Interim root-of-trust enrolment and device-bound public key registration

1 . An electronic device comprising:

a security module having a physical unclonable function, (PUF), the security module configured to establish an enrolment key pair (EPK, ESK) based on a first challenge and response to the PUF, the enrolment key pair comprising an enrolment public key (EPK) and an enrolment secret key (ESK);

one or more memories; and

a processor configured to:

over a secure connection, transmit a certificate signing request (CSR) to a server for a certificate certifying that the EPK is associated with a device identifier, the CSR comprising:

the device identifier; and

the EPK;

wherein the CSR is signed using the ESK, and wherein the device identifier is based on a function of the EPK;

over the secure connection, receive a temporary enrolment device certificate certifying that the EPK is associated with the device identifier and including a validity period; and

install the temporary enrolment device certificate in memory;

wherein the one or more memories have further installed thereon a primary trusted root certificate, and

wherein the processor is further configured to:

receive a secure connection issuing certificate and a secure connection certificate from the server, the secure connection issuing certificate and secure connection certificate being descendants of the primary trusted root certificate;

verify the secure connection certificate using the primary trusted root certificate;

in response to the verification, establish the secure connection to the server; and

over the secure connection, receive an issuing certificate, wherein the issuing certificate is a descendant of the primary trusted root certificate;

wherein the device is further configured to establish a device key pair (DPK, DSK) based on a second challenge and response to the PUF, the device key pair comprising a device public key (DPK) and a device secret key (DSK); and

wherein the processor is further configured to:

over a second secure connection, established before an expiry of the validity period of the temporary device enrolment certificate, transmit a second certificate signing request (CSR) to the server for a certificate certifying that the DPK is associated with the device identifier, the second CSR comprising:

the DPK; and

the device identifier;

wherein the second CSR is signed using the DSK;

over the second secure connection, receive a device certificate associating the DPK with the device identifier;

verify that the device certificate is a descendant of the primary trusted root certificate; and

in response to the verification, install the device certificate in memory.

2 . The electronic device of claim 1 , wherein the processor is further configured to:

verify that the issuing certificate is directly descended from the primary trusted root certificate; and

in response to the verification, install the issuing certificate in the one or more memories.

3 . The electronic device of claim 1 , wherein verifying the secure connection certificate comprises verifying that the secure connection certificate is a descendant of the primary trusted root certificate and comparing a server identifier included in the secure connection certificate to a server identity stored in the one or more memories of the electronic device.

4 . The electronic device of claim 3 , wherein the processor is further configured to initiate the secure connection to the server identified by the server identifier stored in the one or more memories of the electronic device.

5 . The electronic devices of claim 1 , wherein the device identifier is based on a hash function of the EPK.

6 . The electronic device of claim 1 ,

wherein the one or more memories have installed thereon a temporary enrolment trusted root certificate; and

wherein the processor is further configured to, subsequent to receiving the temporary enrolment device certificate, verify the temporary enrolment device certificate using the temporary enrolment trusted root certificate; and

wherein installing the temporary enrolment device certificate is in response to the verification.

7 . A method for performance by an electronic device, the electronic device comprising:

a security module having a physical unclonable function (PUF), the security module configured to establish an enrolment key pair (EPK, ESK) based on a first challenge and response to the PUF, the enrolment key pair comprising an enrolment public key (EPK) and an enrolment secret key (ESK); and

one or more memories;

wherein the method comprises:

over a secure connection, transmitting a certificate signing request (CSR) to a server for a certificate certifying that the EPK is associated with a device identifier, the CSR comprising:

the device identifier; and

the EPK;

wherein the CSR is signed using the ESK, and wherein the device identifier is based on a function of the EPK;

over the secure connection, receiving a temporary enrolment device certificate certifying that the EPK is associated with the device identifier and including a validity period;

installing the temporary enrolment device certificate in memory;

wherein the one or more memories have further installed thereon a primary trusted root certificate, and

wherein the processor is further configured to:

receive a secure connection issuing certificate and a secure connection certificate from the server, the secure connection issuing certificate and secure connection certificate being descendants of the primary trusted root certificate;

verify the secure connection certificate using the primary trusted root certificate;

in response to the verification, establish the secure connection to the server; and

