Device provisioning and authentication

1. A method comprising:

receiving, using at least one processor associated with a network server, a request from a second server associated with the network server to register a device in a vehicle, the request comprising an identifier of the device;

in response to receiving the request, registering the device using the at least one processor, the registering comprising recording the identifier of the device in a database of active devices;

receiving, using the at least one processor, a certificate signing request from the device, the certificate signing request to provide a device security certificate to the device, wherein the device security certificate for the device is to enable authentication of the device during communication with another entity;

obtaining, using the at least one processor, an identifier of the device from the certificate signing request;

determining, using the at least one processor, whether an existing device security certificate is available for the device based on the identifier; and

sending, using the at least one processor, the certificate signing request to a certificate authority server associated with the network server upon determining that an existing device security certificate is not available;

receiving, using the at least one processor, a device security certificate for the device from the certificate authority server; and

sending, using the at least one processor, the device security certificate to the device.

2. The method of claim 1 , wherein determining whether an existing device security certificate is available for the device comprises:

determining whether the device is registered in the database of active devices using the identifier; and

upon determining that the device is registered, determining whether an existing device security certificate is available for the device using the identifier.

3. The method of claim 1 , further comprising:

storing the device security certificate in storage coupled to the network server;

receiving, from a management service associated with the network server, instructions to decommission the device, the instructions including the identifier of the device;

in response to receiving the instructions to decommission the device:

accessing, using the identifier of the device obtained from the instructions, the device security certificate from the storage, and

deleting the device security certificate from the storage; and

removing the identifier of the device from the database of active devices.

4. The method of claim 1 , wherein the certificate signing request is received over a network connection between the network server and the device in the vehicle, the method further comprising:

receiving a connection request from the device;

establishing a communication session with the device over the network connection in response to the request; and

receiving the certificate signing request from the device following establishment of the communication session,

wherein the device security certificate is sent to the device in the communication session.

5. The method of claim 1 , further comprising:

storing the device security certificate in storage coupled to the network server;

receiving, from a management service associated with the network server, instructions to deprovision the device, the instructions including the identifier of the device;

in response to receiving the instructions to deprovision the device, accessing, using the identifier of the device obtained from the instructions, the device security certificate from the storage; and

deleting the device security certificate from the storage.

6. The method of claim 1 , further comprising:

receiving a second certificate signing request from a second device in a second vehicle, the second certificate signing request to provide a device security certificate to the second device;

obtaining a second identifier of the second device from the second certificate signing request;

determining, using the second identifier, that an existing device security certificate is available for the second device at the network server; and

in response to determining that an existing device security certificate is available for the second device at the network server:

revoking the existing device security certificate for the second device,

generating an audit log entry, and

terminating communication with the second device.

7. The method of claim 1 , further comprising:

receiving a second certificate signing request from a second device in a second vehicle, the second certificate signing request to provide a device security certificate to the second device;

obtaining a second identifier of the second device from the second certificate signing request;

determining, using the second identifier, that the second device is not registered in a database of active devices; and

in response to determining that the second device is not registered in the database of active devices:

generating an audit log entry, and

terminating communication session with the second device.

8. A network server, comprising:

one or more processors;

memory storing instructions that, when executed, are configured to cause the one or more processors to perform operations comprising:

receiving a request from a second server associated with the network server to register a device in a vehicle, the request comprising an identifier of the device;

in response to receiving the request, registering the device, comprising recording the identifier of the device in a database of active devices;

receiving a certificate signing request from the device, the certificate signing request to provide a device security certificate to the device, wherein the device security certificate for the device is to enable authentication of the device during communication with another entity;

obtaining an identifier of the device from the certificate signing request;

determining whether an existing device security certificate is available for the device based on the identifier; and

sending the certificate signing request to a certificate authority server associated with the network server upon determining that an existing device security certificate is not available;

receiving a device security certificate for the device from the certificate authority server; and

sending the device security certificate to the device.

9. The network server of claim 8 , wherein determining whether an existing device security certificate is available for the device comprises:

determining whether the device is registered in the database of active devices using the identifier; and

upon determining that the device is registered, determining whether an existing device security certificate is available for the device using the identifier.

10. The network server of claim 8 , the operations further comprising:

storing the device security certificate in storage coupled to the network server;

receiving, from a management service associated with the network server, instructions to decommission the device, the instructions including the identifier of the device;

in response to receiving the instructions to decommission the device:

accessing, using the identifier of the device obtained from the instructions, the device security certificate from the storage, and

deleting the device security certificate from the storage; and

removing the identifier of the device from the database of active devices.

