Device provisioning using supplemental password identities

Abstract

The device provisioning service uses the supplemental cryptographic identity of the networked device to provision the networked device to access one or more service systems. An initial registration record (associated with the initial cryptographic identity) and a supplemental registration record are stored in the device provisioning service. The device provisioning service receives an identity issuance request from the networked device. The identity issuance request includes the initial cryptographic identity. Based on the identity issuance request, a supplemental cryptographic identity is requested from a supplemental cryptographic identity issuer identified in the initial registration record. The device provisioning service receives the requested supplemental cryptographic identity from the supplemental cryptographic identity issuer. Based on the supplemental registration record, the networked device is provisioned to access one or more service systems. The supplemental cryptographic identity is transmitted to the networked device.

Description

Background Art

[0001] The Device Provisioning Service (DPS) can be used to configure smart devices (e.g., connected devices) via a network connection (such as the Internet). Each smart device is provided with an identifier by its manufacturer, and when the smart device is powered on and connects to the DPS to request provisioning, the DPS will challenge the smart device to verify its manufacturer-provided identity. For example, a smart device can be a smart sensor, plug, light bulb, or other device (e.g., thermostat, doorbell, security camera) that is hard-coded to "wake up" and begin registering itself with one or more different cloud-based DPSs, such as Nokia Smart Home, Google Home, and others. Samsung SmartThings, Nest, Phillips Hue, Smart Life, Garmin Connect, etc.

[0002] The expansion of the consumer-driven smart device market has led to an increased demand for cross-solution compatibility, security flexibility, and greater affordability. Therefore, being forever tied to a single DPS for the lifecycle of a smart device poses risks and undesirable constraints. For example, if a manufacturer goes out of business or otherwise terminates support for a smart device, the device owner may be left with a non-functional device. From another perspective, manufacturer-issued credentials may expire, be hacked, or otherwise lost. Similarly, enhanced provisioning features may be obtained from a different DPS, such as through a DPS owned and implemented by the enterprise that owns the smart device. An enterprise DPS can provide provisioning coordination between many enterprise-owned assets, the ability to provision across manufacturers, and / or enhanced security of a manufacturer DPS. Summary of the invention

[0003] The described technology provides a device provisioning service that uses a supplemental cryptographic identity of a networked device to provision a networked device to access one or more service systems. An initial enrollment record (associated with the initial cryptographic identity) and a supplemental enrollment record are stored in the device provisioning service. An identity issuance request is received from a networked device at the device provisioning service. The identity issuance request includes the initial cryptographic identity. Based on the identity issuance request, a supplemental cryptographic identity is requested from a supplemental cryptographic identity issuer identified in the initial enrollment record. The requested supplemental cryptographic identity is received from the supplemental cryptographic identity issuer at the device provisioning service. Based on the supplemental enrollment record, the networked device is provisioned to access one or more service systems. The supplemental cryptographic identity is transmitted to the networked device.

[0004] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used to limit the scope of the claimed subject matter.

[0005] Other implementations are also described and listed herein. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] Figure 1 An example provisioning of networked devices using supplemental cryptographic identities is illustrated.

[0007] Figure 2 An example device provisioning system is illustrated.

[0008] Figure 3 Example operations for provisioning a networked device using a supplemental cryptographic identity are illustrated.

[0009] Figure 4 An example operating environment for provisioning networked devices using supplemental cryptographic identities is illustrated. DETAILED DESCRIPTION

[0010] In at least one implementation of the described technology, a networked device (such as an Internet of Things (IoT) device, a networked industrial asset, a mobile computing device, or another communication device) can be securely associated to a supplemental cryptographic identity based on an initial cryptographic identity. The supplemental cryptographic identity can then be used to provision the networked device instead of or in addition to the initial cryptographic identity.

[0011] In one scenario, a device provisioning service (DPS) may be configured to process identity issuance requests from networked devices based on an initial cryptographic identity and an initial enrollment record stored in the DPS, and to provision networked devices according to supplemental enrollment records associated with supplemental cryptographic identities.

