Abstract: An Internet of Things (IoT) device with zero touch provisioning includes one or more processing devices; a secure element; and memory storing software that, when executed in the one or more processing devices, cause the one or more processing devices to: install one or more clients on the IoT device for provisioning, enrollment, and updating, based on a device configuration; store an immutable device identity and a signing certificate in the secure element; and responsive to the IoT device being powered-on, cause the one or more clients and the secure element to perform the zero touch provisioning of the IoT device. The one or more clients on the IoT device for provisioning, enrollment, and updating operate with corresponding services with all communicating being encrypted, thereby protecting against cloning and counterfeiting of IoT devices.

Abstract: For zero-touch provisioning of devices at scale using device configuration templates by device type, a secure element, a provisioning wizard, a provisioning client, an enrollment client, an update client, an enrollment service, an update publisher service, signing and encryption certificates, a method including generating device configuration templates for enrollment and update by device type, sending device configuration templates signed with a device owner signing certificate, and a device owner encryption certificate to the device manufacturer, generating a device configuration for a device based on the device configuration templates using a secure element on the device for immutable device identity, an extended configuration for the device, signing the device configuration with a device manufacturer signing certificate and a secure element signing certificate, encrypting the doubly signed device configuration with an owner encryption certificate, configuring bootstrap metadata, and configuring the device

Abstract: A method of building a device historian, across a supply chain of device manufactures and managers, by a plurality of device management services comprising an enrollment service, an update service, a policy service, and an analytics service, a transaction connector, a blockchain broker service participating as a node in a blockchain network, and transaction filters. The method comprises sending, by the plurality of device management services a transaction record over the transaction connector to the blockchain broker service, receiving, by the blockchain broker service, the transaction record, filtering, by the blockchain broker service, information in the transaction record based on the transaction filters, preparing, by the blockchain broker service, a versioned block based on the filtered information from the transaction record, and adding, by the blockchain broker service, the versioned block to the blockchain network.

Abstract: A method of building a device historian, across a supply chain of device manufactures and managers, by a plurality of device management services comprising an enrollment service, an update service, a policy service, and an analytics service, a transaction connector, a blockchain broker service participating as a node in a blockchain network, and transaction filters. The method comprises sending, by the plurality of device management services a transaction record over the transaction connector to the blockchain broker service, receiving, by the blockchain broker service, the transaction record, filtering, by the blockchain broker service, information in the transaction record based on the transaction filters, preparing, by the blockchain broker service, a versioned block based on the filtered information from the transaction record, and adding, by the blockchain broker service, the versioned block to the blockchain network.

Abstract: For protection of multipart system applications using a cryptographically protected package, a package map and a package object store for decryption and verification at runtime on the target device platform, a method including associating a device class with a set of content signing and encryption keys; signing application files based on the device class of the target device platform; aggregating application files into a file container based on a structured construct; encrypting application files/file containers with an encryption key associated with the device class; generating a package map and object stores for cryptographic artifacts and detached package metadata for passwords associated with the device package; building, the device package and update packages of the device package, detached package metadata, and package install scripts for the target device platform; publishing, the update packages signed with update package provider and update package publisher signing keys, and encrypted with target de

Abstract: A method of device identification for enrollment and registration of an endpoint device that is connected to a gateway device.

Abstract: A method of dynamically generating a domain based public group key and private member keys using a domain key agent, a domain key service of a domain key broker, and a domain key distribution center. The method includes: sending to the domain key service of a domain key broker a request for a private member key for the domain, wherein the request includes proof of possession of a vehicle private key associated with a vehicle certificate and a vehicle public key; receiving from the domain key service a private member key and a public group key; sending a message digitally signed using the member private key; verifying the digital signature on the received message using the public group key; and dynamically renewing the public group key and private member key based on the domain.

Abstract: A method of building a device historian, across a supply chain of device manufactures and managers, by a plurality of device management services comprising an enrollment service, an update service, a policy service, and an analytics service, a transaction connector, a blockchain broker service participating as a node in a blockchain network, and transaction filters. The method comprises sending, by the plurality of device management services a transaction record over the transaction connector to the blockchain broker service, receiving, by the blockchain broker service, the transaction record, filtering, by the blockchain broker service, information in the transaction record based on the transaction filters, preparing, by the blockchain broker service, a versioned block based on the filtered information from the transaction record, and adding, by the blockchain broker service, the versioned block to the blockchain network.

