Authenticating a networked camera using a certificate having device binding information

Abstract

A device authentication method includes: connecting to a device such as a camera through a network; receiving, from the device, a certificate of the device including device binding information about the device; sending, to the device, a device management message for administration level authentication; receiving, from the device, device information about the device in response to the administration level authentication being successful; determining whether the certificate is valid based on the device binding information and the device information; and establishing a protected communication session with the device in response to the certificate being determined to be valid.

What is claimed is: 
     
         1 . A device authentication method comprising:
 connecting to a device through a network;   receiving, from the device, a certificate of the device comprising device binding information about the device;   sending, to the device, a device management message for administration level authentication;   receiving, from the device, device information about the device in response to the administration level authentication being successful;   determining whether the certificate is valid based on the device binding information and the device information; and   establishing a protected communication session with the device in response to the certificate being determined to be valid.   
     
     
         2 . The authentication method of  claim 1 , wherein the device information comprises identification information about the device for identifying the device from other devices. 
     
     
         3 . The authentication method of  claim 2 , wherein the device binding information represents that the certificate has been issued for the device identified by the device information. 
     
     
         4 . The authentication method of  claim 3 , wherein the device information comprises at least a part of a Medium Access Control (MAC) address of a communication interface included in the device. 
     
     
         5 . The authentication method of  claim 4 , wherein the device information comprises information about a component constituting the device. 
     
     
         6 . The authentication method of  claim 4 , wherein the determining whether the certificate is valid comprises:
 determining whether the device binding information comprises the device information; and   determining whether a digital signature of a certificate authority issuing the certificate is valid.   
     
     
         7 . The authentication method of  claim 6 , wherein the determining whether the certificate is valid comprises:
 generating pinning information about the certificate received from the device; and   determining whether the generated pining information matches pre-stored pinning information about the device.   
     
     
         8 . The authentication method of  claim 1 , further comprising, in response to the administration level authentication being successful, receiving, from the device, system configuration information about the device. 
     
     
         9 . A camera authentication method comprising:
 receiving, from a management device, a request to connect to a camera;   receiving, from the management device, a device management message for administration level authentication;   sending, to the management device, device information about the camera corresponding to an access class allowed to read system configuration information about the camera in response to the administration level authentication being successful;   sending, to the management device, a certificate comprising device binding information about a camera; and   establishing a protected communication session with the management device based on a result of determining whether the certificate is valid at the management device.   
     
     
         10 . A management device for a camera comprising:
 a communication interface configured to communicate with the camera;   a storage configured to store device information about the camera; and   a controller configured to control the communication interface to establish a protected communication session with the camera based on a result of checking a validity of a certificate received from the camera,   wherein the controller is further configured to determine whether the certificate is valid based on the device information stored in the storage and the device binding information included in the certificate.   
     
     
         11 . The management device of  claim 10 , wherein the device information comprises at least a part of a Medium Access Control (MAC) address of a communication interface included in the camera. 
     
     
         12 . The management device of  claim 11 , wherein the controller is configured to:
 determine whether the device binding information comprises the device information stored in the storage; and   validate the certificate by determining whether a digital signature of a certificate authority issuing the certificate is valid.   
     
     
         13 . The management device of  claim 12 , wherein the certificate is expressed in a form of X.509v3, and
 wherein the device binding information is included in a SubjectPublickeyInfo field or an extension field.   
     
     
         14 . The management device of  claim 12 , wherein the storage is configured to pre-store pinning information about the camera, and
 wherein the controller is further configured to generate pinning information about the certificate received from the camera, and determine whether the generated pinning information about the certificate matches the pre-stored pinning information about the camera.   
     
     
         15 . The management device of  claim 13 , wherein the controller is further configured to control the communication interface establish the protected communication session via SSL (Secure Socket Layer) protocols in response to validating the certificate. 
     
     
         16 . A camera comprising:
 a communication interface configured to communicate with a management device;   an image sensor configured to capture image data;   a storage configured to store a certificate comprising device binding information generated based on device information about the camera, and store a public key included in the certificate and a private key generated to have a cryptographic relation with the public key; and   a controller configured to control the communication interface to:
 receive a connection request from the management device; 
 send the certificate to the management device; and 
 establish a protected communication session with the management device according to a result of determining that the certificate of the camera is valid at the management device based on the device binding information and the device information. 
   
     
     
         17 . The camera device of  claim 16 , wherein the device information comprises identification information about the camera for identifying the camera from other devices. 
     
     
         18 . The camera device of  claim 17 , wherein the device information comprises at least a part of a Medium Access Control (MAC) address of the communication interface. 
     
     
         19 . The camera device of  claim 18 , wherein the determining that the certificate of the camera is valid comprises:
 determining whether the device binding information comprises the device information;   determining whether a digital signature of a certificate authority issuing the certificate is valid; and   determining whether pinning information about the certificate matches pre-stored pinning information about the camera.   
     
     
         20 . The camera device of  claim 16 , wherein the control unit is further configured to:
 receive, from the management device, a device management message for administration level authentication; and   sending, to the management device, device information corresponding to an access class allowed to read system configuration information about the camera in response to the administration level authentication being successful.