Vehicle integration platform (VIP) security integration
Systems and methods are directed to improvements for secure communications between client systems and a vehicle integration platform associated with a service provider entity. In one example, a communication infrastructure is provided which includes a vehicle integration platform that includes a plurality of application programming interfaces configured to facilitate communication among clients. The communication infrastructure includes a security integration system which is configured to receive and validate a client certificate forwarded to the vehicle integration platform from a client and determine an identity of the client and an origin of a request associated with the client certificate. The security integration system is configured to generate a certificate signing request associated with the client certificate based in part on the identity of the client and obtain an operational certificate for the client based in part on the certificate signing request to establish ability for client authentication within the vehicle integration platform.
1. A communication infrastructure, comprising:
a vehicle integration platform comprising a plurality of application programming interfaces configured to facilitate message communication among clients; and
a security integration system configured to:
receive and validate a client certificate forwarded to the vehicle integration platform from a client;
determine an identity of the client and an origin of a request associated with the client certificate;
generate a certificate signing request associated with the client certificate based in part on the identity of the client; and
obtain an operational certificate for the client based in part on the certificate signing request to establish an ability for client authentication within the vehicle integration platform.
2. The communication infrastructure of claim 1 , wherein the security integration system is further configured to determine a client-specific security configuration for use in generating the certificate signing request.
3. The communication infrastructure of claim 2 , wherein the security integration system is further configured to:
determine that the client does not support message signing based on the client-specific security configuration;
obtain a stub device certificate for the client from a secure storage system associated with the vehicle integration platform; and
provide for generating the certificate signing request based on the stub device certificate.
4. The communication infrastructure of claim 3 , wherein the stub device certificate is generated for the client during provisioning of the client within the vehicle integration platform.
5. The communication infrastructure of claim 1 , wherein the security integration system is further configured to provide for signing messages between the client and the vehicle integration platform based on the operational certificate.
6. The communication infrastructure of claim 1 , wherein the security integration system is part of the vehicle integration platform.
7. The communication infrastructure of claim 1 , wherein the client comprises at least one of a plurality of autonomous vehicles respectively associated with one or more vendors and one or more system clients associated with an entity.
8. The communication infrastructure of claim 1 , wherein the vehicle integration platform further comprises a licensing service system, the licensing service system configured to generate and provide operational certificates associated with the client.
9. The communication infrastructure of claim 8 , wherein the vehicle integration platform further comprises a licensing service proxy system, the licensing service proxy system configured to receive and relay messages to the licensing service system for the clients, wherein the licensing service proxy system is located downstream of the security integration system.
10. The communication infrastructure of claim 9 , wherein the licensing service proxy system is configured to receive and relay messages comprising simple certificate enrollment protocol messages.
11. The communication infrastructure of claim 1 , wherein the operational certificate is established to provide client authentication with the vehicle integration platform for a predetermined time period.
12. A computer-implemented method for facilitating secure communications between a client and a vehicle integration platform, the method comprising:
receiving, by a computing system comprising one or more computing devices, a client certificate forwarded to the vehicle integration platform by the client;
validating, by the computing system, the client certificate;
determining, by the computing system, an identity of the client and an origin of a request associated with the client certificate;
generating, by the computing system, a certificate signing request associated with the client certificate based in part on the identity of the client; and
obtaining, by the computing system, an operational certificate for the client based in part on the certificate signing request to establish an ability for client authentication within the vehicle integration platform.
13. The computer-implemented method of claim 12 , wherein the method further comprises determining, by the computing system, a client-specific security configuration for use in generating the certificate signing request.
14. The computer-implemented method of claim 13 , wherein the method further comprises:
determining, by the computing system, that the client does not support message signing based on the client-specific security configuration;
obtaining, by the computing system, a stub device certificate for the client from a secure storage system associated with the vehicle integration platform; and
generating, by the computing system, the certificate signing request based on the stub device certificate.
15. The computer-implemented method of claim 12 , wherein the method further comprises providing, by the computing system, for signing messages between the vehicle integration platform and the client based on the operational certificate.
16. The computer-implemented method of claim 12 , wherein the client comprises at least one of a plurality of autonomous vehicles respectively associated with one or more vendors and one or more system clients associated with an entity.
17. The computer-implemented method of claim 12 , wherein:
the method further comprises, generating, by the computing system, the operational certificate for the client in association with a licensing service system;
the licensing service system is comprised within the vehicle integration platform; and
the licensing service system comprises a licensing service proxy system configured to receive and relay messages to the licensing service system for the client as part of generating the operational certificate.
18. A computing system, comprising: one or more processors; and one or more memories including instructions that, when executed by the one or more processors, cause the one or more processors to perform operations, the operations comprising: receiving a client certificate forwarded to a vehicle integration platform by a client; validating the client certificate: determining an identity of the client and an origin of a request associated with the client certificate; generating a certificate signing request associated with the client certificate based in part on the identity of the client; obtaining an operational certificate for the client based in part on the certificate signing request to establish an ability for client authentication within the vehicle integration platform; and signing messages from the client based on the operational certificate.
19. The computing system of claim 18 , the operations further comprising:
determining a client-specific security configuration for use in generating the certificate signing request; and
determining, based on the client-specific security configuration, whether a system associated with the client supports message signing.
20. The computing system of claim 19 , the operations further comprising:
determining that the client does not support message signing based on the client-specific security configuration;
obtaining a stub device certificate for the client from a secure storage system associated with the vehicle integration platform; and
generating the certificate signing request based on the stub device certificate.
21. A system, comprising:
a plurality of clients operated by one or more entities;
a gateway system configured to receive a message from one of the plurality of clients and forward the message to a security integration system, the gateway system further configured as a transport layer security end point for communications between the plurality of clients and a service provider infrastructure;
a vehicle integration platform comprising a plurality of application programming interfaces configured to facilitate message communication among the plurality of clients;
a secure storage system configured to store one or more stub device certificates, a stub device certificate being associated with one of the plurality of clients;
a licensing service system configured to generate an operational certificate for one of the plurality of clients based on a certificate signing request; and
a security integration system comprising one or more middleware layers implemented between the gateway system and the vehicle integration platform, the security integration system configured to:
obtain the received message from the gateway system, the received message comprising a client certificate associated with the one of the plurality of clients;
validate the client certificate;
determine an identity of the client and an origin of the message associated with the client certificate;
obtain a stub device certificate from the secure storage system based in part on the identity of the client;
generate a certificate signing request associated with the client based at least in part on the received stub device certificate associated with the client;
provide the certificate signing request associated with the client to the licensing service system;
obtain an operational certificate associated the client from the licensing service system in response to the certificate signing request, the operational certificate establishing an ability for client authentication within the vehicle integration platform; and
sign the message from the client based on the operational certificate prior to forwarding the signed message to a public platform system of the vehicle integration platform.
22. The system of claim 21 , wherein the security integration system comprises at least one middleware layer for each of the plurality of clients.