Abstract: For zero-touch provisioning of devices at scale using device configuration templates by device type, a secure element, a provisioning wizard, a provisioning client, an enrollment client, an update client, an enrollment service, an update publisher service, signing and encryption certificates, a method including generating device configuration templates for enrollment and update by device type, sending device configuration templates signed with a device owner signing certificate, and a device owner encryption certificate to the device manufacturer, generating a device configuration for a device based on the device configuration templates using a secure element on the device for immutable device identity, an extended configuration for the device, signing the device configuration with a device manufacturer signing certificate and a secure element signing certificate, encrypting the doubly signed device configuration with an owner encryption certificate, configuring bootstrap metadata, and configuring the device

Abstract: For protection of multipart system applications using a cryptographically protected package, a package map and a package object store for decryption and verification at runtime on the target device platform, a method including associating a device class with a set of content signing and encryption keys; signing application files based on the device class of the target device platform; aggregating application files into a file container based on a structured construct; encrypting application files/file containers with an encryption key associated with the device class; generating a package map and object stores for cryptographic artifacts and detached package metadata for passwords associated with the device package; building, the device package and update packages of the device package, detached package metadata, and package install scripts for the target device platform; publishing, the update packages signed with update package provider and update package publisher signing keys, and encrypted with target de

Abstract: A method of building a device historian, across a supply chain of device manufactures and managers, by a plurality of device management services comprising an enrollment service, an update service, a policy service, and an analytics service, a transaction connector, a blockchain broker service participating as a node in a blockchain network, and transaction filters. The method comprises sending, by the plurality of device management services a transaction record over the transaction connector to the blockchain broker service, receiving, by the blockchain broker service, the transaction record, filtering, by the blockchain broker service, information in the transaction record based on the transaction filters, preparing, by the blockchain broker service, a versioned block based on the filtered information from the transaction record, and adding, by the blockchain broker service, the versioned block to the blockchain network.

Abstract: A method of device identification for enrollment and registration of an endpoint device that is connected to a gateway device.

Abstract: A method of device identification for enrollment and registration of an endpoint device that is connected to a gateway device.

Abstract: A method of securing data transport between an endpoint device, without an IP address and connected to a gateway device, and a connected service using a discovery agent, a discovery service, and an enrollment service. The method includes: sending to the discovery service on the gateway device, an authenticated identity beacon with a device profile of the endpoint device; verifying authentication of the endpoint device and the device profile and generating a certificate request for the endpoint device; processing, by the enrollment service, the certificate request for the endpoint device to translate the certificate request for a certificate authority and receiving a certificate for the endpoint device issued by the certificate authority; processing the received certificate for the endpoint device to translate the received certificate for the endpoint device to represent a privacy certificate authority; and performing cryptographic operations on data using the certificate for the endpoint device.

Abstract: A method of dynamically generating a domain based public group key and private member keys using a domain key agent, a domain key service of a domain key broker, and a domain key distribution center. The method includes: sending to the domain key service of a domain key broker a request for a private member key for the domain, wherein the request includes proof of possession of a vehicle private key associated with a vehicle certificate and a vehicle public key; receiving from the domain key service a private member key and a public group key; sending a message digitally signed using the member private key; verifying the digital signature on the received message using the public group key; and dynamically renewing the public group key and private member key based on the domain.

Abstract: A method of device identification for enrollment and registration of an endpoint device that is connected to a gateway device.

Abstract: A method of securing data transport between an endpoint device, without an IP address and connected to a gateway device, and a connected service using a discovery agent, a discovery service, and an enrollment service. The method includes: sending to the discovery service on the gateway device, an authenticated identity beacon with a device profile of the endpoint device; verifying authentication of the endpoint device and the device profile and generating a certificate request for the endpoint device; processing, by the enrollment service, the certificate request for the endpoint device to translate the certificate request for a certificate authority and receiving a certificate for the endpoint device issued by the certificate authority; processing the received certificate for the endpoint device to translate the received certificate for the endpoint device to represent a privacy certificate authority; and performing cryptographic operations on data using the certificate for the endpoint device.

Abstract: A method of building a device historian, across a supply chain of device manufactures and managers, by a plurality of device management services comprising an enrollment service, an update service, a policy service, and an analytics service, a transaction connector, a blockchain broker service participating as a node in a blockchain network, and transaction filters. The method comprises sending, by the plurality of device management services a transaction record over the transaction connector to the blockchain broker service, receiving, by the blockchain broker service, the transaction record, filtering, by the blockchain broker service, information in the transaction record based on the transaction filters, preparing, by the blockchain broker service, a versioned block based on the filtered information from the transaction record, and adding, by the blockchain broker service, the versioned block to the blockchain network.

Abstract: A method of dynamically generating a domain based public group key and private member keys using a domain key agent, a domain key service of a domain key broker, and a domain key distribution center. The method includes: sending to the domain key service of a domain key broker a request for a private member key for the domain, wherein the request includes proof of possession of a vehicle private key associated with a vehicle certificate and a vehicle public key; receiving from the domain key service a private member key and a public group key; sending a message digitally signed using the member private key; verifying the digital signature on the received message using the public group key; and dynamically renewing the public group key and private member key based on the domain.

Abstract: A method of updating a registered device using a development system and a release management system. The method includes: building an update package; signing the update package using a provider signing key, wherein a first digital signature is included in the update package; encrypting the signed update package using a publisher public key; requesting, by an update client on the device, an update package; preparing, by the update service, a set of signed update packages for the device; reencrypting and resigning, by the update service, the signed update package by decrypting the initial encryption using a publisher private key of the update publisher, signing the update package using a signing key of the update publisher, and finally encrypting the update package using a device public key from the device certificate, for final encryption of the update package; and decrypting the encrypted update package using a device private key.