Systems, methods, and devices for multi-stage provisioning and multi-tenant operation for a security credential management system
Inventors
Fynaardt, Daniel R. • Lattin, William L. • Powell, Gregory
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-12316785-B2
Publication Date
2025-05-27
Expiration Date
Abstract
The system for provisioning computerized devices of a tenant includes an enrollment certificate authority generating enrollment certificates in response to first provisioning requests for the enrollment certificates, a second certificate authority generating digital assets for onboard units and roadside units of the tenant in response to second provisioning requests from the computerized devices. A security credential management system platform, connected to the enrollment certificate authority and to the second certificate authority, receiving the first provisioning requests for enrollment certificates for the computerized devices, routing the first provisioning requests to the enrollment certificate authority based on the tenant identification (ID), receiving the second provisioning requests for digital assets for the computerized devices, and routing the second provisioning requests to the second certificate authority based on the device identifier. Each first provisioning request includes the tenant ID, and each second provisioning request includes a device identifier.
Core Innovation
The invention provides a system for securely provisioning a plurality of computerized devices of a tenant. The tenant is identified by a tenant identification (ID), and the system includes an enrollment certificate authority and a second certificate authority. The enrollment certificate authority generates enrollment certificates in response to first provisioning requests, while the second certificate authority generates digital assets for onboard units and roadside units of the tenant in response to second provisioning requests that include a device identifier.
A Security Credential Management System (SCMS) host platform is operably connected to the enrollment certificate authority and to the second certificate authority. The SCMS host platform receives first provisioning requests for enrollment certificates, where each first provisioning request includes a tenant identification (ID), and performs routing so that at least some of the first provisioning requests are routed to the enrollment certificate authority based on the tenant ID, and at least some of the second provisioning requests are routed to the second certificate authority based on the device identifier.
The invention further supports a multi-tenant architecture for provisioning digital assets across multiple stages of security credential management. It includes mechanisms such as a virtual registration authority and an abstraction layer for routing, tied to tenant ID and device identifier based operations. The documented content additionally includes tenant/device identification and policy enforcement, and it supports additional components such as optional certificate/linkage authority components and hardware isolation based on service tiers/SLAs.
Claims Coverage
The independent claims are directed to a system and a method that securely provision a plurality of computerized devices by using an SCMS host platform to route provisioning requests to different certificate authorities based on tenant ID and device identifier. The inventive features are centered on multi-stage request routing and tenant/device-specific digital asset generation, with additional refinements in dependent claims.
Tenant-based enrollment request routing to an enrollment certificate authority
The SCMS host platform receives the first provisioning requests for enrollment certificates for the plurality of computerized devices, each first provisioning request including a tenant identification (ID), and routes at least some of the first provisioning requests to the enrollment certificate authority based on the tenant ID.
Device-identifier-based digital asset request routing to a second certificate authority
The SCMS host platform receives the second provisioning requests for digital assets for the plurality of computerized devices, each second provisioning request including a device identifier, and routes at least some of the second provisioning requests to the second certificate authority based on the device identifier.
Multi-authority certificate authority generation for multi-stage provisioning
The enrollment certificate authority generates enrollment certificates in response to first provisioning requests, and the second certificate authority generates digital assets for onboard units and roadside units of the tenant in response to second provisioning requests that include a device identifier.
SCMS host platform operable connection to both certificate authorities
The SCMS host platform is operably connected to the enrollment certificate authority and to the second certificate authority for performing operations that include receiving and routing both first and second provisioning requests.
Across the independent claims, the key coverage is the combination of enrollment certificate generation by an enrollment certificate authority, digital asset generation by a second certificate authority, and SCMS host platform routing of first provisioning requests based on tenant ID and routing of second provisioning requests based on device identifier.
Stated Advantages
Not explicitly described in patent.
Documented Applications
Not explicitly described in patent.
Interested in licensing this patent?