Derived certificate based on changing identity
A first device with a changing identity establishes a secure connection with a second device in a network by acting as its own certificate authority. The first device issues itself a self-signed root certificate that binds an identity of the first device to a long-term public key of the first device. The root certificate is digitally signed using a long-term private key, where the long-term public key and the long-term private key form a public/private key pair. The first device provides its root certificate to the second device in any trusted manner. The first device can then create a certificate for one or more short-term identities acquired by the first device and sign the newly-created certificate using the long-term private key. The first device can authenticate itself to the second device by sending the newly-created certificate to the second device.
1. A non-transitory computer-readable medium storing instructions for enabling a certificate authority service, and when the instructions are executed by a processor of a first device, cause the processor to:
create for the first device a root certificate binding an identity of the first device to a long-term public key of the first device, the root certificate indicating that the root certificate is available for verifying digital signatures of derived certificates, wherein the root certificate is digitally signed using a long-term private key of the first device;
generate a short-term public/private key pair consisting of a short-term public key of the first device and a short-term private key of the first device; and
create for the first device a derived certificate binding at least one of one or more short-term identities acquired by a network module of the first device to the short-term public key of the first device, wherein the one or more short-term identities comprise one or more network addresses, and wherein the derived certificate is digitally signed using the long-term private key of the first device; and
wherein the computer-readable medium further stores code which, when executed by the processor, causes the first device to:
make the root certificate available to a second device in any trusted manner via any one of one or more communication interfaces of the first device; and
send the derived certificate to the second device via any one of the one or more communication interfaces.
2. The non-transitory computer-readable medium as claimed in claim 1 , wherein, responsive to the network module acquiring one or more new short-term identities of the first device, the certificate authority service is further configured to:
generate a new short-term public/private key pair consisting of a new short-term public key of the first device and a new short-term private key of the first device; and
create for the first device a new derived certificate that binds at least one of the one or more new short-term identities of the first device to the new short-term public key of the first device, the new derived certificate digitally signed using the long-term private key of the first device; and
wherein the code, when executed by the processor further causes the first device to send the new derived certificate to the second device.
3. The non-transitory computer-readable medium as claimed in claim 1 , wherein the one or more network addresses comprise one or more Internet protocol (IP) addresses.
4. The non-transitory computer-readable medium as claimed in claim 1 , wherein, responsive to the first device receiving a root certificate of the second device in any trusted manner via any one of the one or more communication interfaces, the code, when executed by the processor, causes the first device to store the root certificate of the second device, wherein the root certificate of the second device binds an identity of the second device to a long-term public key of the second device, wherein the root certificate of the second device is digitally signed using a long-term private key of the second device, and wherein the long-term public key of the second device and the long-term private key of the second device form a long-term public/private key pair of the second device.
5. The non-transitory computer-readable medium as claimed in claim 4 , wherein, responsive to the first device receiving via one of the one or more communication interfaces a digitally signed derived certificate that binds one or more identities of the second device to a public key and that indicates that the received derived certificate was issued by the second device, the certificate authority service, when executed by the processor, is further configured to use the received derived certificate and the root certificate of the second device to determine the authenticity of a device from which the received derived certificate was received.
6. The non-transitory computer-readable medium as claimed in claim 5 , wherein the code, when executed by the processor, causes the first device to:
verify a digital signature of the received derived certificate using the long-term public key of the root certificate of the second device.
7. The non-transitory computer-readable medium as claimed in claim 6 , wherein the code, when executed by the processor, causes the first device to:
verify that one of the one or more identities indicated in a subject field of the received derived certificate is identical to an identity of a device from which the received derived certificate was received.
8. The non-transitory computer-readable medium as claimed in claim 7 , wherein the code, when executed by the processor, causes the first device to:
determine that the device from which the received derived certificate was received is authenticated as the second device.
9. The non-transitory computer-readable medium as claimed in claim 8 , wherein the code, when executed by the processor, causes the first device to:
establish a secure connection with the second device.