Systems, methods, and devices for multi-stage provisioning and multi-tenant operation for a security credential management system
A system for securely provisioning a plurality of computerized devices of a tenant, is provided. The system includes a processor, and a computer storage medium including instructions that when executed by the processor cause the processor to perform operations. The operations include receiving provisioning requests from the plurality of computerized devices needing certificates, each provisioning request indicating a tenant identifier identifying the tenant, and transmitting the provisioning requests to a set of security credential management system backend components based on the tenant identifier. The set of SCMS backend components includes enrollment certificate authorities operable to generate enrollment certificates, each provisioning request being transmitted to one of the one or more enrollment certificate authorities based on the tenant identifier of each provisioning request, and a pseudonym certificate authority operable to generate digital assets in response to receiving a provisioning request.
1. A system for securely provisioning a plurality of computerized devices of a tenant, the system comprising:
a processor; and
a non-transitory computer storage medium comprising instructions that when executed by the processor cause the processor to perform operations comprising:
receiving first provisioning requests for enrollment certificates for the plurality of computerized devices, each first provisioning request indicating a tenant identifier (ID) identifying the tenant; and
transmitting the first provisioning requests to a set of security credential management system (SCMS) backend components for a centrally-managed SCMS, based on the tenant ID,
wherein the set of SCMS backend components comprises:
an enrollment certificate authority operable to generate the enrollment certificates exclusively for the tenant in response to receiving the first provisioning requests for the enrollment certificates, each of the first provisioning requests being transmitted to the enrollment certificate authority based on the tenant ID of the first provisioning requests; and
a pseudonym certificate authority operable to generate digital assets exclusively for the tenant in response to receiving a second provisioning request including the tenant ID and a device identification.
2. The system of claim 1 , wherein the operations further comprise identifying one or more of a device type and a device configuration of a computerized device associated with a provisioning request.
3. The system of claim 2 , wherein the operations further comprise determining a compatibility of the enrollment certificates and pseudonym certificates based on the identifying.
4. The system of claim 1 , wherein the operations further comprise obtaining installation data related to an initial installation of a computerized device associated with a provisioning request, and wherein the enrollment certificate authority and the pseudonym certificate authority are configured to provide a respective enrollment certificate and a respective pseudonym certificate based on the installation data.
5. The system of claim 1 , wherein the set of SCMS backend components comprises:
a first linkage authority and a second linkage authority operable to generate linkage values for the tenant in response to receiving requests for the linkage values.
6. The system of claim 1 , wherein the tenant ID is a null value.
7. The system of claim 1 , wherein the operations further comprise, verifying, based on at least one of the tenant ID or an enrollment certificate, that the second provisioning request is authorized.
8. The system of claim 1 , wherein the transmitting is performed by a virtual registration authority executed by the processor.
9. The system of claim 8 , wherein the system comprises an abstraction layer executed by the processor for performing the receiving, wherein the abstraction layer is executed at a level above the virtual registration authority.
10. The system of claim 1 , wherein the processor executes a plurality of virtual registration authorities, each virtual registration authority of the plurality of virtual registration authorities being associated with the tenant ID.
11. A method for securely provisioning a plurality of computerized devices of a tenant, the method comprising:
receiving, at a server, first provisioning requests for enrollment certificates for the plurality of computerized devices, each first provisioning request indicating a tenant identifier (ID);
transmitting, by the server, the first provisioning requests to a set of security credential management system (SCMS) backend components for a centrally-managed SCMS, based on the tenant ID of the first provisioning requests, wherein the SCMS backend components comprise an enrollment certificate authority and a pseudonym certificate authority;
generating, by the enrollment certificate authority, the enrollment certificates exclusively for the tenant in response to receiving the first provisioning requests for the enrollment certificates, each of the first provisioning requests being transmitted to the enrollment certificate authority based on the tenant identifier of the first provisioning requests; and
generating, by the pseudonym certificate authority, a digital asset exclusively for the tenant in response to receiving a second provisioning request including the tenant ID and a device identification for the digital asset.
12. The method of claim 11 , further comprising identifying one or more of a device type and a device configuration of a computerized device associated with a provisioning request.
13. The method of claim 12 , further comprising determining a compatibility of the enrollment certificates and pseudonym certificates based on the identifying.
14. The method of claim 11 , further comprising obtaining installation data related to an initial installation of a computerized device associated with a provisioning request, and wherein the enrollment certificate authority and the pseudonym certificate authority are configured to provide a respective enrollment certificate and a respective pseudonym certificate based on the installation data.
15. The method of claim 11 , wherein the set of SCMS backend components comprises:
a first linkage authority and a second linkage authority operable to generate linkage values for the tenant in response to receiving requests for the linkage values.
16. The method of claim 11 , wherein the tenant ID is a null value.
17. The method of claim 11 , further comprising, verifying, based on at least one of the tenant ID or an enrollment certificate, that the second provisioning request is authorized.
18. The method of claim 11 , wherein the transmitting is performed by a virtual registration authority operating on the server.
19. The method of claim 18 , wherein the server comprises an abstraction layer configured to perform the receiving, wherein the abstraction layer is executed at a level above the virtual registration authority.
20. The method of claim 11 , wherein the server comprises a plurality of virtual registration authorities, each virtual registration authority of the plurality of virtual registration authorities being associated with the tenant ID.