored in said device certificate;
means for decrypting, by said client device, said second digital signature using said obtained CA public key;
means for concluding that said device certificate is authentic if said decrypted second digital signature is authentic; and
means for concluding that said server device is authentic if (1) said decrypted first digital signs is authentic, (2) a device identifier value covered by said decrypted first digital signature matches a globally-unique device identifier which identifies a sender of said second message, and (3) said device certificate is authentic.
-
-
29. The system as claimed in claim 28, wherein said server device is executing a Dynamic Host Configuration Protocol (DHCP) service.
-
30. The system as claimed in claim 28, wherein said server device is executing a Domain Name System (DNS) service.
-
31. A method for using device certificates to authenticate communicating devices in a computing environment, comprising the steps of:
-
creating a public key, private key pair for a first device, said key pair adapted for use in public key cryptography systems;
creating a first device certificate for said first device, wherein said first device certificate identifies said first device as owning said first device certificate using a globally-unique device identifier associated with a network adapter card directly attached to said first device and wherein said public key is stored in said first device certificate, thereby associating said public key with said globally-unique device identifier;
securely storing said private key on said first device in protected storage that is readable only by hardware or firmware of said first device and not by software of said first device;
digitally signing, by said hardware or firmware, a first message using said private key of said key pair and sending said digitally-signed first message from said first device to a second device;
receiving said digitally-signed first message at said second device;
authenticating, by said second device, said first device as having sent said digitally-signed first message by authenticating said first device'"'"'s digital signature thereupon;
processing said first message, by said second device, only if said authenticating step determines that said first device is authentic, resulting in creation of a second message, returning said second message from said second device to said first device, only if said authenticating step determines that said first device is authentic; and
receiving said returned second message at said first device. - View Dependent Claims (32, 33, 34, 35, 36, 37, 38, 39, 40, 41)
said step of digitally signing said first message creates a first digital signature over one or more fields of said first message, wherein said one or more fields includes at least said globally-unique device identifier, and wherein said first device certificate is sent along with said digitally-signed first message;
said step of receiving said digitally-signed first message further comprises receiving said first device certificate, in addition to said digitally-signed first message; and
said step of authenticating said first device further comprises the steps of;
decrypting said first digital signature using said public key stored in said first device certificate;
obtaining a certificate authority (CA) public key associated with a CA which created a second digital signature stored in said first device certificate;
decrypting said second digital signature using said obtained CA public key;
concluding that said first device certificate is authentic if said decrypted second digital signature is authentic; and
concluding that said first device is authentic if (1) said decrypted first digital signature is authentic, (2) a device identifier value covered by said decrypted first digital signature matches a globally-unique identifier which identifies a sender of said first message, and (3) said first device certificate is authentic.
-
-
33. The method as claimed in claim 32, wherein:
-
said step of processing said first message further comprises the step of digitally signing, by said second device, one or more fields of said resulting second message, using a second private key associated with said second device and resulting in creation of a third digital signature;
said step of returning said second message further comprises the step of returning, along with said second message;
(1) a second device certificate, wherein said second device certificate comprises (a) a second globally-unique device identifier associated with a network adapter card of said second device, thereby identifying said second device as owning said second device certificate and (b) a second public key, said second public key associated with said second private key and adapted for use in public key cryptography systems, thereby associating said second public key with said second globally-unique device identifier, and (2) said third digital signature; and
said step of receiving said returned second message at said first device also receives said second device certificate and said third digital signature; and
further comprising the steps of;
decrypting, by said first device, said received third digital signature using said second public key stored in said received second device certificate;
obtaining, by said first device, a second CA public key associated with a second CA which created a fourth digital signature stored in said second device certificate;
decrypting, by said first device, said further digital signature using said obtained second CA public key;
concluding that said second device certificate is authentic if said decrypted fourth digital signature is authentic;
concluding that said second device is authentic if (1) said decrypted third digital signature is authentic, (2) a third device identifier valve covered by said decrypted third digital signature matches a globally-unique device identifier which identifies a sender of said second message, and (3) said second device certificate is authentic; and
using said received second message at said first device only if said second device is authentic.
-
-
34. The method as claimed in claim 32, wherein:
-
a CA certificate containing said CA public key is sent, alone with said digitally-signed first message and said first device certificate, to said second device using a copy of said CA certificate stored at said first device; and
said step of obtaining said CA public key uses said sent CA certificate.
-
-
35. The method as claimed in claim 33, wherein:
-
said step of said second message, said second device certificate, and said third digital signature also returns a second CA certificate containing said second CA public key to said first device using a second device copy of said second CA certificate; and
said step of obtaining said second CA public key uses said returned CA certificate.
-
-
36. The method as claimed in claim 33, further comprising the steps of:
-
creating a handshaking message by said first device, wherein said handshaking message comprises one or more message fields and a fourth digital signature, wherein said one or more message fields include a time stamp, said fourth digital signature computed over said one or more message fields;
sending said handshaking message from said first device to said second device;
receiving said handshaking message at said second device;
decrypting said fourth digital signature using said public key of said first device; and
completing a message exchange initiated by said first message and said second message if said decrypted fourth digital signature is valid and said time stamp is not stale.
-
-
37. The method as claimed in claim 31, wherein said protected storage is a write-only memory of said first device, said write-only memory having an ability to perform computations using data values previously stored therein.
