Microsoft Technology Licensing, LLC

Jelani Zukar Brandon

Rajeev Mandayam Vokkarne

Nicole Elaine Berdy

Alexander I Tolpin

Mounica Arroju

Timothy James Larden

SachinKumar ChandraMohan

Tamer Awad

Puneet Gupta

Simon Porter

Nicole E Berdy

Tamer A Awad

Sachinkumar Chandramohan

An IoT hub comprising one or more servers and databases is configured to automatically assign Internet of Things (IoT) enabled devices to IoT solutions based on a subnet to which the IoT devices are connected. A user interface is configured to enable a user to define subnets within the customer's network environment and assign each subnet to an IoT solution. Upon the user setting up an IoT device's network connection to a network device, such as a router, the IoT device transmits its network information to the IoT hub. The IoT hub can then automatically assign the IoT device to a specific IoT solution without further user input or predict which IoT solution to utilize for that IoT device based on known parameters.

Subnet-based device allocation with geofenced attestation

Managing devices in an IoT environment. A method includes, as a result of a device being provisioned by a special-purpose solution, storing at a central unified registry a correlation of the device and the given special purpose solution. The method further includes correlating the device to a different special-purpose solution at the unified registry. As a result, the method further includes causing subsequent configuration of the device to be performed by the different special-purpose solution.

Device lifecycle management via a central identity service

An existing Simple Authentication and Security Layer (SASL) framework is modified to overcome message size limitations by implementing a control byte that enables segmentation of SASL messages. In implementations in which client computing devices utilize a trusted platform module (TPM) for enhanced security, the client computing device can transmit multiple public keys and other information to a provisioning service during an attestation process. This information can be segmented across multiple messages while leveraging the SASL framework. A control byte may be utilized in each message and define attributes about the respective messages, such as whether a current message is an interim or final message segment. Likewise, the provisioning service can divide a challenge key into multiple segments and include a control byte for each segment. The control byte within segmented messages enables utilization of the TPM public keys and thereby can leverage the heightened security provided by the TPM.

Trusted platform module attestation flow over simple authentication and security layer with multiple symmetric key identification

Transferring control over a device. A method includes, receiving a first indication, including a first verifiable token, from a first entity that at least a portion of control of a device should be relinquished by the first entity. A second indication is received from the second entity, including a second verifiable token, that the at least a portion of control should be transferred to the second entity. The first token and the second token are verified. As a result of verifying the first token and the second token, the at least a portion of control of the device is transferred from the first entity to the second entity. Transferring the at least a portion of control of the device from the first entity to the second entity includes updating the device with configuration applicable to the second entity.

Transferring digital device ownership via a signed transfer request

Examples are disclosed that relate to using a multiplexed transmission to register a telemetry device with a telemetry system and report telemetry data to the telemetry system on behalf of a telemetry device. One disclosed example provides a method comprising receiving a multiplexed transmission from a telemetry device, the multiplexed transmission comprising a registration message and telemetry data, demultiplexing the multiplexed transmission to obtain the registration message and the telemetry data, registering the telemetry device with a telemetry system based upon the registration message, sending the telemetry data to the telemetry system, and sending a registration response to the telemetry device, the registration response confirming registration of the telemetry device with the telemetry system.

Combined registration and telemetry reporting

Provisioning a requesting device is provided using extended identity attestation for the requesting device. A provisioning request is received at a device provisioning system. The provisioning request includes a registration identifier provided by the requesting device. A plurality of extended attestation components is accessed in an enrollment datastore of the device provisioning system. Each extended attestation component identifies an external computing system. One of the extended attestation components in the enrollment datastore is selected based on the received registration identifier. Execution of the device attestation is initiated at the external computing system identified by the selected extended attestation component to yield an attestation result. Satisfaction of a validity condition by the attestation result is detected. The requesting device is provisioned from the device provisioning system, responsive to detection that the attestation result satisfies the validity condition.

Growing community of inventors

Woodinville, WA, United States of America

Jelani Zukar Brandon