System, apparatus and method for scalable internet of things (IoT) device on-boarding with quarantine capabilities

1. At least one computer readable storage medium comprising instructions that when executed enable a system to:

receive, in a domain controller of a domain managed by the domain controller, a request from a first device to join the domain, the domain controller comprising a first quarantine point at a first layer of a multi-layer communication model;

communicate with a domain name system (DNS) server to determine whether the first device is a first device type, based at least in part on a manufacturer certificate for the first device; and

based on the determination, verify that the first device is authorized to be a member of the domain and communicate the verification to a second server coupled to the domain controller, wherein responsive to an authentication protocol performed between the second server and the first device, the first device is to be removed from a second quarantine point at a second layer of the multi-layer communication model, wherein the second layer is a lower layer of the multi-layer communication model than the first layer, the second quarantine point is more restrictive than the first quarantine point.

2. The at least one computer readable medium of claim 1 , further comprising instructions that when executed enable the domain controller to self-assert a name for the domain and register the domain with the DNS server based at least in part on a group public key, the name independent of an Internet protocol network naming convention.

3. The at least one computer readable medium of claim 2 , further comprising instructions that when executed enable the domain controller to provision a group private key for the first device responsive to removal of the first device from the second quarantine point.

4. The at least one computer readable medium of claim 1 , further comprising instructions that when executed enable the domain controller to register the first device with the DNS server, to indicate that the first device is a member of the domain.

5. The at least one computer readable medium of claim 4 , further comprising instructions that when executed enable the domain controller to, responsive to registration of the first device with the DNS server, remove the first device from the first quarantine point.

6. The at least one computer readable medium of claim 1 , further comprising instructions that when executed enable the domain controller to provide a public key for the domain to a block chain service, the block chain service comprising a ledger for transfer of ownership of one or more devices including the first device to the domain.

7. The at least one computer readable medium of claim 1 , further comprising instructions that when executed enable the domain controller to, by default, hold unknown devices in the first quarantine point at the first layer of the multi-layer communication model.

8. The at least one computer readable medium of claim 7 , wherein unknown devices comprise devices that are not members of the domain managed by the domain controller.

9. The at least one computer readable medium of claim 1 , wherein the instructions, when executed, enable the domain controller to communicate with the DNS server to determine that the first device has the given device type, in response to receiving the request from the first device to join the domain.

10. A domain controller comprising logic which enables the domain controller to:

hold unknown devices in a first quarantine point at a first layer of a multi-layer communication model;

receive, from a device, a request to join a domain managed by the domain controller;

in response to receiving the request to join the domain, communicate with a domain name system (DNS) server to determine that the device has a given device type, based at least in part on a manufacturer certificate for the device;

in response to determining that the device has a given device type, verify that the device is authorized to be a member of the domain and communicate the verification to a second server, to cause the second server to complete an authentication protocol with the device and, in response to completion of the authentication protocol, remove the device from a second quarantine point at a second layer of the multi-layer communication model, wherein the second layer is a lower layer of the multi-layer communication model than the first layer, and the second quarantine point is more restrictive than the first quarantine point.

11. The domain controller of claim 10 , further comprising logic which enables the domain controller to self-assert a name for the domain and register the domain with the DNS server based at least in part on a group public key, wherein the name is independent of an Internet protocol network naming convention.

12. The domain controller of claim 10 , further comprising logic which enables the domain controller to provision a group private key for the device, responsive to removal of the device from the second quarantine point.

13. The domain controller of claim 10 , further comprising logic which enables the domain controller to register the device with the DNS server, to indicate that the device is a member of the domain.

14. The domain controller of claim 13 , further comprising logic which enables the domain controller to remove the device from the first quarantine point, responsive to registration of the device with the DNS server as member of the domain.

15. The domain controller of claim 10 , further comprising logic which enables the domain controller to provide a public key for the domain to a block chain service, wherein the block chain service comprises a ledger for transfer of ownership of devices to the domain.

16. The domain controller of claim 10 , wherein unknown devices comprise devices that are not members of the domain managed by the domain controller.

17. The domain controller of claim 10 , further comprising logic which enables the domain controller to:

verify credentials of the device; and

responsive to verification of the credentials, remove the device from the first quarantine point.

18. A method for managing a domain, the method comprising:

at a domain controller that manages a domain that uses a multi-layer communication model, holding devices that are not members of the domain in a first quarantine point at a first layer of the multi-layer communication model;

at the domain controller, receiving, from a device, a request to join the domain;

in response to receiving the request to join the domain, communicating with a domain name system (DNS) server to determine that the device has a given device type, based at least in part on a manufacturer certificate for the device;

in response to determining that the device has a given device type, verifying that the device is authorized to be a member of the domain and communicating the verification to a second server, to cause the second server to complete an authentication protocol with the device and, in response to completion of the authentication protocol, remove the device from a second quarantine point at a second layer of the multi-layer communication model, wherein the second layer is a lower layer of the multi-layer communication model than the first layer, and the second quarantine point is more restrictive than the first quarantine point.

19. A method according to claim 18 , further comprising:

registering the device with the DNS server, to indicate that the device is a member of the domain; and

after registering the device with the DNS server as member of the domain, removing the device from the first quarantine point.

20. A method according to claim 18 , further comprising:

providing a public key for the domain to a block chain service, wherein the block chain service comprises a ledger for transfer of ownership of devices to the domain.