# US 12,225,000 B2 · Server for issuing a digital certificate and device for verifying authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,000 B2 - Document ID: US12225000B2 - Status: Granted - Kind: B2 - Application number: 17/837,941 - Filed: 2022-06-10 - Published: 2022-09-22 - Granted: 2025-02-11 - Earliest claimed: 2019-12-12 - Assignees: Huawei Technologies Duesseldorf GmbH - Applicants: Huawei Technologies Duesseldorf GmbH - Inventors: Lijun Liao; Yong Li; Li Duan; Qing Han - Web page: https://patentgrep.com/patent/US12225000B2 ## CPC - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 9/3066: {involving algebraic varieties, e.g. elliptic or hyper-elliptic curves} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A Certification Authority (CA) server for issuing digital certificates generates a first digital certificate associated with a first public key of the device and calculates an update factor for the first private key. Based on the first public key, the calculated update factor, and a predefined public system parameter, the CA server calculates a second public key for a determined time period for the device. The CA server generates a second digital certificate valid at the determined time period and associated with the second public key and sends the second digital certificate to the device. A device may calculate an update factor for a stored first private key, calculates a second private key based on the calculated update factor and the first private key, receives from the CA server a second digital certificate associated with a second public key, and validates the device based on the second digital certificate. ## Claims ### Claim 1 A Certification Authority (CA) server for issuing digital certificates, the CA server comprising: one or more processors; and a computer memory communicatively coupled to the one or more processors and having executable program code stored thereon, wherein the one or more processors are configured to: generate a first digital certificate for a device, wherein the first digital certificate is associated with a first public key of the device, calculate an update factor for a first private key of the device, calculate a second public key for a determined time period for the device, based on the first public key, the calculated update factor and a predefined public system parameter, and generate a second digital certificate-valid at the determined time period and associated with the second public key and send the second digital certificate to the device. ### Claim 2 (depends on 1) The CA server according to claim 1, wherein the one or more processors are further configured to: receive, from the device, via a secure communication channel, one or more of: an identifier, ID, of the device, the first public key of the device, a first Pseudo Random Function (PRF) key, or an encryption key of the device. ### Claim 3 (depends on 2) The CA server according to claim 2, wherein the one or more processors are further configured to: calculate a second PRF key and calculate the update factor, based on calling a PRF on the first PRF key. ### Claim 4 (depends on 2) The CA server according to claim 2, wherein: the update factor is calculated based on a random number, and wherein the one or more processors are further configured to: generate a cipher-text by encrypting the calculated update factor with the encryption key of the device, and send the cipher-text to the device. ### Claim 5 (depends on 1) The CA server according to claim 1, wherein: the second public key is calculated based on multiplying the update factor by the predefined public system parameter indicating a point of an elliptic curve cryptography, and adding the product of the multiplication to the first public key. ### Claim 6 (depends on 1) The CA server according to claim 1, wherein: the CA server is configured for authentication via Public Key Infrastructure (PKI) with public key cryptography. ### Claim 7 A method for a Certification Authority (CA) server for issuing digital certificates, the method comprising: generating a first digital certificate for a device, wherein the first digital certificate is associated with a first public key of the device, calculating an update factor for a first private key of the device, calculating a second public key for a determined time period for the device, based on the first public key, the calculated update factor, and a predefined public system parameter, and generating a second digital certificate valid at the determined time period and associated with the second public key and send the second digital certificate to the device. ### Claim 8 A device comprising: one or more processors; and a computer memory communicatively coupled to the one or more processors and having executable program code stored thereon, wherein the one or more processors are configured to: store a pair of a first public key and a first private key, store a first digital certificate issued by a Certification Authority (CA) server, wherein the first digital certificate is associated with the first public key, calculate an update factor for the first private key, calculate a second private key based on the calculated update factor and the first private key, receive a second digital certificate from the CA server, wherein the second digital certificate is associated with a second public key, and verify an authentication of the device based on the second digital certificate using the second public key and the second private key. ### Claim 9 (depends on 8) The device according to claim 8, wherein the one or more processors are further configured to: send, to the CA server, via a secure communication channel, one or more of: an identifier (ID) of the device, the first public key of the device, a first Pseudo Random Function (PRF) key, or an encryption key of the device. ### Claim 10 (depends on 9) The device according to claim 9, wherein the one or more processors are further configured to: calculate a second PRF key and calculate the update factor, based on calling a PRF on the first PRF key. ### Claim 11 (depends on 9) The device according to claim 9, wherein the one or more processors are further configured to: receive, from the CA server, a cipher-text, and calculate the update factor-by decrypting the cipher-text with a decryption key of the device. ### Claim 12 (depends on 8) The device according to claim 8, wherein: the second private key is calculated based on adding the calculated update factor to the first private key. ### Claim 13 (depends on 8) The device according to claim 8, wherein the device is a node in Internet of Things (IoT). ### Claim 14 (depends on 7) A non-transitory computer-readable medium having a program code stored thereon, the program code, when executed by a computer processor, causes the method of claim 7 to be performed.