Server for issuing a digital certificate and device for verifying authentication
A Certification Authority (CA) server for issuing digital certificates generates a first digital certificate associated with a first public key of the device and calculates an update factor for the first private key. Based on the first public key, the calculated update factor, and a predefined public system parameter, the CA server calculates a second public key for a determined time period for the device. The CA server generates a second digital certificate valid at the determined time period and associated with the second public key and sends the second digital certificate to the device. A device may calculate an update factor for a stored first private key, calculates a second private key based on the calculated update factor and the first private key, receives from the CA server a second digital certificate associated with a second public key, and validates the device based on the second digital certificate.
1. A Certification Authority (CA) server for issuing digital certificates, the CA server comprising:
one or more processors; and
a computer memory communicatively coupled to the one or more processors and having executable program code stored thereon, wherein the one or more processors are configured to:
generate a first digital certificate for a device, wherein the first digital certificate is associated with a first public key of the device,
calculate an update factor for a first private key of the device,
calculate a second public key for a determined time period for the device, based on the first public key, the calculated update factor and a predefined public system parameter, and
generate a second digital certificate-valid at the determined time period and associated with the second public key and send the second digital certificate to the device.
2. The CA server according to claim 1 , wherein the one or more processors are further configured to:
receive, from the device, via a secure communication channel, one or more of:
an identifier, ID, of the device,
the first public key of the device,
a first Pseudo Random Function (PRF) key, or
an encryption key of the device.
3. The CA server according to claim 2 , wherein the one or more processors are further configured to:
calculate a second PRF key and calculate the update factor, based on calling a PRF on the first PRF key.
4. The CA server according to claim 2 , wherein:
the update factor is calculated based on a random number, and wherein the one or more processors are further configured to:
generate a cipher-text by encrypting the calculated update factor with the encryption key of the device, and
send the cipher-text to the device.
5. The CA server according to claim 1 , wherein:
the second public key is calculated based on multiplying the update factor by the predefined public system parameter indicating a point of an elliptic curve cryptography, and adding the product of the multiplication to the first public key.
6. The CA server according to claim 1 , wherein:
the CA server is configured for authentication via Public Key Infrastructure (PKI) with public key cryptography.
7. A method for a Certification Authority (CA) server for issuing digital certificates, the method comprising:
generating a first digital certificate for a device, wherein the first digital certificate is associated with a first public key of the device,
calculating an update factor for a first private key of the device,
calculating a second public key for a determined time period for the device, based on the first public key, the calculated update factor, and a predefined public system parameter, and
generating a second digital certificate valid at the determined time period and associated with the second public key and send the second digital certificate to the device.
8. A device comprising:
one or more processors; and
a computer memory communicatively coupled to the one or more processors and having executable program code stored thereon, wherein the one or more processors are configured to:
store a pair of a first public key and a first private key,
store a first digital certificate issued by a Certification Authority (CA) server, wherein the first digital certificate is associated with the first public key,
calculate an update factor for the first private key,
calculate a second private key based on the calculated update factor and the first private key,
receive a second digital certificate from the CA server, wherein the second digital certificate is associated with a second public key, and
verify an authentication of the device based on the second digital certificate using the second public key and the second private key.
9. The device according to claim 8 , wherein the one or more processors are further configured to:
send, to the CA server, via a secure communication channel, one or more of:
an identifier (ID) of the device,
the first public key of the device,
a first Pseudo Random Function (PRF) key, or
an encryption key of the device.
10. The device according to claim 9 , wherein the one or more processors are further configured to:
calculate a second PRF key and calculate the update factor, based on calling a PRF on the first PRF key.
11. The device according to claim 9 , wherein the one or more processors are further configured to:
receive, from the CA server, a cipher-text, and
calculate the update factor-by decrypting the cipher-text with a decryption key of the device.
12. The device according to claim 8 , wherein:
the second private key is calculated based on adding the calculated update factor to the first private key.
13. The device according to claim 8 , wherein the device is a node in Internet of Things (IoT).
14. A non-transitory computer-readable medium having a program code stored thereon, the program code, when executed by a computer processor, causes the method of claim 7 to be performed.