Token-based zero-touch enrollment for provisioning edge computing applications
Approaches in accordance with various embodiments allow for zero-touch enrollment of devices with respective manager systems. In at least one embodiment, a device at startup can contact a central directory service (CDS) for information about an associated manager. The CDS can authenticate the device using device information included in the request, and can send a challenge token to the device in response. The challenge token can include information for the manager, protected with multiple layers of security that should only be able to be decrypted by the authenticated device. The device can decrypt this challenge token to determine the manager information, and can convert this challenge token to a bearer token. The device can then send a request to the determined manager that includes the bearer token, which the manager can use to authenticate the device. The manager can then send the device appropriate configuration information.
1. A method, comprising:
receiving, at a device and in response to a first request, a challenge token having one or more layers of encryption, wherein the challenge token is received from a trusted authority storing contact information for a plurality of devices, the contact information specifying address and identification information for one or more recipients including one or more manager systems associated with subsets of the plurality of devices;
decrypting, by the device, the challenge token to access information including at least a destination;
converting the decrypted challenge token to a bearer token secured with a secure key for the device; and
sending a second request, including the bearer token, to the destination specified in the challenge token, the bearer token enabling a recipient of the request to authenticate the device based, at least in part, upon a device identifier included in the first request, and provide configuration information to the device, wherein the device identifier is mapped to a manager system corresponding to the destination.
2. The method of claim 1 , wherein the challenge token includes one or more of a device identifier for the device, manager system address information, a manager system identifier, a token expiration time, the secure key for the device, and a randomly-generated nonce.
3. The method of claim 1 , wherein the one or more layers of encryption of the challenge token include at least one of a digital signature of a trusted authority generating the challenge token, encryption using a self-generated secure key for the device, or encryption using a persistent secure key for the device.
4. The method of claim 1 , wherein the bearer token includes the decrypted challenge token with a nonce appended that was included in the decrypted challenge token, the bearer token signed with a self-generated secure key for the device.
5. The method of claim 1 , wherein the recipient is a manager system associated with the device, and wherein the bearer token enables the manager system to determine the configuration information and provide the configuration information to the device to enable the device to operate for an intended purpose.
6. The method of claim 5 , wherein the manager system is enabled to verify authentication of the device by a trusted authority that generated the challenge token without directly communicating with the trusted authority.
7. The method of claim 6 , wherein the device is able to be authenticated to the manager system and receive the configuration information using only a single request to, and receiving only a single response from, the manager system.
8. The method of claim 1 , further comprising:
sending the first request at an initial startup of the device when the configuration information is not stored on the device.
9. A device, comprising:
a processor; and
memory including instructions that, when performed by the processor, cause the device to:
receive, in response to an enrollment request, a challenge token having one or more layers of encryption, wherein the challenge token is generated by a trusted authority storing contact information for a plurality of devices, the contact information specifying address and identification information for one or more manager systems associated with subsets of the plurality of devices;
decrypt the challenge token to access information for a manager system;
convert the decrypted challenge token to a bearer token secured with a secure key for the device; and
send a second request for configuration information to the manager system, the request second including the bearer token to enable the manager system to authenticate the device and provide the configuration information, wherein the manager system is enabled to verify authentication of the device by the trusted authority that generated the challenge token without directly communicating with the trusted authority.
10. The device of claim 9 wherein the one or more layers of encryption of the challenge token include at least one of a digital signature of the trusted authority generating the challenge token, encryption using a self-generated secure key for the device, or encryption using a persistent secure key for the device.
11. The device of claim 9 , wherein information in the bearer token enables the manager system to determine the configuration information and provide the configuration information to the device to enable the device to operate for an intended purpose.
12. A method, comprising:
receiving, from a device to a manager system, a request, the request including a bearer token being digitally signed by the device;
determining, from the bearer token, first identifying information for the device and second identifying information for a trusted authority having authenticated the device, the first identifying information and second identifying information having been included in a challenge token issued by the trusted authority and decrypted by the device, wherein the bearer token enables the manager system to verify authentication of the device by the trusted authority that issued the challenge token without directly communicating with the trusted authority;
authenticating the device using at least the first identifying information and the second identifying information;
determining configuration information for the device; and
sending the configuration information to the device,
wherein the device is enabled to operate for an intended purpose, and
wherein the device is able to be authenticated to the manager system and
receive the configuration information using only a single request and receiving only a single response from the manager system.
13. The method of claim 12 , further comprising:
verifying, from the bearer token, third identifying information for the manager system before sending the configuration information to the device.
14. The method of claim 12 , wherein a digital signature on the bearer token corresponds to a self-generated secure key for the device different from a persistent key for the device that was used to encrypt the challenge token.