Verification of identity using a secret key

1. A method comprising:

receiving, by a computing device, a message from a host device;

generating, by the computing device, a public identifier, a certificate, and a public key, wherein the public identifier is associated with an identity of the computing device, the certificate is generated using the message, and generating the certificate comprises:

concatenating the message with the public key to provide first data;

encrypting the first data using a private identifier to provide second data; and

encrypting the second data using a private key to provide the certificate; and

sending, by the computing device, the public identifier, the certificate, and the public key to the host device, wherein the host device is configured to verify the identity of the computing device using the public identifier, the certificate, and the public key.

2. The method of claim 1 , wherein verifying the identity of the computing device comprises concatenating the message and the certificate to provide third data.

3. The method of claim 2 , wherein verifying the identity of the computing device further comprises decrypting the third data using the public key to provide fourth data.

4. The method of claim 3 , wherein verifying the identity of the computing device further comprises decrypting the fourth data using the public identifier to provide a result, and comparing the result to the public key.

5. The method of claim 1 , wherein the computing device stores a secret key, the method further comprising:

using the secret key as an input to a message authentication code to generate a derived secret;

wherein the public identifier is generated using the derived secret as an input to an asymmetric generator.

6. The method of claim 1 , wherein the public identifier is a first public identifier, and the computing device stores a first device secret used to generate the first public identifier, the method further comprising:

receiving a replace command from the host device;

in response to receiving the replace command, replacing the first device secret with a second device secret; and

sending, to the host device, a second public identifier generated using the second device secret.

7. The method of claim 1 , wherein:

a first asymmetric generator generates the public identifier and the private identifier as an associated pair; and

a second asymmetric generator generates the public key and the private key as an associated pair.

8. The method of claim 1 , further comprising generating a random number as an input to an asymmetric key generator, wherein the public key and the private key are generated using the asymmetric key generator.

9. The method of claim 8 , wherein the random number is generated using a physical unclonable function (PUF).

10. A system comprising:

at least one processor; and

memory containing instructions configured to instruct the at least one processor to:

send a message to a computing device;

receive, from the computing device, a public identifier, a certificate, and a public key, wherein the public identifier is associated with an identity of the computing device, the certificate is generated by the computing device, and the computing device is configured to:

concatenate the message with the public key to provide first data;

encrypt the first data using a private identifier to provide second data; and

encrypt the second data using a private key to provide the certificate; and

verify the identity of the computing device using the public identifier, the certificate, and the public key.

11. The system of claim 10 , wherein verifying the identity of the computing device comprises:

concatenating the message and the certificate to provide third data;

decrypting the third data using the key to provide fourth data;

decrypting the fourth data using the identifier to provide a result; and

comparing the result to the key.

12. The system of claim 10 , wherein the public identifier is a first public identifier, the computing device stores a first device secret used to generate the first public identifier, and the instructions are further configured to instruct the at least one processor to:

send a replace command to the computing device, the replace command to cause the computing device to replace the first device secret with a second device secret, and

receive, from the computing device, a second public identifier generated using the second device secret.

13. The system of claim 12 , wherein the computing device is configured to use the second device secret as an input to a message authentication code that provides a derived secret, and to generate the second public identifier using the derived secret.

14. The system of claim 12 , wherein the replace command includes a field having a value based on the first device secret.

15. The system of claim 10 , further comprising a freshness mechanism configured to generate a freshness, wherein the message sent to the computing device includes the freshness.

16. The system of claim 10 , wherein the identity of the computing device includes an alphanumeric string.

17. A non-transitory computer storage medium storing instructions which, when executed on a computing device, cause the computing device to at least:

receive a message from a host device;

generate a public identifier, a certificate, and a public key, wherein the public identifier corresponds to an identity of the computing device, the certificate is generated using the message, and generating the certificate comprises:

concatenating the message with the public key to provide first data;

encrypting the first data using a private identifier to provide second data; and

encrypting the second data using a private key to provide the certificate; and

send the public identifier, the certificate, and the public key to the host device for use in verifying the identity of the computing device.

18. The non-transitory computer storage medium of claim 17 , wherein the public identifier is associated with the private identifier, and the public key is associated with the private key.

19. The non-transitory computer storage medium of claim 17 , wherein verifying the identity of the computing device comprises performing a decryption operation using the public identifier to provide a result, and comparing the result to the key.