Onboarding software on secure devices to generate device identities for authentication with remote servers
Systems, methods and apparatuses to configure a computing device for identification and authentication are described. For example, a key management server (KMS) has a certificate generator and is coupled to a registration portal. A copy of secret implemented into a secure component during its manufacture in a factory is stored in the KMS. After leaving the factory, the component can be assembled into the device. The portal receives registration of the component and a hash of software of the device. The certificate generator generates, independent of the device, public keys of the device, using the copy of the secret stored in the KMS and hashes of the software received via the registration portal, and then sign a digital certificate of the public key of the device. Authentication of the device can then be performed via the private key of the device and the certified public key.
1. A system, comprising:
a key management server having a certificate generator; and
a registration portal coupled to the key management server;
wherein the key management server is configured to receive and store first information implemented into a component during manufacturing of the component;
wherein the component is configured to be assembled into a computing device having software;
wherein the registration portal is configured to receive registration information of the component being used with the software and to receive second information about the software;
wherein the computing device is configured to generate an asymmetrical key pair from the first information and the second information, the asymmetrical key pair including a public key of the computing device and a private key of the computing device; and
wherein the certificate generator is configured to generate, independent of the computing device, the asymmetrical key pair from the first information stored in the key management server and the second information received via the registration portal, and is configured to sign a digital certificate of the public key generated by the certificate generator.
2. The system of claim 1 , wherein the registration portal is configured to receive, from a remote server, the second information about the software and provide the certificate of the public key to the remote server.
3. The system of claim 2 , wherein the remote server is configured with a provisioning tool, the provisioning tool configured to generate the second information about the software.
4. The system of claim 3 , wherein the provisioning tool is configured to install the software in the computing device.
5. The system of claim 3 , wherein the provisioning tool is configured to transmit the second information about the software to the registration portal.
6. The system of claim 3 , wherein the provisioning tool is configured to activate a feature in the component in accordance with the registration information.
7. The system of claim 6 , wherein after the feature in the component is activated, the computing device is capable of authenticating with the remote server using the private key of the computing device.
8. The system of claim 6 , wherein after the feature in the component is activated, the computing device is capable of computing the asymmetrical key pair.
9. The system of claim 8 , wherein the computing device is configured to generate the asymmetrical key pair in accordance with a standard.
10. The system of claim 8 , wherein the first information is unique to the component among components manufacturing in a factory.
11. The system of claim 10 , wherein the component includes a memory device.
12. A method, comprising:
receiving and storing, in a key management server, first information implemented in a component during manufacturing of the component, wherein the component is configured to be assembled into a computing device having software;
receiving, in a registration portal coupled to the key management server, registration information of the component being used with the software;
receiving, in the registration portal, second information about the software, wherein the computing device is configured to generate an asymmetrical key pair from the first information and the second information, the asymmetrical key pair including a public key of the computing device and a private key of the computing device;
generating, in the key management server and independent of the computing device, the asymmetrical key pair from the first information stored in the key management server and the second information received via the registration portal; and
signing, by the key management server, a digital certificate of the public key to indicate association of the private key of the computing device and the computing device.
13. The method of claim 12 , further comprising:
providing, by the registration portal, the certificate of the public key to a remote server that provides the second information about the software.
14. The method of claim 13 , further comprising:
configuring a provisioning tool in the remote server, the provisioning tool configured to generate the second information about the software, install the software in the computing device, and transmit the second information about the software to the registration portal.
15. The method of claim 14 , further comprising:
activating, by the provisioning tool, a feature in the component in accordance with the registration information.
16. The method of claim 15 , wherein activation of the feature in the component enables the computing device to authenticate with the remote server using the private key of the computing device.
17. The method of claim 15 , wherein activation of the feature in the computing device enables the computing device to compute the asymmetrical key pair.
18. The method of claim 17 , wherein the computing device is configured to generate the asymmetrical key pair in accordance with a standard.
19. The method of claim 18 , wherein the first information is unique to the component among components manufacturing in a factory; and the component includes a flash memory device.
20. A non-transitory computer storage medium storing instructions which, when executed in a computer system, cause the computer system to perform a method, the method comprising:
receiving and storing, in a key management server, first information implemented in a component during manufacturing of the component, wherein the component is configured to be assembled into a computing device having software;
receiving, in a registration portal coupled to the key management server, registration information of the component being used with the software;
receiving, in the registration portal, second information about the software, wherein the computing device is configured to generate an asymmetrical key pair from the first information and the second information, the asymmetrical key pair including a public key of the computing device and a private key of the computing device;
generating, in the key management server and independent of the computing device, the asymmetrical key pair from the first information stored in the key management server and the second information received via the registration portal; and
signing, by the key management server, a digital certificate of the public key to indicate association of the private key of the computing device and the computing device.