System and method for using a subscriber identity module as a pseudonym certificate

A system of authenticating a communication device by issuance of a certificate, comprising:

• a subscriber identity module (SIM) in a form of an applet securely linked to the device and used as a pseudonym certificate authority (PCA);
• wherein the SIM is configured to:
• validate a device identity presented by the device, wherein the SIM serves as a Registration Authority;
• and
• issue a new certificate in response to a certificate sign request (CSR) submitted by the communication device, wherein the SIM serves as a Certificate Authority (CA),
• wherein SIM is provisioned securely with a copy of a device root CA certificate to validate a certificate chain of the device identity and a communication CA certificate to issue a new communication end-entity device certificate stored in the device or in the SIM,
• wherein one or more processors of the SIM and communication device further perform device authentication by performing the operations of:
• retrieving by the communication device a current time from a trusted time source;
• submitting by the communication device the new communication end-entity device certificate and the current time to the SIM;
• validating by the SIM a chain using the copy of the device root CA certificate;
• validating by the SIM the dates related to the copy of the device root CA certificate using the current time;
• generating by the SIM a secure random challenge and storing it in the SIM with the current time;
• encrypting by the SIM the secure random challenge using a public key for the communication CA certificate forming an encrypted challenge;
• sending by the SIM to the device the encrypted challenge;
• and
• decrypting by the device the encrypted challenge using a private key for the device root CA certificate providing an decrypted challenge;
• storing by the device the decrypted challenge.

A system of authenticating a device by issuance of a certificate, comprising:

• a subscriber identity module (SIM) in a form of an applet securely linked to the device and used as a pseudonym certificate authority (PCA);
• a copy of a device root CA certificate used to validate a certificate chain of the device identity provisioned securely in the SIM;
• a communication CA certificate used to issue a new communication end entity device certificate stored in the device or in the SIM;
• wherein the SIM is configured to:
• validate a device identity presented by the communication device,
• wherein the SIM serves as a Registration Authority by:
• receiving the new communication end-entity device certificate and the current time to the SIM validating by the SIM a chain using the copy of the device root CA certificate;
• validating by the SIM the dates related to the copy of the device root CA certificate using the current time;
• generating by the SIM a secure random challenge and storing it in the SIM with the current time;
• encrypting by the SIM the secure random challenge using a public key for the communication CA certificate forming an encrypted challenge;
• and
• sending by the SIM to the device the encrypted challenge for decryption and storage by the device of a decrypted challenge;
• and
• issue a new certificate in response to a certificate sign request (CSR) submitted by the device, wherein the SIM serves as a Certificate Authority (CA), wherein the system performs in response to the CSR, the operations of:
• generating by the device a public/private key pair which will be associated to the communication CA certificate;
• building by the device the CSR including a challenge password;
• generating a private key by the device to sign the CSR;
• submitting by the device the CSR to the SIM;
• retrieving by the SIM, the password and the time;
• checking by the SIM the challenge password;
• verifying by the SIM, a CSR signature using the public key;
• checking rules by the SIM and generating by the SIM validity dates from a current time;
• and
• issuing by the SIM a new certificate if all rules are checked and passed.