Electronic device and method for generating attestation certificate based on fused key

Patent metadata

Field	Value
Publication number	US-11706199-B2
Application number	US-202016985503-A
Country	US
Kind code	B2
Filing date	Aug 5, 2020
Priority date	Aug 6, 2019
Publication date	Jul 18, 2023
Grant date	Jul 18, 2023

Abstract

An electronic device and method of operating an electronic device are provided. The electronic device includes an integrated circuit including at least one key, at least one processor including the integrated circuit, and a memory operatively connected to the at least one processor. The memory stores instructions that, when executed, cause the at least one processor to obtain at least one piece of hardware information related to the electronic device, generate a signed certificate signing request including the at least one piece of hardware information, based on the at least one key, transmit the signed certificate signing request to an external electronic device, receive an attestation certificate generated based on the signed certificate signing request, from the external electronic device, and store the received attestation certificate in the memory.

First claim

What is claimed is:

1. An electronic device, comprising:
an integrated circuit including at least one key comprising a private key and a public key corresponding to the private key, wherein the private key is stored in a fused state in the integrated circuit;
at least one processor including the integrated circuit; and
a memory operatively connected to the at least one processor, wherein the memory stores instructions that, when executed, cause the at least one processor to:
obtain at least one piece of hardware information related to the electronic device;
generate a certificate signing request including the public key and the at least one piece of hardware information;
generate a signed certificate signing request by signing the certificate signing request using the private key;
transmit the signed certificate signing request to an external electronic device;
receive an attestation certificate generated based on the signed certificate signing request, from the external electronic device;
store the received attestation certificate in the memory;
receive an attestation record request including a challenge from a server via an application running in the at least one processor;
in response to the attestation record request:
generate a signed application certificate using the application by signing an application certificate including the challenge with the private key stored in the fused state;
generate an attestation record including the stored attestation certificate, a root certificate, the signed application certificate and new hardware information related to the electronic device; and
transmit the attestation record to the server for verification of the electronic device.

2. The electronic device of claim 1 , wherein the instructions, when executed, further cause a secure processor operating in a secure execution environment among the at least one processor to sign the certificate signing request.

3. The electronic device of claim 1 , wherein the at least one key is accessible by a secure processor that operates in a secure execution environment among the at least one processor.

4. The electronic device of claim 1 , wherein the at least one key is generated by the at least one processor, and is stored in a secure memory included in the integrated circuit.

5. The electronic device of claim 1 , wherein the at least one piece of hardware information comprises an international mobile equipment identity (IMEI), model information, manufacturer information, a serial number, a hardware ID, baseband information, or a combination thereof.

6. The electronic device of claim 1 , wherein the attestation certificate is generated in the external electronic device by signing the certificate signing request using a root key.

7. The electronic device of claim 1 , wherein the instructions, when executed, further cause the at least one processor to:
in response to the attestation record request:
generate at least one other key;
identify new hardware information related to the electronic device; and
sign the new hardware information using a private key of the other key.

8. The electronic device of claim 7 , wherein the instructions, when executed, further cause the at least one processor to generate the application certificate by including data indicating a comparison result between the new hardware information and hardware information included in the attestation certificate, in a designated field of the application certificate.

9. The electronic device of claim 7 , wherein the instructions, when executed, further cause the at least one processor to generate the application certificate by including data indicating an integrity state of software of the electronic device in a designated field of the application certificate.

10. The electronic device of claim 7 , wherein the instructions, when executed, further cause the at least one processor to encrypt the at least one other key, and store the encrypted at least one other key in the memory so that the encrypted at least one other key is used for a subsequent attestation record request.

11. A method of operating an electronic device comprising an integrated circuit including at least one key comprising a private key and a public key, a memory, and at least one processor including the integrated circuit, the method comprising:
identifying at least one piece of hardware information related to the electronic device;
generating a certificate signing request including the public key and the at least one piece of hardware information;
generating a signed certificate signing request by signing the certificate signing request using the private key, wherein the private key is stored in a fused state in the integrated circuit;
transmitting the signed certificate signing request to an external electronic device;
receiving an attestation certificate generated based on the signed certificate signing request, from the external electronic device;
storing the received attestation certificate in the memory,
receiving an attestation record request including a challenge from a server via an application running in the at least one processor; and
in response to the attestation record request:
generating a signed application certificate using the application by signing an application certificate including the challenge with the private key stored in the fused state;
generating an attestation record including the stored attestation certificate, a root certificate, the signed application certificate and new hardware information related to the electronic device; and
transmitting the attestation record to the server for verification of the electronic device.

12. The method of claim 11 , wherein signing the certificate signing request using the private key is performed by a secure processor that operates in a secure execution environment among the at least one processor of the electronic device.

13. The method of claim 11 , wherein the at least one piece of hardware information comprises an international mobile equipment identity (IMEI), model information, manufacturer information, a serial number, a hardware ID, baseband information, or a combination thereof.

14. The method of claim 11 , further comprising:
in response to the attestation record request, generating at least one other key;
identifying new hardware information related to the electronic device;
signing the new hardware information using a private key of the at least one other key.

15. The method of claim 14 , wherein generating the application certificate further comprises:
generating the application certificate by including data indicating a comparison result between the new hardware information and hardware information included in the attestation certificate, in a designated field of the application certificate.

16. The method of claim 14 , wherein generating the application certificate further comprises:
generating the application certificate by including data indicating an integrity state of software of the electronic device in a designated field of the application certificate.

17. The method of claim 14 , further comprising:
encrypting the at least one other key; and
storing the encrypted at least one other key in the memory.

Assignees

• Samsung Electronics Co Ltd

Inventors

• Kong Sunjune
• Kim Bumhan
• Kim Jinhyoung
• Yoo Sunghoon
• Kim Byeonghwa
• Kim Jeongil
• Jung Mincheol

Classifications

• H04L63/0428 Primary

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04L9/0897 Primary

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title

• H04L9/0866

  involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics · CPC title

• H04L63/065

  for group communications (cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833) · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title