# US 10,375,058 B2 · Secure efficient registration of industrial intelligent electronic devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,375,058 B2 - Document ID: US10375058B2 - Status: Granted - Kind: B2 - Application number: 15/625,580 - Filed: 2017-06-16 - Published: 2017-12-21 - Granted: 2019-08-06 - Earliest claimed: 2016-06-16 - Assignees: ABB Schweiz AG - Applicants: ABB Schweiz AG - Inventors: Arijit Bose; Fernando Alvarez; Richard Deverson - Web page: https://patentgrep.com/patent/US10375058B2 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/067: {using one-time keys (cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863)} - H04L 63/0838: {using one-time-passwords} - G06F 21/33: using certificates - G06F 21/44: Program or device authentication - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - Y04S 40/18: Network protocols supporting networked applications, e.g. including control of end-device applications over a network - Y04S 40/20: Information technology specific aspects, e.g. CAD, simulation, modelling, system security - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - Y04S: SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS ## Abstract A method for registering an intelligent electronic device with a certification authority. The method includes enrolling a configuration tool at the certification authority; generating a one-time password for the intelligent electronic device and storing the one-time password in the certification authority and in the configuration tool; connecting to the intelligent electronic device with the configuration tool, wherein the configuration tool authenticates at the intelligent electronic device; sending the one-time password from the configuration tool to the intelligent electronic device; enrolling the intelligent electronic device at the certification authority with the one-time password and registering the intelligent electronic device with the certification authority; and receiving a device certificate from the certification authority in the intelligent electronic device. ## Claims ### Claim 1 A method for registering an intelligent electronic device with a certification authority, the intelligent electronic device being adapted for controlling a power electric device and being an embedded controller of a power electric device, the method comprising: enrolling a configuration tool at the certification authority; generating a one-time password for the intelligent electronic device and storing the one-time password in the certification authority and in the configuration tool, wherein the configuration tool requests a configuration certificate from the certification authority, the configuration tool authenticates itself at the certification authority with the configuration certificate, and the one-time password is encrypted with the configuration certificate of the configuration tool; connecting to the intelligent electronic device with the configuration tool, wherein the configuration tool authenticates at the intelligent electronic device; sending the one-time password from the configuration tool to the intelligent electronic device, wherein the one-time password is included in configuration data sent to the intelligent electronic device, wherein the configuration data furthermore includes at least one of an address of the certification authority and/or a root certificate of the certification authority; enrolling the intelligent electronic device at the certification authority with the one-time password and registering the intelligent electronic device with the certification authority, wherein the one-time password is included into RA/CA registration data created by the intelligent electronic device from the configuration data; receiving a device certificate from the certification authority in the intelligent electronic device. ### Claim 2 (depends on 1) The method of claim 1, further comprising: requesting an authentication from a user of the configuration tool and authorising the user by the certification authority for the configuration tool. ### Claim 3 (depends on 1) The method of claim 1, wherein the one-time password is requested online via a secure communication connection; wherein the one-time password is requested via a TLS and/or HTTPS connection. ### Claim 4 (depends on 1) The method of claim 1, wherein the configuration tool authenticates at the intelligent electronic device with a user password; wherein the user password for the authentication of the configuration tool at the intelligent electronic device is a standard password used for more than one intelligent electronic device. ### Claim 5 (depends on 1) The method of claim 1, wherein the configuration tool is connected with the intelligent electronic device via a secure communication connection; wherein the one-time password is sent from the configuration tool to the intelligent electronic device via a TLS and/or HTTPS connection. ### Claim 6 (depends on 1) The method of claim 1, wherein enrolling the intelligent electronic device with the certification authority is based on the Simple Certificate Enrolment Protocol or the Enrollment over Secure Transport protocol. ### Claim 7 (depends on 1) The method of claim 1, further comprising: providing the configuration tool with a list of intelligent electronic devices; generating different one-time passwords for the intelligent electronic devices in the list; enrolling every intelligent electronic device from the list at the certification authority with its one-time password. ### Claim 8 A non-transitory computer readable medium containing a computer program, which