Automatic provisioning of a device to access an account

• US 9,614,835 B2
• Filed: 06/08/2015
• Issued: 04/04/2017
• Est. Priority Date: 06/08/2015
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Saboori, Anooshiravan, Soni, Himanshu, Dawoud, Peter, Nystrom, Magnus, Schwartz, Jonathan David, Zhou, Dayi
• Primary Examiner(s): Okeke, Izunna
• Assistant Examiner(s): Shayanfar, Ali
• Application Number:
  US14/733,777
• Publication Number:
  US 20160359844A1
• Time in Patent Office: 666 Days
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy

Abstract

A system for bootstrap provisioning of a device is provided. A vouching device is provisioned to access a bootstrap account of a bootstrap account provider and a secondary account of a secondary account provider. The bootstrap account provider stores an indication of the secondary account, and the secondary account provider stores verification data to verify a certification of the vouching device. A target device is provisioned to access the bootstrap account of the bootstrap account provider. The target device receives from the bootstrap account provider an indication that the target device is provisioned with the secondary account provider. The target device directs generation of a certification by the vouching device of target authentication data of the target device. The target device then sends the certification to the secondary account provider to effect the provisioning of the target device to access the secondary account.

Claims

1. A computer-readable storage medium storing computer-executable instructions for a bootstrap account provider, the computer-executable instructions comprising instructions that:

associate with a bootstrap account a vouching device;

receive a notification that the vouching device is associated with a secondary account of a secondary account provider; and

in response to receiving a request of a target device to access the bootstrap account,

perform a multi-factor authentication to authenticate that the target device is authorized to access the bootstrap account;

associate with the bootstrap account the target device; and

provide to the target device an indication that the target device is to be provisioned to access the secondary account using a certification of the vouching device that the target device is authorized to access the secondary account and that the secondary account provider can verify using verification data associated with the secondary account so that after the target device is associated with the bootstrap account, the target device can be automatically provisioned to access the secondary account based on the certification.

2. The computer readable storage medium of claim 1 wherein the instructions that perform the multi-factor authentication further send an authentication code to a device associated with the bootstrap account so that the authentication code can be provided to the target device and sent by the target device to the bootstrap account provider.

3. The computer-readable storage medium of claim 1 wherein the notification includes provisioning data provided by the secondary account provider to the vouching device and the indication includes the provisioning data.

4. The computer-readable storage medium of claim 1 wherein the certification is certified using certification data provided by the secondary account provider to the vouching device.

5. The computer-readable storage medium of claim 1 wherein the certification is certified using certification data that is a private key and wherein the verification data is a public key of a certification public/private key pair.

6. The computer-readable storage medium of claim 5 wherein the certification public/private key pair was generated by the vouching device.

7. A method performed by a computing device for a bootstrap account provider, the method comprising:

associating with a bootstrap account a vouching device;

receiving a notification that the vouching device is associated with a secondary account of a secondary account provider; and

in response to receiving a request of a target device to access the bootstrap account,

performing an authentication to authenticate that the target device is authorized to access the bootstrap account;

associating with the bootstrap account the target device; and

providing to the target device an indication that the target device is to be provisioned to access the secondary account using a certification of the vouching device that the target device is authorized to access the secondary account and that the secondary account provider can verify using verification data associated with the secondary account

so that after the target device is associated with the bootstrap account, the target device can be automatically provisioned to access the secondary account based on the certification.

8. The method of claim 7 wherein the authentication is a multi-factor authentication and the performing the multi-factor authentication further includes sending an authentication code to a device associated with the bootstrap account so that the authentication code can be provided to the target device and sent by the target device to the bootstrap account provider.

9. The method of claim 7 wherein the notification includes provisioning data provided by the secondary account provider to the vouching device and the indication includes the provisioning data.

10. The method of claim 7 wherein the certification is certified using certification data provided by the secondary account provider to the vouching device.

11. The method of claim 7 wherein the certification is certified using certification data that is a private key and wherein the verification data is a public key of a certification public/private key pair.

12. The method of claim 11 wherein the certification public/private key pair was generated by the vouching device.

13. A computing device comprising:

a computer-readable storage medium storing computer-executable instructions of a bootstrap account provider, the computer-executable instructions comprising instructions that;

associate with a bootstrap account a vouching device;

receive a notification that the vouching device is associated with a secondary account of a secondary account provider; and

in response to receiving a request of a target device to access the bootstrap account,

perform a multi-factor authentication to authenticate that the target device is authorized to access the bootstrap account;

associate with the bootstrap account the target device; and

provide to the target device an indication that the target device is to be provisioned to access the secondary account using a certification of the vouching device that the target device is authorized to access the secondary account and that the secondary account provider can verify using verification data associated with the secondary account

so that after the target device is associated with the bootstrap account, the target device can be automatically provisioned to access the secondary account based on the certification; and

a processor that executes the computer-executable instructions stored in the computer-readable storage medium.

14. The computing device of claim 13 wherein the instructions that perform the multi-factor authentication further send an authentication code to a device associated with the bootstrap account so that the authentication code can be provided to the target device and sent by the target device to the bootstrap account provider.

15. The computing device of claim 13 wherein the notification includes provisioning data provided by the secondary account provider to the vouching device and the indication includes the provisioning data.

16. The computing device of claim 13 wherein the certification is certified using certification data provided by the secondary account provider to the vouching device.

17. The computing device of claim 13 wherein the certification is certified using certification data that is a private key and wherein the verification data is a public key of a certification public/private key pair.

18. The computing device of claim 17 wherein the certification public/private key pair was generated by the vouching device.