Device provisioning using secure credentials for a first deployment
A disclosed method includes assigning a unique identifier to a computer product instance, such as a server, switch, router, or storage device, to be deployed at a data center or other location on behalf of a customer, generating security credentials for the computer product dependent on the identifier, obtaining the credentials by a customer-side automated deployment agent, and using them by the deployment agent during deployment of the computer product. The credentials may be generated by a supplier-side credential management system, then requested and received by the deployment agent over a secure communication channel. The credentials may be generated by a program shared between the supplier-side credential management system and the deployment agent. The identifier may identify a hardware or software component or be selected by the supplier or customer. The credentials may include a username, password, token, cryptographic key, or digital certificate for a first login.
1. A method, comprising:
assigning a unique identifier to a computer product instance to be deployed at a customer site;
generating, by a supplier of the computer product instance, security credentials for the computer product instance dependent on i) the assigned unique identifier and ii) a customer identifier associated with the computer product instance;
obtaining, by a customer-side automated deployment agent, the security credentials, at a first time, for the computer product instance that were generated dependent on the assigned unique identifier and the customer identifier;
using, by the customer-side automated deployment agent, the security credentials during deployment of the computer product instance;
after using the security credentials, attempting to obtain the security credentials, at a second time after the first time, from the supplier of the computer product instance; and
in response to attempting to obtain the security credentials at the second time after the first time, preventing use of the security credentials at the second time.
2. The method of claim 1 wherein:
generating the security credential comprises:
a supplier-side credential management system generating the security credentials; and
the supplier-side credential management system storing the security credentials; and
obtaining the security credentials comprises the customer-side automated deployment agent requesting and receiving the security credentials from the supplier-side credential management system over a secure communication channel.
3. The method of claim 1 , wherein:
generating the security credential comprises generating the security credentials using a shared credential generation program;
the method further comprises providing the shared credential generation program to the customer-side automated deployment agent; and
obtaining the security credentials comprises the customer-side automated deployment agent generating the security credentials using the provided shared credential generation program.
4. The method of claim 1 , wherein:
generating the security credential comprises:
receiving a shared credential generation program from the customer-side automated deployment agent; and
generating the security credentials using the received shared credential generation program; and
obtaining the security credentials comprises the customer-side automated deployment agent generating the security credentials using the shared credential generation program.
5. The method of claim 1 , wherein the unique identifier assigned to the computer product instance comprises an identifier of a hardware of software component of the computer product instance.
6. The method of claim 1 , wherein assigning the unique identifier to the computer product instance comprises the supplier or customer selecting the unique identifier.
7. The method of claim 1 , wherein using the security credentials during deployment of the computer product instance comprises using the security credentials for a first login to an operating system executing on the computer product instance, a first login to application software executing on the computer product instance, a first login to a management environment executing on the computer product instance, or a first login to a baseboard management controller of the computer product instance.
8. The method of claim 1 , wherein the computer product instance comprises a compute server, network switch, router device, or storage device to be deployed at the customer site.
9. The method of claim 1 , wherein the security credentials comprise one or more of an access username, an access password, an access cookie, an access token, a cryptographic key, a public key token, or a digital certificate.
10. The method of claim 1 , further comprising generating, by the customer-side automated deployment agent and subsequent to using the security credentials during deployment of the computer product instance, new security credentials for the computer product instance.
11. A system, comprising:
at least one computing device implementing a supplier-side credential management system for performing:
assigning a unique identifier to a computer product instance to be deployed at a customer site; and
generating security credentials for the computer product instance dependent on i) the assigned unique identifier and ii) a customer identifier associated with the computer product instance; and
at least one computing device implementing a customer-side automated deployment agent for performing:
obtaining the security credentials, at a first time, for the computer product instance that were generated dependent on the assigned unique identifier and the customer identifier;
using the security credentials during deployment of the computer product instance;
after using the security credentials, attempting to obtain the security credentials, at a second time after the first time, from the supplier of the computer product instance; and
in response to attempting to obtain the security credentials at the second time after the first time, preventing use of the security credentials at the second time.
12. The system of claim 11 , wherein:
generating the security credential comprises:
the supplier-side credential management system generating the security credentials; and
the supplier-side credential management system storing the security credentials; and
obtaining the security credentials comprises the customer-side automated deployment agent requesting and receiving the security credentials from the supplier-side credential management system over a secure communication channel.
13. The system of claim 11 , wherein:
generating the security credential comprises the supplier-side credential management system generating the security credentials using a shared credential generation program;
the supplier-side credential management system further performs providing the shared credential generation program to the customer-side automated deployment agent; and
obtaining the security credentials comprises the customer-side automated deployment agent generating the security credentials using the provided shared credential generation program.
14. The system of claim 11 , wherein:
generating the security credential comprises:
receiving a shared credential generation program from the customer-side automated deployment agent; and
generating the security credentials using the shared credential generation program; and
obtaining the security credentials comprises the customer-side automated deployment agent generating the security credentials using the shared credential generation program.
15. The system of claim 11 , wherein:
the unique identifier assigned to the computer product instance comprises an identifier of a hardware or software component of the computer product instance or a unique identifier selected by a supplier or customer; and
the security credentials comprise one or more of an access username, an access password, an access cookie, an access token, a cryptographic key, a public key token, or a digital certificate.
16. Non-transitory computer readable memory media storing instructions executable to implement:
a supplier-side credential management system configured to perform:
assigning a unique identifier to a computer product instance to be deployed at a customer site; and
generating security credentials for the computer product instance dependent on i) the assigned unique identifier and ii) a customer identifier associated with the computer product instance; and
a customer-side automated deployment agent configured to perform:
obtaining the security credentials, at a first time, for the computer product instance that were generated dependent on the assigned unique identifier and the customer identifier;
using the security credentials during deployment of the computer product instance;
after using the security credentials, attempting to obtain the security credentials, at a second time after the first time, from the supplier of the computer product instance; and
in response to attempting to obtain the security credentials at the second time after the first time, preventing use of the security credentials at the second time.
17. The media of claim 16 , wherein:
generating the security credential comprises:
the supplier-side credential management system generating the security credentials; and
the supplier-side credential management system storing the security credentials; and
obtaining the security credentials comprises the customer-side automated deployment agent requesting and receiving the security credentials from the supplier-side credential management system over a secure communication channel.
18. The media of claim 16 , wherein:
generating the security credential comprises the supplier-side credential management system generating the security credentials using a shared credential generation program;
the supplier-side credential management system is further configured to perform providing the shared credential generation program to the customer-side automated deployment agent; and
obtaining the security credentials comprises the customer-side automated deployment agent generating the security credentials using the provided shared credential generation program.
19. The media of claim 16 , wherein:
generating the security credential comprises:
receiving a shared credential generation program from the customer-side automated deployment agent; and
generating the security credentials using the shared credential generation program; and
obtaining the security credentials comprises the customer-side automated deployment agent generating the security credentials using the shared credential generation program.
20. The method of claim 1 , wherein the unique identifier assigned to the computer product instance comprises a randomly generated alphanumeric identifier that is mutually agreed upon by the supplier of the computer product instance and the customer-side automated deployment agent.