# Terminology

## Identity & configuration terms

**Component handle:** A specific device or piece of a system. In the Guardian ecosystem, a component is defined by a human-readable name, the certificates and keys it provides, and the operations it can perform.

**Hardware ID:** A unique identifier to the specific instance of a component, commonly set to the device's serial number. The same hardware ID is used throughout the lifetime of the component, including through any reprovision operations.

**System:** A grouping of components, also known as a system definition. All provisioning requests for components in this system will either go through a manual or automatic approval, depending on your system setting.

## **Process terms:**

### **Approval workflows**

* **Automatic approval:** System setting where provisioning requests are processed automatically without human intervention.
* **Manual approval:** System setting where provisioning requests require human review and approval before processing.

### **Device provisioning** 

**Provisioning:** The process of securely establishing device identity and configuring cryptographic credentials for secure communication.

**Reprovisioning:** Updating an already-provisioned device with new certificates or configuration while maintaining the same hardware identity.

**Provisioning methods**

* **Connected provisioning:** Provisioning workflow for devices with network connectivity that can communicate directly with Guardian Cloud.
* **Disconnected provisioning:** Provisioning workflow for devices without network connectivity where provisioning requests must be manually transferred via files.
* **Proxy provisioning:** Using a connected device to handle provisioning requests for disconnected devices that cannot communicate directly with Guardian Cloud.

## **Cryptography & security terms**

**Certificate Authority (CA):** The trusted entity that issues digital certificates. In Guardian deployments, Guardian Cloud can serve as a CA, though Guardian also works with other certificate authorities.

**Certificate Revocation List (CRL):** A list of certificates that have been revoked before their expiration date and should no longer be trusted.

**Certificate Signing Request (CSR):** A standardized message containing a device's public key and identity information, sent to Guardian Cloud to request a digital certificate.

**PKI (Public Key Infrastructure):** The cryptographic framework that Guardian uses to establish and maintain secure digital identities through certificates and keys.

**Trust anchor:** The foundational certificates used to validate other certificates in the system. Stored in the `TrustStore` file.

## Guardian Platform terms

**Platform components:**

* **Guardian Cloud:** Cloud-based platform that processes certificate requests, enrolls devices into trust hierarchies, and generates certificates.
* **Guardian Library:** Software library that runs on your devices to parse configuration profiles, request certificates from Guardian Cloud, and enable cryptographic functions.

### Guardian file types and extensions

Guardian uses several file types with specific extensions during the provisioning process:

**Provision Request:** File used for transmitting information including public keys to the Guardian Cloud backend. This contains the Certificate Signing Requests (CSRs) sent to Guardian Cloud. Extension: `.mcpr`

**TrustStore:** Trust anchors for the Guardian platform. Extension: `.mcts`

**Profile files:**

1. **Certified Profile to be Provisioned:** Signed instructions and configuration for the Guardian library and provisioning operations. This is the initial profile template for this device type created during the provisioning process. Extension: `.mcpp`
2. **Certified Profile:** Signed instructions and configuration for the Guardian library run and reprovisioning operations. This is the final device profile created during the provisioning process. Extension: `.mcp`

**Identity files:** 

1. **Private Identity to be Provisioned:** Key material for initial provisioning operations and connections. This is the initial private identity template. Extension: `.mcpip`
2. **Private Identity:** Key material for reprovisioning and run operations and connections. This is the final private identity file, which contains the private keys that stay on the device. Extension: `.mcpi`