Authentication device and system
A public key architecture ( 160 ) includes a dual certificate hierarchy which facilitates two independent authentication functions. One of the authentication functions authenticates an authentication device ( 164 ) to a verification device ( 166 ). The other authentication function authenticates a configuration device ( 162 ) to the authentication device ( 164 ). In some embodiments, the authentication process uses a lightweight certificate formed in conjunction with a lightweight signature scheme ( 370 ).
1. An authentication method comprising:
storing a device authentication private key on an authentication device;
storing a device authentication public key certificate linked to a trusted authentication root certificate on the authentication device, wherein the device authentication private key and the device authentication public key certificate facilitate authentication of the authentication device to a verification device according to a device authentication protocol; and
storing a configuration root certificate on the authentication device, wherein the configuration root certificate facilitates authentication of a configuration device to the authentication device according to a configuration authentication protocol, wherein the device authentication protocol and the configuration authentication protocol use two separate certificate chains that both originate from a trusted party as a root of trust.
2. The authentication method of claim 1 , further comprising:
receiving, at the authentication device, a configuration public key certificate from the configuration device; and
determining, at the authentication device, whether the configuration device has a configuration private key corresponding to the configuration public key certificate.
3. The authentication method of claim 2 , further comprising:
receiving, at the authentication device, a configuration parameter from the configuration device; and
storing the configuration parameter on the authentication device in response to a determination at the authentication device that the configuration device has the configuration private key.
4. The authentication method of claim 3 , wherein the configuration parameter from the configuration device comprises identification information for the authentication device.
5. The authentication method of claim 3 , further comprising:
coupling the authentication device to a product, wherein the configuration parameter from the configuration device comprises product information corresponding to the product.
6. The authentication method of claim 2 , further comprising:
storing the configuration private key on the configuration device; and
storing the configuration public key certificate on the configuration device.
7. The authentication method of claim 2 , wherein the configuration public key certificate comprises a restriction.
8. The authentication method of claim 1 , further comprising:
receiving, at the authentication device, a plurality of configuration public key certificates within a configuration certificate chain associated with the configuration device, wherein the configuration root certificate stored on the authentication device forms the root of trust for the configuration certificate chain; and
verifying, at the authentication device, each of the configuration public key certificates within the configuration certificate chain.
9. The authentication method of claim 1 , wherein the verification device comprises a near field communication (NFC) electronic device.
10. The authentication method of claim 9 , wherein the NFC electronic device comprises:
a mobile telephone having NFC communication functionality.
11. An authentication device comprising:
a memory device configured to store data; and
processing logic coupled to the memory device, wherein the processing logic is configured to store, in the memory device, the following: a device authentication private key; a device authentication public key certificate linked to a trusted authentication root certificate; and a configuration root certificate; wherein the processing logic is further configured to use the device authentication private key and the device authentication public key certificate to facilitate authentication of the authentication device to a verification device according to a device authentication protocol; wherein the processing logic is further configured to use the configuration root certificate to facilitate authentication of a configuration device to the authentication device according to a configuration authentication protocol, wherein the device authentication protocol and the configuration authentication protocol use two separate certificate chains that both originate from a trusted party as a root of trust.
12. The authentication device of claim 11 , wherein the processing logic is further configured to receive a configuration parameter from the configuration device, and store the configuration parameter in the memory device in response to a determination at the authentication device that the configuration device has the configuration private key corresponding to the configuration public key certificate.
13. The authentication device of claim 12 , wherein the configuration parameter comprises identification information for the authentication device.
14. The authentication device of claim 12 , wherein the configuration parameter comprises product information corresponding to a product to which the authentication device is coupled.
15. A system comprising the authentication device of claim 12 , wherein the verification device comprises a near field communication (NFC) electronic device.
16. The system of claim 15 , wherein the NFC electronic device comprises a mobile telephone having NFC communication functionality.