Patent Description:
Consumer-driven expansion of the smart device market has led to increased demands for cross-solution compatibility, secure flexibility, and increased affordability. Accordingly, being forever tied to a single DPS for the life of the smart device introduces risks and undesirable constraints. For example, if the manufacturer goes out of business or otherwise terminates support of the smart device, the device owner may be left with a non-functional device. In another perspective, the credentials issued by the manufacturer may expire, be hacked, or be otherwise lost. Likewise, enhanced provisioning features may be available from different DPSs, such as from a DPS owned and implemented by an enterprise that owns the smart device. An enterprise DPS may provide coordination of provisioning among many enterprise-owned assets, the ability for cross-manufacturer provisioning, and/or enhanced security over manufacturer DPSs.

<CIT> relates to techniques for provisioning device-specific credentials to an Internet of Things (IoT) device that accesses a cloud-based IoT service. The IoT service receives, from the IoT device, a request for device-specific credentials. The request comprises a provisioning certificate including information identifying a group of devices associated with the IoT device. The provisioning certificate is authenticated by evaluating the information with expected information. The device-specific credentials are generated based, at least in part, on the information provided in the provisioning certificate. The device-specific credentials are sent to the IoT device, and the IoT device installs and activates the device-specific credentials. The device-specific credentials are associated with the IoT device in a registry of the IoT service.

<NPL> relates to key aspects for deploying a Public Key Infrastructure (PKI) security solution in an Internet of Things (IoT) ecosystem, ranging from deploying certificates on new devices (bootstrapping) to complete life cycle management of these certificates. Different certificate management protocols are investigated and the applicability of enhanced security over transport (EST) protocol for IoT PKI solution is motivated. In addition, a PKI deployment model is proposed and the bootstrap mechanism to bring up an IoT device and provision it with a digital certificate. Furthermore, a prototype implementation is provided to demonstrate certificate enrollment procedure with an EST server.

It is the object of the present invention to enhance secure device provisioning for network-connected devices.

The described technology provides a device provisioning service that provisions a network-connected device to access one or more service systems using a supplemental cryptographic identity of the network-connected device. An initial enrollment record (associated with an initial cryptographic identity) and a supplemental enrollment record are stored in a device provisioning service. An identity issuance request is received from the network-connected device at the device provisioning service. The identity issuance request includes the initial cryptographic identity. The supplemental cryptographic identity is requested from a supplemental cryptographic identity issuer identified in the initial enrollment record based on the identity issuance request. The requested supplemental cryptographic identity is received at the device provisioning service from the supplemental cryptographic identity issuer. The network-connected device is provisioned to access the one or more service systems according to the supplemental enrollment record. The supplemental cryptographic identity is communicated to the network-connected device.

This summary is provided to introduce a selection of concepts in a simplified form that is further described below in the Detailed Description.

In at least one implementation of the described technology, a networked-connected device, such as an Internet-of-Things (IoT) device, a network-connected industrial asset, a mobile computing device, or another communications device, can be securely associated with a supplemental cryptographic identity based on an initial cryptographic identity. The network-connected device can then be provisioned using the supplemental cryptographic identity instead of or in addition to the initial cryptographic identity.

In one scenario, a device provisioning service (DPS) can be set up to process an identity issuance request from a network-connected device based on the initial cryptographic identity and an initial enrollment record stored in the DPS and to provision the network-connected device in accordance with a supplemental enrollment record associated with the supplemental cryptographic identity.

For example, the network-connected device connects to the DPS via a secure connection and presents the DPS with an identity issuance request (e.g., a certificate signing request or CSR, or a JSON Web Token or JWT) and an initial cryptographic identity to request a new identity (e.g., a new certificate) over the secure connection. In response to receipt of the identity issuance request, the DPS accesses the initial enrollment record (or another enrollment record) associated with the initial cryptographic identity. The initial enrollment record is stored at or is accessible by the DPS.

Using configuration information stored in the initial enrollment record (or another enrollment record), the DPS validates the initial cryptographic identity and the identity issuance request. If the initial cryptographic identity and the identity issuance request are validated, then the DPS can request a supplemental cryptographic identity from an identity issuer, such as a local or external certificate authority based on the validated identity issuance requests. The identity issuer returns the supplemental cryptographic identity and associates it with a supplemental enrollment record. The DPS can then provision the network-connected device using configuration information stored in the supplemental enrollment record and return the supplemental cryptographic identity to the network-connected device, which can subsequently use the supplemental cryptographic identity to connect to the DPS and other services registered by the DPS for access by the network-connected device presenting the supplemental cryptographic identity.

