Device provisioning using a supplemental cryptographic identity

1. A method of provisioning a network-connected device to access one or more service systems using a supplemental cryptographic identity of the network-connected device, the method comprising:

storing, in a device provisioning service, an initial enrollment record associated with an initial cryptographic identity and a supplemental enrollment record;

receiving an identity issuance request from the network-connected device at the device provisioning service, the identity issuance request including the initial cryptographic identity;

requesting, based on the identity issuance request, the supplemental cryptographic identity from a supplemental cryptographic identity issuer identified in the initial enrollment record;

receiving the requested supplemental cryptographic identity at the device provisioning service from the supplemental cryptographic identity issuer;

provisioning the network-connected device to access the one or more service systems according to the supplemental enrollment record; and

communicating the supplemental cryptographic identity to the network-connected device.

2. The method of claim 1 , wherein the initial enrollment record identifies the supplemental cryptographic identity issuer, and further comprising:

determining the supplemental cryptographic identity issuer from the initial enrollment record before requesting the supplemental cryptographic identity from the supplemental cryptographic identity issuer.

3. The method of claim 1 further comprising:

associating the supplemental enrollment record with the supplemental cryptographic identity issuer at the device provisioning service, responsive to receiving the received supplemental cryptographic identity.

4. The method of claim 1 further comprising:

cryptographically challenging the network-connected device to prove the initial cryptographic identity included in the identity issuance request; and

determining, using the initial enrollment record, that the network-connected device has successfully proven the initial cryptographic identity, responsive to the cryptographic challenging and before requesting the supplemental cryptographic identity.

5. The method of claim 1 further comprising:

determining that the identity issuance request was validly signed by the network-connected device, before requesting the supplemental cryptographic identity.

6. The method of claim 1 , wherein the identity issuance request includes an identifier of the device provisioning service.

7. The method of claim 1 , wherein the provisioning comprises:

registering the network-connected device with the one or more service systems based on the supplemental cryptographic identity.

8. A device provisioning system for provisioning a network-connected device to access one or more service systems using a supplemental cryptographic identity of the network-connected device, the device provisioning system comprising:

one or more hardware processors;

one or more tangible data storage media configured to store an initial enrollment record associated with an initial cryptographic identity and a supplemental enrollment record;

a device communications interface configured for communications with the network-connected device;

a registration interface configured for communication with the one or more service systems;

an identity provider interface configured to communicate with one or more supplemental cryptographic identity issuers;

an identity processor subsystem executed by the one or more hardware processors and coupled to the device communications interface to receive an identity issuance request from the network-connected device at the device provisioning system, the identity issuance request including the initial cryptographic identity, the identity processor subsystem being further coupled to the identity provider interface to request, based on the identity issuance request, the supplemental cryptographic identity from the supplemental cryptographic identity issuer identified in the initial enrollment record, to receive the requested supplemental cryptographic identity at the device provisioning system from the supplemental cryptographic identity issuer, and to communicate the supplemental cryptographic identity through the device communications interface to the network-connected device; and

a provisioning subsystem executed by the one or more hardware processors and coupled to the one or more tangible data storage media and the registration interface to provision the network-connected device to access the one or more service systems according to the supplemental enrollment record.

9. The device provisioning system of claim 8 wherein the initial enrollment record identifies the supplemental cryptographic identity issuer, and the identity processor subsystem is configured to determine the supplemental cryptographic identity issuer from the initial enrollment record before requesting the supplemental cryptographic identity from the supplemental cryptographic identity issuer.

10. The device provisioning system of claim 8 wherein the provisioning subsystem is configured to associate the supplemental enrollment record with the supplemental cryptographic identity issuer at the device provisioning system, responsive to receipt of the supplemental cryptographic identity by the identity processor subsystem.

11. The device provisioning system of claim 8 wherein the identity processor subsystem is configured to cryptographically challenge the network-connected device to prove the initial cryptographic identity included in the identity issuance request and determining, using the initial enrollment record, that the network-connected device has successfully proven the initial cryptographic identity, responsive to the cryptographic challenge and before requesting the supplemental cryptographic identity.

12. The device provisioning system of claim 8 wherein the identity processor subsystem is configured to determine that the identity issuance request was validly signed by the network-connected device, before requesting the supplemental cryptographic identity.

13. The device provisioning system of claim 8 , wherein the identity issuance request includes an identifier of the device provisioning system.

14. The device provisioning system of claim 8 wherein the provisioning subsystem is further configured to register the network-connected device with the one or more service systems based on the supplemental cryptographic identity.

15. One or more tangible processor-readable storage media of a tangible article of manufacture encoding processor-executable instructions for executing on an electronic computing device a process of provisioning a network-connected device to access one or more service systems using a supplemental cryptographic identity of the network-connected device, the process comprising:

storing, in a device provisioning service, an initial enrollment record associated with an initial cryptographic identity and a supplemental enrollment record;

receiving an identity issuance request from the network-connected device at the device provisioning service, the identity issuance request including the initial cryptographic identity;

requesting, based on the identity issuance request, the supplemental cryptographic identity from a supplemental cryptographic identity issuer identified in the initial enrollment record;

receiving the requested supplemental cryptographic identity at the device provisioning service from the supplemental cryptographic identity issuer;

provisioning the network-connected device to access the one or more service systems according to the supplemental enrollment record; and

communicating the supplemental cryptographic identity to the network-connected device.

16. The one or more tangible processor-readable storage media of claim 15 wherein the initial enrollment record identifies the supplemental cryptographic identity issuer, and the process further comprises:

determining the supplemental cryptographic identity issuer from the initial enrollment record before requesting the supplemental cryptographic identity from the supplemental cryptographic identity issuer.

17. The one or more tangible processor-readable storage media of claim 15 wherein the process further comprises:

associating the supplemental enrollment record with the supplemental cryptographic identity issuer at the device provisioning service, responsive to receiving the received supplemental cryptographic identity.

18. The one or more tangible processor-readable storage media of claim 15 wherein the process further comprises:

cryptographically challenging the network-connected device to prove the initial cryptographic identity included in the identity issuance request; and

determining, using the initial enrollment record, that the network-connected device has successfully proven the initial cryptographic identity, responsive to the cryptographic challenging and before requesting the supplemental cryptographic identity.

19. The one or more tangible processor-readable storage media of claim 15 wherein the process further comprises:

determining that the identity issuance request was validly signed by the network-connected device, before requesting the supplemental cryptographic identity.

20. The one or more tangible processor-readable storage media of claim 15 wherein the provisioning comprises:

registering the network-connected device with the one or more service systems based on the supplemental cryptographic identity.