Unique and secure identification of a networked computing node

1. A computer-implemented method for identification of a service node coupled to an administrative node and a certificate authority node via a computer network, the administrative and certificate authority nodes having respective public and private keys, comprising:

establishing a shared key between the certificate authority node and the administrative node;

while booting the service node, automatically generating by the service node a public key and a private key for the service node;

sending a request from the service node to the administrative node, the request including the public key of the service node and indicating to the administrative node that the service node is available for configuration;

double encrypting, in response to the request from the service node, a selected value at the administrative node first using the shared key and second using the public key of the service node, whereby a double encrypted value is generated;

transmitting the double encrypted value to the service node;

decrypting the double encrypted value at the service node, whereby a single encrypted value is generated;

transmitting the single encrypted value to the certificate authority node;

decrypting the single encrypted value at the certificate authority node using the shared key;

generating an authentication code having a value that indicates whether the certificate authority node successfully decrypted the single encrypted value using the shared key;

transmitting from the administrative node to the service node configuration data that configures the service node to provide a selected service; and

conditionally accepting the configuration data by the service node in response to the value of the authentication code.

2. The method of claim 1 , further comprising:

transmitting from the administrative node to the service node data that indicate an offer to configure the service node to provide a selected service; and

accepting the offer if the authentication code indicates successful authentication of the administrative node and other selected acceptance criteria are met.

3. The method of claim 1 , wherein the service node includes a network interface card and further comprising generating the public key and private key of the service node on the network interface card.

4. The method of claim 3 , further comprising storing the public key and private key of the service node on the network interface card.

5. The method of claim 3 , further comprising:

encrypting at the administrative node using the public key of the service node an address that references the certificate authority node; and

decrypting at the service node the address that references the certificate authority node, wherein the step of transmitting the single encrypted value to the certificate authority node uses the decrypted address that references the certificate authority node.

6. The method of claim 3 , further comprising transmitting from the administrative node to the service node configuration data that configures the service node to provide a selected service.

7. The method of claim 3 , further comprising:

transmitting from the administrative node to the service node data that indicate an offer to configure the service node to provide a selected service; and

accepting the offer if the authentication code indicates successful authentication of the administrative node and other selected acceptance criteria are met.

8. An apparatus for identification of a service node coupled to an administrative node and a certificate authority node via a computer network, the administrative and certificate authority nodes having respective public and private keys, comprising:

means for establishing a shared key between the certificate authority node and the administrative node;

means for while booting the service node, automatically generating by the service node a public key and a private key for the service node;

means for sending a request from the service node to the administrative node, the request including the public key of the service node and indicating to the administrative node that the service node is available for configuration;

means, responsive to the request from the service node, for double encrypting a selected value at the administrative node first using the shared key and second using the public key of the service node, whereby a double encrypted value is generated;

means for transmitting the double encrypted value to the service node;

means for decrypting the double encrypted value at the service node, whereby a single encrypted value is generated;

means for transmitting the single encrypted value to the certificate authority node;

decrypting the single encrypted value at the certificate authority node using the shared key;

means for generating an authentication code having a value that indicates whether the certificate authority node successfully decrypted the single encrypted value using the shared key;

means for transmitting from the administrative node to the service node configuration data that configures the service node to provide a selected service; and

means for conditionally accepting the configuration data by the service node responsive to the value of the authentication code.

9. A computing arrangement, comprising:

a network;

a certificate authority node coupled to the network;

an administrative node coupled to the network, the administrative node configured to establish a shared key with the certificate authority node; and

a service node coupled to the network, the service node configured to automatically generate a public key and a private key for the service node while booting and send a request from the service node to the administrative node, the request including the public key of the service node and indicating to the administrative node that the service node is available for configuration;

wherein the administrative node is further configured to double encrypt a selected value first using the shared key and second using the public key of the service node in response to the request from the service node, whereby a double encrypted value is generated, transmit the double encrypted value to the service node, and transmit from the administrative node to the service node configuration data that configures the service node to provide a selected service, the service node is further configured to decrypt the double encrypted value, whereby a single encrypted value is generated, and transmit the single encrypted value to the certificate authority node, the certificate authority is further configured to decrypt the single encrypted value using the shared key and to generate an authentication code having a value that indicates whether the single encrypted value was successfully decrypted using the shared key, and the service node is further configured to conditionally accepting the configuration data in response to the value of the authentication code.

10. The arrangement of claim 9 , wherein the administrative node is further configured to transmit to the service node data that indicate an offer to configure the service node to provide a selected service, and the service node is further configured to accept the offer if the authentication code indicates successful authentication of the administrative node and other selected acceptance criteria are met.

11. The arrangement of claim 9 , wherein the service node includes a network interface card, and the network interface card generates the public key and private key of the service node.

12. The arrangement of claim 11 , wherein the network interface is further configured for storage of the public key and private key of the service node.

13. The arrangement of claim 11 , wherein the administrative node is further configured to encrypt, using the public key of the service node, an address that references the certificate authority node, and the service node is further configured to decrypt the address that references the certificate authority node.