[0012] For example, a networked device is connected to the DPS via a secure connection and submits an identity issuance request (e.g., a certificate signing request or CSR, or a JSON Web Token or JWT) and an initial cryptographic identity to the DPS to request a new identity (e.g., a new certificate) over the secure connection. In response to receipt of the identity issuance request, the DPS accesses an initial registration record (or another registration record) associated with the initial cryptographic identity. The initial registration record is stored at or accessible by the DPS.

[0013] Using the configuration information stored in the initial registration record (or another registration record), the DPS verifies the initial cryptographic identity and the identity release request. If the initial cryptographic identity and the identity release request are verified, the DPS can request a supplemental cryptographic identity from an identity issuer (such as a local or external certificate authority) based on the verified identity release request. The identity issuer returns the supplemental cryptographic identity and associates it with the supplemental registration record. The DPS can then use the configuration information stored in the supplemental registration record to provision the networked device and return the supplemental cryptographic identity to the networked device, which can then use the supplemental cryptographic identity to connect to the DPS and other services registered by the DPS to access by giving the supplemental cryptographic identity through the networked device.

[0014] Figure 1 An example provisioning of a networked device 100 using a supplemental cryptographic identity (e.g., a buyer identity 102) is illustrated. In the illustrated embodiment, the networked device 100 is represented by a vehicle, which may be a vehicle in a fleet purchased and / or operated by a buyer (e.g., a delivery company). The vehicle is sold in association with an initial cryptographic identity (e.g., a manufacturer identity 104), such as a cryptographic certificate issued by a manufacturer 106. However, the buyer may not want to rely entirely on the manufacturer and its issued identities. For example, the manufacturer may go out of business and the identities it issues may no longer be trusted. Therefore, the buyer establishes its own device provisioning service 108 to issue supplemental cryptographic identities (i.e., buyer identities) managed and controlled by the buyer, and to provision its networked devices. In this way, even if the manufacturer identity 104 is no longer valid, the buyer can continue to provision and manage the networked device 100 through its own device provisioning service 108 and buyer identity 102. The method may also allow the buyer to override and / or customize the manufacturer's provisioning of networked devices 100.

[0015] like Figure 1 As shown, manufacturer 106 initially provides an initial cryptographic identity (i.e., manufacturer identity) to networked device 100. It should be understood that the term "initial" in this application does not mean that networked device 100 has no previous cryptographic identity. Rather, "initial" is intended to be interpreted relative to networked device 100 subsequently becoming associated with a supplemental cryptographic identity (e.g., buyer identity 102). In one embodiment, to obtain provisioning using the initial cryptographic identity, networked device 100 accesses a global endpoint (e.g., at a known URL) and identifies a device provisioning service from which to obtain provisioning. The global endpoint directs networked device 100 to the appropriate device provisioning service for provisioning. Other provisioning methods are also contemplated.

[0016] In addition, in some embodiments, the networked device 100 can also request a supplemental cryptographic identity and then use the supplemental cryptographic identity to obtain provisioning. For example, the buyer can program the networked device 100 (e.g., via a public API (application programming interface) or SDK (software development kit)) to specify which device provisioning service to contact when requesting a supplemental cryptographic identity and / or supplemental provisioning. Optionally, the networked device 100 can obtain an identifier of the supplemental device provisioning service in an initial provisioning operation (e.g., from an initial device provisioning service) through hard-coded configuration information, based on periodic identity updates (e.g., tracking the remaining useful life or RUL of its credentials and requesting a new identity when the RUL drops below a threshold), etc. in response to a remote command from the buyer or another authorized entity. In some embodiments, the initial device provisioning service and the supplemental device provisioning service can be the same device provisioning service and configuration information from different registration records can still be applied.

[0017] In one embodiment, for example, a buyer or some other entity sets up device provisioning service 108 to identify and verify manufacturer identity 104 provided by networked device 100, and the buyer creates an initial registration record that includes an identifier of a particular identity issuer and verification parameters associated with the initial cryptographic identity. Networked device 100 issues an identity issuance request 110 to device provisioning service 108 to request a supplemental cryptographic identity. Identity issuance request 110 includes the initial cryptographic identity, which device provisioning service 108 uses to access the initial registration record associated with the initial cryptographic identity. If device provisioning service 108 is able to verify identity issuance request 110, device provisioning service 108 then requests the supplemental cryptographic identity from the identity issuer (not shown) specified in the initial registration record.

