Decentralized enrollment and revocation of devices

1. A computer-implemented method comprising:

receiving, at a first server, a plurality of certificates and a device inventory list and storing the plurality of certificates and the device inventory list in a blockchain;

receiving, at a second server associated with the blockchain, a validation request from a device and validating the device to determine that the device is not compromised;

in response to validating the device, receiving, at the second server, a certificate request from the device and verifying the certificate request against the device inventory list stored in the blockchain; and

in response to verifying the certificate request, enrolling the device by sending a certificate from the plurality of certificates stored in the blockchain to the device.

2. The method of claim 1 , further comprising:

in response to receiving, at the first server, the plurality of certificates and the device inventory list, storing the plurality of certificates and the device inventory list in a first database associated with the first server; and

replicating the plurality of certificates and the device inventory list stored in the first database into a second database associated with the second server using the blockchain.

3. The method of claim 1 , further comprising:

in response to receiving, at the first server, the plurality of certificates, converting the plurality of certificates from a first format to a second format; and

wherein storing the plurality of certificates in the blockchain comprises storing the plurality of certificates in the second format.

4. The method of claim 1 , further comprising:

receiving, at the first server, a revocation list based on the device inventory list and storing the revocation list in the blockchain.

5. The method of claim 1 , further comprising:

in response to receiving the certificate request from the device, proxying the certificate request from a first transport to a second transport.

6. The method of claim 1 , further comprising:

in response to verifying the certificate request, generating an audit log associated with the device.

7. The method of claim 1 , wherein validating the device comprises validating against the device inventory list stored in the blockchain.

8. The method of claim 1 , wherein receiving, at the first server, the plurality of certificates comprises receiving the plurality of certificates from a certificate authority.

9. One or more non-transitory computer-readable storage media storing one or more sequences of program instructions which, when executed by one or more computing devices, cause performing:

receiving, at a first server, a plurality of certificates and a device inventory list and storing the plurality of certificates and the device inventory list in a blockchain;

receiving, at a second server associated with the blockchain, a validation request from a device and validating the device to determine that the device is not compromised;

in response to validating the device, receiving, at the second server, a certificate request from the device and verifying the certificate request against the device inventory list stored in the blockchain; and

in response to verifying the certificate request, enrolling the device by sending a certificate from the plurality of certificates stored in the blockchain to the device.

10. The one or more non-transitory computer-readable media of claim 9 , further comprising instructions that, when executed by the one or more computing devices, cause:

in response to receiving, at the first server, the plurality of certificates and the device inventory list, storing the plurality of certificates and the device inventory list in a first database associated with the first server; and

replicating the plurality of certificates and the device inventory list stored in the first database into a second database associated with the second server using the blockchain.

11. The one or more non-transitory computer-readable media of claim 10 , further comprising instructions that, when executed by the one or more computing devices, cause:

in response to receiving, at the first server, the plurality of certificates, converting the plurality of certificates from a first format to a second format; and

wherein storing the plurality of certificates in the blockchain comprises storing the plurality of certificates in the second format.

12. The one or more non-transitory computer-readable media of claim 11 , further comprising instructions that, when executed by the one or more computing devices, cause:

receiving, at the first server, a revocation list based on the device inventory list and storing the revocation list in the first database; and

replicating the revocation list stored in the first database into the second database associated with the second server using the blockchain.

13. The one or more non-transitory computer-readable media of claim 12 , further comprising instructions that, when executed by the one or more computing devices, cause:

in response to receiving the certificate request from the device, proxying the certificate request from a first transport to a second transport.

14. The one or more non-transitory computer-readable media of claim 13 , further comprising instructions that, when executed by the one or more computing devices, cause:

in response to verifying the certificate request, generating an audit log associated with the device.

15. The one or more non-transitory computer-readable media of claim 14 , wherein validating the device comprises validating against the device inventory list stored in the blockchain.

16. The one or more non-transitory computer-readable media of claim 15 , wherein receiving, at the first server, the plurality of certificates comprises receiving the plurality of certificates from a certificate authority.

17. A computer system comprising:

one or more processors;

a computer-readable storage media coupled to the one or more processors;

a memory coupled to the computer-readable storage media and storing instructions which, when executed, cause the one or more processors to:

receive, at a first server, a plurality of certificates and a device inventory list and storing the plurality of certificates and the device inventory list in a blockchain;

receive, at a second server associated with the blockchain, a validation request from a device and validating the device to determine that the device is not compromised;

in response to validating the device, receive, at the second server, a certificate request from the device and verify the certificate request against the device inventory list stored in the blockchain; and

in response to verifying the certificate request, enroll the device by sending a certificate from the plurality of certificates stored in the blockchain to the device.

18. The computer system of claim 17 , wherein the memory stores further instructions which, when executed, cause the one or more processors to:

in response to receiving, at the first server, the plurality of certificates and the device inventory list, store the plurality of certificates and the device inventory list in a first database associated with the first server; and

replicate the plurality of certificates and the device inventory list stored in the first database into a second database associated with the second server using the blockchain.

19. The computer system of claim 18 , wherein the memory stores further instructions which, when executed, cause the one or more processors to:

in response to receiving, at the first server, the plurality of certificates, convert the plurality of certificates from an X.509 format to a PKCS7 format; and

wherein to store the plurality of certificates in the first database comprises storing the plurality of certificates in the PKCS7 format.

20. The computer system of claim 18 , wherein the memory stores further instructions which, when executed, cause the one or more processors to:

receive, at the first server, a revocation list based on the device inventory list and store the revocation list in the first database; and

replicate the revocation list stored in the first database into the second database associated with the second server using the blockchain.

21. The computer system of claim 18 , wherein the memory stores further instructions which, when executed, cause the one or more processors to:

in response to verifying the certificate request, generate an audit log associated with the device.

22. The computer system of claim 18 , wherein the memory stores further instructions which, when executed, cause the one or more processors to:

in response to receiving the certificate request from the device, proxy the certificate request from a first transport to a second transport.

23. The computer system of claim 22 , wherein the first transport of the certificate request is a Constrained Application Protocol (CoAP), and wherein the second transport of the certificate request is a Hypertext Transfer Protocol (HTTP).