Systems, methods, and devices for provisioning and processing geolocation information for computerized devices

1. A method, implemented by an enhanced security credential management system (SCMS) host, for securely provisioning a device comprising an on-board unit device or a roadside unit (RSU) device that includes an enrollment certificate and one or more application certificates, wherein the device is geographically restricted according to both the enrollment certificate and the one or more application certificates, the method comprising:

providing the enrollment certificate to the device, wherein the enrollment certificate specifies a geo-region for the device;

receiving a request for a batch of application certificates for the device;

generating local policy data for the batch of application certificates, the local policy data indicating tenant-specific data corresponding to the device, the tenant-specific data comprising application permissions, a duration of validity of the application certificates, and an overlap time period for the application certificates;

determining, in response to the request, an operating geolocation for the device;

verifying that the operating geolocation is within the geo-region;

generating the batch of application certificates based on the local policy data, wherein the batch of application certificates comprises a first application certificate and a second application certificate, wherein the first application certificate corresponds to the operating geolocation for a first period of time and the second application certificate corresponds to a subsequent geolocation for a second period of time; and

providing, in response to the request, the batch of application certificates and the local policy data to the device, whereby the device is geographically restricted according to the operating geolocation and the subsequent geolocation of the batch of application certificates.

2. The method according to claim 1 , wherein

the request includes the operating geolocation for the device; and

wherein determining, in response to the request, an operating geolocation for the device comprises obtaining the operating geolocation from the request.

3. The method according to claim 2 , wherein the request is received from the device.

4. The method according to claim 3 , whereby the device is configured with the operating geolocation, and the device includes the operating geolocation in the request.

5. The method according to claim 1 , further comprising:

prior to receiving the request for the batch of application certificates, receiving a request to store the operating geolocation for the device, wherein the request includes the operating geolocation for the device; and

storing, in response to the request, the operating geolocation for the device; and

wherein determining, in response to the request, an operating geolocation for the device comprises obtaining the operating geolocation that was stored.

6. The method according to claim 5 , wherein the request to store the operating geolocation is received from a user of the device.

7. The method according to claim 1 , wherein the geo-region is a country or a state.

8. A non-transitory computer readable media containing instructions that, when executed by one or more processors, perform a method for securely provisioning a device comprising an on-board unit device or a roadside unit (RSU) device that includes an enrollment certificate and one or more application certificates, wherein the device is geographically restricted according to the one or more application certificates, the method comprising:

providing the enrollment certificate to the device, wherein the enrollment certificate specifies a geo-region for the device;

receiving a request for a batch of application certificates for the device;

generating local policy data for the batch of application certificates, the local policy data indicating tenant-specific data corresponding to the device, the tenant-specific data comprising application permissions, a duration of validity of the application certificates, and an overlap time period for the application certificates;

determining, in response to the request, an operating geolocation for the device;

verifying that the operating geolocation is within the geo-region;

generating the batch of application certificates based on the local policy data, wherein the batch of application certificates comprises a first application certificate and a second application certificate, wherein the first application certificate corresponds to the operating geolocation for a first period of time and the second application certificate corresponds to a subsequent geolocation for a second period of time; and

providing, in response to the request, the batch of application certificates and the local policy data to the device, whereby the device is geographically restricted according to the operating geolocation and the subsequent geolocation of the batch of application certificates.

9. The non-transitory computer readable media according to claim 8 , wherein the request includes the operating geolocation for the device; and

wherein determining, in response to the request, an operating geolocation for the device comprises obtaining the operating geolocation from the request.

10. The non-transitory computer readable media according to claim 9 , wherein the request is received from the device.

11. The non-transitory computer readable media according to claim 10 , whereby the device is configured with the operating geolocation, and the device includes the operating geolocation in the request.

12. The non-transitory computer readable media according to claim 8 , wherein the method further comprises:

prior to receiving the request for the batch of application certificates, receiving a request to store the operating geolocation for the device, wherein the request includes the operating geolocation for the device; and

storing, in response to the request, the operating geolocation for the device; and

wherein determining, in response to the request, an operating geolocation for the device comprises obtaining the operating geolocation that was stored.

