Mocana Corporation

Digicert, Inc.

Advanced Micro Devices Corporation

Automiti LLC

Atul Gupta

Srinivas H Kumar

Shreya Uchil

Ruslan Ulanov

Shashank Jaywant Pandhare

Gopal Raman

Srikesh Amrutur Srinivas

Pramod Malibiradar

Minh Van Ngo

Dawn M Hopper

Tyagamohan Gottipati

John Caffall

Systems and methods for configuration-driven processing of data via a configuration service include receiving a batch of archived data with contents that include a configuration file and one or more resources; validating the batch of archived data; responsive to the validating, extracting the contents of the batch of archived data; and processing the one or more resources based on the configuration file, to configure a service with the one or more resources, wherein the configuration file defines a type of each of the one or more resources, a relationship between the one or more resources, and any actions to be performed on the one or more resources.

Systems and methods for configuration-driven processing of data via a configuration service

An Internet of Things (IoT) device with zero touch provisioning includes one or more processing devices; a secure element; and memory storing software that, when executed in the one or more processing devices, cause the one or more processing devices to: install one or more clients on the IoT device for provisioning, enrollment, and updating, based on a device configuration; store an immutable device identity and a signing certificate in the secure element; and responsive to the IoT device being powered-on, cause the one or more clients and the secure element to perform the zero touch provisioning of the IoT device. The one or more clients on the IoT device for provisioning, enrollment, and updating operate with corresponding services with all communicating being encrypted, thereby protecting against cloning and counterfeiting of IoT devices.

System and method for zero touch provisioning of IoT devices

A method of building a device historian, across a supply chain of device manufactures and managers, by a plurality of device management services comprising an enrollment service, an update service, a policy service, and an analytics service, a transaction connector, a blockchain broker service participating as a node in a blockchain network, and transaction filters. The method comprises sending, by the plurality of device management services a transaction record over the transaction connector to the blockchain broker service, receiving, by the blockchain broker service, the transaction record, filtering, by the blockchain broker service, information in the transaction record based on the transaction filters, preparing, by the blockchain broker service, a versioned block based on the filtered information from the transaction record, and adding, by the blockchain broker service, the versioned block to the blockchain network.

System and method for recording device lifecycle transactions as versioned blocks in a blockchain network using a transaction connector and broker service

A trust chain having client system and a remote system in a secure connection, wherein an intermediary system associated with the network flow path serves as a signing entity to establish an end to end transitive trust. The intermediate system is a corroborative entity in the operations technology realm of the client system. The remote system serves as the host for a plurality of services in the information technology realm. A two way handshake during the initial secure exchange protocol between a local client application and a remote service is extended to a three way handshake that includes a nonce issued by the remote service on the remote system and a digital signature for the nonce issued by a signature service on an associated intermediate system. The nonce signature is verified authoritatively at the remote system based on the signing certificate of the intermediate system for explicit proof of association.

System and method for a multi system trust chain

For zero-touch provisioning of devices at scale using device configuration templates by device type, a secure element, a provisioning wizard, a provisioning client, an enrollment client, an update client, an enrollment service, an update publisher service, signing and encryption certificates, a method including generating device configuration templates for enrollment and update by device type, sending device configuration templates signed with a device owner signing certificate, and a device owner encryption certificate to the device manufacturer, generating a device configuration for a device based on the device configuration templates using a secure element on the device for immutable device identity, an extended configuration for the device, signing the device configuration with a device manufacturer signing certificate and a secure element signing certificate, encrypting the doubly signed device configuration with an owner encryption certificate, configuring bootstrap metadata, and configuring the device provisioning client to autostart at power-on for device enrollment and update.

