Registration of devices in secure domain

An endpoint apparatus for enrollment in a secure domain, the endpoint apparatus comprising hardware including an interface to data communications circuitry, a processor, and a data store containing instructions that, when executed, cause the hardware to:

• send an enrollment request to a delegated registrar (DR) device to initiate a trust-establishment procedure with the DR device to establish initial connectivity and an initial symmetric key to be shared between the DR and the endpoint apparatus;
• receive, from the DR device, limited-use credentials for group-access key establishment, and group connectivity parameters for interacting with a group administrator (GA) device, wherein the GA device controls membership in the secure domain and the group connectivity parameters;
• and
• perform a group-enrollment procedure via a communications connection with the GA device, wherein the endpoint apparatus provides the limited-use credentials to the GA device and receives, from the GA device, the group-access key.

A machine-implemented method for enrolling an endpoint device in a secure domain, the method being carried out by an endpoint device, and comprising:

• sending an enrollment request to a delegated registrar (DR) device to initiate a trust-establishment procedure with the DR device to establish initial connectivity and an initial symmetric key to be shared between the DR and the endpoint device;
• receiving, from the DR device, limited-use credentials for group-access key establishment, and group connectivity parameters for interacting with a group administrator (GA) device, wherein the GA device controls membership in the secure domain and the group connectivity parameters;
• and
• performing a group-enrollment procedure via a communications connection with the GA device, including providing the limited-use credentials to the GA device and receiving, from the GA device, the group-access key.