13. The non-transitory computer readable media according to claim 12 , wherein the request to store the operating geolocation is received from a user of the device.

14. The non-transitory computer readable media according to claim 8 , wherein the geo-region is a country or a state.

15. A system for securely provisioning a device comprising an on-board unit device or a roadside unit (RSU) device that includes an enrollment certificate and one or more application certificates, wherein the device is geographically restricted according to the one or more application certificates, the system comprising:

one or more memories containing instructions;

one or more processors, operatively coupled to the one or more memories, that execute the instructions to perform operations comprising:

providing the enrollment certificate to the device, wherein the enrollment certificate specifies a geo-region for the device;

receiving a request for a batch of application certificates for the device;

generating local policy data for the batch of application certificates, the local policy data indicating tenant-specific data corresponding to the device, the tenant-specific data comprising application permissions, a duration of validity of the application certificates, and an overlap time period for the application certificates;

determining, in response to the request, an operating geolocation for the device;

verifying that the operating geolocation is within the geo-region;

generating the batch of application certificates based on the local policy data, wherein the batch of application certificates comprises a first application certificate and a second application certificate, wherein the first application certificate corresponds to the operating geolocation for a first period of time and the second application certificate corresponds to a subsequent geolocation for a second period of time; and

providing, in response to the request, the batch of application certificates and the local policy data to the device, whereby the device is geographically restricted according to the operating geolocation and the subsequent geolocation of the batch of application certificates.

16. The system according to claim 15 , wherein

the request includes the operating geolocation for the device; and

wherein determining, in response to the request, an operating geolocation for the device comprises obtaining the operating geolocation from the request.

17. The system according to claim 16 , wherein the request is received from the device.

18. The system according to claim 17 , whereby the device is configured with the operating geolocation, and the device includes the operating geolocation in the request.

19. The system according to claim 15 , wherein the operations further comprise:

prior to receiving the request for the batch of application certificates, receiving a request to store the operating geolocation for the RSU device, wherein the request includes the operating geolocation for the device; and

storing, in response to the request, the operating geolocation for the device; and

wherein determining, in response to the request, an operating geolocation for the device comprises obtaining the operating geolocation that was stored.

20. The system according to claim 19 , wherein the request to store the operating geolocation is received from a user of the device.

21. The method of claim 1 , wherein the batch of application certificates comprises two or more application certificates.

22. A system for securely provisioning a device comprising an on-board unit device or a roadside unit (RSU) device that includes an enrollment certificate and an application certificate, wherein the device is geographically restricted according to the application certificate, the system comprising:

one or more memories containing instructions;

one or more processors, operatively coupled to the one or more memories, that execute the instructions to perform operations comprising:

providing the enrollment certificate to the device, wherein the enrollment certificate specifies a geo-region for the device;

receiving a request for the application certificate for the device;

generating local policy data for the application certificate, the local policy data indicating tenant-specific data corresponding to the device, the tenant-specific data comprising application permissions, a duration of validity of the application certificate, and an overlap time period for the application certificate with a second application certificate;

determining, in response to the request, a present operating geolocation for the device;

verifying that the present operating geolocation is within the geo-region;

generating the application certificate based on the local policy data, wherein the application certificate comprises a first operating geolocation area and a second operating geolocation area, wherein the first operating geolocation area corresponds to the present operating geolocation for a first period of time and the second operating geolocation area corresponds to a subsequent geolocation area for a second period of time; and

providing, in response to the request, the application certificate and the local policy data to the device, whereby the device is geographically restricted according to the first operating geolocation area for the first period of time and the second operating geolocation area for the second period of time.

23. The system of claim 15 , wherein the one or more processors, operatively coupled to the one or more memories, execute the instructions to perform operations further comprising:

modifying, after the device is deployed, the local policy data to change the number of application certificates issued in the batch of application certificates during the first period of time or the second period of time; and

transmitting the modified local policy data to the device.