A method of device identification for enrollment and registration of an endpoint device that is connected to a gateway device. The method includes: sending an authenticated identity beacon with an endpoint device profile to a discovery service; generating, by the discovery service, a certificate request for the endpoint device from a privacy certificate authority; sending the certificate request for the endpoint device to an enrollment service; processing, by the enrollment service, the certificate request to translate the certificate request for a certificate authority, sending, by the enrollment service to the certificate authority, the translated certificate request; receiving, by the enrollment service, a certificate for the endpoint device issued by the certificate authority; processing, by the enrollment service, the received certificate for the endpoint device to translate the received certificate to represent a privacy certificate authority; and sending the certificate for the endpoint device to the discovery service.

System and method of device identification for enrollment and registration of a connected endpoint device, and blockchain service

A method of dynamically generating a domain based public group key and private member keys using a domain key agent, a domain key service of a domain key broker, and a domain key distribution center. The method includes: sending to the domain key service of a domain key broker a request for a private member key for the domain, wherein the request includes proof of possession of a vehicle private key associated with a vehicle certificate and a vehicle public key; receiving from the domain key service a private member key and a public group key; sending a message digitally signed using the member private key; verifying the digital signature on the received message using the public group key; and dynamically renewing the public group key and private member key based on the domain.

Dynamic domain key exchange for authenticated device to device communications

The method provides a multi system trust chain between a client system and a remote system in a secure connection, wherein an intermediary system associated with the network flow path serves as a signing entity to establish an end to end transitive trust. The intermediate system is a corroborative entity in the operations technology (OT) realm of the client system. The remote system serves as the host for a plurality of services in the information technology (IT) realm. A two way handshake during the initial secure exchange protocol between a local client application and a remote service is extended to a three way handshake that includes a nonce issued by the remote service on the remote system and a digital signature for the nonce issued by a signature service on an associated intermediate system. The nonce signature is verified authoritatively at the remote system based on the signing certificate of the intermediate system for explicit proof of association.

A method of device identification for enrollment and registration of an endpoint device that is connected to a gateway device. The method includes: sending an authenticated identity beacon with an endpoint device profile to a discovery service; generating, by the discovery service, a certificate request for the endpoint device from a privacy certificate authority; sending the certificate request for the endpoint device to an enrollment service; processing, by the enrollment service, the certificate request to translate the certificate request for a certificate authority; sending, by the enrollment service to the certificate authority, the translated certificate request; receiving, by the enrollment service, a certificate for the endpoint device issued by the certificate authority; processing, by the enrollment service, the received certificate for the endpoint device to translate the received certificate to represent a privacy certificate authority; and sending the certificate for the endpoint device to the discovery service.

A method of securing data transport between an endpoint device, without an IP address and connected to a gateway device, and a connected service using a discovery agent, a discovery service, and an enrollment service. The method includes: sending to the discovery service on the gateway device, an authenticated identity beacon with a device profile of the endpoint device; verifying authentication of the endpoint device and the device profile and generating a certificate request for the endpoint device; processing, by the enrollment service, the certificate request for the endpoint device to translate the certificate request for a certificate authority and receiving a certificate for the endpoint device issued by the certificate authority; processing the received certificate for the endpoint device to translate the received certificate for the endpoint device to represent a privacy certificate authority; and performing cryptographic operations on data using the certificate for the endpoint device.

System and method for securing data transport between a non-IP endpoint device that is connected to a gateway device and a connected service

A method of updating a registered device using a development system and a release management system. The method includes: building an update package; signing the update package using a provider signing key, wherein a first digital signature is included in the update package; encrypting the signed update package using a publisher public key; requesting, by an update client on the device, an update package; preparing, by the update service, a set of signed update packages for the device; reencrypting and resigning, by the update service, the signed update package by decrypting the initial encryption using a publisher private key of the update publisher, signing the update package using a signing key of the update publisher, and finally encrypting the update package using a device public key from the device certificate, for final encryption of the update package; and decrypting the encrypted update package using a device private key.

System and method for securely updating a registered device using a development system and a release management system operated by an update provider and an update publisher

Growing community of inventors

Sunnyvale, CA, United States of America

Atul Gupta