Device-bound certificate authentication

• US 8,438,394 B2
• Filed: 07/08/2011
• Issued: 05/07/2013
• Est. Priority Date: 01/14/2011
• Status: Active Grant

• Current Assignee: Device Authority Ltd.
• Original Assignee: DeviceAuthority Inc. (f/k/a NetAuthority, Inc.) (Device Authority Ltd.)
• Inventors: Etchegoyen, Craig S., Harjanto, Dono
• Primary Examiner(s): Armouche, Hadi
• Assistant Examiner(s): LEWIS, LISA C
• Application Number:
  US13/179,387
• Publication Number:
  US 20120204033A1
• Time in Patent Office: 669 Days
• Field of Search: 713/175, 726/2, 726/10
• US Class Current: 713/175
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3231 Biological data, e.g. fingerprint, voice or retina network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A device-bound certificate authority binds a certificate to one or more devices by including digital fingerprints of the devices in the certificate. A device only uses a device-bound certificate if the digital fingerprint of the device is included in the certificate and is verified. Thus, a certificate is only usable by one or more devices to which the certificate is explicitly bound. Such device-bound certificates can be used for various purposes served by certificates generally such as device driver authentication and authorization of access to secure content, for example.

Claims

1. A method for binding a digital certificate that can be stored on a computer-readable medium to multiple devices, the method comprising:

receiving at a server computer a request from a remote device through a computer network wherein the request identifies the certificate and identifies each of devices by a device identifier created by the server computer, each device identifier being uniquely associated with a digital fingerprint of one of the devices;

retrieving the certificate;

for each of the devices;

retrieving a digital fingerprint of the device; and

including the digital fingerprint in the certificate; and

sending the certificate with the included digital fingerprints to the remote device through the computer network,

wherein the server computer in response to the request serves a device driver cryptographically signed with the certificate so that any of the devices can install the device only upon a condition in which one of the digital fingerprints corresponds to the installing device.

2. The method of claim 1 wherein the remote device determines whether any of the digital fingerprints that are included in the certificate corresponds to the remote device and, upon a condition in which at least one of the digital fingerprint fingerprints corresponds to the remote device, accepts the certificate as legitimate.

3. The method of claim 2 wherein the remote device determines whether any of the digital fingerprints that are included in the certificate corresponds to a requesting device from which the remote device has received a request for access to secure content of the remote device and, upon a condition in which at least one of the digital fingerprints corresponds to the requesting device and the remote device is preconfigured to recognize the requesting device as authorized to access the secure content, grants the request.

4. The method of claim 1 wherein the remote device determines whether any of the digital fingerprints that are included in the certificate corresponds to a requesting device from which the remote device has received a request for access to secure content of the remote device and, upon a condition in which at least one of the digital fingerprints corresponds to the requesting device and the remote device is preconfigured to recognize the requesting device as authorized to access the secure content, grants the request.

5. The method of claim 1 wherein the remote device determines whether any of the digital fingerprints that is are included in the certificate corresponds to a requesting device from which the remote device has received a request for access to secure content of the remote device and, upon a condition in which at least one of the digital fingerprint fingerprints corresponds to the requesting device and the remote device is preconfigured to recognize the requesting device as authorized to access the secure content, grants the request.

6. A non-transitory computer readable medium useful in association with a computer which includes one or more processors and a memory, the computer readable medium including computer instructions which are configured to cause the computer, by execution of the computer instructions in the one or more processors from the memory, to bind a digital certificate that can be stored on a computer readable medium to multiple devices by at least:

receiving at the computer a request from a remote device through a computer network wherein the request identifies the certificate and identifies each of the devices by a device identifier created by the server computer, each device identifier being uniquely associated with a digital fingerprint of one of the devices;

retrieving the certificate;

for each of the one or more devices;

retrieving a digital fingerprint of the device; and

including the digital fingerprint in the certificate; and

sending the certificate with the one or more included digital fingerprints to the remote device through the computer network,

wherein the server computer in response to the request serves a device driver cryptographically signed with the certificate so that any of the devices can install the device only upon a condition in which one of the digital fingerprints corresponds to the installing device.