<FIG> illustrates example provisioning of a networked-connected device <NUM> using a supplemental cryptographic identity (e.g., a buyer identity <NUM>). In the illustrated implementation, the network-connected device <NUM> is represented by a vehicle, which may be a vehicle of a fleet purchased and/or operated by a buyer (e.g., a delivery company). The vehicle is sold in association with an initial cryptographic identity (e.g., a manufacturer identity <NUM>), such as a cryptographic certificate issued by a manufacturer <NUM>. However, the buyer may not wish to rely entirely on the manufacturer and its issued identity. For example, the manufacturer may go out of business, and its issued identity may no longer be trustworthy. As such, the buyer sets up its own device provisioning service <NUM> to issue a supplemental cryptographic identity (i.e., the buyer identity), which the buyer manages and controls, and to provision its network-connected devices. In this manner, the buyer can continue to provision and manage the network-connected device <NUM> through its own device provisioning service <NUM> and the buyer's identity <NUM>, even if the manufacturer identity <NUM> is no longer valid. This approach can also allow the buyer to override and/or customize the manufacturer's provisioning of the network-connected device <NUM>.

As illustrated in <FIG>, the manufacturer <NUM> initially provides the network-connected device <NUM> with an initial cryptographic identity (i.e., the manufacturer identity). It should be understood that the term "initial" in this application does not mean that the network-connected device <NUM> did not have previous cryptographic identities. Instead, "initial" is intended to be interpreted relative to the network-connected device <NUM> subsequently becoming associated with the supplemental cryptographic identity (e.g., the buyer identity <NUM>). In one implementation, to obtain provisioning using the initial cryptographic identity, the network-connected device <NUM> accesses a global endpoint (e.g., at a known URL) and identifies a device provisioning service from which to obtain provisioning. The global endpoint directs the network-connected device <NUM> to an appropriate device provisioning service for provisioning. Other provisioning methods are also contemplated.

In addition, in some implementations, the network-connected device <NUM> may also request a supplemental cryptographic identity and then obtain provisioning using the supplemental cryptographic identity. For example, the buyer can program the network-connected device <NUM> (e.g., via public APIs (application programming interfaces) or SDKs (software development kits) to specify which device provisioning service to contact when requesting a supplemental cryptographic identity and/or supplemental provisioning. Alternatively, the network-connected device <NUM> may obtain an identifier of a supplemental device provisioning service in the initial provisioning operation (e.g., from the initial device provisioning service), through hard-coded configuration information, in response to a remote command from the buyer or another authorized entity, based on periodic identity renewals (e.g., keeping track of the remaining useful life or RUL of its credentials and requesting a new identity when the RUL drops below a threshold), etc. In some implementations, the initial device provisioning service and the supplemental device provisioning service may be the same device provisioning service and may still apply configuration information from different enrollment records.

In one implementation, for example, the buyer or some other entity sets up the device provisioning service <NUM> to recognize and validate the manufacturer identity <NUM> presented by the network-connected device <NUM>, the buyer creates the initial enrollment record including validation parameters associated with the initial cryptographic identity and an identifier of a particular identity issuer. The network-connected device <NUM> issues an identity issuance request <NUM> to the device provisioning service <NUM> to request the supplemental cryptographic identity. The identity issuance request <NUM> includes the initial cryptographic identity, which the device provisioning service <NUM> uses to access an initial enrollment record associated with the initial cryptographic identity. If the device provisioning service <NUM> is able to validate the identity issuance request <NUM>, the device provisioning service <NUM> then requests the supplemental cryptographic identity from the identity issuer (not shown) specified in the initial enrollment record.

Validation of the identity issuance request may be performed in a variety of ways. In some implementations, the device provisioning service <NUM> can challenge the network-connected device <NUM> to prove its identity as being the manufacturer identity <NUM>, such as using a symmetric or asymmetric key challenge to the network-connected device <NUM> based on the manufacturer identity <NUM>. The device provisioning service <NUM> can also evaluate the identity issuance request <NUM> to determine whether the identity issuance request <NUM> was validly signed by the network-connected device <NUM>. Additional or different validation operations may be employed. These validation operations are conditional to the device provisioning service <NUM> requesting the supplemental cryptographic identity from the identity issuer specified in the initial enrollment record.

Having validated the identity issuance request from the network-connected device <NUM>, the device provisioning service <NUM> requests the supplemental cryptographic identity from the identity issuer specified in the initial enrollment record. The request may specify an intermediate root in the certificate chain of the supplemental cryptographic identity issuer from which the supplemental cryptographic identity is to be created. The supplemental cryptographic identity issued by the supplemental cryptographic identity issuer in response to the identity issuance request is returned to the device provisioning service <NUM>.

