Provisioning sensitive data into third party
A method for providing identity data to network-enabled devices includes receiving a request for identity data from a network-enabled device that is deployed to an end-user. The network-enabled device is pre-provisioned with a PIN, a global key pair, a user-accessible first device identifier, and a second device identifier usable by a service provider delivering a service to the device. The identity data request includes the first and second identifiers, a protected rendition of the PIN, and an encryption key or other data from which an encryption key is derivable. The identifiers, the protected rendition of the PIN, and the encryption key or the other data are signed by a private key in the global key pair. The validity of the PIN included in the request is verified to authenticate the device. If the PIN is valid, identity data for the device is generated, encrypted and sent to the network-enabled device.
1. A method for providing identity data to a network-enabled device, comprising:
receiving a request for identity data from a network-enabled device that is provided to enable the network-enabled device to be authorized to operate to play videos in a network providing video content, the identity data being deployed to an end-user, the network-enabled device being pre-provisioned with a PIN and a service provider's public key from a web portal, a global key pair used by multiple network-enabled devices belonging to a particular population, a first device identifier that is user-accessible used in a key exchange for delivering the PIN, a second device identifier issued by the service provider and used by the service provider for delivering at least one service to the network-enabled device, the request for identity data including the first and second identifiers, a protected rendition of the PIN, and an encryption key or data from which an encryption key is derivable, the first and second identifiers, the protected rendition of the PIN, and the encryption key or the data from which an encryption key is derivable being signed by a private key in the global key pair;
verifying validity of the PIN included in the request to authenticate the network-enabled device to enable use of the network-enabled device in the network;
generating the identity data for the network-enabled device if the PIN is valid;
encrypting the identity data;
sending the encrypted identity data to the network-enabled device;
wherein the protected rendition of the PIN is a cryptographic hash computed over at least the combination of the PIN and second device identifier; and
wherein the protected rendition of the PIN is encrypted with the service provider's public key.
2. The method of claim 1 further comprising encrypting the identity data with a public key in the global key pair.
3. The method of claim 1 further comprising:
deriving a symmetric key from the data from which an encryption key is derivable as part of a key exchange protocol, when the symmetric key is not provided; and encrypting the identity data with the symmetric key.
4. The method of claim 3 wherein the key exchange protocol is Deffie-Hellman (D-H).
5. The method of claim 1 wherein the PIN is pre-provisioned in the network-enabled device during a registration process between the end user and the service provider.
6. The method of claim 5 wherein the PIN is delivered to the network-enabled device over a secure network connection.
7. The method of claim 6 wherein the PIN is delivered to the service provider by a provisioning system.
8. The method of claim 7 wherein the PIN is encrypted prior to delivery by the public key in the global key pair.
9. The method of claim 5 wherein a hash of the PIN is delivered to the network-enabled device by the service provider.
10. The method of claim 9 wherein the protected rendition of the PIN included in the identity data request includes the hash of the PIN.
11. The method of claim 1 wherein the second device identifier is also pre-provisioned in the network-enabled device during the registration process.
12. A method for providing identity data to a network-enabled device, comprising:
receiving a request for identity data from a network-enabled device that is provided to enable the network-enabled device to be authorized to operate to play videos in a network providing video content, the identity data being deployed to an end-user, the network-enabled device being pre-provisioned with a PIN, a global key pair used by multiple network-enabled devices belonging to a particular population, a first device identifier that is user-accessible used in a key exchange for delivering the PIN, a second device identifier issued by a service provider and used by the service provider for delivering at least one service to the network-enabled device, the request for identity data including the first and second identifiers, a protected rendition of the PIN, and an encryption key or data from which an encryption key is derivable, the first and second identifiers, the protected rendition of the PIN, and the encryption key or the data from which an encryption key is derivable being signed by a private key in the global key pair;
verifying validity of the PIN included in the request to authenticate the network-enabled device;
generating the identity data for the network-enabled device if the PIN is valid;
encrypting the identity data; and
sending the encrypted identity data to the network-enabled device,
wherein the protected rendition of the PIN is a cryptographic hash computed over at least the combination of the PIN and second device identifier; and
wherein verifying validity of the PIN comprises computing the same hash over the PIN and the second device identifier and verifying that the hash value is the same as the hash included is in the request message.