Provisioning secrets in an unsecured environment

A computer implemented method, comprising:

• in response to receiving an authorization request for a number of provisioning operations to provision devices from a provisioning engine, validating the authorization request using an identity key uniquely associated with the provisioning engine, each provisioning operation to generate provisioning data for provisioning a single device, wherein the authorization request includes a maximum sequence number indicating a maximum number of provisioning operations allowed in the provisioning engine;
• if the authorization request is validated, determining if the provisioning engine has performed the maximum number of provisioning operations;
• if the provisioning engine has performed the maximum number of provisioning operations, generating a sequence number indicating an authorized number of provisioning operations allowed for the provisioning engine in addition to the maximum number of provisioning operations, the sequence number being greater than the maximum sequence number;
• and
• sending the provisioning engine an authorization packet including the sequence number cryptographically signed using an authorization key, wherein the provisioning engine is limited to perform no more than the authorized number of provisioning operations in addition to the maximum number of provisioning operations.

A non-transitory computer-readable storage medium storing instructions that, when executed by a processor included in a computer, cause the computer to perform steps that include:

• updating, at the computer, a maximum sequence number in a configuration, the maximum sequence number updated to indicate credits for an additional number of provisioning operations authorized for the computer, wherein the maximum sequence number is updated increasingly in value to indicate the additional number of provisioning operations, each provisioning operation to generate provisioning data for provisioning a single device;
• in response to receiving a provisioning request to provision a device with provisioning data, validating the provisioning data based on the configuration;
• determining, by the computer, whether enough of the credits are left for an authorization of a provisioning operation via the maximum sequence number, wherein there is lack of credits for the authorization if the additional number of provisioning operations have been performed by the computer;
• and
• performing, by the computer, the provisioning operation to provision the device if the provisioning operation is authorized based on the credits left, wherein the provisioning data for the provisioning request is validated, the provisioning operation to generate personalized provisioning data for the device, and the personalized provisioning data is used specifically to provision the device.

A non-transitory computer-readable storage medium storing instructions that, when executed by a processor included in a computer, cause the computer to perform steps that include:

• in response to receiving an authorization request for a number of provisioning operations to provision devices from a provisioning engine, validating the authorization request using an identity key uniquely associated with the provisioning engine, each provisioning operation to generate provisioning data for provisioning a single device, wherein the authorization request includes a maximum sequence number indicating a maximum number of provisioning operations allowed by the provisioning engine;
• if the authorization request is validated, determining if the provisioning engine has performed the maximum number of provisioning operations;
• if the provisioning engine has performed the maximum number of provisioning operations, generating a sequence number indicating an authorized number of provisioning operations allowed for the provisioning engine in addition to the maximum number of provisioning operations, the sequence number being greater than the maximum sequence number;
• and
• sending the provisioning engine an authorization packet including the sequence number cryptographically signed using an authorization key, wherein the provisioning engine is limited to perform no more than the authorized number of provisioning operations in addition to the maximum number of provisioning operations.

A data processing system, comprising:

• a memory unit including instructions and a configuration;
• and
• a processing unit coupled to the memory unit through a bus to execute the instructions, wherein the instructions include:
• a configuration software module being configured to update a maximum sequence number in the configuration, the maximum sequence number updated to indicate credits for an additional number of provisioning operations authorized, wherein the maximum sequence number is updated increasingly to indicate the additional number of provisioning operations, each provisioning operation to generate provisioning data for provisioning a single device,
• an authorization software module being configured to, in response to receiving a provisioning request to provision a device with provisioning data, validate the provisioning data based on the configuration, and
• determine whether enough of the credits are left for an authorization of a provisioning operation via the maximum sequence number, wherein there is lack of credit for the authorization if the additional number of provisioning operations have been performed, and
• a provisioning software module being configured to perform the provisioning operation to provision the device if the provisioning operation is authorized based on the credits left, wherein the provisioning data for the provisioning request is validated by the authorization module, the provisioning operation to generate personalized provisioning data for the device, and the personalized provisioning data is used specifically to provision the device.

A data processing system, comprising:

• a memory unit including instructions;
• and
• a processing unit coupled to the memory unit through a bus to execute the instructions, wherein the instructions include:
• an authorization software handler module configured to
• validate an authorization request in response to receiving the authorization request for a number of provisioning operations to provision devices from a provisioning engine according to an identity key uniquely associated with the provisioning engine, each provisioning operation to generate provisioning data for provisioning a single device, wherein the authorization request includes a maximum sequence number indicating a maximum number of provisioning operations allowed by the provisioning engine, and
• determine, if the authorization request is validated, if the provisioning engine has performed the maximum number of provisioning operations,
• generate, if the provisioning engine has performed the maximum number of provisioning operations, a sequence number indicating an authorized number of provisioning operations allowed for the provisioning engine in addition to the maximum number of provisioning operations, the sequence number being greater than the maximum sequence number, and
• a provisioning engine interface software module configured to
• send the provisioning engine an authorization packet including the sequence number cryptographically signed using an authorization key, wherein the provisioning engine is limited to perform no more than the authorized number of provisioning operations in addition to the maximum number of provisioning operations.

A computer implemented method, comprising:

• updating, in a computer, a maximum sequence number in a configuration, the maximum sequence number updated to indicate indicating a maximum number of provisioning operations allowed by the computer, each provisioning operation to generate provisioning data for provisioning a single device;
• in response to a request for provisioning a device uniquely identified by a device identifier, determining, by the computer, whether there are enough credits to provision the device, wherein there are not enough credits available if the maximum number of provisioning operations have been performed by the computer;
• updating the maximum sequence number for additional credits to provision the device by the computer if there are not enough credits available, wherein the maximum sequence number is updated increasingly in value to indicate the additional credits;
• and performing, by the computer, a provisioning operation to provision the device if enough credits are available, the provisioning operation to generate personalized provisioning data based on the device identifier, wherein the personalized provisioning data can only be recovered and used by the device in order to provision the device in an attempt to establish an operating environment for the device.