DEVICE-LEVEL AUTHENTICATION WITH UNIQUE DEVICE IDENTIFIERS
First Claim
1. A method comprising:
- transmitting, by a client device, a manufacturer security certificate to a provisioning server device, wherein the manufacturer security certificate is associated with a manufacturer of the client device;
establishing, between the client device and the provisioning server device, a secure connection, wherein the secure connection is established based on the manufacturer security certificate;
transmitting, by the client device over the secure connection, device data that characterizes the client device;
after transmission of the device data, receiving, by the client device over the secure connection, a server security certificate, wherein the server security certificate identifies secure communication parameters of one or more pre-validated server devices, wherein the pre-validated server devices do not include the provisioning server device;
after transmission of the device data, receiving, by the client device over the secure connection, a unique client device identifier, wherein the unique client device identifier is not included in the device data and is configured to support secure access to the pre-validated server devices;
storing, by the client device, the unique client device identifier in a tamper-resistant secure memory element of the client device; and
based on the unique client device identifier, accessing, by the client device, protected information available to a particular pre-validated server device of the one or more pre-validated server devices, wherein the accessing the protected information comprises (i) establishing, between the client device and the particular pre-validated server device, a second secure connection, wherein the second secure connection is established based on the server security certificate, (ii) after establishing the second secure connection, transmitting, by the client device over the second secure connection, a representation of the unique client device identifier, and (iii) receiving, by the client device over the second secure connection, the protected information, wherein the second secure connection involves mutual authentication between the client device and the particular pre-validated server device.
1 Assignment
0 Petitions
Accused Products
Abstract
An embodiment may include transmitting a manufacturer security certificate to a provisioning server device, and establishing, with the provisioning server device, a secure connection based on the manufacturer security certificate. The embodiment may also involve transmitting, over the secure connection, device data that characterizes the client device, and receiving, over the secure connection, a server security certificate. The embodiment may further include obtaining a unique client device identifier, where the unique client device identifier is stored in a secure memory element of the client device. The embodiment may additionally include, possibly based on the server security certificate and the unique client device identifier, accessing protected information available to a particular pre-validated server device.
26 Citations
24 Claims
-
1. A method comprising:
-
transmitting, by a client device, a manufacturer security certificate to a provisioning server device, wherein the manufacturer security certificate is associated with a manufacturer of the client device; establishing, between the client device and the provisioning server device, a secure connection, wherein the secure connection is established based on the manufacturer security certificate; transmitting, by the client device over the secure connection, device data that characterizes the client device; after transmission of the device data, receiving, by the client device over the secure connection, a server security certificate, wherein the server security certificate identifies secure communication parameters of one or more pre-validated server devices, wherein the pre-validated server devices do not include the provisioning server device; after transmission of the device data, receiving, by the client device over the secure connection, a unique client device identifier, wherein the unique client device identifier is not included in the device data and is configured to support secure access to the pre-validated server devices; storing, by the client device, the unique client device identifier in a tamper-resistant secure memory element of the client device; and based on the unique client device identifier, accessing, by the client device, protected information available to a particular pre-validated server device of the one or more pre-validated server devices, wherein the accessing the protected information comprises (i) establishing, between the client device and the particular pre-validated server device, a second secure connection, wherein the second secure connection is established based on the server security certificate, (ii) after establishing the second secure connection, transmitting, by the client device over the second secure connection, a representation of the unique client device identifier, and (iii) receiving, by the client device over the second secure connection, the protected information, wherein the second secure connection involves mutual authentication between the client device and the particular pre-validated server device. - View Dependent Claims (3, 4, 5, 7, 9, 12)
-
-
2. (canceled)
-
6. (canceled)
-
8. (canceled)
-
10-11. -11. (canceled)
-
13. A method comprising:
-
receiving, by a provisioning server device, a manufacturer security certificate from a client device, wherein the manufacturer security certificate is associated with a manufacturer of the client device; establishing, between the client device and the provisioning server device, a secure connection, wherein the secure connection is established based on the manufacturer security certificate; receiving, by the provisioning server device over the secure connection, device data that characterizes the client device; transmitting, by the provisioning server device over the secure connection, a server security certificate, wherein the server security certificate identifies secure communication parameters of one or more pre-validated server devices, wherein the pre-validated server devices do not include the provisioning server device; randomly generating, by the provisioning server device, a representation of a unique client device identifier, wherein the unique client device identifier is associated with the client device and is configured to support, for the client device, secure access to the pre-validated server devices; transmitting, by the provisioning server device over the secure connection, the unique client device identifier, wherein reception of the unique client device identifier causes the client device to store the unique client device identifier in a tamper-resistant secure memory element of the client device; and based on the representation of the unique client device identifier, registering, by the provisioning server device, the client device, wherein the registration associates the representation of the unique client device identifier with policies that allow the client device to securely access, by way of the secure communication parameters, protected information available to the one or more pre-validated server devices, wherein the accessing the protected information comprises (i) establishing, between the client device and a particular pre-validated server device, a second secure connection, wherein the second secure connection is established based on the server security certificate, (ii) after establishing the second secure connection, transmitting, by the client device over the second secure connection, a representation of the unique client device identifier, and (iii) receiving, by the client device over the second secure connection, the protected information, wherein the second secure connection involves mutual authentication between the client device and the particular pre-validated server device. - View Dependent Claims (14, 17, 18)
-
-
15-16. -16. (canceled)
-
19. An article of manufacture including a non-transitory computer-readable medium, having stored thereon program instructions that, upon execution by a client device, cause the client device to perform operations comprising:
-
transmitting a manufacturer security certificate to a provisioning server device, wherein the manufacturer security certificate is associated with a manufacturer of the client device;
establishing, between the client device and the provisioning server device, a secure connection, wherein the secure connection is established based on the manufacturer security certificate;transmitting, over the secure connection, device data that characterizes the client device; after transmission of the device data, receiving, over the secure connection, a server security certificate, wherein the server security certificate identifies secure communication parameters of one or more pre-validated server devices, wherein the pre-validated server devices do not include the provisioning server device; after transmission of the device data, receiving a unique client device identifier over the secure connection, wherein the unique client device identifier is not included in the device data and is configured to support secure access to the pre-validated server devices; storing, by the client device, the unique client device identifier in a tamper-resistant secure memory element of the client device; and based on the unique client device identifier, accessing protected information available to a particular pre-validated server device, wherein the accessing the protected information comprises (i) establishing, between the client device and the particular pre-validated server device, a second secure connection, wherein the second secure connection is established based on the server security certificate, (ii) after establishing the second secure connection, transmitting, by the client device over the second secure connection, a representation of the unique client device identifier, and (iii) receiving, by the client device over the second secure connection, the protected information, wherein the second secure connection involves mutual authentication between the client device and the particular pre-validated server device. - View Dependent Claims (21, 22, 23, 24)
-
-
20. (canceled)
Specification