Systems and methods for authenticating devices

A system for authenticating devices, the system comprising:

• a memory;
• an identification module, stored in the memory, programmed to identify, at a computing system, a request from a device for a credentialing service to issue a credential to the device, the request comprising an application identifier encrypted with a first encryption key, the first encryption key having been derived by the device based on a token provisioned to the device by a vendor of the device;
• a transmission module, stored in the memory, programmed to transmit, from the computing system, the request to the credentialing service, wherein the credentialing service responds to the request by encrypting the credential with a second encryption key that was derived based on the token and by sending the encrypted credential to the computing system;
• a receiving module, stored in the memory, programmed to receive, at the computing system and from the credentialing service, the credential encrypted with the second encryption key, wherein the vendor has registered an application identified by the application identifier with the credentialing service;
• a providing module, stored in the memory, programmed to provide, from the computing system, the encrypted credential to the device, wherein the device derives the second encryption key based on the token and uses the second encryption key to decrypt the encrypted credential;
• and
• at least one hardware processor configured to execute the identification module, the transmission module, the receiving module, and the providing module.

A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• identify, at a computing system, a request from a device for a credentialing service to issue a credential to the device, the request comprising an application identifier encrypted with a first encryption key, the first encryption key having been derived by the device based on a token provisioned to the device by a vendor of the device,
• transmit, from the computing system, the request to the credentialing service, wherein the credentialing service responds to the request by encrypting the credential with a second encryption key that was derived based on the token and by sending the encrypted credential to the computing system;
• receive, at the computing system and from the credentialing service, the credential encrypted with the second encryption key, wherein the vendor has registered an application identified by the application identifier with the credentialing service,
• provide, from the computing system, the encrypted credential to the device, wherein the device derives the second encryption key based on the token and uses the second encryption key to decrypt the encrypted credential.