Method for mutually attesting security levels of electronic devices in multi device environment

Patent metadata

Field	Value
Publication number	US-12574256-B2
Application number	US-202318532453-A
Country	US
Kind code	B2
Filing date	Dec 7, 2023
Priority date	Nov 29, 2022
Publication date	Mar 10, 2026
Grant date	Mar 10, 2026

Abstract

An electronic device is provided. The electronic device includes a communication module for supporting near-field wireless communication, memory, and at least one processor operatively connected to the communication module and the memory. The memory stores one or more programs including instructions that, when executed by the at least one processor, may cause the electronic device to establish near-field wireless communication connection with an external device through the communication module, generate a first private key by using a determined random function, generate a first public key based on the first private key, generate a first certificate including a security level of the electronic device with respect to the first public key, and transmit the generated first certificate to the external device through the communication module.

First claim

What is claimed is:

1 . An electronic device comprising:
a communication circuitry configured to support near-field wireless communication; memory; and at least one processor operatively connected to the communication circuitry and the memory, wherein the memory stores one or more programs including instructions that, when executed by the at least one processor, cause the electronic device to:
determine a security level of the electronic device based on a hardware element for executing a trusted application generating a private key, a public key and a certificate with respect to the public key, and a location where the private key, the public key and the certificate are stored,
establish near-field wireless communication connection with an external device through the communication circuitry,
execute the trusted application to generate a first private key by using a determined random function,
a first public key based on the first private key and,
a first certificate with respect to the first public key, the first certificate being configured to include the determined security level of the electronic device, and
transmit the generated first certificate to the external device through the communication circuitry such that the external device authenticates the electronic device using the generated first certificate.

2 . The electronic device of claim 1 ,
wherein the hardware element of the electronic device comprises at least one of a processor, a secure processor inside the processor or a secure element outside the processor, the secure element including an independent processor and an independent memory, wherein in case that the trusted application is executed on the secure processor or the secure element, the security level of the electronic device is determined as a first level, and wherein in case that the trusted application is executed on the processor, the security level of the electronic device is determined as a second level lower than the first level.

3 . The electronic device of claim 1 , wherein the first certificate further includes at least one of at least a portion of account information, a firmware version, whether software has been modified, a device type, or a list of child nodes of the electronic device, wherein the child nodes are end devices connected to a network via the electronic device acting as a hub.

4 . The electronic device of claim 1 , wherein the one or more programs further include instructions that, when executed by the at least one processor, cause the electronic device to:
generate a first random number by using a determined random function; generate a first public element from the first random number by using an encryption algorithm; electrically sign the first public element by using the first private key to generate a first electronic signature; and transmit the first public element, the first electronic signature, and the first certificate to the external device through the communication circuitry.

5 . The electronic device of claim 1 , wherein the one or more programs further include instructions that, when executed by the at least one processor, cause the electronic device to:
receive a second public element, a second electronic signature, and a second certificate from the external device through the communication circuitry; verify the second certificate by using a prestored root key; and verify the second electronic signature by using a second public key included in the second certificate.

6 . The electronic device of claim 5 , wherein the one or more programs further include instructions that, when executed by the at least one processor, cause the electronic device to identify a security level of the external device included in the second certificate.

7 . The electronic device of claim 6 , wherein the one or more programs further include instructions that, when executed by the at least one processor, cause the electronic device to provide an authority of the external device on a network including the electronic device and the external device, based on the identified security level of the external device.

8 . The electronic device of claim 6 , wherein the one or more programs further include instructions that, when executed by the at least one processor, cause the electronic device to store the identified security level of the external device in a public area of the memory.

9 . A method, performed by an electronic device, to mutually attest a security level of an external device, the method comprising:
determining a security level of the electronic device based on a hardware element for executing a trusted application generating a private key, a public key and a certificate with respect to the public key, and a location where the private key, the public key and the certificate are stored; establishing near-field wireless communication connection with the external device; executing the trusted application to generate a first private key by using a determined random function; a first public key based on the first private key and a first certificate with respect to the first public key, the first certificate being configured to include the determined security level of the electronic device; and transmitting the generated first certificate to the external device such that the external device authenticates the electronic device using the generated first certificate.

10 . The method of claim 9 ,
wherein the hardware element of the electronic device comprises at least one of a processor, a secure processor inside the processor or a secure element outside the processor, the secure element including an independent processor and an independent memory, wherein in case that the trusted application is executed on the secure processor or the secure element, the security level of the electronic device is determined as a first level, and wherein in case that the trusted application is executed on the processor, the security level of the electronic device is determined as a second level lower than the first level.

11 . The method of claim 9 , wherein the first certificate further includes at least one of at least a portion of account information, a firmware version, whether software has been modified, a device type, or a list of child nodes of the electronic device, wherein the child nodes are end devices connected to a network via the electronic device acting as a hub.

12 . The method of claim 9 , further comprising:
generating a first random number by using a determined random function; generating a first public element from the first random number by using an encryption algorithm; electrically signing the first public element by using the first private key to generate a first electronic signature; and transmitting the first public element, the first electronic signature, and the first certificate to the external device.

13 . The method of claim 9 , further comprising:
receiving a second public element, a second electronic signature, and a second certificate from the external device; verifying the second certificate by using a prestored root key; and verifying the second electronic signature by using a second public key included in the second certificate.

14 . The method of claim 13 , further comprising:
identifying a security level of the external device included in the second certificate.

15 . The method of claim 14 , further comprising:
providing an authority of the external device on a network including the electronic device and the external device, based on the identified security level of the external dev

Assignees

• Samsung Electronics Co Ltd

Inventors

• Kim Bumhan
• Park Hyewon
• Lee Dasom

Classifications

• H04L9/3247 Primary

  involving digital signatures · CPC title

• H04L9/0869

  involving random numbers or seeds · CPC title

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title

• H04L9/3263 Primary

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title