Authentication of networked devices having low computational capacity
Authentication of a networked device with limited computational resources for secure communications over a network. Authentication of the device begins with the supplicant node transmitting a signed digital certificate with its authentication credentials to a proxy node. Upon verifying the certificate, the proxy node then authenticates the supplicant's credentials with an authentication server accessible over the network, acting as a proxy for the supplicant node. Typically, this verification includes decryption according to a public/private key scheme. Upon successful authentication, the authentication server creates a session key for the supplicant node and communicates it to the proxy node. The proxy node encrypts the session key with a symmetric key, and transmits the encrypted session key to the supplicant node which, after decryption, uses the session key for secure communications. In some embodiments, the authentication server encrypts the session key with the symmetric key.
1. A method comprising:
receiving, by a first device and from a second device, an authentication credential;
determining, by the first device, that the authentication credential is associated with a third device that is different from the second device;
authenticating, by the first device, the third device using the authentication credential;
after authenticating the third device, creating, by the first device, a session key for the third device;
encrypting, by the first device, the session key using a symmetric key;
transmitting, by the first device, the encrypted session key to the second device; and
establishing a communication session between the first device and the third device based on the encrypted session key.
2. The method of claim 1 , further comprising receiving, by the first device and from the second device, a node identifier associated with the third device, wherein determining that the authentication credential is associated with the third device comprises determining that the node identifier is not associated with the second device based on the node identifier.
3. The method of claim 1 , further comprising:
receiving, by the first device and from the second device, a node identifier associated with the third device;
encrypting the node identifier using the symmetric key; and
transmitting, by the first device, the encrypted node identifier to the second device.
4. The method of claim 3 , further comprising:
receiving, by the first device and from the second device, a nonce;
encrypting the nonce using the symmetric key; and
transmitting, by the first device, the encrypted nonce to the second device.
5. The method of claim 1 , wherein the symmetric key is pre-stored in the first device.
6. The method of claim 1 , further comprising:
receiving, by the second device, the authentication credential;
verifying, by the second device, the authentication credential using asymmetric key cryptography; and
in response to verifying the authentication credential, transmitting, by the second device, the authentication credential to the first device.
7. The method of claim 6 , wherein receiving, by the second device, the authentication credential comprises receiving, by the second device, the authentication credential from the third device.
8. The method of claim 6 , wherein receiving, by the second device, the authentication credential comprises receiving, by the second device, a digital certificate that comprises the authentication credential.
9. The method of claim 8 , wherein verifying the authentication credential comprises verifying the digital certificate computing a hash of a first portion of the digital certificate.
10. The method of claim 8 , wherein the digital certificate comprises a nonce.
11. The method of claim 8 , wherein the digital certificate comprises an encrypted portion and an unencrypted portion, wherein the encrypted portion comprises the authentication credential.
12. The method of claim 11 , wherein the unencrypted portion comprises a node identifier associated with the third device.
13. The method of claim 11 , wherein verifying the authentication credential comprises decrypting the digital certificate using asymmetric key cryptography.
14. The method of claim 11 , further comprising comparing the encrypted portion with the unencrypted portion to verify the digital certificate.
15. The method of claim 8 , wherein receiving, by the second device, the digital certificate comprises receiving, by the second device, the digital certificate from the third device.
16. The method of claim 8 , wherein the digital certificate is a signed digital certificate.
17. The method of claim 16 , wherein the signed digital certificate is signed by a certificate authority.
18. The method of claim 17 , wherein the signed digital certificate is stored at the third device.
19. The method of claim 1 , wherein the third device has lower computational capacity than the second device.
20. The method of claim 1 , further comprising:
receiving, by the second device, the encrypted session key; and
forwarding, by the second device, the encrypted session key to the third device.
21. The method of claim 1 , wherein receiving, by the first device and from the second device, the authentication credential comprises using a wireless link according to an IEEE 802.11 protocol.
22. The method of claim 1 , wherein receiving, by the first device and from the second device, the authentication credential comprises using a wireless link according to a Bluetooth or Bluetooth Low Energy (BLE) protocol.