Provisioning network keys to devices to allow them to provide their identity
A device is provisioned and authorized for use on a network. The device may be required to generate a cryptographic key and provide a digital certificate the cryptographic key, a hardware identifier, and attribute information to an authorization host as part of the provisioning process. The authorization host may use attribute information to determine whether to authorize the device for use on the network, and whether the generated cryptographic key should be trusted for use on the network.
1. A system comprising memory to store instructions that, as a result of execution by one or more processors, cause the system to:
detect an unprovisioned device on a first network;
provide instructions to the device to generate an asymmetric key pair, the asymmetric key pair including at least a first public key and a first private key;
obtain, from the device, information comprising:
the first public key; and
encrypted device attribute information, the encrypted device attribute information encrypted using a second private key;
determine, using a second public key, whether the information is authentic, the second public key corresponding to the second private key;
obtain, from a source different from the device, one or more expected attributes;
determine whether the device has the one or more expected attributes by at least decrypting the encrypted device attribute information; and
contingent on at least the information determined to be authentic and the device determined to have the one or more expected attributes, cause the first public key to be usable to authenticate the device on a second network.
2. The system of claim 1 , wherein the instructions to determine whether the device has the one or more expected attributes, as a result of execution by the one or more processors, cause the system to at least determine whether the device communicates from a location specified in the one or more expected attributes.
3. The system of claim 1 , wherein the second public key is associated with a manufacturer of the device.
4. The system of claim 3 , wherein the instructions that cause the first public key to be usable, as a result of execution by the one or more processors, cause the system to provide, to the device, a digital certificate for the first public key.
5. The system of claim 1 , wherein the first network is isolated from the second network.
6. The system of claim 1 , wherein:
the information further includes a hardware identifier; and
the instructions, as a result of execution the one or more processors, further cause the system to:
indicate the device failed provisioning if the hardware identifier was previously used for device provisioning.
7. The system of claim 1 , wherein:
the system includes a second device on the second network;
the instructions that cause the first public key to be usable to authenticate the device on a second network comprise instructions that, as a result of execution by the one or more processors, cause the system to issue a digital certificate usable to verify digital signatures generated using a private key corresponding to the first public key;
the digital certificate encodes at least some of the one or more expected attributes; and
the second device on the second network verifies, based at least in part on the at least some of the one or more expected attributes in the digital certificate, whether a digitally signed message originated from the device.
8. The system of claim 1 , wherein the instructions to obtain, from the source different from the unprovisioned device, the one or more expected attributes includes instructions that, as a result of execution by the one or more processors, cause the system to obtain an electronic manifest comprising the one or more expected attributes from an entity associated with a manufacturer of the unprovisioned device.
9. A computer-implemented method, comprising:
detecting an unprovisioned device on a first network;
providing instructions to the device to generate an asymmetric key pair, the asymmetric key pair including at least a first public key and a first private key;
obtaining, from the device, information that includes the first public key and opaque data that encodes one or more attributes associated with the device, wherein the device lacks access to the one or more attributes encoded in the opaque data;
determining, using a second public key, whether the information is authentic, the second public key corresponding to a second private key;
determining whether the device has one or more expected attributes based at least in part on the one or more attributes; and
contingent on at least the information determined to be authentic and the device determined to have the one or more expected attributes, causing the first public key to be usable to authenticate the device on a second network.
10. The computer-implemented method of claim 9 , wherein determining whether the device has one or more expected attributes further comprises determining whether the device communicates from a location specified in the one or more expected attributes.
11. The computer-implemented method of claim 9 , wherein the second public key is associated with a manufacturer of the device.
12. The computer-implemented method of claim 11 , wherein causing the first public key to be useable comprises causing the system to provide, to the device, a digital certificate for the first public key.
13. The computer-implemented method of claim 9 , wherein the first network is isolated from the second network.
14. A non-transitory computer-readable storage medium having stored thereon executable instructions that, if executed by one or more processors of a computer system, cause the computer system to at least:
detect an unprovisioned device on a first network;
provide instructions to the device to generate an asymmetric key pair, the asymmetric key pair including at least a first public key and a first private key;
obtain information that includes the first public key and a ciphertext;
determine, using a second public key, whether the information is authentic, the second public key corresponding to a second private key;
determine whether the device has one or more expected attributes based at least in part on device attribute information obtained by decrypting the ciphertext, wherein the unprovisioned device lacks access to the one or more expected attributes; and
contingent on at least the information determined to be authentic and the device determined to have the one or more expected attributes, cause the first public key to be usable to authenticate the device on a second network.
15. The non-transitory computer-readable storage medium of claim 14 , wherein the instructions to determine whether the device has the one or more expected attributes comprises instructions that cause the system to verify whether the device is on a part of a top-of-rack switch identified in the attribute information.
16. The non-transitory computer-readable storage medium of claim 15 , wherein the instructions to cause the first public key to be usable comprise instructions that, if executed by the one or more processors, cause the computer system to provide, to the device, a digital certificate for the first public key.
17. The non-transitory computer-readable storage medium of claim 14 , wherein the first network is isolated from the second network.
18. The non-transitory computer-readable storage medium of claim 14 , wherein:
the information further includes a hardware identifier; and
the instructions further comprise instructions that, if executed by the one or more processors, cause the computer system to indicate the device failed provisioning if the hardware identifier was previously used for device provisioning.
19. The non-transitory computer-readable storage medium of claim 14 , wherein:
the computer system includes a second device on the second network;
the instructions further comprise instructions that, if executed by the one or more processors, cause the computer system to issue a digital certificate usable to verify digital signatures generated using a private key corresponding to the first public key;
the digital certificate encodes at least some of the one or more expected attributes; and
the second device on the second network verifies, based at least in part on the at least some of the one or more expected attributes in the digital certificate, whether a digitally signed message originated from the device.
20. The non-transitory computer-readable storage medium of claim 14 , wherein the instructions further comprise instructions that, if executed by the one or more processors, cause the computer system to obtain the one or more expected attributes includes by at least querying the one or more expected attributes from a manifest file.