[0018] Validation of the identity issuance request may be performed in a variety of ways. In some implementations, the device provisioning service 108 may challenge the networked device 100 to verify its identity as the manufacturer identity 104, such as using a symmetric or asymmetric key challenge to the networked device 100 based on the manufacturer identity 104. The device provisioning service 108 may also evaluate the identity issuance request 110 to determine whether the identity issuance request 110 is validly signed by the networked device 100. Additional or different validation operations may be employed. These validation operations are conditioned on the device provisioning service 108 requesting a supplemental cryptographic identity from the identity issuer specified in the initial registration record.

[0019] After verifying the identity issuance request from the networked device 100, the device provisioning service 108 requests a supplemental cryptographic identity from the identity issuer specified in the initial registration record. The request may specify an intermediate root in the certificate chain of the supplemental cryptographic identity issuer from which the supplemental cryptographic identity will be created. The supplemental cryptographic identity issued by the supplemental cryptographic identity issuer in response to the identity issuance request is returned to the device provisioning service 108.

[0020] The device provisioning service 108 associates the supplemental cryptographic identity with the supplemental registration record and uses the configuration information in the supplemental registration record to provision the networked device 100. For example, the device provisioning service 108 uses the supplemental cryptographic identity to register one or more service systems 112 (e.g., a system providing IoT services, a system providing cloud services, an IoT hub) with the networked device 100. The device provisioning service 108 also returns the supplemental cryptographic identity as the buyer identity 102. Thereafter, the networked device 100 can access the same service system 112 by providing the supplemental cryptographic identity (i.e., the buyer identity) to those services.

[0021] Figure 2 An example device provisioning service system 200 is illustrated. A networked device 202 transmits an identity issuance request 204 to a device communication interface 206 of the device provisioning service system 200. An identity processing subsystem 208 receives the identity issuance request 204 (with the initial cryptographic identity) from the device communication interface 206 and attempts to verify the identity issuance request 204 using configuration information stored in an initial registration record 210 that is associated with the initial cryptographic identity. The verification may include challenging the networked device 202 to verify that the initial cryptographic identity belongs to it, and / or verifying that the identity issuance request 204 has been validly signed by the networked device 202.

[0022] If the identity processing subsystem 208 verifies the identity issuance request 204, the identity processing subsystem 208 requests the supplemental cryptographic identity 212 from the supplemental cryptographic identity issuer 214 (e.g., using the identity issuance request 211) through the identity issuer interface 216 of the device provisioning service system 200. For example, the supplemental cryptographic identity issuer 214 can be a local or remote certificate authority. The identity processing subsystem 208 can also specify (e.g., using the identity issuance request 211) an intermediate root of the certificate chain maintained by the supplemental cryptographic identity issuer 214 so that the supplemental cryptographic identity 212 is created from the intermediate node.

[0023] The identity processing subsystem 208 receives the supplemental cryptographic identity 212 from the supplemental cryptographic identity issuer 214 through the identity issuer interface 216 and associates the supplemental cryptographic identity with a supplemental registration record 218. The supplemental registration record 218 stores configuration information (e.g., provisioning information for the identity, verification information for the identity) associated with the supplemental cryptographic identity 212. Thus, the configuration information in the supplemental registration record 218 can be used to provision, verify future requests from the networked device 202, and otherwise interact with the networked device 202 based on the supplemental cryptographic identity 212, in which the networked device 202 presents the supplemental cryptographic identity 212.

[0024] Thus, the provisioning subsystem 220 can retrieve the provisioning information from the supplemental registration record 218 and communicate with one or more service systems 222 via the registration interface 224 to provision the networked device 202 to the one or more service systems 222 based on the supplemental cryptographic identity 212. In one embodiment, such provisioning includes registering the networked device 202 to the one or more service systems 222 using the supplemental cryptographic identity 212. The device provisioning service system 200 also returns the supplemental cryptographic identity 212 to the networked device 202, which can use the supplemental cryptographic identity 212 to access the one or more service systems 222.

[0025] All described interfaces and subsystems may be implemented using a combination of hardware and / or software executed on hardware.

