Device-bound certificate authentication
View Patent ↗A device-bound certificate authority binds a certificate to one or more devices by including digital fingerprints of the devices in the certificate. A device only uses a device-bound certificate if the digital fingerprint of the device is included in the certificate and is verified. Thus, a certificate is only usable by one or more devices to which the certificate is explicitly bound. Such device-bound certificates can be used for various purposes served by certificates generally such as device driver authentication and authorization of access to secure content, for example.
1. A non-transitory computer readable medium useful in association with a computer which includes one or more processors and a memory, the computer readable medium including computer instructions which are configured to cause the computer, by execution of the computer instructions in the one or more processors from the memory, to bind a digital certificate that can be stored on a computer-readable medium to multiple devices by at least:
receiving at a server computer a request from a remote device through a computer network wherein the request identifies the certificate and identifies the multiple devices,
retrieving the certificate;
for each of the multiple devices:
retrieving a digital fingerprint of the device; and
including the digital fingerprint in the certificate;
and
sending the certificate with the included digital fingerprints to the remote device through the computer network;
wherein the server computer in response to the request serves a device driver cryptographically signed with the certificate so that any of the devices can install the device driver only upon a condition in which one of the digital fingerprints corresponds to the installing device.
2. The computer readable medium of claim 1 wherein
the remote device determines whether the digital fingerprint that is included in the certificate corresponds to the remote device; and
upon a condition in which the digital fingerprint corresponds to the remote device, accepts the certificate as legitimate.
3. The computer readable medium of claim 1 wherein the remote device also uses the certificate to verify that a device driver is properly cryptographically signed as a precondition to installing the device driver only upon the condition in which the digital fingerprint corresponds to the remote device.
4. The computer readable medium of claim 1 wherein the remote device determines whether the digital fingerprint that is included in the certificate corresponds to a requesting device from which the remote device has received a request for access to secure content of the remote device and, upon a condition in which the digital fingerprint corresponds to the requesting device and the remote device is preconfigured to recognize the requesting device as authorized to access the secure content, grants the request.
5. A computer system comprising:
at least one processor;
a non-transitory computer readable medium that is operatively coupled to the processor; and
certificate serving logic (i) that, at least in part, executes in the processor from the computer readable medium and (ii) that, when executed by the processor, causes the computer to bind a digital certificate that can be stored on the computer-readable medium to multiple devices by at least:
receiving at a server computer a request from a remote device through a computer network wherein the request identifies the certificate and identifies the multiple devices;
retrieving the certificate;
for each of the multiple devices:
retrieving a digital fingerprint of the device; and
including the digital fingerprint in the certificate;
and
sending the certificate with the included digital fingerprints to the remote device through the computer network;
wherein the server computer in response to the request serves a device driver cryptographically signed with the certificate so that any of the devices can install the device driver only upon a condition in which one of the digital fingerprints corresponds to the installing device.
6. The computer system of claim 5 wherein the remote device determines whether the digital fingerprint that is included in the certificate corresponds to the remote device and, upon a condition in which the digital fingerprint corresponds to the remote device, accepts the certificate as legitimate.
7. The computer system of claim 6 wherein the remote device also uses the certificate to verify that a device driver is properly cryptographically signed as a precondition to installing the device driver only upon the condition in which the digital fingerprint corresponds to the remote device.
8. The computer system of claim 5 wherein the remote device determines whether the digital fingerprint that is included in the certificate corresponds to a requesting device from which the remote device has received a request for access to secure content of the remote device and, upon a condition in which the digital fingerprint corresponds to the requesting device and the remote device is preconfigured to recognize the requesting device as authorized to access the secure content, grants the request.