Authentication of networked devices having low computational capacity
Authentication of a networked device with limited computational resources for secure communications over a network. Authentication of the device begins with the supplicant node transmitting a signed digital certificate with its authentication credentials to a proxy node. Upon verifying the certificate, the proxy node then authenticates the supplicant's credentials with an authentication server accessible over the network, acting as a proxy for the supplicant node. Typically, this verification includes decryption according to a public/private key scheme. Upon successful authentication, the authentication server creates a session key for the supplicant node and communicates it to the proxy node. The proxy node encrypts the session key with a symmetric key, and transmits the encrypted session key to the supplicant node which, after decryption, uses the session key for secure communications. In some embodiments, the authentication server encrypts the session key with the symmetric key.
1. A method of initiating secured network communications, comprising:
transmitting a digital certificate signed by a certificate authority from a supplicant node to a proxy node, the certificate comprising a first portion and a second portion, the second portion comprising a certificate authority identifier, a node identifier for the supplicant node, a digital signature of the certificate authority, a symmetric key, and an authentication credential for the supplicant node, wherein the second portion of the digital certificate is encrypted using a private key corresponding to a public key;
at the proxy node, verifying a hash of the certificate;
then communicating the authentication credential for the supplicant node from the proxy node to an authentication server;
at the authentication server, authenticating the credential for the supplicant node;
communicating a session key from the authentication server to the proxy node;
transmitting the session key from the proxy node to the supplicant node; and
at the supplicant node, executing communications over a network using the session key.
2. The method of claim 1 , further comprising: generating the signed digital certificate at the certificate authority; and then storing the signed digital certificate at the supplicant node.
3. The method of claim 1 , wherein the
first portion of the certificate comprises the certificate authority identifier, the node identifier, and the digital signature of the certificate authority.
4. The method of claim 3 , wherein the step of verifying the certificate comprises:
decrypting the second portion of the digital certificate using the public key; and
comparing contents of the decrypted second portion with the first portion.
5. The method of claim 3 , wherein the first portion further comprises the symmetric key and the authentication credential for the supplicant node;
wherein the first portion is encrypted using a portion of the public key; and
wherein the second portion is encrypted using the portion of the public key, and the encrypted second portion is encrypted using the private key.
6. The method of claim 5 , wherein the step of verifying the certificate comprises:
decrypting the second portion of the certificate using the public key;
then decrypting the first and second portions of the certificate using the portion of the public key; and
comparing contents of the decrypted first and second portions.
7. The method of claim 1 , further comprising:
prior to transmitting the session key from the proxy node to the supplicant node, encrypting the session key using the symmetric key; and
at the supplicant node, decrypting the session key using the symmetric key.
8. The method of claim 7 , wherein the step of encrypting the session key using the symmetric key is performed at the proxy node after receiving the session key from the authentication server.
9. The method of claim 7 , wherein the step of encrypting the session key using the symmetric key is performed at the authentication server prior to transmitting the session key to the proxy node.
10. The method of claim 1 , wherein the step of transmitting the certificate from the supplicant node to the proxy node comprises:
transmitting the certificate from the supplicant node to a first joined node; and
forwarding the certificate from the first joined node to the proxy node.
11. The method of claim 10 , wherein the forwarding step comprises:
transmitting the certificate from the first joined node to a second joined node; and
forwarding the certificate from the second joined node to the proxy node.
12. The method of claim 1 , wherein the step of communicating the authentication credential comprises:
transmitting the authentication credential from the proxy node to a network gateway; and
transmitting the authentication credential from the network gateway to the authentication server over a wide area network;
and wherein the step of authenticating the credential comprises:
at the authentication server, authenticating the credential for the supplicant node according to a protocol; and
at the authentication server, creating the session key.
13. The method of claim 1 , wherein the proxy node is located at a network gateway and the authentication server is located at a network element accessible to the network gateway over a wide area network;
and wherein the step of authenticating the credential comprises:
communicating the authentication credential from the network gateway to the authentication server over the wide area network;
at the authentication server, authenticating the credential for the supplicant node according to a protocol; and
at the authentication server, creating the session key.