Method and apparatus for providing a key certificate in a tamperproof manner
AssigneeSiemens Aktiengesellschaft
InventorsJens-Uwe Busser, Steffen Fries
Life of this patent
Estimating the term…
Abstract
A method and a server are configured to provide, in a tamperproof manner, a key certificate for a public device key of a user device, which is installed for a user, by means of a server belonging to a service provider who provides the user with a service via the user device, wherein the server provides the user device with the key certificate if a signing request message received by the user device is successfully verified by the server using a one-time password generated for the user device by the server.
Claims14
A method for a manipulation-proof delivery of a key certificate for a device-key to a user device installed on a user's premises, by a server of a service provider that makes a service available to the user via the user device, the method comprising:
- the server generating a one-time password for the user device and transmitting the one-time password to the user device via a data medium,
- the user device locally generating a cryptographic device-key pair comprising a public device-key and a private device-key for the user device,
- in response to generating the cryptographic device-key pair, the user device compiling a signing request message for the locally generated public key,
- logically combining the signing request message with the one-time password for the user device that has been read out from the data medium,
- calculating a keyed-hash value for at least one data field in the signing request message by applying a keyed-hash function to the one-time password for the user device and the locally generated public device-key,
- the user device transmitting the signing request message to the server,
- the server verifying the signing request message received from the user device based on the one-time password generated by the server for the user device, and
- the server providing the key certificate to the user device in response to a successful verification of the signing request message.
A system comprising:
- a server configured to provide a key certificate for a public device-key to a user device in a manipulation-proof manner, the user device being installed on a user's premises and being configured to receive a service from the server via a user device, the server comprising:
- a memory and a processor programmed to:
- generate a one-time password for the user device and transmitting the one-time password to the user device via a data medium,
- receive a signing request message transmitted by the user device the received signing request message being generated by the user device in response to the generation of a cryptographic device-key pair by the user device, and including a keyed-hash value resulting from application of a keyed-hash function to the one-time password generated by the server and the public device-key generated by the user device, analyze the received signing request message, including the keyed-hash value, to verify the signing request message received from the user device based on the one-time password generated by the server for the user device, and
- provide the key certificate to the user device in response to a successful verification of the signing request message received from the user device.
Dependencies are inferred from the claim text.