-
38. The method as claimed in claim 31, wherein said protected storage is a read-write memory of said first device, said read write memory being readable only by means of a shared secret key.
-
39. The method as claimed in claim 31, wherein said address identifying said first device in said first device certificate is a medium access control (MAC) address of said network adapter card.
-
40. The method as claimed claim 33, further comprising the steps of:
-
generating, by said first device, a first challenge;
including, by said first device, said first challenge in said one or more fields of said first message; and
including, by said second device, said first challenge in said one or more fields of said second message; and
wherein said step of using said received second message further comprises using said received second message only if said signed first challenge is valid.
-
-
41. The method as claimed in claim 36, further comprising the steps of:
-
generating, by said first device, a first challenge;
including, by said first device, said first challenge in said one or more fields of said first message;
generating, by said second device, a second challenge;
including said first challenge and said second challenge in said one or more fields of said second message; and
including, by said first device, said second challenge in said one or more message fields of said handshaking message; and
wherein;
said step of using said received second message or comprises using said received second message only if said signed first challenge is valid; and
said step of completing said message exchange further comprises completing said message exchange only if said signed second challenge is valid.
-
-
42. A method for using device certificates to automatically authenticate a communicating device in a computing environment, comprising the step of:
-
creating a public key, private key pair for a device that will function as a server device, said key pair adapted for use in public key cryptography systems;
creating a device certificate for said server device, wherein said device certificate identifies said server device as owning said device certificate using a globally-unique device identifier associated with a network adapter card directly attached to said server device and wherein said public key is stored in said device certificate, thereby associating said public key with said global-unique device identifier;
securely storing said private key on said server device in protected storage that is readable only by hardware or firmware of said serve device and not by software of said server device;
sending a first message from a client device to said server device;
receiving said first message at said server device;
processing, by said server device, said first message, resulting in creation of a second message;
digitally signing, by said hardware or firmware, said second message, using said private key of said key pair, and returning said digitally-signed second message to said client device;
receiving said returned digitally-signed second message at said client device;
authenticating said severer device, by said client device, as having sent said digitally-signed second message by authenticating said server device'"'"'s digital signature thereupon, responsive to receiving said returned digitally-signed second message; and
using said received second message at said client device if said authenticating step determines that said server device is authentic. - View Dependent Claims (43, 44, 45)
said step of digitally signing said second message crates a first digital signature over one or more fields of said second message, and wherein said device certificate is sent along with said digitally-signed second message; and
said step of receiving said returned digitally-signed second message also receives said device certificate; and
said step of authenticating further comprises the steps of;
decrypting, by said client device, said first digital signature using said public key stored in said received device certificate;
obtaining, by said client device, a certificate authority (CA) public key associated with a CA which created a second digital signature stored in said device certificate;
decrypting, by said client device, said second digital sure using said obtained CA pubic key, concluding that said device certificate is authentic if said decrypted second digital signature is authentic; and
including that said server device is authentic if (1) said decrypted first digital signature is authentic, (2) a device identifier value covered by said decrypted first digital signature matches a globally-unique device identifier which identifies a sender of said second message, and (3) said device certificate is authentic.
-
-
44. The method as claimed in claim 43, wherein said server device is executing a Dynamic Host Configuration Protocol (DHCP) service.
-
45. The method as claimed in claim 43, wherein said server device is executing a Domain Name System (DNS) service.
-
46. A computer-implemented method of using device certificates to authenticate communicating devices, comprising steps of:
-
digitally signing a message, by a first device where said message is created, using a private key from a public key cryptography public/private key pair of the fist device thereby creating a digital signature for the message, wherein (1) a globally-unique identifier associated with a network adapter card of the first device is stored in a device certificate that is associated with the first device, thereby identifying the first device as an owner of the device certificate;
(2) the public key is stored in the device certificate, thereby associating the public key with the globally-unique identifier; and
(3) the private key is stored in device-resident, access-protected storage of the first device; and
authenticating the first device, by a receiver of the digitally-signed message, before the receiver will act upon contents of the message, further comprising steps of;
authenticating the it device as having created the digital signature on the digitally-signed message, by the receiver, using the public key of the first device; and
ensuring that the globally-unique identifier stored in the device certificate matches a device identifier that identifies a sender of the digitally-signed message.
-
-
47. A computer-implemented method of using device certificates to authenticate communicating devices, comprising steps of:
-
authenticating a first device, by a second device that receives a digitally-signed first message from the fist device, using a first device certificate of the first device; and
responsive to a successful outcome of the authenticating step, responding to the first message, further comprising steps of;
digitally signing a second message, by the second device where the second message is created, using a private key from a public key cryptography public/private key pair of the second device, thereby creating a digital signature for the second message, wherein (1) a globally-unique identifier associated with a network adapter card of the second device is stored in a second device certificate that is associated with the second device, thereby identifying the second device as an owner of the second device certificate;
(2) the public key is stored in the second device certificate, thereby associating the public key with the globally-unique identifier;
(3) the private key is stored in device-resident, access-protected storage of the second device; and
(4) the second message includes the second device certificate, such that the digital signature on the second message covers the public key and the globally-unique identifier of the second device;
authenticating the second device as having created the digital size on the digitally-signed second message, by the first device upon receipt thereof using the public key of the second device; and
that the second message was sent to the first device by the second device by comparing the globally-unique identifier stored in the second device certificate to a device identifier that identifies a sender of the digitally-signed second message.
-
Specification