Cryptographically identifying a device

1. A method for cryptographically identifying a device to a cloud service, the method comprising:

providing, to the cloud service, a token and a signature of the token, the token being embedded in the device, the token including a serial number and an identifier of a public key, wherein the cloud service verifies the token by decrypting the signature of the token with a public key retrieved using the identifier, determines a user based on the serial number, identifies a tenant of a multi-tenant cloud based on the user, and sends a request to enroll the device in the identified tenant, wherein the signature of the token is generated at the time of manufacture by encrypting the token using a private key component of a public key/private key pair, wherein the public key retrieved using the identifier is a public key component of the public key/private key pair;

receiving, from the cloud service, provisioning information customized for the user and including a client certificate for communicating with the cloud service.

2. The method of claim 1 wherein the token is valid for at least five years.

3. The method of claim 1 wherein the client certificate is a public key certificate.

4. The method of claim 1 wherein the multi-tenant cloud comprises computing resources shared by a plurality of tenants and data of each tenant of the plurality of tenants is isolated from other tenants of the plurality of tenants.

5. A system comprising:

a processor;

a read-only memory (ROM) communicatively coupled to the processor, the ROM storing a token and a signature of the token, the token including a serial number and an identifier of a public key; and

a memory communicatively coupled to the processor, the memory storing instructions executable by the processor to:

read the token from the ROM;

provide the token to a cloud service, wherein the cloud service verifies the token by decrypting the signature of the token with a public key retrieved using the identifier, determines a user based on the serial number, identifies a tenant of a multi-tenant cloud based on the user, and sends a request to enroll the device in the identified tenant, wherein the signature of the token is generated at the time of manufacture by encrypting the token using a private key component of a public key/private key pair, wherein the public key retrieved using the identifier is a public key component of the public key/private key pair; and

receive, from the cloud service, provisioning information, the provisioning information being customized for the user and including a client certificate for communicating with the cloud service.

6. The system of claim 5 wherein the token includes expiration information.

7. The system of claim 5 wherein the token is a JavaScript Object Notation (JSON) Web Token (JWT).

8. The system of claim 5 wherein the ROM is at least one of an electrically erasable programmable read-only memory and a flash memory.

9. The system of claim 5 wherein the provisioning information further includes an application selected by the user for installation on the system.

10. The system of claim 5 wherein the multi-tenant cloud comprises computing resources shared by a plurality of tenants and data of each tenant of the plurality of tenants is isolated from other tenants of the plurality of tenants.

11. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for cryptographically identifying a device to a cloud service, the method comprising:

providing, to a cloud service using an encrypted channel, a token and a signature of the token, the token being embedded in the device, the token including a serial number and an identifier of a public key, wherein the cloud service verifies the token by decrypting the signature of the token with a public key retrieved using the identifier, determines a user based on the serial number, identifies a tenant of a multi-tenant cloud based on the user, and sends a request to enroll the device in the identified tenant, wherein the signature of the token is generated at the time of manufacture by encrypting the token using a private key component of a public key/private key pair, wherein the public key retrieved using the identifier is a public key component of the public key/private key pair; and

receiving, from the cloud service responsive to the providing, provisioning information, the provisioning information being customized for the user and including a client certificate for secure communications with the cloud service.

12. The non-transitory computer-readable storage medium of claim 11 wherein the token includes human-readable text.

13. The non-transitory computer-readable storage medium of claim 11 wherein the token includes a date and time at which the cryptographically signed token becomes valid.

14. The non-transitory computer-readable storage medium of claim 11 wherein the user is determined based on the serial number in a sales system.

15. The non-transitory computer-readable storage medium of claim 11 wherein the provisioning information includes a software update for the device, the software update being at least one of a software distribution and a software version selected by the customer.

16. The non-transitory computer-readable storage medium of claim 11 wherein the encrypted channel uses Hypertext Transfer Protocol Secure (HTTPS).

17. The non-transitory computer-readable storage medium of claim 11 wherein the client certificate is an x509 public key certificate.

18. The non-transitory computer-readable storage medium of claim 11 wherein the multi-tenant cloud comprises computing resources shared by a plurality of tenants and data of each tenant of the plurality of tenants is isolated from other tenants of the plurality of tenants.