Secure root-of-trust enrolment and identity management of embedded devices

A method for performance by an electronic device, the electronic device comprising:

• a security module having a physical unclonable function (PUF), the security module configured to establish an enrolment key pair (EPK, ESK) based on a first challenge and response to the PUF, the enrolment key pair comprising an enrolment public key (EPK) and an enrolment secret key (ESK);
• and one or more memories having installed thereon a primary trusted root certificate;
• and wherein the electronic device is configured to establish a device key pair (DPK,DSK) based on a second challenge and response to the PUF, the device key pair comprising a device public key (DPK) and a device secret key (DSK);
• wherein the method comprises:
• receiving a secure connection issuing certificate and a secure connection certificate from a server, the secure connection issuing certificate and secure connection certificate being descendants of the primary trusted root certificate;
• verifying the secure connection certificate using the primary trusted root certificate;
• in response to the verification, establishing a secure connection to the server;
• over the secure connection, transmitting a certificate signing request (CSR) to the server for a certificate certifying that the DPK is associated with a device identifier, the CSR comprising:
• the device identifier, and the DPK,
• wherein the CSR is signed using the DSK, and
• wherein the device identifier is based on a function of the EPK;
• over the secure connection, receiving a device certificate associating the DPK with the device identifier;
• verifying that the device certificate is a descendant of the primary trusted root certificate;
• and
• in response to the verification, installing the device certificate in memory.

A server of a server system comprising one or more servers, the server system for authenticating an electronic device, the server configured to:

• initiate transmission of a secure connection issuing certificate and a secure connection certificate from the server system to the electronic device, the secure connection issuing certificate and secure connection certificate being descendants of a primary trusted root certificate known to the electronic device;
• receive a certificate signing request (CSR) for a certificate certifying that a device public key (DPK) of a device key pair is associated with a device identifier for identifying an electronic device, the CSR comprising:
• the device identifier, and the DPK,
• wherein the CSR is signed using a device secret key (DSK) of the device key pair, and
• wherein the device identifier is based on a function of an enrolment public key (EPK) of an enrolment key pair known to belong to the electronic device;
• cause the device identifier of the CSR to be checked against a database of device identifiers for which the server may sign a certificate;
• cause a check of the device identifier of the CSR to be performed to verify that the device identifier is known to identify the electronic device by verifying that the device identifier of the CSR matches the device identifier of a temporary enrolment device certificate, the temporary enrolment device certificate certifying that the EPK is associated with the device identifier and including a validity period, the temporary enrolment device certificate having been presented by the electronic device to the server system when establishing a secure connection;
• sign a device certificate based on the CSR, wherein the device certificate is a descendant of a primary trusted root certificate known to the electronic device;
• initiate transmission of the device certificate from the server system over a secure connection to the electronic device identified by the device identifier.

A method comprising:

• initiating transmission of a secure connection issuing certificate and a secure connection certificate from the server system to the electronic device, the secure connection issuing certificate and secure connection certificate being descendants of a primary trusted root certificate known to the electronic device;
• receiving a certificate signing request (CSR) for a certificate certifying that a device public key (DPK) of a device key pair is associated with a device identifier for identifying an electronic device, the CSR comprising the device identifier, and the DPK, wherein the CSR is signed using a device secret key (DSK) of the device key pair, and wherein the device identifier is based on a function of an enrolment public key (EPK) of an enrolment key pair known to belong to the electronic device;
• causing the device identifier to be checked against a database of device identifiers for which the server may sign a certificate;
• causing a check of the device identifier of the CSR to be performed to verify that the device identifier is known to identify the electronic device by verifying that the device identifier of the CSR matches the device identifier of a temporary enrolment device certificate, the temporary enrolment device certificate certifying that the EPK is associated with the device identifier and including a validity period, the temporary enrolment device certificate having been presented by the electronic device to the server system when establishing a secure connection;
• signing a device certificate based on the CSR, wherein the device certificate is a descendant of a primary trusted root certificate known to the electronic device;
• and
• initiating transmission of the device certificate over a secure connection to the electronic device identified by the device identifier.

A system comprising an electronic device and one or more servers:

• wherein the electronic device comprises a security module having a physical unclonable function (PUF), the security module configured to establish an enrolment key pair (EPK, ESK) based on a first challenge and response to the PUF, the enrolment key pair comprising an enrolment public key (EPK) and an enrolment secret key (ESK);
• wherein the electronic device is configured to establish a device key pair (DPK,DSK) based on a second challenge and response to the PUF, the device key pair comprising a device public key (DPK) and a device secret key (DSK);
• the electronic device further comprising:
• one or more memories having installed thereon a primary trusted root certificate;
• and a processor configured to:
• over a secure connection, transmit a certificate signing request (CSR) to the one or more servers for a certificate certifying that the DPK is associated with a device identifier, the CSR comprising:
• the device identifier;
• and the DPK;
• wherein the CSR is signed using the DSK, and wherein the device identifier is based on a function of the EPK;
• over the secure connection, receive a device certificate associating the DPK with the device identifier;
• verify that the device certificate is a descendant of the primary trusted root certificate;
• and in response to the verification, install the device certificate in memory;
• and wherein the one or more servers are configured to:
• receive the CSR over the secure connection from the electronic device;
• check the device identifier against a database of device identifiers for which the server may sign a certificate;
• verify that the device identifier is known to identify the electronic device;
• sign the device certificate based on the CSR, wherein the device certificate is a descendant of the primary trusted root certificate;
• send the device certificate over the secure connection to the electronic device identified by the device identifier.