Provisioning system for cloud-connected printers

1. A method to provision a printer, the method comprising:

receiving a provisioning request from the printer, the provisioning request containing (i) a printer identifier, and (ii) an account identifier associated with the printer;

obtaining, from a digital certificate issuer, a unique string;

sending the unique string to the printer;

receiving from the printer, in response to sending the unique string, a certificate signing request containing (i) the printer identifier, (ii) the account identifier, and (iii) an authentication token including the unique string signed with a private key of the printer;

validating the certificate signing request;

passing the validated certificate signing request to the digital certificate issuer;

receiving, from the digital certificate issuer, a digital certificate encoding the printer identifier and the account identifier; and

providing the digital certificate to the printer for storage.

2. The method of claim 1 , wherein the certificate signing request includes a second digital certificate corresponding to a cryptographic controller of the printer.

3. The method of claim 2 , wherein validating the certificate signing request includes verifying a chain of trust for the second digital certificate.

4. The method of claim 2 , wherein validating the certificate signing request includes:

retrieving manufacturing data corresponding to the printer; and

verifying that the manufacturing data indicates an association between the printer identifier and the second digital certificate.

5. The method of claim 1 , wherein validating the certificate signing request includes determining whether the printer identifier is present in a repository of manufacturing data.

6. The method of claim 1 , wherein providing the digital certificate to the printer includes sending (i) the digital certificate, and (ii) a network identifier of a print server, for use by the printer to establish a secure connection with the print server using the digital certificate.

7. The method of claim 6 , further comprising:

receiving an indication that the printer is to be decommissioned; and

transmitting a decommissioning command to at least one of the print server and a client computing device associated with the account identifier, for causing the printer to discard the digital certificate.

8. A provisioning server, comprising:

a communications interface; and

a processor configured to:

receive a provisioning request from a printer, the provisioning request containing (i) a printer identifier, and (ii) an account identifier associated with the printer;

obtain, from a digital certificate issuer, a unique string;

send the unique string to the printer;

receive from the printer, in response to sending the unique string, a certificate signing request containing (i) the printer identifier, (ii) the account identifier, and (iii) an authentication token including the unique string signed with a private key of the printer;

validate the certificate signing request;

pass the certificate signing request to the digital certificate issuer;

receive, from the digital certificate issuer, a digital certificate encoding the printer identifier and the account identifier; and

provide the digital certificate to the printer for storage.

9. The provisioning server of claim 8 , wherein the certificate signing request includes a second digital certificate corresponding to a cryptographic controller of the printer.

10. The provisioning server of claim 9 , wherein the processor is configured, to validate the certificate signing request, to verify a chain of trust for the second digital certificate.

11. The provisioning server of claim 9 , wherein the processor is configured, to validate the certificate signing request, to:

retrieve manufacturing data corresponding to the printer; and

verify that the manufacturing data indicates an association between the printer identifier and the second digital certificate.

12. The provisioning server of claim 8 , wherein the processor is configured, to validate the certificate signing request, to determine whether the printer identifier is present in a repository of manufacturing data.

13. The provisioning server of claim 8 , wherein the processor is configured, to provide the digital certificate to the printer, to send (i) the digital certificate, and (ii) a network identifier of a print server, for use by the printer to establish a secure connection with the print server using the digital certificate.

14. The provisioning server of claim 13 , wherein the processor is further configured to:

receive an indication that the printer is to be decommissioned; and

transmit a decommissioning command to at least one of the print server and a client computing device associated with the account identifier, for causing the printer to discard the digital certificate.

15. A method to provision a printer, comprising:

obtaining, at the printer, (i) a network identifier of a provisioning server, and (ii) an account identifier associated with the printer;

transmitting, to the provisioning server using the network identifier, a provisioning request containing (i) a printer identifier, and (ii) the account identifier;

receiving a unique string from the provisioning server;

generating a certificate signing request containing (i) the printer identifier, (ii) the account identifier, and (iii) an authentication token based on the unique string;

sending the certificate signing request to the provisioning server for validation;

receiving a digital certificate encoding the printer identifier and the account identifier; and

storing the digital certificate in a memory of the printer.

16. The method of claim 15 , further comprising:

receiving, with the digital certificate, a second network identifier corresponding to a print server; and

establishing a connection with the print server using the second network identifier and the digital certificate.

17. The method of claim 15 , wherein obtaining the network identifier and the account identifier includes:

emitting a beacon containing an un-provisioned status indicator;

establishing a connection with a client computing device; and

receiving the network identifier and the account identifier from the client computing device.

18. The method of claim 15 , wherein generating the certificate signing request includes:

generating the authentication token by signing the unique string with a private key of the printer.

19. The method of claim 18 , wherein the private key is associated with a cryptographic accelerator of the printer.

20. The method of claim 15 , further comprising:

receiving a de-provisioning command; and

discarding the digital certificate.