Method and apparatus for embedding secret information in digital certificates
View Patent ↗A method and system is provided for embedding cryptographically modified versions of secret in digital certificates for use in authenticating devices and in providing services subject to conditional access conditions.
1. A method for using authentication to access video data, the authentication using embedding cryptographically modified versions of secrets in digital certificates to authenticate devices for access to obtain the video data, the method comprising the steps of:
receiving a service request in a second device entity that provides access to the video, the service request provided from a first device entity needing access to the video,
wherein the service request comprises a leaf digital certificate generated and digitally signed by a certification entity that has been provided to the first device entity, and
wherein the leaf digital certificate has a unique identifier of the first device entity and contains the result of hashing of a secret identifier;
recovering, in the second entity, the hashed secret identifier from the leaf digital certificate;
authenticating the first device entity by determining if the recovered secret identifier and a device ID match those stored for the first device entity by the second device entity; and
enabling provision of the service to provide access to the video to the first device entity if the authentication is successful,
wherein the first device entity is a member of a class of devices, and the certification entity comprises a sub-certification entity providing the leaf digital certificate to the first device entity and other leaf digital certificates to each of the other devices in the class of devices;
wherein each leaf digital certificate comprises a unique identifier of each associated device and an associated secret unique to the associated device;
wherein each leaf digital certificate is digitally signed according to a trusted sub-certification entity digital certificate provided by the sub-certification entity; and
determining if the sub-certification entity certificate or any digital certificate in a chain up to a root of trust has been revoked; and
verifying the leaf digital certificate only if the trusted digital sub-certification entity digital certificate and any digital certificate in the chain up to the root of trust has not been revoked.
2. The method of claim 1 , wherein the leaf digital certificate is further verified according to a public key of the certification entity.
3. The method of claim 1 , wherein the step of determining if the trusted sub-certificate has been revoked comprises:
receiving, from the second entity, a list identifying revoked sub-certification entity certificates; and
determining that the trusted sub-certification entity certificate has been revoked if the list identifies the trusted sub-certification entity certificate.
4. The method of claim 1 , wherein the secret is provided to the first device entity in a same message as the digital certificate by a certificate authority.
5. The method of claim 1 , wherein the provision of the service is enabled only if the digital certificate and all digital certificates in the chain from the digital certificate up to a root of trust are not a member of a set of revoked digital certificates.
6. The method of claim 5 , further comprising the steps of:
receiving, in the second entity, a list identifying revoked digital certificates; and
determining if the digital certificate is among the identified the revoked digital certificates;
enabling the provision of the service only if the digital certificate and all digital certificates in the chain from the digital certificate up to a root of trust are not among the identified revoked digital certificates.
7. An apparatus for using authentication to access video data, the authentication using embedded cryptographically modified versions of secrets in digital certificates to authenticate devices for access to the video, the apparatus comprising:
a second device entity providing authentication access to video content upon a request from a first device entity, the second entity comprising:
a communications module, for transceiving information, wherein the information comprises:
a service request from the first device entity,
wherein the service request comprises a leaf digital certificate generated and digitally signed by a certification entity that has been provided to the first device entity, and
wherein the leaf digital certificate has a unique identifier of the first device entity and contains the result of hashing of a secret identifier;
a processor, for executing instructions stored in a memory communicatively coupled to the processor, the instructions including instructions for:
recovering, in the second device entity, the hashed secret identifier from the leaf digital certificate;
authenticating the first device entity by determining if the recovered secret identifier and a device ID match those stored for the first device entity by the second device entity; and
enabling provision of the service to provide access to the video to the first device entity if the authentication is successful
wherein the first device entity is a member of a class of devices, and the certification entity comprises a sub-certification entity providing the leaf digital certificate to the first device entity and other leaf digital certificates to each of the other devices in the class of devices;
wherein each leaf digital certificate comprises a unique identifier of each associated device and an associated secret unique to the associated device;
wherein each leaf digital certificate is digitally signed according to a trusted sub-certification entity digital certificate provided by the sub-certification entity; and
determining if the sub-certification entity certificate or any digital certificate in a chain up to a root of trust has been revoked; and
verifying the leaf digital certificate only if the trusted digital sub-certification entity digital certificate and any digital certificate in the chain up to the root of trust has not been revoked.
8. The method of claim 7 , wherein the first device entity receives devices Ids and secrets from a certification authority.
9. The method of claim 8 , wherein the second device entity functions as a service enabling entity and receives the device IDs and secrets from the certification authority.
10. The apparatus of claim 7 , wherein the first device entity receives devices Ids and secrets from a certification authority.
11. The apparatus of claim 10 , wherein the second device entity functions as a service enabling entity and receives the device IDs and secrets from the certification authority.