Spatial broadcasting device authentication
Embodiments relate to systems for generating identity records (e.g., authentication certificates) at a server for validating broadcast messages. The server may receive a request to generate an identity record, where the request may include a public key of a named entity device that is configured to broadcast messages. The server may generate the identity record using the private key of the server and transmit the generated certificate to a namespace server for storage. A policy consuming device configured to receive a broadcast message, which may be signed using the private key of the named entity device, subsequently accesses the namespace server for the identity record including the public key of the named entity device. The policy consuming device validates the authentication certificate using the server's public key and validates the broadcast message using the named entity device's public key.
1. A computer-implemented method, comprising:
providing, by a third-party server, an interface for an organization to manage a plurality of named entity devices controlled by the organization, each of the plurality of named entity devices associated with a location, the interface allowing the organization to activate or deactivate any of the plurality of named entity devices at the location;
receiving, by the third-party server, an identity publication request for a named entity device public key for a named entity device, the identity publication request including the named entity device public key, the named entity device public key corresponding to a named entity device private key held by the named entity device;
receiving, via the interface, an activation request for the named entity device from the organization;
generating, by the third-party server, a domain name system (DNS) record for the named entity device using a third-party server private key, the DNS record comprising the named entity device public key, a location record and a status record;
storing the DNS record that comprises the named entity device public key in a namespace server;
receiving an authentication request from a policy consuming device for authenticating the named entity device, the authentication request sent responsive to the named entity device sending a signed message to the policy consuming device, the signed message comprising a timestamp, the location where the named entity device is located, and a signature generated by the named entity device using the named entity device private key;
determining that the named entity device is selected as activated by the organization; and
causing a transmission of the DNS record from the namespace server to the policy consuming device to provide the policy consuming device to use the named entity device public key to validate the signed message broadcasted to the policy consuming device by the named entity device, the DNS record including the location record for the policy consuming device to verify the location in the signed message and the status record indicating that the named entity device is activated.
2. The computer-implemented method of claim 1 , wherein the policy consuming device drops the signed message responsive to a time difference between a received timestamp and the generated timestamp exceeds a threshold time difference.
3. The computer-implemented method of claim 1 , wherein the policy consuming device drops the signed message responsive to a distance difference between a location of policy consuming device and the location of the named entity device exceeds a threshold distance difference.
4. The computer-implemented method of claim 1 , wherein the signed message further comprises a status indicating whether the named entity device is authorized to broadcast messages or has been compromised and wherein the policy consuming device drops the signed message responsive to the status indicating that the named entity device has been compromised.
5. The computer-implemented method of claim 1 , wherein the identity publication request is an authentication certificate request, wherein the DNS record is an authentication certificate, and wherein the namespace server provides, responsive to receiving the authentication request from the policy consuming device, the authentication certificate including the named entity device public key to the policy consuming device.
6. The computer-implemented method of claim 5 , wherein the authentication certificate has a X.509 digital certificate format and the namespace server operates according to a DNS-based Authentication of Named Entities (DANE) protocol.
7. The computer-implemented method of claim 1 , wherein the namespace server provides the named entity device public key to the policy consuming device using domain name system security extensions (DNSSEC).
8. The computer-implemented method of claim 1 , further comprising initiating a publication workflow to publish a signed certificate at the namespace server.
9. The computer-implemented method of claim 1 , wherein the named entity device is a roadside beacon.
10. The computer-implemented method of claim 1 , wherein an automated vehicle includes the policy consuming device and wherein the automated vehicle modifies an automated routine using the validated signed message.
