Device certificate individualization

Patent metadata

Field	Value
Publication number	US-9336359-B2
Application number	US-201213367198-A
Country	US
Kind code	B2
Filing date	Feb 6, 2012
Priority date	Oct 18, 2004
Publication date	May 10, 2016
Grant date	May 10, 2016

Abstract

A method of generating a device certificate. A method of generating a device certificate comprising, constructing a device certificate challenge at a device, sending information to a device certificate individualization server in response to the device certificate challenge, validating the device certificate challenge by the device certificate individualization server, and validating the device certificate response by the device.

First claim

The invention claimed is:

1. One or more computer-readable memory devices or storage devices storing instructions which, when executed by one or more processing units, cause the one or more processing units to:
access an instance of a device certificate template, wherein the device certificate template is shared by a plurality of devices of a product line and the device certificate template includes product line characteristics of the plurality of devices of the product line; and
use the instance of the device certificate template and information specific to an individual device of the plurality of devices to obtain a device certificate for the individual device, wherein the information specific to the individual device distinguishes the individual device from other devices of the product line,
wherein the device certificate that is obtained using the instance of the device certificate template and the information specific to the individual device enables the individual device to access protected content, and
wherein the device certificate template provides a chain of trust structure linking a first certificate associated with a manufacturer of the individual device to a second certificate associated with a certificate authority.

2. The one or more computer-readable memory devices or storage devices of claim 1 , the stored instructions further causing the processor to:
access another instance of the device certificate template; and
use the another instance of the device certificate template and other information specific to another individual device of the plurality of devices to obtain another device certificate for the another individual device,
wherein the instance of the device certificate template and the another instance of the device certificate template are identical, the information and the other information are different, and the device certificate and the another device certificate are different.

3. The one or more computer-readable memory devices or storage devices of claim 1 , wherein the instance of the device certificate template is stored on the individual device when accessed and the using comprises:
sending the instance of the device certificate template and the information specific to the individual device to another device that creates the device certificate for the individual device; and
receiving the device certificate from the another device.

4. The one or more computer-readable memory devices or storage devices of claim 3 , wherein the product line characteristics included in the device certificate template comprise device features of the plurality of devices of the product line that distinguish the plurality of devices of the product line from another product line having different device features.

5. The one or more computer-readable memory devices or storage devices of claim 4 , wherein the first certificate is a device authorization certificate and the second certificate is an authorization root certificate.

6. The one or more computer-readable memory devices or storage devices of claim 4 , the stored instructions further causing the processor to:
create a challenge comprising the instance of the device certificate template, the information specific to the individual device, and a public key;
send the challenge to the another device; and
store a private key corresponding to the public key on the individual device.

7. The one or more computer-readable memory devices or storage devices of claim 6 , the stored instructions further causing the processor to:
receive the device certificate from the another device in an encrypted form; and
decrypt the device certificate using the private key.

8. A computing device comprising:
one or more processing units; and
one or more memory devices or storage devices storing instructions which, when executed by the one or more processing units, cause the one or more processing units to:
access a device certificate template for a product line, wherein the computing device is one of a plurality of devices of the product line and the device certificate template identifies one or more device features that are common to the plurality of devices of the product line; and
use the device certificate template and information specific to the computing device to obtain a device certificate for the computing device,
wherein:
the device certificate enables the computing device to access protected content,
the device certificate template comprises another certificate associated with a manufacturer of the plurality of computing devices of the product line, and
the one or more device features included in the device certificate template distinguish the product line from at least some other product lines.

9. The computing device of claim 8 , wherein the device certificate template comprises an authorization root certificate associated with a certificate authority.

10. A system comprising the computing device of claim 8 and a server configured to create the device certificate based on the device certificate template and the information specific to the computing device and send the device certificate to the computing device.

11. The system of claim 10 , wherein the server is further configured to:
create the device certificate by filling in sections of the device certificate template with the information specific to the computing device;
create another device certificate for another computing device of the product line by filling in the sections of the device certificate template with other information specific to the another computing device; and
send the another device certificate to the another computing device.

12. The computing device of claim 8 , wherein the one or more device features identified by the device certificate template include a model identifier shared by each of the plurality of devices of the product line.

13. The computing device of claim 12 , wherein the information specific to the computing device comprises a serial number of the computing device.

14. The computing device of claim 13 , wherein the another certificate is a device authorization certificate.

15. The computing device of claim 8 , wherein the device certificate template comprises a partial chain of trust that is completed by the device certificate.

16. The computing device of claim 8 , wherein the instructions further cause the one or more processing units to:
generate a key pair comprising a public key and a private key;
store the private key on the computing device;
send the public key, the device certificate template, and the information specific to the computing device to another computing device that creates the device certificate and encrypts the device certificate using the public key;
receive the device certificate from the another computing device in encrypted form; and
decrypt the device certificate using the private key.

17. A method performed by at least one computer processing unit, the method comprising:
populating a device certificate template to obtain a populated device certificate template comprising:
information common to a plurality of computing devices of a product line,
an authorization certificate associated with a manufacturer of the plurality of computing devices of the product line, and
an authorization root certificate associated with a certificate authority, wherein the plurality of computing devices have stored thereon different identifiers;

receiving, from the plurality of computing devices, the different identifiers; and
using the populated device certificate template and th

Assignees

• Jain Amit
• Storm Clifford Paul
• Cutter Jr Benjamin Brooks
• Evans Brian Patrick
• Microsoft Technology Licensing Llc

Inventors

• Jain Amit
• Storm Clifford Paul
• Cutter Jr Benjamin Brooks
• Evans Brian Patrick

Classifications

• G06F21/10 Primary

  Protecting distributed programs or content, e.g. vending or licensing of copyrighted material (protection in video systems or pay television H04N7/16) {; Digital rights management [DRM]} · CPC title

• H04L9/3271

  using challenge-response · CPC title

• H04L2209/603

  Digital right managament [DRM] · CPC title

• H04L9/3263

  involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title