Systems and methods for countering co-existence attack
Embodiments described herein provide systems and methods to prevent, or provide a countermeasure, to a co-existence attack, for example, that may occur in a Security Credential Management System (SCMS) where both regular butterfly key (RBK) protocol and unified butterfly key (UBK) protocol are supported. Embodiments described herein provide, support, employ, or implement hardware acceleration for a Hardware Security Module (HSM), for example, for cryptographic operations (e.g., block ciphers, digital signature schemes, and key exchange protocols).
1. A method for provisioning of digital certificates for use in authentication operations in an environment where both regular butterfly key (RBK) protocol and unified butterfly key (UBK) protocol are supported, the method comprising:
initializing, by a first entity, settings to operate according to the UBK protocol;
transmitting, by the first entity, a certificate request to a second entity on the basis that the second entity is operating according to the UBK protocol;
receiving, by the first entity, an encrypted response from the second entity, wherein the encrypted response includes at least one digital certificate and a protocol indicator, wherein the protocol indicator provides an indication of whether the digital certificate was generated according to the UBK protocol or the RBK protocol;
decrypting, by the first entity, the encrypted response to extract the digital certificate; and
checking, by the first entity, for the protocol indicator, wherein:
if the protocol indicator indicates that the digital certificate was generated according to the UBK protocol, enabling use of the digital certificate by the first entity; and
if the protocol indicator indicates that the digital certificate was generated according to the RBK protocol, discarding the digital certificate by the first entity.
2. The method of claim 1 , wherein the environment comprises a Security Credential Management System (SCMS).
3. The method of claim 2 , wherein the second entity comprises a device acting as a Registration Authority (RA) in the SCMS.
4. The method of claim 2 , wherein the digital certificate and the protocol indicator are generated by a device acting as an Authorization Certificate Authority (ACA) in the SCMS.
5. The method of claim 1 , wherein the protocol indicator comprises a single bit of information, wherein a first value for the bit indicates that the digital certificate was generated according to the UBK protocol, wherein a second value for the bit indicates that the digital certificate was generated according to the RBK protocol.
6. The method of claim 1 , wherein the protocol indicator is provided within metadata of the digital certificate.
7. The method of claim 1 , comprising generating, by the first entity, a caterpillar public key, wherein the caterpillar public key can be used by the second entity to process the certificate request.
8. The method of claim 1 , comprising reporting, by the first entity, of the second entity.
9. A computing device for provisioning of digital certificates for use in authentication operations in an environment where both regular butterfly key (RBK) protocol and unified butterfly key (UBK) protocol are supported, the computing device comprising:
a memory containing machine readable medium storing machine executable code;
one or more processors coupled to the memory and configured to execute the machine executable code to cause the one or more processors to:
initialize, by a first entity, settings to operate according to the UBK protocol;
transmit, by the first entity, a certificate request to a second entity on the basis that the second entity is operating according to the UBK protocol;
receive, by the first entity, an encrypted response from the second entity, wherein the encrypted response includes at least one digital certificate and a protocol indicator, wherein the protocol indicator provides an indication of whether the digital certificate was generated according to the UBK protocol or the RBK protocol;
decrypt, by the first entity, the encrypted response to extract the digital certificate; and
check, by the first entity, for the protocol indicator, wherein:
if the protocol indicator indicates that the digital certificate was generated according to the UBK protocol, enable use of the digital certificate by the first entity; and
if the protocol indicator indicates that the digital certificate was generated according to the RBK protocol, discard the digital certificate by the first entity.
10. The computing device of claim 9 , wherein the environment comprises a Security Credential Management System (SCMS).
11. The computing device of claim 10 , wherein the second entity comprises a device acting as a Registration Authority (RA) in the SCMS.
12. The computing device of claim 10 , wherein the digital certificate and the protocol indicator are generated by a device acting as an Authorization Certificate Authority (ACA) in the SCMS.
13. The computing device of claim 9 , wherein the protocol indicator comprises a single bit of information, wherein a first value for the bit indicates that the digital certificate was generated according to the UBK protocol, wherein a second value for the bit indicates that the digital certificate was generated according to the RBK protocol.
14. The computing device of claim 9 , wherein the protocol indicator is provided within metadata of the digital certificate.
15. The computing device of claim 9 , wherein the one or more processors are further configured to execute the machine executable code to cause the one or more processors to:
generate, by the first entity, a caterpillar public key, wherein the caterpillar public key can be used by the second entity to process the certificate request.
16. The computing device of claim 9 , wherein the one or more processors are further configured to execute the machine executable code to cause the one or more processors to:
report, by the first entity, of the second entity.
17. A tangible non-transitory machine readable storage medium comprising instructions executable by a first entity to perform a method for provisioning of digital certificates for use in authentication operations in an environment where both regular butterfly key (RBK) protocol and unified butterfly key (UBK) protocol are supported, the method comprising:
initializing settings to operate according to the UBK protocol;
transmitting a certificate request to a second entity on the basis that the second entity is operating according to the UBK protocol;
receiving an encrypted response from the second entity, wherein the encrypted response includes at least one digital certificate and a protocol indicator, wherein the protocol indicator provides an indication of whether the digital certificate was generated according to the UBK protocol or the RBK protocol;
decrypting the encrypted response to extract the digital certificate; and
checking for the protocol indicator, wherein:
if the protocol indicator indicates that the digital certificate was generated according to the UBK protocol, enabling use of the digital certificate; and
if the protocol indicator indicates that the digital certificate was generated according to the RBK protocol, discarding the digital certificate.
18. The tangible non-transitory machine readable storage medium of claim 17 , wherein the environment comprises a Security Credential Management System (SCMS).
19. The tangible non-transitory machine readable storage medium of claim 18 , wherein the second entity comprises a device acting as a Registration Authority (RA) in the SCMS.
20. The tangible non-transitory machine readable storage medium of claim 18 , wherein the digital certificate and the protocol indicator are generated by a device acting as an Authorization Certificate Authority (ACA) in the SCMS.
21. The tangible non-transitory machine readable storage medium of claim 17 , wherein the protocol indicator comprises a single bit of information, wherein a first value for the bit indicates that the digital certificate was generated according to the UBK protocol, wherein a second value for the bit indicates that the digital certificate was generated according to the RBK protocol.
22. The tangible non-transitory machine readable storage medium of claim 17 , wherein the protocol indicator is provided within metadata of the digital certificate.
23. The tangible non-transitory machine readable storage medium of claim 17 , wherein the method comprises generating a caterpillar public key, wherein the caterpillar public key can be used by the second entity to process the certificate request.