Authentication of networked devices having low computational capacity
Authentication of a networked device with limited computational resources for secure communications over a network. Authentication of the device begins with the supplicant node transmitting a signed digital certificate with its authentication credentials to a proxy node. Upon verifying the certificate, the proxy node then authenticates the supplicant's credentials with an authentication server accessible over the network, acting as a proxy for the supplicant node. Typically, this verification includes decryption according to a public/private key scheme. Upon successful authentication, the authentication server creates a session key for the supplicant node and communicates it to the proxy node. The proxy node encrypts the session key with a symmetric key, and transmits the encrypted session key to the supplicant node which, after decryption, uses the session key for secure communications. In some embodiments, the authentication server encrypts the session key with the symmetric key.
1. A method of initiating secured network communications, comprising:
transmitting, by a first device, a digital certificate to a second device, wherein the digital certificate includes a first portion and a second portion, the second portion including an authentication credential;
verifying, by the second device, the digital certificate by comparing the first portion and the second portion, wherein the second portion includes an encryption key, an identifier of the first device, and a certificate authority identifier;
in response to the verifying, receiving, by the second device, a session key;
transmitting, by the second device to the first device, the session key; and
transmitting, by the first device, a communication encrypted by the session key.
2. The method of claim 1 , further comprising: encrypting, by the second device, the session key with the encryption key; and
decrypting, by the first device, the session key.
3. The method of claim 1 , further comprising:
transmitting, by the first device, with the digital certificate a nonce.
4. The method of claim 3 , wherein:
the nonce comprises a pseudo-random number.
5. The method of claim 3 , further comprising:
in response to verifying the digital certificate, storing, by the second device, the encryption key and the nonce.
6. The method of claim 1 , further comprising: transmitting, by the second device, the authentication credential and the identifier of the first device to an authentication device.
7. The method of claim 6 , further comprising:
prior to transmitting by the second device, the authentication credential and the identifier of the first device to the authentication device, determining, by the second device and the authentication device, a protocol for authentication.
8. The method of claim 6 , further comprising:
transmitting, by the second device, a protocol code to the authentication device, wherein the protocol code identifies a protocol for authentication that is to be used between the second device and the authentication device.
9. The method of claim 6 , further comprising:
encrypting, by a certificate authority device, the second portion using a private key; and
distributing a public key corresponding to the private key to the second device, wherein the public key is configured to decrypt the second portion.
10. A network comprising:
a first device configured to transmit a digital certificate, the digital certificate having a first portion and a second portion, wherein the second portion includes an authentication credential, an encryption key, an identifier of the first device, and a certificate authority identifier;
a second device configured to:
receive the digital certificate;
verify the digital certificate by comparing the first portion and the second portion; and
transmit the authentication credential to an authenticating device; and
the authenticating device configured to:
receive the authentication credential;
authenticate the first device based on the authentication credential; and
transmit a session key;
wherein the second device is configured to receive the session key and transmit the session key to the first device; and
wherein the first device is configured to transmit a communication encrypted by the session key.
11. The network of claim 10 , further comprising:
encrypting, by the second device, the session key with the encryption key; and
decrypting, by the first device, the session key.
12. The network of claim 10 , further comprising:
transmitting, by the first device, with the digital certificate a nonce.
13. The network of claim 12 , wherein:
the nonce comprises a pseudo-random number.
14. The network of claim 12 , further comprising:
in response to verifying the digital certificate, storing, by the second device, the encryption key and the nonce.
15. The network of claim 10 , further comprising:
a certificate authority configured to generate the digital certificate.
16. The network of claim 10 , wherein: the second device transmits the identifier of the first device to the authenticating device.
17. The network of claim 10 , wherein: the second device is configured to determine a protocol for authentication with the authenticating device prior to transmitting the authentication credential.
18. The network of claim 15 , wherein:
the certificate authority encrypts the second portion using a private key; and
a public key corresponding to the private key is distributed to the second device, the public key configured to decrypt the second portion.