Systems, methods, and devices for multi-stage provisioning and multi-tenant operation for a security credential management system
The system for provisioning computerized devices of a tenant includes an enrollment certificate authority generating enrollment certificates in response to first provisioning requests for the enrollment certificates, a second certificate authority generating digital assets for onboard units and roadside units of the tenant in response to second provisioning requests from the computerized devices. A security credential management system platform, connected to the enrollment certificate authority and to the second certificate authority, receiving the first provisioning requests for enrollment certificates for the computerized devices, routing the first provisioning requests to the enrollment certificate authority based on the tenant identification (ID), receiving the second provisioning requests for digital assets for the computerized devices, and routing the second provisioning requests to the second certificate authority based on the device identifier. Each first provisioning request includes the tenant ID, and each second provisioning request includes a device identifier.
1. A system for securely provisioning a plurality of computerized devices of a tenant, the tenant having a tenant identifier (ID) that identifies the tenant, the system comprising:
an enrollment certificate authority operable to generate enrollment certificates in response to first provisioning requests for the enrollment certificates;
a second certificate authority operable to generate digital assets for onboard units and roadside units of the tenant in response to second provisioning requests from the plurality of computerized devices, wherein each of the second provisioning requests includes a device identifier; and
a Security Credential Management System (SCMS) host platform, operably connected to the enrollment certificate authority and to the second certificate authority, wherein the SCMS host platform is configured to perform operations comprising:
receiving the first provisioning requests for enrollment certificates for the plurality of computerized devices, each first provisioning request including a tenant identification (ID);
routing at least some of the first provisioning requests to the enrollment certificate authority based on the tenant ID;
receiving the second provisioning requests for digital assets for the plurality of computerized devices, each second provisioning request including a device identifier; and
routing at least some of the second provisioning requests to the second certificate authority based on the device identifier.
2. The system of claim 1 , wherein the operations further comprise:
identifying one or more of a device type and a device configuration of a computerized device associated with a provisioning request.
3. The system of claim 2 , wherein the operations further comprise:
determining a compatibility of the enrollment certificates and the digital assets based on the identifying.
4. The system of claim 2 , wherein the operations further comprise:
obtaining installation data related to an initial installation of the computerized device associated with a provisioning request,
wherein the enrollment certificate authority and the second certificate authority are configured to provide a respective enrollment certificate and a respective digital asset based on the installation data.
5. The system of claim 1 , wherein the operations further comprise:
verifying, based on at least one of the tenant ID or an enrollment certificate, that the second provisioning requests are authorized.
6. The system of claim 1 , further comprising:
a first linkage authority and a second linkage authority operable to generate linkage values for the tenant in response to receiving requests for the linkage values.
7. The system of claim 1 , wherein the tenant ID is a null value.
8. The system of claim 1 , further comprising:
a virtual registration authority executed by the host platform, the virtual registration authority operable to transmit the first provisioning requests to the SCMS, based on the tenant ID.
9. The system according to claim 8 , further comprising:
an abstraction layer executed by the host platform, the abstraction layer operable to receive the first provisioning requests for the enrollment certificates for the plurality of computerized devices, each of the first provisioning requests indicating a tenant ID identifying the tenant,
wherein the abstraction layer is executed at a level above the virtual registration authority.
10. The system of claim 1 , wherein the SCMS host platform executes a plurality of virtual registration authorities, each virtual registration authority of the plurality of virtual registration authorities being associated with the tenant ID.
11. A method for securely provisioning a plurality of computerized devices of a tenant, the method comprising:
generating, by an enrollment certificate authority, enrollment certificates in response to first provisioning requests for the enrollment certificates;
generating, by a second certificate authority, digital assets for onboard units and roadside units of the tenant in response to second provisioning requests from the plurality of computerized devices, wherein each of the second provisioning requests includes a device identifier; and
receiving, by a Security Credential Management System (SCMS) host platform, the first provisioning requests for enrollment certificates for the plurality of computerized devices, each first provisioning request including a tenant identification (ID);
routing, by the SCMS host platform, at least some of the first provisioning requests to the enrollment certificate authority based on the tenant ID;
receiving, by the SCMS host platform, the second provisioning requests for digital assets for the plurality of computerized devices, each second provisioning request including a device identifier; and
routing, by the SCMS host platform, at least some of the second provisioning requests to the second certificate authority based on the device identifier,
wherein the SCMS host platform is operably connected to the enrollment certificate authority and to the second certificate authority.
12. The method of claim 11 , further comprising:
identifying one or more of a device type and a device configuration of a computerized device associated with a provisioning request.
13. The method of claim 12 , further comprising:
determining a compatibility of the enrollment certificates and the digital assets based on the identifying.
14. The method of claim 11 , further comprising:
obtaining installation data related to an initial installation of a computerized device associated with a provisioning request, and wherein the enrollment certificate authority and the second certificate authority are configured to provide a respective enrollment certificate and a respective digital asset based on the installation data.
15. The method of claim 11 , wherein the SCMS host platform comprises:
a first linkage authority and a second linkage authority operable to generate linkage values for the tenant in response to receiving requests for the linkage values.
16. The method of claim 11 , wherein the tenant ID is a null value.
17. The method of claim 11 , further comprising:
verifying, based on at least one of the tenant ID or an enrollment certificate, that the second provisioning requests are authorized.
18. The method of claim 11 , further comprising:
transmitting, by a virtual registration authority, the first provisioning requests to the SCMS host platform based on the tenant ID.
19. The method according to claim 18 , further comprising:
executing, by the SCMS host platform, an abstraction layer operable to receive the first provisioning requests for the enrollment certificates for the plurality of computerized devices, each of the first provisioning requests indicating a tenant ID identifying the tenant,
wherein the abstraction layer is executed at a level above the virtual registration authority.
20. The method of claim 11 , wherein further comprising:
executing, by the SCMS host platform, a plurality of virtual registration authorities, each virtual registration authority of the plurality of virtual registration authorities being associated with the tenant ID.