Certificate update method and certificate update system of device driving the same

1 . A method of updating a certificate of a device in response to a bootloader of the device being changed, the method comprising:

generating a device identifier comprising unique information of the device;

generating a device identity (ID) certificate signing request (CSR) based on the device identifier;

updating the bootloader, the updating including updating a certificate of the device based on the device ID CSR using firmware of the device in response to a request of a host device; and

in response to the bootloader being changed,

authenticating the updating of the bootloader based on a first certificate generated by a manufacturer of the device, and

changing the device identifier and the device ID CSR, and

in response to the authenticating of the updating of the bootloader failing using the first certificate, authenticating the updating of the bootloader based on a second certificate generated by an original equipment manufacturer (OEM) of the device, wherein the second certificate is the updated certificate of the device generated based on the device ID CSR.

2 . The method of claim 1 , wherein the updating the certificate of the device further includes:

receiving a signing request from the bootloader;

generating a device ID certificate chain in response to the signing request; and

updating information of the device ID certificate chain.

3 . The method of claim 1 , wherein the updating the certificate of the device further includes:

verifying a signature of an intermediate certificate based on a first public key of a stored root certificate; and

verifying a signature of a device ID based on a second public key included in the intermediate certificate in response to the verifying of the signature of the intermediate certificate being successful.

4 . The method of claim 3 , wherein the updating the certificate of the device further includes:

receiving, by the host device, a challenge message to the firmware; and

transmitting a challenge authentication message generated based on a device private key to the host device in response to the challenge message.

5 . The method of claim 2 , wherein the receiving of the signing request of the device ID includes generating a device ID CSR based on the generated device identifier.

6 . The method of claim 2 , wherein the generating of the device ID certificate chain further includes:

transmitting the device ID CSR to the host device; and

receiving, by a certification authority (CA), chain information of the second certificate in response to the device ID CSR.

7 . The method of claim 2 , wherein the updating of the information of the device ID certificate chain further includes:

changing the certificate of the device based on chain information of the second certificate; and

storing the first certificate and the second certificate in a certificate storage device.

8 . The method of claim 1 , further comprising:

updating a third certificate generated by a customer.

9 . The method of claim 8 , wherein the updating of the third certificate further includes:

receiving the device ID CSR from the bootloader;

generating a certificate chain in response to the device ID CSR; and

updating information of the certificate chain to the first certificate.

10 . A method of updating a certificate of a device in response to a bootloader of the device being changed, the method comprising:

generating a device identifier;

generating, by the bootloader, a device identity (ID) certificate signing request (CSR) based on the device identifier; and

authenticating an update of the bootloader in response to the device ID CSR, the authenticating of the update of the bootloader further including,

verifying a first certificate stored in a first slot of memory, the first certificate generated by a manufacturer of the device,

requesting a second certificate from a host device in response to the verifying of the first certificate failing, the second certificate generated based on the device ID CSR by an original equipment manufacturer (OEM) of the device; and

storing the second certificate in a second slot of the memory and authenticating the update of the bootloader based on the second certificate and the device ID CSR,

wherein in response to the bootloader being changed, the device identifier and the device ID CSR are changed.

11 . The method of claim 10 , wherein the authenticating of the updating of the bootloader further includes:

receiving the device ID CSR from the bootloader;

generating a certificate chain in response to the device ID CSR; and

updating information of the certificate chain stored in the second slot of the memory.

12 . The method of claim 11 , wherein the authenticating of the updating of the bootloader further includes:

authenticating the updating of the bootloader based on the second certificate that is an alias key certificate.

13 . The method of claim 11 , wherein the authenticating of the updating of the bootloader further includes:

verifying a signature of an intermediate certificate based on a first public key of a stored root certificate; and

verifying a signature of a device ID based on a second public key included in the intermediate certificate in response to the verifying of the signature of the intermediate certificate being successful.

14 . The method of claim 11 , wherein the authenticating of the updating of the bootloader further includes:

receiving a challenge message from the host device; and

transmitting a challenge authentication message generated based on a device private key to the host device in response to the challenge message.

15 . The method of claim 11 , wherein the authenticating of the updating of the bootloader further includes:

generating the device ID CSR based on the generated device identifier.

16 . The method of claim 11 , further comprising:

storing information of a third certificate in a third slot of the memory, the storing including,

transmitting the device ID CSR to the host device;

receiving, from a certification authority (CA) of the OEM, certificate chain information of the third certificate; and

changing an ID certificate of the device based on the chain information of the third certificate.

17 . A certificate update system of a device for updating a certificate in response to a bootloader of the device being changed, the certificate update system comprising:

processing circuitry configured to,

generate a device identifier comprising unique information of a device;

generate a device identity (ID) certificate signing request (CSR) based on the device identifier using a bootloader;

update the bootloader based on the device ID CSR;

update a certificate of the device in response to a request from a host device; and

in response to the bootloader being changed,

authenticate an update of the bootloader based on a first certificate generated by a manufacturer of the device, and

the device identifier and the device ID CSR are changed, and

in response to the authenticating of the updating of the bootloader failing using the first certificate, authenticating the updating of the bootloader based on a second certificate generated by an original equipment manufacturer (OEM) of the device, wherein the second certificate is the updated certificate of the device generated based on the device ID CSR.

18 . The certificate update system of claim 17 , wherein the processing circuitry is further configured to:

receive the device ID CSR;

generate a device ID certificate chain in response to the device ID CSR; and

update information of the device ID certificate chain.

19 . The certificate update system of claim 17 , wherein the host device is configured to:

verify the device, the verifying including,

verifying a signature of an intermediate certificate based on a first public key of a stored root certificate, and

verifying a signature of a device ID based on a second public key included in the intermediate certificate in response to succeeding in verifying the signature of the intermediate certificate.

20 . The certificate update system of claim 17 , wherein the processing circuitry is further configured to:

generate the device ID CSR based on the generated device identifier using the bootloader.