Secure cloud based multi-tier provisioning

A computing system, comprising:

• a networked device configured to operate according to a set of configuration parameter values for corresponding configuration parameters;
• a provisioning server configured to:
• generate an activation key for a set of networked devices that includes the networked device;
• store the activation key in server-side storage medium;
• create an application configuration for the networked device comprising the set of configuration parameter values by:
• collecting first configuration parameter values for the networked device from a first entity and second configuration parameter values for the networked device from a second entity;
• storing the configuration parameter values in server side computer storage medium;
• and
• controlling access to the computer storage medium such that the second entity is prevented from reading the first configuration value;
• receive, from a customer entity device, an identifier for an authorized installation entity;
• receive, using a first network connection, from an installation device that is different from the set of networked devices and the customer entity device, valid credentials for the authorized installation entity;
• determine, based at least on the valid credentials, that the entity is the authorized installation entity;
• when it is determined that the entity is the authorized installation entity enable input of a networked device identifier and an activation key on the installation device;
• receive the networked device identifier and dynamic configuration parameter values from the installation device, where the dynamic configuration parameter values depend on an environment in which the networked device is deployed;
• verify the dynamic configuration parameter values;
• and
• prior to transmitting the application configuration to the networked device, add the dynamic configuration parameter values to the set of configuration parameter values in the application configuration;
• receive the activation key from an anonymous access level on the installation device;
• in response to receiving the activation key and networked device identifier from the installation device, make a second network connection to the networked device;
• transmit the application configuration comprising the configuration parameter values to the networked device such that the application configuration is not transmitted to the installation device.

A non-transitory computer-readable storage medium storing computer-executable instructions that when executed by a computer cause the computer to perform corresponding functions, the instructions comprising:

• generating an activation key for a set of networked devices;
• storing the activation key in server-side computer storage medium;
• storing, in the server side computer storage medium, a set of configuration parameter values associated with an application to be run by a networked device in the set of networked devices;
• managing access to the computer storage medium such that access to the activation key and the configuration parameter values by unauthorized entities is prevented;
• receiving, from a customer entity device, an identifier for an authorized installation entity;
• receiving, using a first network connection, from an installation device that is different from the set of networked devices and the customer entity device, valid credentials for the authorized installation entity;
• determining, based at least on the valid credentials, that the entity is the authorized installation entity;
• when it is determined that the entity is the authorized installation entity enabling input of a networked device identifier and an activation key on the installation device;
• receiving the networked device identifier and dynamic configuration parameter values from the installation device, where the dynamic configuration parameter values depend on an environment in which the networked device is deployed;
• verifying the dynamic configuration parameter values;
• and
• prior to transmitting the application configuration to the networked device, adding the dynamic configuration parameter values to the set of configuration parameter values in the application configuration;
• receiving an identifier for the networked device and the activation key from an anonymous access level on the installation device;
• in response to receiving the activation key and networked device identifier from the installation device:
• identifying an application configuration for the networked device comprising the set of configuration parameter values;
• making a second network connection to the networked device;
• and
• transmitting the application configuration to the networked device using the second network connection, such that the application configuration is not provided to the installation device.