over the secure connection, receive an issuing certificate, wherein the issuing certificate is a descendant of the primary trusted root certificate;

wherein the device is further configured to establish a device key pair (DPK, DSK) based on a second challenge and response to the PUF, the device key pair comprising a device public key (DPK) and a device secret key (DSK); and

wherein the processor is further configured to:

over a second secure connection, established before an expiry of the validity period of the temporary device enrolment certificate, transmit a second certificate signing request (CSR) to the server for a certificate certifying that the DPK is associated with the device identifier, the second CSR comprising:

the DPK; and

the device identifier;

wherein the second CSR is signed using the DSK;

over the second secure connection, receive a device certificate associating the DPK with the device identifier;

verify that the device certificate is a descendant of the primary trusted root certificate; and

in response to the verification, install the device certificate in memory.

8 . A non-transitory computer-readable medium having instructions stored thereon which, when read by a processor of an electronic device computing device, cause the processor to execute a method according to claim 7 .

9 . A server comprising one or more memories and a processor configured to:

receive a certificate signing request (CSR) comprising a device identifier and an enrolment public key (EPK) of an enrolment key pair established by an electronic device, the CSR for a certificate certifying that the EPK is associated with the device identifier, wherein the device identifier is based on a function of the EPK;

cause the device identifier to be checked against a database of device identifiers for which the server may sign a certificate;

cause a check of the device identifier to be performed to certify the device identifier is a function of the EPK;

cause the EPK to be associated with the device identifier in the database;

sign a temporary enrolment device certificate certifying that the EPK is associated with the device identifier and including a validity period;

initiate transmission of the signed temporary enrolment device certificate over a secure connection to the electronic device identified by the device identifier;

send over the secure connection an issuing certificate, wherein the issuing certificate is a descendant of a primary trusted root certificate known to the electronic device;

receive the temporary enrolment device certificate;

receive, over a second secure connection, established before an expiry of the validity period of the temporary device enrolment certificate, a second CSR comprising the device identifier and a device public key (DPK) of a device key pair established by the electronic device, wherein the second CSR is for a certificate certifying that the DPK is associated with the device identifier;

cause the device identifier of the second CSR to be checked against the database of device identifiers for which the server may sign a certificate;

cause a check of the device identifier of the second CSR to be performed to verify that the device identifier of the second CSR matches the device identifier specified in the received temporary enrolment device certificate;

cause a check of the device identifier of the second CSR to be performed to verify that the device identifier of the second CSR is a function of the EPK

sign a device certificate based on the CSR, wherein the device certificate is a descendant of a primary trusted root certificate known to the electronic device; and initiate transmission of the device certificate over a second secure connection to the electronic device identified by the device identifier;

wherein the server is further configured to select, based on the device identifier, the issuing certificate to send over the secure connection from a plurality of issuing certificates that are descendants of the primary trusted root certificate.

10 . The server of claim 9 , wherein the issuing certificate sent over the secure connection is based on a security policy associated with the device identifier.

11 . The server of claim 9 , wherein causing a device identifier of an electronic device to be checked against a database comprises causing a check that the device identifier received in the CSR is already stored in the database, and wherein the server is authorised to sign the temporary enrolment device certificate if the received device identifier is already stored in the database.

12 . The server of claim 9 , wherein causing a check of the device identifier to be performed to certify the device identifier is a function of the EPK comprises causing a check of the device identifier to be performed to certify the device identifier is based on a hash function of the EPK.

13 . The server of claim 9 , wherein the validity period of the temporary enrolment device certificate is less than ten minutes.

14 . The server of claim 9 , the server further configured to initiate transmission of a secure connection issuing certificate and a secure connection certificate to the electronic device, the secure connection issuing certificate and secure connection certificate being descendants of a primary trusted root certificate known to the electronic device.

