Device provisioning using a supplemental cryptographic identity
A device provisioning service provisions a network-connected device to access one or more service systems using a supplemental cryptographic identity of the network-connected device. An initial enrollment record (associated with an initial cryptographic identity) and a supplemental enrollment record are stored in a device provisioning service. An identity issuance request is received from the network-connected device at the device provisioning service. The identity issuance request includes the initial cryptographic identity. The supplemental cryptographic identity is requested from a supplemental cryptographic identity issuer identified in the initial enrollment record based on the identity issuance request. The requested supplemental cryptographic identity is received at the device provisioning service from the supplemental cryptographic identity issuer. The network-connected device is provisioned to access the one or more service systems according to the supplemental enrollment record. The supplemental cryptographic identity is communicated to the network-connected device.
1 . A method of provisioning a network-connected device to access a service system using a supplemental cryptographic identity of the network-connected device, the method comprising:
storing, using a device provisioning system, an initial enrollment record associated with an initial cryptographic identity and a supplemental enrollment record;
receiving, using the device provisioning system, to an identity issuance request from the network-connected device at the device provisioning system, the supplemental cryptographic identity being received at the device provisioning system from a supplemental cryptographic identity issuer identified in the initial enrollment record, the identity issuance request including the initial cryptographic identity; and
provisioning, using the device provisioning system, the network-connected device to access the service system according to the supplemental enrollment record.
2 . The method of claim 1 , further comprising:
requesting, using the device provisioning system based on the identity issuance request, the supplemental cryptographic identity from the supplemental cryptographic identity issuer identified in the initial enrollment record; and
determining using the device provisioning system the supplemental cryptographic identity issuer from the initial enrollment record before requesting the supplemental cryptographic identity from the supplemental cryptographic identity issuer.
3 . The method of claim 1 further comprising:
requesting, using the device provisioning system based on the identity issuance request, the supplemental cryptographic identity from the supplemental cryptographic identity issuer identified in the initial enrollment record; and
associating, using the device provisioning system, the supplemental enrollment record with the supplemental cryptographic identity issuer at the device provisioning system, service, responsive to receiving the supplemental cryptographic identity.
4 . The method of claim 1 further comprising:
cryptographically challenging, using the device provisioning system, the network-connected device to prove the initial cryptographic identity included in the identity issuance request; and
determining, using the device provisioning system, that the network-connected device has successfully proven the initial cryptographic identity, responsive to the cryptographic challenging and before requesting the supplemental cryptographic identity.
5 . The method of claim 1 , further comprising:
determining, using the device provisioning system, that the identity issuance request was validly signed by the network-connected device, before requesting the supplemental cryptographic identity.
6 . The method of claim 1 , wherein the identity issuance request includes an identifier of the device provisioning system.
7 . The method of claim 1 , wherein the provisioning comprises:
registering, using the device provisioning system, the network-connected device with the service system based on the supplemental cryptographic identity.
8 . A device provisioning system for provisioning a network- connected device to access a service system using a supplemental cryptographic identity of the network-connected device, the device provisioning system comprising:
one or more hardware processors;
one or more tangible data storage media configured to store an initial enrollment record associated with an initial cryptographic identity and a supplemental enrollment record;
device communications interface hardware configured for communications with the network-connected device;
registration interface hardware configured for communication with the service system;
identity provider interface hardware configured to communicate with one or more supplemental cryptographic identity issuers;
an identity processor subsystem executed by the one or more hardware processors and coupled to the device communications interface hardware to receive an identity issuance request from the network-connected device at the device provisioning system, the supplemental cryptographic identity being received at the device provisioning system from a supplemental cryptographic identity issuer identified in the initial enrollment record, the identity issuance request including the initial cryptographic identity; and
a provisioning subsystem executed by the one or more hardware processors and coupled to the one or more tangible data storage media and the registration interface hardware to provision the network-connected device to access the service system according to the supplemental enrollment record.
