Techniques for enrolling a device or service using a proximity channel and a cloud channel
Systems, devices, and methods are provided for establishing trust between devices using a proximity channel and a cloud channel. An enrollee device and manager may perform a mutual authentication process where grant codes are exchanged, wherein the enrollee grants the manager the ability to be a manager in the enrollment process and the manger grants the enrollee the ability to issue an identity certificate. A proximity channel may be used to establish proof-of-possession and a cloud-based authorization may be performed to verify that the enrollee is a legitimate participant.
1. A computer-implemented method, comprising:
providing, from an originator to a responder over a proximity channel, wherein the originator comprises one or more hardware processors of a first device:
an originator public key;
an originator message grant code; and
an originator enroll grant code;
providing, from the responder to the originator, wherein the responder comprises one or more hardware processors of a second device:
a responder public key; and
a first ciphertext encrypted using a session key generated based at least in part on the originator public key and a responder private key, the first ciphertext encoding:
a responder message grant code;
a responder enroll grant code;
an originator enroll token obtained from the originator enroll grant code; and
the responder public key;
verifying, at the originator, the responder public key and the originator enroll token in the first ciphertext;
providing, by the originator to the responder, a second ciphertext encrypted using the responder public key, the second ciphertext encoding:
a responder enroll token obtained from the responder enroll grant code; and
a certificate signing request for the originator;
verifying, at the responder, the responder enroll token in the second ciphertext;
based at least in part on successful verification of the responder enroll token at the responder, issuing a certificate to the originator;
providing, by the responder to the originator, a third ciphertext encrypted using the session key, the third ciphertext encoding:
the originator enroll token;
an issued certificate; and
a trusted root certificate;
verifying, at the originator, the originator enroll token in the third ciphertext;
providing, by the originator and to the responder, an indication of success enrollment; and
submitting an enrollment request to an identity service, the enrollment request comprising an issued certificate.
2. The computer-implemented method of claim 1 , wherein responder is a manager entity having access to an account signing key (ASK) for issuing certificates.
3. The computer-implemented method of claim 1 , wherein a quick response (“QR” code is provided over the proximity channel.
4. The computer-implemented method of claim 1 , wherein:
the originator message grant code is redeemable for an originator message token that grants access to the responder to send messages to the originator; and
the responder message grant code is redeemable for a responder message token that grants access to the originator to send messages to the responder.
5. A computer-implemented method, comprising:
providing, by one or more processors of a first device and over a proximity channel, an enrollment request;
receiving, by the one or more processors and over a communications network, an enrollment response from a second device, comprising:
a public key associated with the second device;
a first token that grants the second device to act as a manager; and
a first grant code;
verifying, by the one or more processors, the first token;
determining, by the one or more processors, based on the public key and a private key of the first device, a session key;
exchanging, by the one or more processors, the first grant code for a second token that grants access to issue an identity certificate;
establishing, by the one or more processors, a secure device-to-device channel with the second device using the session key;
submitting, by the one or more processors and over the secure device-to-device channel, a certificate signing request, wherein the certificate signing request comprises:
identity information of the first device; and
the second token; and
receiving, by the one or more processors and over the secure device-to-device channel, a certificate signing response, comprising:
an issued certificate comprising the identity information;
a trusted root certificate; and
the first token.
6. The method of claim 5 , further comprising:
submitting, by the one or more processors and to an identity service, a participant enrollment request, comprising the issued certificate.
7. The computer-implemented method of claim 5 , wherein the session key is established using an Elliptic Curve Diffie Hellman (ECDH) key exchange.
8. The computer-implemented method of claim 5 , wherein the first device is a headless device.
9. The computer-implemented method of claim 5 , wherein exchanging the first grant code for the second token comprises:
submitting a request to an authorization service to perform a cloud-based authorization of the first device using one or more native identity providers.
10. The computer-implemented method of claim 5 , wherein a quick response (“QR” code is provided over the proximity channel.
11. The computer-implemented method of claim 5 , wherein the enrollment request further comprises a second grant code that is redeemable by the second device for the first token.
12. The computer-implemented method of claim 11 , wherein:
the enrollment request further comprises a third grant code that is redeemable for a third token that grants access to send messages to the first device; and
the enrollment response further comprises a fourth grant code that is redeemable for a fourth token that grants access to send messages to the second device.
13. A computer-implemented method, comprising:
receiving, by one or more processors of a first device, an enrollment request over a proximity channel from a second device, the enrollment request comprising:
a first public key; and
a first grant code;
providing, by the one or more processors, the first grant code to an authorization service;
receiving, by the one or more processors and from the authorization service, a first token that grants access to the first device to act as a manager for the second device;
providing, by the one or more processors, an enrollment response comprising:
the first token;
a second public key; and
a second grant code redeemable for a second token that grants access to issue identity certificates;
receiving, by the one or more processors, from the second device, a certificate signing request, comprising:
identity information of the second device; and
the second token;
verifying, by the one or more processors, the second token; and
generating, by the one or more processors and with an account signing key (ASK), an issued certificate that includes the identity information of the second device; and
providing, by the one or more processors, a certificate signing response, comprising:
the first token;
the issued certificate; and
a trusted root certificate.
14. The computer-implemented method of claim 13 , further comprising:
determining, by the one or more processors, a session key based on the first public key and a private key associated with the first device; and
establishing, by the one or more processors, a secure device-to-device channel with the second device.
15. The computer-implemented method of claim 14 , wherein the session key is determined using an Elliptic Curve Diffie Hellman (ECDH) key exchange.
16. The computer-implemented method of claim 13 , wherein a quick response (“QR” code is provided over the proximity channel.
17. The computer-implemented method of claim 13 , wherein the authorization service performs a first cloud-based authorization of the first device using one or more native identity providers and a second cloud-based authorization of the second device using the one or more native identity providers.
18. The computer-implemented method of claim 13 , wherein the trusted root certificate is self-signed by the first device using the ASK.
19. The computer-implemented method of claim 13 , wherein the second device is a headless device.
20. The computer-implemented method of claim 13 , wherein:
the enrollment request further comprises a third grant code that is redeemable for a third token that grants access to send messages to the first device; and
the enrollment response further comprises a fourth grant code that is redeemable for a fourth token that grants access to send messages to the second device.