[0026] Figure 3 Example operations 300 for provisioning a networked device using a supplemental cryptographic identity are illustrated. A storage operation 302 stores an initial registration record and a supplemental registration record at a device provisioning service. The initial registration record is associated with the initial cryptographic identity (e.g., stored in association with the initial cryptographic identity, including verification parameters associated with the initial cryptographic identity). The supplemental registration record is associated with the supplemental cryptographic identity (e.g., stored in association with the supplemental cryptographic identity, including verification parameters associated with the supplemental cryptographic identity, including provisioning information associated with the supplemental cryptographic identity).

[0027] A receiving operation 304 receives an identity issuance request from a networked device at a device provisioning service (e.g., via a device communication interface). An identity issuance request operation 306 requests a supplemental cryptographic identity from a supplemental cryptographic identity issuer identified in the initial registration record. The request may be conditional on successful verification of the identity issuance request received from the networked device. The request may also specify an intermediate root of a certificate chain or some similar parameter to further characterize the requested identity.

[0028] Another receiving operation 308 receives the requested supplemental cryptographic identity from the supplemental cryptographic identity issuer. A provisioning operation 310 provisions the networked device to access one or more service systems based on the supplemental registration record. In one embodiment, the provisioning operation 310 registers the networked device with the one or more service systems using the supplemental cryptographic identity. A responding operation 312 transmits the supplemental cryptographic identity to the networked device, which can use the supplemental cryptographic identity to access the one or more service systems.

[0029] Figure 4 An example communication device 400 for implementing the features and operations of the described techniques is illustrated. The communication device 400 is an example networking device and can be a client device such as a laptop, mobile device, desktop computer, tablet; server / cloud device; Internet of Things device; electronic accessory; or other electronic device. The communication device 400 includes one or more processors 402 and memory 404. The memory 404 typically includes volatile memory (e.g., RAM) and non-volatile memory (e.g., flash memory). An operating system 410 resides in the memory 404 and is executed by the processor 402.

[0030] In the example communication device 400, as Figure 4 As shown, one or more modules or segments, such as application 450 and other modules, are loaded into operating system 410 on memory 404 and / or storage device 420 and executed by processor 402. Storage device 420 includes one or more tangible storage media devices and can store registration records, identities, configuration information, cryptographic data elements, and other data, and can be local to communication device 400, or can be remote and communicatively connected to communication device 400.

[0031] The communication device 400 includes a power supply 416, which is powered by one or more batteries or other power sources and provides power to other components of the communication device 400. The power supply 416 can also be connected to an external power source or charge an internal battery or other power source.

[0032] The communication device 400 may include one or more communication transceivers 430, which may be connected to one or more antennas 432 to provide network connectivity (e.g., mobile phone networks, Bluetooth ). The communication device 400 may also include a network adapter 436, which is a type of communication device. The communication device 400 may use an adapter and any other type of communication device to establish a connection on a wide area network (WAN) or a local area network (LAN). It should be understood that the network connections shown are exemplary and that other communication devices and components for establishing a communication link between the communication device 400 and other devices may be used.

[0033] The communication device 400 may include one or more input devices 434 (e.g., a keyboard or mouse) to allow a user to enter commands and information. These and other input devices may be coupled to a server via one or more interfaces 438 (such as a serial port interface, a parallel port, or a universal serial bus (USB)). The communication device 400 may also include a display 422, such as a touch screen display.

[0034] The communication device 400 may include various tangible processor-readable storage media and intangible processor-readable communication signals. Tangible processor-readable storage may be implemented by any available media accessible to the communication device 400, and includes volatile and non-volatile storage media, removable and non-removable storage media. Tangible processor-readable storage media do not include communication signals, and include volatile and non-volatile, removable and non-removable storage media implemented by any method or technology for storing information such as processor-readable instructions, data structures, program modules or other data. Tangible processor-readable storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other storage technology, CDROM, digital versatile disk (DVD) or other optical disk storage, cassettes, tapes, disk storage or other magnetic storage devices, or any other tangible media that can be used to store the desired information and can be accessed by the communication device 400. In contrast to tangible processor-readable storage media, intangible processor-readable communication signals may be implemented as processor-readable instructions, data structures, program modules or other data residing in a modulated data signal (such as a carrier wave or other signal transmission mechanism). The term "modulated data signal" refers to a signal that has one or more of its characteristics set or changed in such a way as to encode information in the signal. By way of example and not limitation, intangible communication signals include signals propagated through wired media (such as a wired network or direct-wired connection) and wireless media (such as acoustic, RF, infrared and other wireless media).

