Post-manufacture certificate generation
A method for post-manufacture certificate generation for an electronic device 4 comprises obtaining a public key from the electronic device 4 , and enrolling the device in to a chain of trust provided by a public key infrastructure in which a child certificate is attested as valid by an attestor associated with a parent certificate in the chain. The enrolling comprises generating an electronic device certificate 30 -I for the chain of trust using the public key 32 obtained from the electronic device. The enrolling is performed at an enrolment device 6 separate from the electronic device 4 . The electronic device certificate 30 -I is a descendant certificate of the enrolment device certificate 30 -D associated with the enrolment device 6.
1. A method for post-manufacture certificate generation for an electronic device, the method comprising:
obtaining one or more identifiers from the electronic device;
validating the electronic device by an enrollment device based on the one or more identifiers;
when validation of the electronic device by the enrollment device is successful:
obtaining a public key from the electronic device; and
enrolling the electronic device into a chain of trust provided by a public key infrastructure, wherein in the chain of trust, a child certificate is attested as valid by an attestant associated with a parent certificate in the chain of trust, and the enrolling comprises generating an electronic device certificate for the chain of trust using the public key obtained from the electronic device;
wherein the enrolling is performed by the enrollment device, the enrollment device being separate from the electronic device; and
in said chain of trust, the electronic device certificate is a descendant certificate of an enrollment device certificate associated with the enrollment device.
2. The method of claim 1 , wherein the enrollment device comprises a local device communicating with the electronic device by direct communication or via a local area network.
3. The method of claim 1 , wherein the electronic device certificate is a child certificate of the enrollment device certificate.
4. The method of claim 1 , wherein the electronic device certificate is a child certificate of an application certificate associated with a specified application executed by the enrollment device, and the application certificate is a descendant certificate of the enrollment device certificate in the chain of trust.
5. The method of claim 1 , wherein the enrolling comprises uploading the electronic device certificate to a remote certificate storing server.
6. The method of claim 1 , wherein the enrolling is performed in response to a service access request from the electronic device to access a service provided by a remote server.
7. The method of claim 6 , wherein for at least an initial portion of communication performed in response to the service access request, communication between the electronic device and the remote server is performed via the enrollment device.
8. The method of claim 1 , wherein the electronic device certificate comprises metadata indicative of the circumstances in which the electronic device certificate was generated.
9. The method of claim 8 , wherein the metadata specifies at least one of:
a user identifier identifying a user of the electronic device or the enrollment device associated with generation of the electronic device certificate;
an indication of a geographic location of the electronic device or the enrollment device when the electronic device certificate was generated; and
a date or time of generation of the electronic device certificate.
10. The method of claim 1 , wherein the electronic device certificate comprises an X.509 certificate.
11. A non-transitory, computer-readable storage medium storing a computer program for controlling a data processing apparatus to perform the method of claim 1 .
12. An enrollment device comprising:
a memory, and
processing circuitry configured to communicate with the memory and to:
obtain one or more identifiers from an electronic device;
validate the electronic device based on the one or more identifiers;
when validation of the electronic device by the enrollment device is successful:
obtain a public key from an electronic device, wherein the enrollment device is separate from the electronic device; and
enrol the electronic device into a chain of trust provided by a public key infrastructure, wherein in the chain of trust, a child certificate is attested as valid by an attestant associated with a parent certificate in the chain of trust, and the processing circuitry is configured to generate an electronic device certificate for the chain of trust using the public key obtained from the electronic device; and
wherein in said chain of trust, the electronic device certificate is a descendant certificate of an enrollment device certificate associated with the enrollment device.