is adapted for performing a method for registering an intelligent electronic device with a certification authority, the intelligent electronic device being adapted for controlling a power electric device and being an embedded controller of a power electric device, the method comprising: enrolling a configuration tool at the certification authority; generating a one-time password for the intelligent electronic device and storing the one-time password in the certification authority and in the configuration tool, wherein the configuration tool requests a configuration certificate from the certification authority, the configuration tool authenticates itself at the certification authority with the configuration certificate, and the one-time password is encrypted with the configuration certificate of the configuration tool; connecting to the intelligent electronic device with the configuration tool, wherein the configuration tool authenticates at the intelligent electronic device; sending the one-time password from the configuration tool to the intelligent electronic device, wherein the one-time password is included in configuration data sent to the intelligent electronic device wherein the configuration data furthermore includes at least one of an address of the certification authority and/or a root certificate of the certification authority; enrolling the intelligent electronic device at the certification authority with the one-time password and registering the intelligent electronic device with the certification authority, wherein the one-time password is included into RA/CA registration data created by the intelligent electronic device from the configuration data; receiving a device certificate from the certification authority in the intelligent electronic device. ### Claim 9 A system for registering intelligent electronic devices with a certification authority, the system comprising: a configuration tool; and a plurality of intelligent electronic devices being adapted for controlling power electric devices and being embedded controllers of the power electric devices; wherein the configuration tool is adapted for: enrolling at the certification authority for requesting a one-time password for each of the intelligent electronic devices from the certification authority or for providing a one-time password for each of the intelligent electronic devices to the certification authority, wherein the configuration tool requests a configuration certificate from the certification authority, the configuration tool authenticates itself at the certification authority with the configuration certificate, and the one-time password is encrypted with the configuration certificate of the configuration tool; connecting to each of the intelligent electronic devices and authenticating at the respective intelligent electronic device; and sending the respective one-time password to the respective intelligent electronic device, wherein the one-time password is included in configuration data sent to the intelligent electronic device wherein the configuration data furthermore includes at least one of an address of the certification authority and/or a root certificate of the certification authority; wherein each intelligent electronic device is adapted for: enrolling at the certification authority with the one-time password, wherein the one-time password is included into RA/CA registration data created by the intelligent electronic device from the configuration data; and receiving a device certificate from the certification authority. ### Claim 10 (depends on 9) The system of claim 9, wherein the configuration tool, the intelligent electronic devices and the certification authority are interconnected via a data communication network. ### Claim 11 (depends on 7) The method of claim 7, further comprising: requesting an authentication from a user of the configuration tool and authorising the user by the certification authority for the configuration tool. ### Claim 12 (depends on 11) The method of claim 11, wherein the one-time password is requested online via a secure communication connection; wherein the one-time password is requested via a TLS and/or HTTPS connection; wherein the configuration tool authenticates at the intelligent electronic device with a user password; wherein the user password for the authentication of the configuration tool at the intelligent electronic device is a standard password used for more than one intelligent electronic device. ### Claim 13 (depends on 12) The method of claim 12, further comprising: providing the configuration tool with a list of intelligent electronic devices; generating different one-time passwords for the intelligent electronic devices in the list; enrolling every intelligent electronic device from the list at the certification authority with its one-time password. ### Claim 14 (depends on 13) The method of claim 13, wherein the configuration tool is connected with the intelligent electronic device via a secure communication connection; wherein the one-time password is sent from the configuration tool to the intelligent electronic device via a TLS and/or HTTPS connection; wherein the one-time password is included in configuration data sent to the intelligent electronic device; wherein the configuration data furthermore include at least one of an address of the certification authority and/or a root certificate of the certification authority; wherein enrolling the intelligent electronic device with the certification authority is based on the Simple Certificate Enrolment Protocol or the Enrollment over Secure Transport protocol.