[0035] Although this specification contains many specific implementation details, these should not be interpreted as limitations on the scope of any invention or what may be claimed, but rather as descriptions of features specific to particular embodiments of the described technology. Specific features described in the context of separate embodiments in this specification may also be implemented in combination in a single embodiment. Conversely, the various features described in the context of a single embodiment may also be implemented in multiple embodiments individually or in any suitable sub-combination. In addition, although features may be described above as working in a particular combination and even initially claimed as such, one or more features from the claimed combination may be deleted from the combination in some cases, and the claimed combination may be directed to a sub-combination or a variant of a sub-combination.

[0036] Similarly, although operations are depicted in a particular order in the accompanying drawings, this should not be understood as requiring that the operations be performed in the particular order shown or in sequence, or that all of the operations shown be performed to obtain the desired results. In certain circumstances, multitasking and parallel processing can be advantageous. In addition, the separation of the various system components in the above-described embodiments should not be understood as requiring such separation in all embodiments, but it should be understood that the described program components and systems can generally be integrated into a software product or packaged into multiple software products.

[0037] An example method for provisioning a networked device to access one or more service systems using a supplemental cryptographic identity of the networked device is provided. The method includes: storing a supplemental registration record and an initial registration record associated with an initial cryptographic identity in a device provisioning service. Receiving an identity issuance request from the networked device at the device provisioning service, the identity issuance request including the initial cryptographic identity. Based on the identity issuance request, requesting a supplemental cryptographic identity from a supplemental cryptographic identity issuer identified in the initial registration record. Receiving the requested supplemental cryptographic identity from the supplemental cryptographic identity issuer at the device provisioning service. Based on the supplemental registration record, the networked device is provisioned to access one or more service systems. The supplemental cryptographic identity is transmitted to the networked device.

[0038] Another example method of any preceding method is provided wherein the initial enrollment record identifies a supplemental cryptographic identity issuer and further includes determining the supplemental cryptographic identity issuer from the initial enrollment record prior to requesting the supplemental cryptographic identity from the supplemental cryptographic identity issuer.

[0039] Another example method of any of the foregoing methods further includes associating, at the device provisioning service, the supplemental registration record with the supplemental cryptographic identity issuer in response to receiving the supplemental cryptographic identity.

[0040] Another example method of any of the foregoing methods also includes: cryptographically challenging the networked device to verify the cryptographic identity initially included in the identity issuance request, and in response to the cryptographic challenge and before requesting the supplemental cryptographic identity, determining using the initial registration record that the networked device has successfully verified the initial cryptographic identity.

[0041] Another example method of any of the foregoing methods further includes, prior to requesting the supplemental cryptographic identity, determining that the identity issuance request has been validly signed by the networked device.

[0042] Another example method of any preceding method is provided, wherein the identity issuance request includes an identifier of a device provisioning service.

[0043] Another example method of any of the foregoing methods is provided, wherein provisioning includes registering the networked device with one or more service systems based on the supplemental cryptographic identity.

[0044] An example device provisioning system is provided for provisioning a networked device using a supplementary cryptographic identity of the networked device to access one or more service systems. The device provisioning system includes one or more hardware processors and one or more tangible data storage media, the tangible data storage media being configured to store an initial registration record and a supplementary registration record associated with the initial cryptographic identity. A device communication interface is configured for communication with the networked device. A registration interface is configured for communication with one or more service systems. An identity provider interface is configured to communicate with one or more supplementary cryptographic identity issuers. An identity processor subsystem is executed by one or more hardware processors and is coupled to the device communication interface to receive an identity issuance request from the networked device at the device provisioning system. The identity issuance request includes the initial cryptographic identity. The identity processor subsystem is also coupled to the identity provider interface to request a supplementary cryptographic identity from a supplementary cryptographic identity issuer identified in the initial registration record based on the identity issuance request, to receive the requested supplementary cryptographic identity from the supplementary cryptographic identity issuer at the device provisioning system, and to transmit the supplementary cryptographic identity to the networked device via the device communication interface. The provisioning subsystem is executed by one or more hardware processors and is coupled to one or more tangible data storage media and a registration interface to provision a networked device to access one or more service systems according to a supplemental registration record.