The device provisioning service <NUM> associates the supplemental cryptographic identity with a supplemental enrollment record and uses configuration information in the supplemental enrollment record to provision the network-connected device <NUM>. For example, the device provisioning service <NUM> registers the network-connected device <NUM> with one or more service systems <NUM> (e.g., systems providing IoT services, systems providing cloud services, IoT hubs) using the supplemental cryptographic identity. The device provisioning service <NUM> also returns the supplemental cryptographic identity as the buyer identity <NUM>. Thereafter, the network-connected device <NUM> can access the same service systems <NUM> by presenting the supplemental cryptographic identity (i.e., the buyer identity) to those services.

<FIG> illustrates an example device provisioning service system <NUM>. A network-connected device <NUM> communicates an identity issuance request <NUM> to a device communications interface <NUM> of the device provisioning service system <NUM>. An identity processing subsystem <NUM> receives the identity issuance request <NUM> (with the initial cryptographic identity) from the device communications interface <NUM> and attempts to validate the identity issuance request <NUM> using configuration information stored in an initial enrollment record <NUM>, which is associated with the initial cryptographic identity. Validation can include challenging the network-connected device <NUM> to prove the initial cryptographic identity belongs to it and/or verifying that the identity issuance request <NUM> was validly signed by the network-connected device <NUM>.

If the identity processing subsystem <NUM> validates the identity issuance request <NUM>, the identity processing subsystem <NUM> requests a supplemental cryptographic identity <NUM> (e.g., using an identity issuance request <NUM>) from a supplemental cryptographic identity issuer <NUM> through an identity issuer interface <NUM> of the device provisioning service system <NUM>. For example, the supplemental cryptographic identity issuer <NUM> may be a local or remote certificate authority. The identity processing subsystem <NUM> may also specify (e.g., with the identity issuance request <NUM>) an intermediate root of a certificate chain maintained by the supplemental cryptographic identity issuer <NUM> so that the supplemental cryptographic identity <NUM> is created from that intermediate node.

The identity processing subsystem <NUM> receives the supplemental cryptographic identity <NUM> from the supplemental cryptographic identity issuer <NUM> through the identity issuer interface <NUM> and associates it with a supplemental enrollment record <NUM>. The supplemental enrollment record <NUM> stores configuration information associated with the supplemental cryptographic identity <NUM> (e.g., provisioning information for that identity, validation information for that identity). As such, the configuration information in the supplemental enrollment record <NUM> can be used to provision, validate future requests from the network-connected device <NUM>, and otherwise interact with the network-connected device <NUM> based on the supplemental cryptographic identity <NUM>, which the network-connected device <NUM> presents in such interactions.

Accordingly, a provisioning subsystem <NUM> can retrieve provisioning information from the supplemental enrollment record <NUM> and communicate with one or more service systems <NUM> via a registration interface <NUM> to provision the network-connected device <NUM> with the one or more service systems <NUM> based on the supplemental cryptographic identity <NUM>. In one implementation, such provisioning includes registering the network-connected device <NUM> with the one or more service systems <NUM> using the supplemental cryptographic identity <NUM>. The device provisioning service system <NUM> also returns the supplemental cryptographic identity <NUM> to the network-connected device <NUM>, which can use the supplemental cryptographic identity <NUM> to access the one or more service systems <NUM>.

All described interfaces and subsystems may be implemented using a combination of hardware and/or software executing on the hardware.

<FIG> illustrates example operations <NUM> for provisioning of a networked-connected device using a supplemental cryptographic identity. A storing operation <NUM> stores an initial enrollment record and a supplemental enrollment record at a device provisioning service. The initial enrollment record is associated with an initial cryptographic identity (e.g., is stored in associated with the initial cryptographic identity, contains validation parameters associated with the initial cryptographic identity). The supplemental enrollment record will be associated with a supplemental cryptographic identity (e.g., is stored in associated with the supplemental cryptographic identity, contains validation parameters associated with the supplemental cryptographic identity, contains provisioning information associated with the supplemental cryptographic identity).

A receiving operation <NUM> receives an identity issuance request from the network-connected device at the device provisioning service (e.g., through a device communications interface). An identity issuance request operation <NUM> requests the supplemental cryptographic identity from a supplemental cryptographic identity issuer identified in the initial enrollment record. The request may be conditional upon successful validation of the identity issuance request received from the network-connected device. The request may also specify an intermediate root of a certificate chain or some similar parameter to further describe the character of the requested identity.

Another receiving operation <NUM> receives the requested supplemental cryptographic identity from the supplemental cryptographic identity issuer. A provisioning operation <NUM> provisions the network-connected device to access one or more service systems according to the supplemental enrollment record. In one implementation, the provisioning operation <NUM> registers the network-connected device with the one or more service systems using the supplemental cryptographic identity. A response operation <NUM> communicates the supplemental cryptographic identity to the network-connected device, which can use the supplemental cryptographic identity to access the one or more service systems.

