Device Provisioning via Cryptographic Identity Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face challenges in ensuring the security of computing resources and data when using third-party manufactured hardware in their networks, as they lack assurance that the hardware is not compromised or tampered with during manufacturing or transit, potentially leading to rogue devices infiltrating their systems.
Innovation Solution
A system is implemented to authenticate and provision devices by generating a digital certificate using a cryptographic key pair, where the device is configured to network boot and request an operating system installation, and the system verifies the device's attributes and public key to ensure it matches expected trust criteria, issuing a digital certificate only if it meets these criteria.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If digital certificates are provided to third-party manufacturers for device authorization, then device provisioning capability is improved, but security risk increases due to potential rogue device creation
Solution Approach 1:
The system segments the authorization process into two distinct phases: (1) manufacturing phase where devices are provisioned with unique cryptographic identities and attributes, and (2) authorization phase where the authorization server verifies these attributes against authorized device profiles. This segmentation allows third-party manufacturers to provision devices without receiving actual digital certificates, eliminating the security risk while maintaining provisioning capability.
Solution Approach 2:
The authorization server acts as an intermediary between the third-party manufacturer and the network. Instead of providing digital certificates directly to manufacturers, the system uses the authorization server to verify device attributes and issue certificates only after successful verification. This intermediary role prevents rogue device creation while enabling seamless device authorization.
2Reliability
If comprehensive device verification is implemented to prevent rogue devices, then network security is improved, but device provisioning complexity increases
Solution Approach 1:
The system performs preliminary actions by embedding unique cryptographic identities and attributes into devices during the manufacturing phase. These pre-provisioned attributes serve as the basis for later verification by the authorization server, eliminating the need for complex verification procedures during device onboarding while maintaining high security standards.
3Productivity
If third-party manufacturers provision devices without verification, then provisioning speed is improved, but unauthorized device access increases
Solution Approach 1:
The system implements self-service by having devices automatically present their pre-provisioned cryptographic identities and attributes to the authorization server during the provisioning process. The authorization server automatically verifies these attributes against authorized device profiles and issues certificates without requiring manual verification, thereby maintaining high provisioning speed while preventing unauthorized access.
Data Source
AI summary
A device is provisioned and authorized for use on a network. The device may generate a cryptographic key and provide a digital certificate the cryptographic key, a hardware identifier, and attribute information and provide such information to an authorization host as part of the provisioning process. The authorization host may use attribute information to determine whether to authorize the device for use on the network, and whether the generated cryptographic key should be trusted for use on the network.