# US 2018/0323977 A1 · Automated certificate enrollment for devices in industrial control systems or other systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0323977 A1 - Document ID: US20180323977A1 - Status: Published application - Kind: A1 - Application number: 15/891,095 - Filed: 2018-02-07 - Published: 2018-11-08 - Earliest claimed: 2017-05-05 - Assignees: Honeywell International Inc. - Applicants: Honeywell International Inc. - Inventors: Michal Hojsik; Lukas Pohanka; Harshal S. Haridas - Web page: https://patentgrep.com/patent/US20180323977A1 ## CPC - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/3247: {involving digital signatures} - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - H04L 63/101: {Access control lists [ACL]} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 63/02: {for separating internal from external traffic, e.g. firewalls} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method includes receiving, from a device, (i) a certificate request for a certification authority and (ii) a first digital certificate. The certificate request is digitally signed by the first device, and the first digital certificate is stored in the device. The method also includes verifying, at the certification authority, the first digital certificate using a second digital certificate of another certification authority. The method further includes verifying a digital signature of the certificate request using the first digital certificate. In addition, the method includes, after verifying the first digital certificate and the digital signature, transmitting a second digital certificate to the device. ## Claims ### Claim 1 A method comprising: receiving, from a device, (i) a certificate request for a certification authority and (ii) a first digital certificate, wherein the certificate request is digitally signed by the first device and the first digital certificate is stored in the device; verifying, at the certification authority, the first digital certificate using a second digital certificate of another certification authority; verifying a digital signature of the certificate request using the first digital certificate; and after verifying the first digital certificate and the digital signature, transmitting a second digital certificate to the device. ### Claim 2 (depends on 1) The method of claim 1, further comprising: obtaining a unique identifier associated with the device; and determining whether the unique identifier is contained in a whitelist of the certification authority; wherein the second digital certificate is transmitted to the device after determining that the unique identifier is contained in the whitelist. ### Claim 3 (depends on 2) The method of claim 2, wherein the unique identifier comprises a serial number, a medium access control (MAC) address, or an Internet Protocol (IP) address of the device. ### Claim 4 (depends on 2) The method of claim 2, further comprising: receiving multiple unique identifiers; and placing the multiple unique identifiers in the whitelist. ### Claim 5 (depends on 1) The method of claim 1, wherein: the first digital certificate comprises a digital certificate issued by the other certification authority that is associated with a manufacturer of the device; and the second digital certificate comprises a digital certificate issued by the certification authority that is associated with a customer installing or using the device. ### Claim 6 An apparatus configured to provide a certification authority, the apparatus comprising: at least one processor configured to: receive, from a device, (i) a certificate request for the certification authority and (ii) a first digital certificate, wherein the certificate request is digitally signed by the first device and the first digital certificate is stored in the device; verify the first digital certificate using a second digital certificate of another certification authority; verify a digital signature of the certificate request using the first digital certificate; and after verifying the first digital certificate and the digital signature, initiate transmission of a second digital certificate to the device. ### Claim 7 (depends on 6) The apparatus of claim 6, wherein: the at least one processor is further configured to: obtain a unique identifier associated with the device; and determine whether the unique identifier is contained in a whitelist of the certification authority; and the at least one processor is configured to initiate transmission of the second digital certificate to the device after determining that the unique identifier is contained in the whitelist. ### Claim 8 (depends on 7) The apparatus of claim 7, wherein the unique identifier comprises a serial number, a medium access control (MAC) address, or an Internet Protocol (IP) address of the device. ### Claim 9 (depends on 7) The apparatus of claim 7, wherein the at least one processor is further configured to: receive multiple unique identifiers; and place the multiple unique identifiers in the whitelist. ### Claim 10 (depends on 6) The apparatus of claim 6, wherein: the first digital certificate comprises a digital certificate issued by the other certification authority that is associated with a manufacturer of the device; and the second digital certificate comprises a digital certificate issued by the certification authority that is associated with a customer installing or using the device. ### Claim 11 A method comprising: generating a key pair having first and second keys associated with a device; generating a certificate request associated with the key pair; digitally signing the certificate request; transmitting the certificate request and a first digital certificate stored in the device to a certification authority; and in response to the certification authority verifying the first digital certificate and a digital signature of the certificate request, receiving a second digital certificate from the certification authority and storing the second digital certificate in the device. ### Claim 12 (depends on 11) The method of claim 11, wherein: the certificate request is digitally signed using a third key; and the third key comprises a private or secret key associated with the first digital certificate. ### Claim 13 (depends on 11) The method of claim 11, wherein the second digital certificate is received from the certification authority without the device providing a password to the certification authority. ### Claim 14 (depends on 11) The method of claim 11, wherein the first digital certificate comprises a digital certificate issued by another certification authority that is associated with a manufacturer of the device. ### Claim 15 (depends on 11) The method of claim 11, wherein the second digital certificate comprises a digital certificate issued by the certification authority during installation of the device in a system. ### Claim 16 An apparatus comprising: at least one memory configured to store a first digital certificate; and at least one processor configured to: generate a key pair having first and second keys associated with the apparatus; generate a certificate request associated with the key pair; digitally sign the certificate request; initiate transmission of the certificate request and the first digital certificate to a certification authority; and in response to the certification authority verifying the first digital certificate and a digital signature of the certificate request, receive a second digital certificate from the certification authority and store the second digital certificate in the at least one memory. ### Claim 17 (depends on 16) The apparatus of claim 16, wherein: the at least one processor is configured to digitally sign the certificate request using a third key; and the third key comprises a private or secret key associated with the first digital certificate. ### Claim 18 (depends on 16) The apparatus of claim 16, wherein the at least one processor is configured to receive the second digital certificate from the certification authority without providing a password to the certification authority. ### Claim 19 (depends on 16) The apparatus of claim 16, wherein the first digital certificate comprises a digital certificate issued by another certification authority that is associated with a manufacturer of the apparatus. ### Claim 20 (depends on 16) The apparatus of claim 16, wherein the second digital certificate comprises a digital certificate issued by the certification authority during installation of the apparatus in a system.