11. The network server of claim 8 , wherein the certificate signing request is received over a network connection between the network server and the device in the vehicle, the operations further comprising:

receiving a connection request from the device;

establishing a communication session with the device over the network connection in response to the request; and

receiving the certificate signing request from the device following establishment of the communication session,

wherein the device security certificate is sent to the device in the communication session.

12. The network server of claim 8 , the operations further comprising:

storing the device security certificate in storage coupled to the network server;

receiving, from a management service associated with the network server, instructions to deprovision the device, the instructions including the identifier of the device;

in response to receiving the instructions to deprovision the device, accessing, using the identifier of the device obtained from the instructions, the device security certificate from the storage; and

deleting the device security certificate from the storage.

13. The network server of claim 8 , the operations further comprising:

receiving a second certificate signing request from a second device in a second vehicle, the second certificate signing request to provide a device security certificate to the second device;

obtaining a second identifier of the second device from the second certificate signing request;

determining, using the second identifier, that an existing device security certificate is available for the second device at the network server; and

in response to determining that an existing device security certificate is available for the second device at the network server:

revoking the existing device security certificate for the second device,

generating an audit log entry, and

terminating communication with the second device.

14. The network server of claim 8 , the operations further comprising:

receiving a second certificate signing request from a second device in a second vehicle, the second certificate signing request to provide a device security certificate to the second device;

obtaining a second identifier of the second device from the second certificate signing request;

determining, using the second identifier, that the second device is not registered in a database of active devices; and

in response to determining that the second device is not registered in the database of active devices:

generating an audit log entry, and

terminating communication session with the second device.

15. One or more non-transitory computer-readable media storing instructions that, when executed, are configured to cause one or more processors to perform operations comprising:

receiving, at a network server, a request from a second server associated with the network server to register a device in a vehicle, the request comprising an identifier of the device;

in response to receiving the request, registering the device, comprising recording the identifier of the device in a database of active devices;

receiving a certificate signing request from the device, the certificate signing request to provide a device security certificate to the device, wherein the device security certificate for the device is to enable authentication of the device during communication with another entity;

obtaining an identifier of the device from the certificate signing request;

determining whether an existing device security certificate is available for the device based on the identifier; and

sending the certificate signing request to a certificate authority server associated with the network server upon determining that an existing device security certificate is not available;

receiving a device security certificate for the device from the certificate authority server; and

sending the device security certificate to the device.

16. The one or more non-transitory computer-readable media of claim 15 , wherein determining whether an existing device security certificate is available for the device comprises:

determining whether the device is registered in the database of active devices using the identifier; and

upon determining that the device is registered, determining whether an existing device security certificate is available for the device using the identifier.

17. The one or more non-transitory computer-readable media of claim 15 , the operations further comprising:

storing the device security certificate in storage coupled to the network server;

receiving, from a management service associated with the network server, instructions to decommission the device, the instructions including the identifier of the device;

in response to receiving the instructions to decommission the device:

accessing, using the identifier of the device obtained from the instructions, the device security certificate from the storage, and

deleting the device security certificate from the storage; and

removing the identifier of the device from the database of active devices.

18. The one or more non-transitory computer-readable media of claim 15 , wherein the certificate signing request is received over a network connection between the network server and the device in the vehicle, the operations further comprising:

receiving a connection request from the device;

establishing a communication session with the device over the network connection in response to the request; and

receiving the certificate signing request from the device following establishment of the communication session,

wherein the device security certificate is sent to the device in the communication session.

19. The one or more non-transitory computer-readable media of claim 15 , the operations further comprising:

storing the device security certificate in storage coupled to the network server;

receiving, from a management service associated with the network server, instructions to deprovision the device, the instructions including the identifier of the device;

in response to receiving the instructions to deprovision the device, accessing, using the identifier of the device obtained from the instructions, the device security certificate from the storage; and

deleting the device security certificate from the storage.

20. The one or more non-transitory computer-readable media of claim 15 , the operations further comprising:

receiving a second certificate signing request from a second device in a second vehicle, the second certificate signing request to provide a device security certificate to the second device;

obtaining a second identifier of the second device from the second certificate signing request;

determining, using the second identifier, that an existing device security certificate is available for the second device at the network server; and

in response to determining that an existing device security certificate is available for the second device at the network server:

revoking the existing device security certificate for the second device,

generating an audit log entry, and

terminating communication with the second device.

21. The one or more non-transitory computer-readable media of claim 15 , the operations further comprising:

receiving a second certificate signing request from a second device in a second vehicle, the second certificate signing request to provide a device security certificate to the second device;

obtaining a second identifier of the second device from the second certificate signing request;

determining, using the second identifier, that the second device is not registered in a database of active devices; and

in response to determining that the second device is not registered in the database of active devices:

generating an audit log entry, and

terminating communication session with the second device.