9 . The device provisioning system of claim 8 wherein the initial enrollment record identifies the supplemental cryptographic identity issuer, and the identity processor subsystem is configured to determine the supplemental cryptographic identity issuer from the initial enrollment record before requesting the supplemental cryptographic identity from the supplemental cryptographic identity issuer.
10 . The device provisioning system of claim 8 wherein the provisioning subsystem is configured to associate the supplemental enrollment record with the supplemental cryptographic identity issuer at the device provisioning system, responsive to receipt of the supplemental cryptographic identity by the identity processor subsystem.
11 . The device provisioning system of claim 8 wherein the identity processor subsystem is configured to cryptographically challenge the network-connected device to prove the initial cryptographic identity included in the identity issuance request and determining, using the initial enrollment record, that the network-connected device has successfully proven the initial cryptographic identity, responsive to the cryptographic challenge and before requesting the supplemental cryptographic identity.
12 . The device provisioning system of claim 8 wherein the identity processor subsystem is configured to determine that the identity issuance request was validly signed by the network-connected device, before requesting the supplemental cryptographic identity.
13 . The device provisioning system of claim 8 , wherein the identity issuance request includes an identifier of the device provisioning system.
14 . The device provisioning system of claim 8 wherein the provisioning subsystem is further configured to register the network-connected device with the service system based on the supplemental cryptographic identity.
15 . One or more tangible processor-readable storage media of a tangible article of manufacture encoding processor-executable instructions for executing on an electronic computing device of a device provisioning system a process of provisioning a network-connected device to access a service system using a supplemental cryptographic identity of the network-connected device, the process comprising:
storing an initial enrollment record associated with an initial cryptographic identity and a supplemental enrollment record;
receiving an identity issuance request from the network-connected device at the device provisioning system, the supplemental cryptographic identity being received at the device provisioning system from a supplemental cryptographic identity issuer identified in the initial enrollment record, the identity issuance request including the initial cryptographic identity; and
provisioning the network-connected device to access the service system according to the supplemental enrollment record.
16 . The one or more tangible processor-readable storage media of claim 15 , wherein the process further comprises:
requesting, based on the identity issuance request, the supplemental cryptographic identity from the supplemental cryptographic identity issuer identified in the initial enrollment record; and
determining the supplemental cryptographic identity issuer from the initial enrollment record before requesting the supplemental cryptographic identity from the supplemental cryptographic identity issuer.
17 . The one or more tangible processor-readable storage media of claim 15 , wherein the process further comprises:
requesting, based on the identity issuance request, the supplemental cryptographic identity from the supplemental cryptographic identity issuer identified in the initial enrollment record; and
associating the supplemental enrollment record with the supplemental cryptographic identity issuer at the device provisioning system, responsive to receiving the supplemental cryptographic identity.
18 . The one or more tangible processor-readable storage media of claim 15 , wherein the process further comprises:
cryptographically challenging the network-connected device to prove the initial cryptographic identity included in the identity issuance request; and
determining that the network-connected device has successfully proven the initial cryptographic identity, responsive to the cryptographic challenging, and before requesting the supplemental cryptographic identity.
19 . The one or more tangible processor-readable storage media of claim 15 , wherein the process further comprises:
determining that the identity issuance request was validly signed by the network-connected device, before requesting the supplemental cryptographic identity.
20 . The one or more tangible processor-readable storage media of claim 15 , wherein the provisioning comprises:
registering the network-connected device with the service system based on the supplemental cryptographic identity.
21 . The method of claim 1 , wherein provisioning comprises:
transmitting, using the device provisioning system, the supplemental cryptographic identity to the network-connected device.
22 . The method of claim 1 , wherein the initial cryptographic identity includes a first certificate specific to the network-connected device, wherein the supplemental cryptographic identity includes a second certificate specific to the network-connected device.
23 . The one or more tangible processor-readable storage media of claim 15 , wherein the initial cryptographic identity includes a first certificate specific to the network-connected device, wherein the supplemental cryptographic identity includes a second certificate specific to the network-connected device.