11. A system, comprising:
one or more processors; and
memory configured to store instructions, the instructions, when executed by the one or more processors, cause the one or more processors to:
provide, by a third-party server, an interface for an organization to manage a plurality of named entity devices controlled by the organization, each of the plurality of named entity devices associated with a location, the interface allowing the organization to activate or deactivate any of the plurality of named entity devices at the location;
receive, by the third-party server, an identity publication request for a named entity device public key for a named entity device, the identity publication request including the named entity device public key, the named entity device public key corresponding to a named entity device private key held by the named entity device;
receive, via the interface, an activation request for the named entity device from the organization;
generate, by the third-party server, a domain name system (DNS) record for the named entity device using a third-party server private key, the DNS record comprising the named entity device public key, a location record and a status record;
store the DNS record that comprises the named entity device public key, the location and the timestamp in a namespace server;
receive an authentication request from a policy consuming device for authenticating the named entity device, the authentication request sent responsive to the named entity device sending a signed message to the policy consuming device, the signed message comprising a timestamp, the location where the named entity device is located, and a signature generated by the named entity device using the named entity device private key;
determine that the named entity device is selected as activated by the organization; and
cause a transmission of the DNS record from the namespace server to the policy consuming device to provide the policy consuming device to use the named entity device public key to validate the signed message broadcasted to the policy consuming device by the named entity device, the DNS record including the location record for the policy consuming device to verify the location in the signed message and the status record indicating that the named entity device is activated.
12. The system of claim 11 , wherein the policy consuming device drops the signed message responsive to a time difference between a received timestamp and the generated timestamp exceeds a threshold time difference.
13. The system of claim 11 , wherein the policy consuming device drops the signed message responsive to a distance difference between a location of policy consuming device and the location of the named entity device exceeds a threshold distance difference.
14. The system of claim 11 , wherein the namespace server provides the named entity device public key to the policy consuming device using domain name system security extensions (DNSSEC).
15. The system of claim 11 , wherein the signed message further comprises a status indicating whether the named entity device is authorized to broadcast messages or has been compromised and wherein the policy consuming device drops the signed message responsive to the status indicating that the named entity device has been compromised.
16. A non-transitory computer-readable storage medium configured to store computer code comprising instructions, the instructions, when executed by one or more processors, cause the one or more processors to:
provide, by a third-party server, an interface for an organization to manage a plurality of named entity devices controlled by the organization, each of the plurality of named entity devices associated with a location, the interface allowing the organization to activate or deactivate any of the plurality of named entity devices at the location;
receive, by the third-party server, an identity publication request for a named entity device public key for a named entity device, the identity publication request including the named entity device public key, the named entity device public key corresponding to a named entity device private key held by the named entity device;
receive, via the interface, an activation request for the named entity device from the organization;
generate, by the third-party server, a domain name system (DNS) record for the named entity device using a third-party server private key, the DNS record comprising the named entity device public key, a location record and a status record;
store the DNS record that comprises the named entity device public key, the location and the timestamp in a namespace server;
receive an authentication request from a policy consuming device for authenticating the named entity device, the authentication request sent responsive to the named entity device sending a signed message to the policy consuming device, the signed message comprising a timestamp, the location where the named entity device is located, and a signature generated by the named entity device using the named entity device private key;
determine that the named entity device is selected as activated by the organization; and
cause a transmission of the DNS record from the namespace server to the policy consuming device to provide the policy consuming device to use the named entity device public key to validate the signed message broadcasted to the policy consuming device by the named entity device, the DNS record including the location record for the policy consuming device to verify the location in the signed message and the status record indicating that the named entity device is activated.
17. The non-transitory computer-readable storage medium of claim 16 , wherein the policy consuming device drops the signed message responsive to a time difference between a received timestamp and the generated timestamp exceeds a threshold time difference.
18. The non-transitory computer-readable storage medium of claim 16 , wherein the policy consuming device drops the signed message responsive to a distance difference between a location of policy consuming device and the location of the named entity device exceeds a threshold distance difference.
19. The non-transitory computer-readable storage medium of claim 16 , wherein the namespace server provides the named entity device public key to the policy consuming device using domain name system security extensions (DNSSEC).
20. The non-transitory computer-readable storage medium of claim 16 , wherein the signed message further comprises a status indicating whether the named entity device is authorized to broadcast messages or has been compromised and wherein the policy consuming device drops the signed message responsive to the status indicating that the named entity device has been compromised.