Dynamic certificate management for a distributed authentication system
AssigneeMicrosoft Technology Licensing, LLC
InventorsRyan J. FAIRFAX, Felix Stefan DOMKE
Life of this patent
Estimating the term…
Abstract
The disclosed technology is generally directed to embedded device updates. In one example of the technology, a request for a nonce from a device is received. The nonce is sent in response to the request. An authentication request that includes the nonce, a set of measurements associated with the device, and a cryptographic signature generated from a private key associated with the device is received. The device is validated based on the authentication request. In response to successful validation of the device, a short-term certificate is generated for the device.
Claims20
An apparatus, comprising:
- a device including at least one memory adapted to store run-time data for the device, and at least one processor that is adapted to execute processor-executable code that, in response to execution, enables the device to perform actions, including:
- receiving a request for a nonce from a device;
- sending the nonce in response to the request;
- receiving an authentication request that includes the nonce, a set of measurements associated with the device, and a cryptographic signature generated from a private key associated with the device;
- validating the device based on the authentication request;
- and
- in response to successful validation of the device, generating a short-term certificate for the device.
A method, comprising:
- receiving, from a device, a none request;
- responsive to the nonce request, communicating a one-time cryptographic nonce to the device;
- receiving an authentication request that includes the one-time cryptographic nonce, a set of measurements associated with the device, and a cryptographic signature generated from a private key associated with the device;
- responsive to the authentication request, authenticating the device;
- and
- responsive to successful authentication of the device, creating a short-term client certificate for the device.
A processor-readable storage medium, having stored thereon processor-executable code that, upon execution by at least one processor, enables actions, comprising:
- receiving an authentication request that includes a nonce, a set of measurements associated with the device, and a cryptographic signature generated from a private key associated with the device;
- authenticating the device based on the authentication request;
- and
- in response to successful validation of the device, generating a short-term certificate for the device.
Dependencies are inferred from the claim text.