diff --git a/lib/pb-protocol/pb-protocol.c b/lib/pb-protocol/pb-protocol.c
index dbbda40..c468097 100644
--- a/lib/pb-protocol/pb-protocol.c
+++ b/lib/pb-protocol/pb-protocol.c
@@ -363,6 +363,25 @@ int pb_protocol_plugin_option_len(const struct plugin_option *opt)
 	return len;
 }
 
+int pb_protocol_authenticate_len(struct auth_message *msg)
+{
+	switch (msg->op) {
+	case AUTH_MSG_REQUEST:
+		/* enum + password + length */
+		return 4 + 4 + optional_strlen(msg->password);
+	case AUTH_MSG_RESPONSE:
+		/* enum + bool */
+		return 4 + 4;
+	case AUTH_MSG_SET:
+		/* enum + password + password */
+		return 4 + 4 + optional_strlen(msg->set_password.password) +
+			4 + optional_strlen(msg->set_password.new_password);
+	default:
+		pb_log("%s: invalid input\n", __func__);
+		return 0;
+	}
+}
+
 int pb_protocol_serialise_device(const struct device *dev,
 		char *buf, int buf_len)
 {
@@ -663,6 +682,39 @@ int pb_protocol_serialise_plugin_option(const struct plugin_option *opt,
 	return 0;
 }
 
+int pb_protocol_serialise_authenticate(struct auth_message *msg,
+		char *buf, int buf_len)
+{
+	char *pos = buf;
+
+	*(enum auth_msg_type *)pos = msg->op;
+	pos += sizeof(enum auth_msg_type);
+
+	switch(msg->op) {
+	case AUTH_MSG_REQUEST:
+		pos += pb_protocol_serialise_string(pos, msg->password);
+		break;
+	case AUTH_MSG_RESPONSE:
+		*(bool *)pos = msg->authenticated;
+		pos += sizeof(bool);
+		break;
+	case AUTH_MSG_SET:
+		pos += pb_protocol_serialise_string(pos,
+				msg->set_password.password);
+		pos += pb_protocol_serialise_string(pos,
+				msg->set_password.new_password);
+		break;
+	default:
+		pb_log("%s: invalid msg\n", __func__);
+		return -1;
+	};
+
+	assert(pos <= buf + buf_len);
+	(void)buf_len;
+
+	return 0;
+}
+
 int pb_protocol_write_message(int fd, struct pb_protocol_message *message)
 {
 	int total_len, rc;
@@ -1265,3 +1317,39 @@ int pb_protocol_deserialise_plugin_option(struct plugin_option *opt,
 out:
 	return rc;
 }
+
+int pb_protocol_deserialise_authenticate(struct auth_message *msg,
+		const struct pb_protocol_message *message)
+{
+	unsigned int len;
+	const char *pos;
+
+	len = message->payload_len;
+	pos = message->payload;
+
+	msg->op = *(enum auth_msg_type *)pos;
+	pos += sizeof(enum auth_msg_type);
+
+	switch (msg->op) {
+	case AUTH_MSG_REQUEST:
+		if (read_string(msg, &pos, &len, &msg->password))
+			return -1;
+		break;
+	case AUTH_MSG_RESPONSE:
+		msg->authenticated = *(bool *)pos;
+		pos += sizeof(bool);
+		break;
+	case AUTH_MSG_SET:
+		if (read_string(msg, &pos, &len, &msg->set_password.password))
+			return -1;
+		if (read_string(msg, &pos, &len,
+					&msg->set_password.new_password))
+			return -1;
+		break;
+	default:
+		pb_log("%s: unable to parse\n", __func__);
+		return -1;
+	}
+
+	return 0;
+}
diff --git a/lib/pb-protocol/pb-protocol.h b/lib/pb-protocol/pb-protocol.h
index 250c2d1..d5bdc19 100644
--- a/lib/pb-protocol/pb-protocol.h
+++ b/lib/pb-protocol/pb-protocol.h
@@ -26,6 +26,7 @@ enum pb_protocol_action {
 	PB_PROTOCOL_ACTION_PLUGIN_OPTION_ADD	= 0xc,
 	PB_PROTOCOL_ACTION_PLUGINS_REMOVE	= 0xd,
 	PB_PROTOCOL_ACTION_PLUGIN_INSTALL	= 0xe,
+	PB_PROTOCOL_ACTION_AUTHENTICATE		= 0xf,
 };
 
 struct pb_protocol_message {
@@ -34,6 +35,24 @@ struct pb_protocol_message {
 	char     payload[];
 };
 
+enum auth_msg_type {
+	AUTH_MSG_REQUEST,
+	AUTH_MSG_RESPONSE,
+	AUTH_MSG_SET,
+};
+
+struct auth_message {
+	enum auth_msg_type op;
+	union {
+		bool	authenticated;
+		char	*password;
+		struct {
+			char	*password;
+			char	*new_password;
+		} set_password;
+	};
+};
+
 void pb_protocol_dump_device(const struct device *dev, const char *text,
 	FILE *stream);
 int pb_protocol_device_len(const struct device *dev);
@@ -44,6 +63,7 @@ int pb_protocol_system_info_len(const struct system_info *sysinfo);
 int pb_protocol_config_len(const struct config *config);
 int pb_protocol_url_len(const char *url);
 int pb_protocol_plugin_option_len(const struct plugin_option *opt);
+int pb_protocol_authenticate_len(struct auth_message *msg);
 int pb_protocol_device_cmp(const struct device *a, const struct device *b);
 
 int pb_protocol_boot_option_cmp(const struct boot_option *a,
@@ -68,6 +88,8 @@ int pb_protocol_serialise_config(const struct config *config,
 int pb_protocol_serialise_url(const char *url, char *buf, int buf_len);
 int pb_protocol_serialise_plugin_option(const struct plugin_option *opt,
 		char *buf, int buf_len);
+int pb_protocol_serialise_authenticate(struct auth_message *msg,
+		char *buf, int buf_len);
 
 int pb_protocol_write_message(int fd, struct pb_protocol_message *message);
 
@@ -96,4 +118,7 @@ int pb_protocol_deserialise_config(struct config *config,
 
 int pb_protocol_deserialise_plugin_option(struct plugin_option *opt,
 		const struct pb_protocol_message *message);
+
+int pb_protocol_deserialise_authenticate(struct auth_message *msg,
+		const struct pb_protocol_message *message);
 #endif /* _PB_PROTOCOL_H */
