Skip to main content
Version: v1.1

Aos PKI overview

General information​

Public Key infrastructure (PKI) is a cryptographic system that manages digital identities and secure communication using asymmetric (public-key) cryptography. It provides such core pillars of digital security as:

  • authentication - verifying the identity
  • confidentiality - data encryption to protect information from unauthorized access
  • integrity - ensuring data hasn't been tampered with

PKI secure data and ensure (create) trust in the form of digital certificates that are issued by a trusted Certificate Authorities (CA). Trusted Certificates Authorities (CA) are organizations identified by certificates (public keys).

In general case, each organization have to specify trusted CAs as a protected list of certificates. To simplify the process, all popular operation systems, browsers have built-in widely trusted CAs list. At the same time, there are mechanisms to manage the list of trusted CAs through manual operations or managed by enterprise systems (like MS ActiveDirectory).

AosEdge PKI​

AosEdge widely uses PKI to secure many aspects of its operations. To provide the most secure environment, AosEdge use single (or limited) Root of Trust. This means that all verifications are done against a single or limited number of trusted CA. This Root of Trust (certificate of the Root CA) is included in the AosEdge software platform during provisioning.

Using single Root of Trust allows:

  • to ensure that allowed certificates secure all communication channels (not by any valid certificates)
  • to ensure that all data (like a Deployable Items) are signed by AosEdge allowed entities (like trusted by AosEdge publishers only, excluding world well-known trusted CA)
  • to ensure that the trust list can't be changed by external parties (like updates of ca-certificate package in Linux, etc)

Typical AosEdge CA structure​

Root CA
│ 
└── Intermediate CA
    │  
    ├── Units CA
    │    ├── Unit certificate #!
    │    ├── ...
    │    └── ...
    └── Users CA
         ├── User certificate #!
         ├── ...
         └── ...
  • Root CA is the single root of trust. It is the most protected CA (usually completely offline). It is used to sign Intermediate CA certificates only.
  • Intermediate CA is used to protect the Root CA and to be the issuing CA for subordinate CAs. Can be online or offline.
  • Issuing CA (Units CA, Users CA) is used to issue certificates to end entities (like units and users).

Where AosEdge PKI is used​

User identification​

AosEdge uses the PKI (mutual TLS) to authenticate users. This allows to exclude passwords and tokens from the identification processes, and as a result reduce possible attack vectors.

Also, this approach brings the single and well-protected way to identify any types of users and communication channels. AosEdge users, AosCore-based units, system components use the same PKI to authenticate each other.

Data signing and Non-repudiation​

To provide data integrity and non-repudiation, all items that are stored and exchanged between AosCloud and AosCore units, are encrypted and signed. This means that any AosEdge entity can verify the signature of data any time, even being offline. To do this, AosEdge store sign and certificate statuses (answers from OCSP responders). The single Root of Trust allows to be sure that sign are done by AosEdge trusted entities only.