[0045] Another example device provisioning system of any of the foregoing systems is provided wherein the initial enrollment record identifies a supplemental cryptographic identity issuer and the identity processor subsystem is configured to determine the supplemental cryptographic identity issuer from the initial enrollment record prior to requesting the supplemental cryptographic identity from the supplemental cryptographic identity issuer.

[0046] Another example device provisioning system of any of the foregoing systems is provided, wherein the provisioning subsystem is configured to: in response to receipt of the supplemental cryptographic identity by the identity processor subsystem, associate at the device provisioning system the supplemental enrollment record with the supplemental cryptographic identity issuer.

[0047] Another example device provisioning system of any of the foregoing systems is provided, wherein the identity processor subsystem is configured to: cryptographically challenge the networked device to verify an initial cryptographic identity included in an identity issuance request, and in response to the cryptographic challenge and before requesting a supplemental cryptographic identity, determine that the networked device has successfully verified the initial cryptographic identity using an initial registration record.

[0048] Another example device provisioning system of any of the foregoing systems is provided, wherein the identity processor subsystem is configured to: determine, prior to requesting the supplemental cryptographic identity, that the identity issuance request has been validly signed by the networked device.

[0049] Another example device provisioning system of any of the foregoing systems is provided, wherein the identity issuance request includes an identifier of the device provisioning system.

[0050] Another example device provisioning system of any of the foregoing systems is provided, wherein the provisioning subsystem is further configured to: register the networked device with one or more service systems based on the supplemental cryptographic identity.

[0051] One or more example tangible processor-readable storage media of a tangible article encode processor-executable instructions for performing a process on an electronic computing device to provision a networked device to access one or more service systems using a supplemental cryptographic identity of the networked device. The process includes storing a supplemental registration record and an initial registration record associated with an initial cryptographic identity in a device provisioning service. An identity issuance request is received from the networked device at the device provisioning service, the identity issuance request including the initial cryptographic identity. Based on the identity issuance request, a supplemental cryptographic identity is requested from a supplemental cryptographic identity issuer identified in the initial registration record. The requested supplemental cryptographic identity is received from the supplemental cryptographic identity issuer at the device provisioning service. Based on the supplemental registration record, the networked device is provisioned to access one or more service systems. The supplemental cryptographic identity is transmitted to the networked device.

[0052] Other one or more example tangible processor-readable storage media of any of the foregoing storage media are provided, wherein the initial registration record identifies a supplemental cryptographic identity issuer. The process also includes determining the supplemental cryptographic identity issuer from the initial registration record prior to requesting the supplemental cryptographic identity from the supplemental cryptographic identity issuer.

[0053] Other one or more example tangible processor-readable storage media of any of the foregoing storage media are provided wherein the process further comprises associating, at the device provisioning service, the supplemental registration record with the supplemental cryptographic identity issuer in response to receiving the received supplemental cryptographic identity.

[0054] Other one or more example tangible processor-readable storage media of any of the foregoing storage media are provided, wherein the process further comprises: cryptographically challenging the networked device to verify an initial cryptographic identity included in the identity issuance request, and in response to the cryptographic challenge and before requesting a supplemental cryptographic identity, using the initial registration record to determine that the networked device has successfully verified the initial cryptographic identity.

[0055] Other one or more example tangible processor-readable storage media of any of the foregoing storage media are provided, wherein the process further comprises determining, prior to requesting the supplemental cryptographic identity, that the identity issuance request is validly signed by the networked device.

[0056] One or more other example tangible processor-readable storage media of any of the foregoing storage media are provided, wherein provisioning includes registering the networked device with one or more service systems based on the supplemental cryptographic identity.

[0057] An example system is provided for provisioning a networked device to access one or more service systems using a supplemental cryptographic identity of the networked device. The system includes: a component for storing a supplemental registration record and an initial registration record associated with an initial cryptographic identity in a device provisioning service, and a component for requesting an identity issuance request from the networked device at the device provisioning service, the identity issuance request including the initial cryptographic identity. The system also includes: a component for requesting a supplemental cryptographic identity from a supplemental cryptographic identity issuer identified in the initial registration record based on the identity issuance request. The system also includes: a component for receiving the requested supplemental cryptographic identity from the supplemental cryptographic identity issuer at the device provisioning service. The system also includes: a component for provisioning a networked device to access one or more service systems based on the supplemental registration record. The system also includes: a component for transmitting the supplemental cryptographic identity to the networked device.

