Cryptographic Token for Zero Touch Device Enrollment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing networking devices require user intervention for enrollment in services, such as manually entering serial numbers or scanning codes, and often need secure cryptoprocessors for authentication, which incurs additional costs and complexity.
Innovation Solution
The solution involves generating a cryptographically signed token during manufacturing, stored in the device's ROM, which allows automatic enrollment without a secure cryptoprocessor, using a JSON Web Token (JWT) that includes the device's serial number and private key information, enabling secure authentication and provisioning upon first power-up and internet connection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a secure cryptoprocessor (TPM) is added to the networking device for secure authentication, then security is improved, but device cost and complexity increase
Solution Approach 1:
A cryptographically signed token is generated during manufacturing and stored in the device's ROM before deployment. This preliminary action embeds the authentication credentials directly into the device, eliminating the need for a separate secure cryptoprocessor while maintaining security. The token contains a signature that verifies the device's identity during enrollment.
Solution Approach 2:
Instead of using a physical secure cryptoprocessor, the patent creates a cryptographic copy of the authentication functionality through a signed token. The token replicates the security function by containing a digital signature that can be verified by the service, effectively copying the authentication capability without requiring dedicated hardware security modules.
2Reliability
If manual user intervention is required for device enrollment (typing serial number or scanning code), then security is maintained, but ease of operation and productivity deteriorate
Solution Approach 1:
The device performs self-enrollment automatically without requiring user intervention. Upon first power-up and connection to the service, the device autonomously presents its pre-configured signed token for authentication. The enrollment process is initiated and completed automatically by the device itself, eliminating the need for users to manually enter serial numbers or scan codes.
Solution Approach 2:
The device is pre-configured during manufacturing with a cryptographically signed token that enables automatic authentication. This preliminary configuration allows the device to self-enroll when first connected to the service, removing the need for manual user actions during deployment.
3Device complexity
If manual user intervention is required for device enrollment, then device complexity is kept simple, but productivity and ease of operation worsen
Solution Approach 1:
The signed token is generated and embedded in the device's ROM during manufacturing, before the device is deployed. This preliminary action prepares the device for automatic enrollment, allowing it to quickly authenticate and join the service upon first power-up without requiring manual user input, thereby significantly improving enrollment productivity.
Solution Approach 2:
The device autonomously handles the enrollment process by automatically presenting its pre-configured token to the service. This self-service capability eliminates the need for manual intervention and accelerates the enrollment process, improving productivity without adding significant complexity to the device.
Data Source
AI summary
Cryptographically identifying a device to a service includes: providing the cloud service with a cryptographically signed token, the token being embedded in the device when the device was manufactured, the token including first information and second information. The cloud service verifies the token using a public key associated with the second information and determines a user using the first information. The device receives, from the cloud service, provisioning information customized for the user and including a client certificate for communicating with the cloud service.