Auditing and permission provisioning mechanisms in a distributed secure asset-management infrastructure

An Appliance device comprising:

• a processor;
• and
• a network interface coupled to the processor and communicatively coupled to a Service device of a cryptographic manager (CM) system, wherein the processor is operable to:
• receive a Module over a network from the Service device, the Module is an application that securely provisions a data asset to a target device in an operation phase of a manufacturing lifecycle of the target device;
• receive a ticket over the network from the Service device, wherein the ticket is digital data that grants permission to the device to execute the Module;
• verify the ticket;
• and
• execute the Module when the ticket is verified, wherein the Module, when executed by the Appliance device, results in a secure construction of a sequence of operations to securely provision the data asset to the target device;
• and
• a hardware security module (HSM), and wherein the HSM is operable to:
• maintain a list of current tickets for each of ticket names known to the Appliance device;
• maintain a counter that is used to prevent replay attacks;
• and
• receive a second ticket-related message to grant a new ticket to the HSM.

A Service device comprising:

• a processor;
• and
• a network interface coupled to the processor and communicatively coupled over a network to an Appliance device of a cryptographic manager (CM) system, wherein the processor is operable to:
• associate a ticket type with a pre-computed data (PCD) asset for a target device;
• send a Module, the PCD and a ticket over the network to the Appliance device in the CM system, wherein the ticket is a digital data that grants permission to the Appliance device to execute the Module, wherein the ticket specifies a current ticket type, wherein the Module is an application that securely provisions the PCD to the target device in an operation phase of a manufacturing lifecycle of the target device, wherein the Appliance device is to verify that the current ticket type in the ticket matches the ticket type specified in the PCD asset;
• and
• send a ticket-related message over the network to the Appliance to grant a new ticket for a hardware security module (HSM) of the Appliance device, the HSM maintains a list of current tickets for each of ticket names known to the Appliance device and maintains a counter that is used to prevent replay attacks.