[0058] Another example system of any of the foregoing systems is provided wherein the initial enrollment record identifies a supplemental cryptographic identity issuer and further includes means for determining the supplemental cryptographic identity issuer from the initial enrollment record prior to requesting the supplemental cryptographic identity from the supplemental cryptographic identity issuer.

[0059] Another example system of any of the foregoing systems also includes means for associating, at the device provisioning service, the supplemental registration record with the supplemental cryptographic identity issuer in response to receiving the received supplemental cryptographic identity.

[0060] Another example system of any of the foregoing systems also includes: a component for cryptographically challenging the networked device to verify the initial cryptographic identity included in the identity issuance request, and a component for responding to the cryptographic challenge and determining that the networked device has successfully verified the initial cryptographic identity using the initial registration record before requesting a supplemental cryptographic identity.

[0061] Another example system of any of the foregoing systems further includes means for determining, prior to requesting the supplemental cryptographic identity, that the identity issuance request has been validly signed by the networked device.

[0062] Another example system of any of the foregoing systems is provided, wherein the identity issuance request includes an identifier of a device provisioning service.

[0063] Another example system of any of the foregoing systems is provided, wherein provisioning includes means for registering a networked device to one or more service systems based on the supplemental cryptographic identity.

[0064] Thus, certain embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired results. Furthermore, the processes described in the accompanying drawings do not necessarily require the particular order or sequential order shown to achieve the desired results. In certain implementations, multitasking and parallel processing may be advantageous.

[0065] A number of implementations of the technology have been described. However, it will be appreciated that various modifications can be made without departing from the spirit and scope of the following claims.

Claims

1. A method for provisioning a networked device to access one or more service systems using a supplemental cryptographic identity of the networked device, the method comprising: storing the supplemental registration record in a device provisioning service along with the initial registration record associated with the initial cryptographic identity of the networked device; receiving, at the device provisioning service, an identity issuance request from the networked device, the identity issuance request including the initial cryptographic identity; cryptographically challenging the networked device at the device provisioning service to verify the initial cryptographic identity included in the identity issuance request; requesting the supplemental cryptographic identity from a supplemental cryptographic identity issuer identified in the initial registration record based on the identity issuance request; receiving, at the device provisioning service, the requested supplemental cryptographic identity from the supplemental cryptographic identity issuer; provisioning the networked device to access the one or more service systems based on the supplemental registration record; as well as The supplemental cryptographic identity is transmitted to the networked device.

2. The method of claim 1, wherein the initial registration record identifies the supplemental cryptographic identity issuer, and further comprising: Prior to requesting the supplemental cryptographic identity from the supplemental cryptographic identity issuer, determining the supplemental cryptographic identity issuer from the initial registration record.

3. The method according to claim 1, further comprising: In response to receiving the received supplemental cryptographic identity, associating the supplemental registration record with the supplemental cryptographic identity issuer at the device provisioning service.

4. The method according to claim 1, further comprising: In response to the cryptographic challenge and before requesting the supplemental cryptographic identity, determining that the networked device has successfully authenticated the initial cryptographic identity using the initial registration record.

5. The method according to claim 1, further comprising: Prior to requesting the supplemental cryptographic identity, determining that the identity issuance request is validly signed by the networked device. The method of claim 1 , wherein the identity issuance request includes an identifier of the device provisioning service.

7. The method of claim 1, wherein the supplying comprises: The network-connected device is registered with the one or more service systems based on the supplemental cryptographic identity.