15 . A method comprising, in a server:

receiving a certificate signing request (CSR) comprising a device identifier and an enrolment public key (EPK) of an enrolment key pair established by an electronic device, the CSR for a certificate certifying that the EPK is associated with the device identifier, wherein the device identifier is based on a function of the EPK;

causing the device identifier to be checked against a database of device identifiers for which the server may sign a certificate;

causing a check of the device identifier to be performed to certify the device identifier is a function of the EPK;

causing the EPK to be associated with the device identifier in the database;

signing a temporary enrolment device certificate certifying that the EPK is associated with the device identifier and including a validity period;

initiating transmission of the signed temporary enrolment device certificate over a secure connection to the electronic device identified by the device identifier;

sending over the secure connection an issuing certificate, wherein the issuing certificate is a descendant of a primary trusted root certificate known to the electronic device;

receiving the temporary enrolment device certificate;

receiving, over a second secure connection, established before an expiry of the validity period of the temporary device enrolment certificate, a second CSR comprising the device identifier and a device public key (DPK) of a device key pair established by the electronic device, wherein the second CSR is for a certificate certifying that the DPK is associated with the device identifier;

causing the device identifier of the second CSR to be checked against the database of device identifiers for which the server may sign a certificate;

causing a check of the device identifier of the second CSR to be performed to verify that the device identifier of the second CSR matches the device identifier specified in the received temporary enrolment device certificate;

causing a check of the device identifier of the second CSR to be performed to verify that the device identifier of the second CSR is a function of the EPK

signing a device certificate based on the CSR, wherein the device certificate is a descendant of a primary trusted root certificate known to the electronic device; and

initiating transmission of the device certificate over a second secure connection to the electronic device identified by the device identifier,

wherein the server is further configured to select, based on the device identifier, the issuing certificate to send over the secure connection from a plurality of issuing certificates that are descendants of the primary trusted root certificate.

16 . A non-transitory computer-readable medium having instructions stored thereon which, when read by a processor of an electronic device computing device, cause the processor to execute a method according to claim 15 .

17 . A system comprising:

an electronic device comprising:

a security module having a physical unclonable function (PUF), the security module configured to establish an enrolment key pair (EPK, ESK) based on a first challenge and response to the PUF, the enrolment key pair comprising an enrolment public key (EPK) and an enrolment secret key (ESK);

one or more memories; and

a processor configured to:

over a secure connection, transmit a certificate signing request (CSR) to a server of one or more servers for a certificate certifying that the EPK is associated with a device identifier, the CSR comprising:

the device identifier; and

the EPK;

wherein the CSR is signed using the ESK, and wherein the device identifier is based on a function of the EPK;

over the secure connection, receive a temporary enrolment device certificate certifying that the EPK is associated with the device identifier and including a validity period; and

in response to the verification, install the temporary enrolment device certificate in memory;

wherein the one or more memories have further installed thereon a primary trusted root certificate, and wherein the processor is further configured to:

receive a secure connection issuing certificate and a secure connection certificate from the server, the secure connection issuing certificate and secure connection certificate being descendants of the primary trusted root certificate;

verify the secure connection certificate using the primary trusted root certificate;

in response to the verification, establish the secure connection to the server;

receive a secure connection issuing certificate and a secure connection certificate from the server, the secure connection issuing certificate and secure connection certificate being descendants of the primary trusted root certificate;

verify the secure connection certificate using the primary trusted root certificate;

in response to the verification, establish the secure connection to the server;

over the secure connection, receive an issuing certificate, wherein the issuing certificate is a descendant of the primary trusted root certificate;

wherein the device is further configured to establish a device key pair (DPK, DSK) based on a second challenge and response to the PUF, the device key pair comprising a device public key (DPK) and a device secret key (DSK); and

wherein the processor is further configured to:

over a second secure connection, established before an expiry of the validity period of the temporary device enrolment certificate, transmit a second certificate signing request (CSR) to the server for a certificate certifying that the DPK is associated with the device identifier, the second CSR comprising:

the DPK; and

the device identifier;

wherein the second CSR is signed using the DSK;

over the second secure connection, receive a device certificate associating the DPK with the device identifier;

verify that the device certificate is a descendant of the primary trusted root certificate; and

in response to the verification, install the device certificate in memory; and

one or more servers configured to:

receive over the secure connection from the electronic device the CSR comprising the device identifier and the EPK for a certificate certifying that the EPK is associated with the device identifier;

check the device identifier against a database of device identifiers for which the one or more servers may sign a certificate;

check the device identifier to certify the device identifier is a function of the EPK;

associate the EPK with the device identifier in the database;

sign the temporary enrolment device certificate certifying that the EPK is associated with the device identifier and including the validity period; and

send the signed temporary enrolment device certificate over the secure connection to the electronic device.