Systems, methods, and devices for multi-stage provisioning and multi-tenant operation for a security credential management system
Inventors
Fynaardt, Daniel R. • Lattin, William L. • Powell, Gregory
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-11153103-B2
Publication Date
2021-10-19
Expiration Date
Abstract
A system for provisioning computerized devices of a plurality of tenants is provided. The system includes a security credential management system (SCMS) host connected to the devices and that is operable to receive provisioning requests from respective ones of the devices needing certificates, each provisioning request indicating a tenant identifier uniquely identifying a tenant, at least one registration authority that is communicatively connected to the SCMS host and transmits the provisioning requests to SCMS backend components based on the tenant identifier of each provisioning request. The SCMS backend components includes a plurality of enrollment certificate authorities operable to generate the enrollment certificates in response to the provisioning requests, each provisioning request being transmitted to one of the plurality of enrollment certificate authorities based on the tenant identifier of each provisioning request, and a pseudonym certificate authority operable to generate pseudonym certificates in response to provisioning requests for pseudonym certificates.
Core Innovation
A security credential management system (SCMS) host receives tenant-specific provisioning requests for certificates from computerized devices, where each provisioning request indicates a tenant identifier uniquely identifying a tenant among a plurality of tenants. The SCMS host transmits each provisioning request to a registration authority corresponding to the tenant identifier, and the registration authority forwards each transmitted provisioning request to a set of SCMS backend components associated with the registration authority, based on the tenant identifier.
The set of SCMS backend components comprises an enrollment certificate authority operable to generate an enrollment certificate in response to receiving a provisioning request for an enrollment certificate, and a pseudonym certificate authority operable to generate pseudonym certificates in response to receiving a provisioning request for pseudonym certificates. The SCMS host tracks a number of computerized devices provisioned for each tenant based on the provisioning requests and verifies, based on the tracking, that overproduction by the tenant has not occurred.
The SCMS host can further verify whether a computerized device associated with a provisioning request is approved by an authorizing body based on the device type prior to sending or routing the provisioning request to the registration authority. The system can also verify approval by accessing tenant-account information based on the tenant identifier and verify whether the computerized device has an active status. Local policy files can be configured based on the provisioning request, including certificate validity duration, certificate quantity limits, overlap time period, future validity time, and when a tenant must request a certificate top-off, with control to prevent unauthorized provisioning and overproduction.
Claims Coverage
The partial independent-claim set contains three independent claims covering tenant-scoped certificate provisioning using SCMS host routing to registration authorities and SCMS backend components for enrollment and pseudonym certificates. The independent claims collectively introduce device-type-based approval and device-type-scoped overproduction verification in addition to tenant-scoped tracking and verification.
Tenant-corresponding registration authority routing to backend certificate authorities with tenant overproduction verification
A registration authority corresponds to a tenant identifier (ID), and an SCMS host receives provisioning requests indicating the tenant ID and transmits the requests to the registration authority corresponding to the tenant ID; the registration authority forwards the requests to a set of SCMS backend components comprising an enrollment certificate authority and a pseudonym certificate authority; the SCMS host tracks a number of computerized devices provisioned for each tenant based on the provisioning requests and verifies, based on the tracking, that overproduction by the tenant has not occurred.
Device-type-based approval prior to registration authority routing with tenant-and-device-type overproduction verification
The SCMS host receives provisioning requests indicating a tenant identifier (ID) and a device type; the registration authority receives the provisioning request from the SCMS host based on the tenant ID and transmits the provisioning request to a set of SCMS backend components comprising an enrollment certificate authority and a pseudonym certificate authority; the SCMS host verifies whether a computerized device associated with the provisioning request is approved by an authorizing body based on the device type prior to sending the provisioning request to the registration authority; the SCMS host tracks a number of computerized devices provisioned for each tenant and each device type based on the provisioning requests; and the SCMS host verifies, based on the tracking, that overproduction has not occurred for a particular device type.
Method of receiving tenant-and-device-type provisioning requests, routing by tenant ID and device type, and verifying device-type overproduction
A computer implemented method receives, by an SCMS host, provisioning requests indicating a tenant identifier (ID) uniquely identifying a tenant and a device type identifying the device type, routes the provisioning requests based at least in part on the tenant ID and the device type to a registration authority that transmits the provisioning requests to a set of SCMS backend components comprising an enrollment certificate authority and a pseudonym certificate authority; the SCMS host verifies whether a computerized device associated with a provisioning request is approved by an authorizing body based on the device type prior to routing the provisioning request to the registration authority; counts a number of computerized devices provisioned for each tenant and each device type based on the provisioning requests; and verifies, based on the counting, that overproduction has not occurred for a particular device type.
Across the independent claims, the coverage centers on tenant-identified provisioning request reception at an SCMS host, routing to tenant-corresponding registration authorities, and generation of enrollment certificates and pseudonym certificates by backend certificate authorities. The independent claims further require SCMS-host tracking and verification to prevent overproduction, with an added device-type-based approval and overproduction verification for specific device types.
Stated Advantages
Prevents overproduction by the tenant.
Verifies overproduction has not occurred for a particular device type.
Supports secure provisioning by verifying approval of a computerized device based on device type prior to routing or sending provisioning requests.
Documented Applications
Multi-stage multi-tenant security credential management for provisioning digital certificates including V2X enrollment and pseudonym certificates.
Provisioning within architectures with shared vs dedicated registration authorities and backend components for tenant domains tied to service tier and customization or SLA/business requirements.
Certificate top-off with local policy file parameters including indications of when a tenant will need to request a certificate top-off.
Interested in licensing this patent?