8. A device provisioning system for provisioning a networked device to access one or more service systems using a supplemental cryptographic identity of the networked device, the device provisioning system comprising: one or more hardware processors; one or more tangible data storage media configured to store a supplemental registration record and an initial registration record associated with an initial cryptographic identity of the networked device; A device communication interface configured for communication with the networked device; a registration interface configured for communication with the one or more service systems; an identity provider interface configured to communicate with one or more supplemental cryptographic identity issuers; an identity processor subsystem executed by the one or more hardware processors and coupled to the device communication interface to receive an identity issuance request from the networked device at the device provisioning system, the identity issuance request including the initial cryptographic identity, the identity processor subsystem being configured to cryptographically challenge the networked device to verify the initial cryptographic identity included in the identity issuance request, the identity processor subsystem being further coupled to the identity provider interface to request the supplemental cryptographic identity from the supplemental cryptographic identity issuer identified in the initial registration record based on the identity issuance request, to receive the requested supplemental cryptographic identity from the supplemental cryptographic identity issuer at the device provisioning system, and to transmit the supplemental cryptographic identity to the networked device via the device communication interface; as well as A provisioning subsystem, executed by the one or more hardware processors and coupled to the one or more tangible data storage media and the registration interface, provisions the networked device to access the one or more service systems based on the supplemental registration record.

9. The device provisioning system of claim 8, wherein the initial registration record identifies the supplemental cryptographic identity issuer, and the identity processor subsystem is configured to determine the supplemental cryptographic identity issuer from the initial registration record before requesting the supplemental cryptographic identity from the supplemental cryptographic identity issuer.

10. The device provisioning system of claim 8, wherein the provisioning subsystem is configured to, in response to the identity processor subsystem receiving the supplemental cryptographic identity, associate the supplemental registration record with the supplemental cryptographic identity issuer at the device provisioning system.

11. The device provisioning system of claim 8, wherein the identity processor subsystem is configured to: in response to the cryptographic challenge and before requesting the supplemental cryptographic identity, determine using the initial registration record that the networked device has successfully authenticated the initial cryptographic identity.

12. The device provisioning system of claim 8, wherein the identity processor subsystem is configured to: determine that the identity issuance request has been validly signed by the networked device before requesting the supplemental cryptographic identity.

13. The device provisioning system of claim 8, wherein the identity issuance request includes an identifier of the device provisioning system.

14. The device provisioning system of claim 8, wherein the provisioning subsystem is further configured to: register the networked device with the one or more service systems based on the supplemental cryptographic identity.

15. One or more tangible processor-readable storage media of a tangible article of manufacture encoding processor-executable instructions for performing, on an electronic computing device, a process for provisioning a networked device using a supplemental cryptographic identity of the networked device to access one or more service systems, the process comprising: storing the supplemental registration record in a device provisioning service along with the initial registration record associated with the initial cryptographic identity of the networked device; receiving, at the device provisioning service, an identity issuance request from the networked device, the identity issuance request including the initial cryptographic identity; cryptographically challenging the networked device at the device provisioning service to verify the initial cryptographic identity included in the identity issuance request; requesting the supplemental cryptographic identity from a supplemental cryptographic identity issuer identified in the initial registration record based on the identity issuance request; receiving, at the device provisioning service, the requested supplemental cryptographic identity from the supplemental cryptographic identity issuer; provisioning the networked device to access the one or more service systems based on the supplemental registration record; as well as The supplemental cryptographic identity is transmitted to the networked device.

16. The one or more tangible processor-readable storage media of claim 15, wherein the initial registration record identifies the supplemental cryptographic identity issuer, and the process further comprises: Prior to requesting the supplemental cryptographic identity from the supplemental cryptographic identity issuer, determining the supplemental cryptographic identity issuer from the initial registration record.

17. The one or more tangible processor-readable storage media of claim 15, wherein the process further comprises: In response to receiving the received supplemental cryptographic identity, associating the supplemental registration record with the supplemental cryptographic identity issuer at the device provisioning service.

18. The one or more tangible processor-readable storage media of claim 15, wherein the process further comprises: In response to the cryptographic challenge and before requesting the supplemental cryptographic identity, determining that the networked device has successfully authenticated the initial cryptographic identity using the initial registration record.

19. The one or more tangible processor-readable storage media of claim 15, wherein the process further comprises: Prior to requesting the supplemental cryptographic identity, determining that the identity issuance request is validly signed by the networked device.

20. The one or more tangible processor-readable storage media of claim 15, wherein the providing further comprises: The network-connected device is registered with the one or more service systems based on the supplemental cryptographic identity.

Images