Methods and systems for authenticating devices

A system for authenticating a device coupled to a computing system comprising at least one processor, the system comprising:

• an identification module programmed to identify, at a computing system, a request from a device for a credentialing service to issue a credential to the device, the request comprising an application identifier encrypted with a first encryption key, the first encryption key having been derived by the device based on a token provisioned to the device by a vendor of the device;
• a transmission module programmed to transmit, from the computing system, the request to the credentialing service, wherein the credentialing service responds to the request by encrypting the credential with a second encryption key that was derived based on the token and by sending the encrypted credential to the computing system;
• a receiving module programmed to receive, at the computing system and from the credentialing service, the credential encrypted using a second encryption key, wherein the vendor has registered an application identified by the application identifier with the credentialing service by transmitting the first encryption key, the second encryption key, the application identifier, and a vendor identifier to the credentialing service;
• a providing module programmed to provide, from the computing system, the encrypted credential to the device, wherein the device derives the second encryption key based on the token and uses the second encryption key to decrypt the encrypted credential;
• at least one hardware processor configured to execute the identification module, the transmission module, the receiving module, and the providing module.

A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• identify, at the computing system, a request from a device for a credentialing service to issue a credential to the device, the request comprising an application identifier encrypted with a first encryption key, the first encryption key having been derived by the device based on a token provisioned to the device by a vendor of the device;
• transmit, from the computing system, the request to the credentialing service, wherein the credentialing service responds to the request by encrypting the credential with a second encryption key that was derived based on the token and by sending the encrypted credential to the computing system;
• receive, at the computing system and from the credentialing service, the credential encrypted using a second encryption key, wherein the vendor has registered an application identified by the application identifier with the credentialing service by transmitting the first encryption key, the second encryption key, the application identifier, and a vendor identifier to the credentialing service;
• provide, from the computing system, the encrypted credential to the device, wherein the device derives the second encryption key based on the token and uses the second encryption key to decrypt the encrypted credential.