<FIG> illustrates an example communication device <NUM> for implementing the features and operations of the described technology. The communication device <NUM> is an example network-connected device and may be a client device, such as a laptop, mobile device, desktop, tablet; a server/cloud device; an internet-of-things device; an electronic accessory; or another electronic device. The communication device <NUM> includes one or more processor(s) <NUM> and a memory <NUM>. The memory <NUM> generally includes both volatile memory (e.g., RAM) and non-volatile memory (e.g., flash memory). An operating system <NUM> resides in the memory <NUM> and is executed by the processor(s) <NUM>.

In an example communication device <NUM>, as shown in <FIG>, one or more modules or segments, such as applications <NUM> and other modules, are loaded into the operating system <NUM> on the memory <NUM> and/or storage <NUM> and executed by processor(s) <NUM>. The storage <NUM> includes one or more tangible storage media devices and may store enrollment records, identities, configuration information, cryptographic data elements, and other data and be local to the communication device <NUM> or may be remote and communicatively connected to the communication device <NUM>.

The communication device <NUM> includes a power supply <NUM>, which is powered by one or more batteries or other power sources and which provides power to other components of the communication device <NUM>. The power supply <NUM> may also be connected to an external power source that overrides or recharges the built-in batteries or other power sources.

The communication device <NUM> may include one or more communication transceivers <NUM> which may be connected to one or more antenna(s) <NUM> to provide network connectivity (e.g., mobile phone network, Wi-Fi®, Bluetooth®) to one or more other servers and/or client devices (e.g., mobile devices, desktop computers, or laptop computers). The communication device <NUM> may further include a network adapter <NUM>, which is a type of communication device. The communication device <NUM> may use the adapter and any other types of communication devices for establishing connections over a wide-area network (WAN) or local-area network (LAN). It should be appreciated that the network connections shown are exemplary and that other communication devices and means for establishing a communications link between the communication device <NUM> and other devices may be used.

The communication device <NUM> may include one or more input devices <NUM> such that a user may enter commands and information (e.g., a keyboard or mouse). These and other input devices may be coupled to the server by one or more interfaces <NUM>, such as a serial port interface, parallel port, or universal serial bus (USB). The communication device <NUM> may further include a display <NUM>, such as a touch screen display.

The communication device <NUM> may include a variety of tangible processor-readable storage media and intangible processor-readable communication signals. Tangible processor-readable storage can be embodied by any available media that can be accessed by the communication device <NUM> and includes both volatile and nonvolatile storage media, removable and non-removable storage media. Tangible processor-readable storage media excludes communications signals and includes volatile and nonvolatile, removable and non-removable storage media implemented in any method or technology for storage of information such as processor-readable instructions, data structures, program modules or other data. Tangible processor-readable storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CDROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other tangible medium which can be used to store the desired information and which can be accessed by the communication device <NUM>. In contrast to tangible processor-readable storage media, intangible processor-readable communication signals may embody processor-readable instructions, data structures, program modules or other data resident in a modulated data signal, such as a carrier wave or other signal transport mechanism. By way of example, and not limitation, intangible communication signals include signals traveling through wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared, and other wireless media.

While this specification contains many specific implementation details, these should not be construed as limitations on the scope of any inventions or of what may be claimed, but rather as descriptions of features specific to particular embodiments of a particular described technology.

Thus, particular embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims.

In certain implementations, multitasking and parallel processing may be advantageous.

Claim 1:
A method of provisioning a network-connected device (<NUM>, <NUM>) to access one or more service systems (<NUM>, <NUM>) using a supplemental cryptographic identity (<NUM>, <NUM>) of the network-connected device, the method comprising:
storing (<NUM>), in a device provisioning service (<NUM>, <NUM>), an initial enrollment record (<NUM>) associated with an initial cryptographic identity (<NUM>) of the network-connected device and a supplemental enrollment record (<NUM>);
receiving (<NUM>) an identity issuance request (<NUM>, <NUM>) from the network-connected device at the device provisioning service, the identity issuance request including the initial cryptographic identity;
requesting (<NUM>), based on the identity issuance request, the supplemental cryptographic identity from a supplemental cryptographic identity issuer (<NUM>) identified in the initial enrollment record;
receiving (<NUM>) the requested supplemental cryptographic identity at the device provisioning service from the supplemental cryptographic identity issuer;
provisioning (<NUM>) the network-connected device to access the one or more service systems according to the supplemental enrollment record; and
communicating (<NUM>) the supplemental cryptographic identity to the network-connected device.