Cryptographic trust enabled devices of cybersecurity systems

A method comprising:

• receiving, by a processor of a device, from a secrets and service provider system via a brokering agent, an encrypted version of a first set of secrets data corresponding to a target supply chain state of the device associated with a target stage of a supply chain lifecycle of the device;
• in response to receiving the encrypted version of the first set of secrets data, requesting, by the processor from the secrets and service provider system via the brokering agent, a permission to cause a transition to the target supply chain state;
• receiving, by the processor from the secrets and service provider system via the brokering agent, the permission to cause the transition to the target supply chain state;
• and
• in response to receiving the permission to cause the transition to the target supply chain state, causing, by the processor, the transition to the target supply chain state, including:
• storing the first set of secrets data in a protected memory of the device;
• and
• cryptographically sealing a second set of secrets data in the protected memory, wherein the second set of secrets data corresponds to a previous target supply chain state of the device associated with a previous stage of the supply chain lifecycle of the device.

A non-transitory computer-readable storage medium comprising instructions that, when executed by a processing device, cause the processing device to perform operations comprising:

• receiving, from a secrets and service provider system via a brokering agent, an encrypted version of a first set of secrets data corresponding to a target supply chain state of a device associated with a target stage of a supply chain lifecycle of the device;
• in response to receiving the encrypted version of the first set of secrets data, requesting, from the secrets and service provider system via the brokering agent, a permission to cause a transition to the target supply chain state;
• receiving, from the secrets and service provider system via the brokering agent, the permission to cause the transition to the target supply chain state;
• in response to receiving the permission to cause the transition to the target supply chain state, obtaining a decrypted version of the first set of secrets data;
• storing the decrypted version of the first set of secrets data in a protected memory of the device;
• cryptographically sealing a second set of secrets data maintained in the protected memory corresponding to a previous supply chain state associated with a previous stage of the supply chain lifecycle of the device;
• and
• updating a supply chain state maintained by a state machine to reflect the transition to the target supply chain state.