Arris Enterprises LLC

Oscar L Jiang

Xin Qiu

Jason A Pasion

Ting Yao

Alexander Medvinsky

Jinsong Zheng

John I Okimoto

Tat Keung Chan

Rafie Shamsaasef

Ying Hai Chen

Eric J Sprunk

A system and method for receiving secure data in a client device. In one embodiment, the method comprises (a) receiving a token having a token ID and a digital certificate generated by a certificate authority (CA) having client device fingerprint data generated from client device parameters, (b) accepting a request in the client device to provide secure data to the client device, (c) regenerating the client device fingerprint data from the client device parameters, (d) determining, in the client device, differences between the client device fingerprint data of the digital certificate from the regenerated client device fingerprint data, and (e) transmitting a request to a secure data service to provide secure data based upon the determination.

Token node locking with fingerprints authenticated by digital certificates

A method and apparatus, and system for providing device credentials to a plurality of devices is disclosed. The system comprises a credential builder, for generating the credentials or procuring the credentials from a source external to the credential distribution system; a credential loader; a credential server, for accepting credential requests from the devices and for receiving the requested credentials from the credential loader; a first secured interface, communicatively coupling the credential loader and the credential server; a second secured interface, communicatively coupling the credential server and the device; a central credential database, communicatively coupled to the credential loader, for storing each the credentials and a provisioning history of each of the credentials; a credential server database, communicatively coupled to the credential server, for storing the credentials local to the credential server; and a cloning detection system, communicatively coupled to the central credential database and the credential server database, the cloning detection system for detecting duplicate credentials using the credentials stored in the central credential database and the credential server database.

Anti-cloning architecture for device identity provisioning

Anti-cloning of device cryptographic keys for counterfeit prevention

A system and method described below prevents exploitation of a client's PKI station using the a token installed on other host (attackers') processors. This is accomplished by binding the token to the approved PKI client station (host) using the a software development kit installed in the PKI client station. Once a token is bound to a PKI client station, the token can no longer be used on another station unless permitted by authorized personnel.

Binding a hardware security token to a host device to prevent exploitation by other host devices

A system and method for providing secure data to a client device having a token is disclosed. In one embodiment, the method comprises (a) binding the token to the client device according to first token binding information comprising a first token identifier (ID), first client device fingerprint data, and a first timestamp, (b) receiving a request to provide secure data to the client device in a secure data service, (c) determining if the request to provide the secure data to the client device was received within an acceptable temporal range of the stored timestamp, and (d) providing the requested secure data according to the determination.

Token node locking

A system and method for providing secure data to a client device having a token is disclosed. In one embodiment, the method comprises: (a) binding the token to the client device according to first token binding information comprising a first token identifier (ID), first client device fingerprint data, and a first timestamp, (b) receiving a request to provide secure data to the client device in a service, the request comprising the signed first token binding information and timestamp, (c) determining if the request to provide the secure data to the client device was received within an acceptable temporal range of the stored timestamp; and (d) providing the requested secure data according to the determination.

Token node locking with signed fingerprints offloaded to clients

A system for generating unique digital certificates is provided that generates computed hashes public keys and compares them. The system method computes a hash of a public key, compares the computed hash of the public key with hashes of public keys previously generated, generates the digital certificate having the public key and a device identifier only if the computed hash of the public key does not match any of the hashes of public keys previously generated, and provides the digital certificate.

Method and apparatus for online and offline generation of unique digital certificates

A method for resolving the synchronization of identity data from a central database server to distributed database servers is provided. The method involves synchronizing identity data to central and distributed database servers based on identity data types associated with a factory. The method first includes assigning by a configuration manager identity data types to factories which manufacture devices that will need identity data. Next an Identity Data (ID) Loader receives a file containing the identity data, and the ID Loader loads the identity data to a central database server and creates a file history record indicating a record of the file loaded. Next, a Factory Synchronizer Loader (FSL) is triggered to create and execute jobs to load identity data, configuration data or other data. Finally, the identity data is synchronized between the central data base with the remote database servers in a location of the factory. In some embodiments, the FSL corrects identity data and resynchronizes, or determines when synchronization fails and repeats synchronization processes when the failure occurs.

Selective data synchronization and transfer to remote distributed database servers

A method of pushing data from a client to a key collector, comprising preparing one or more SOC keys and one or more SOC IDs at a client, pushing the one or more SOC keys and one or more SOC IDs from the client to one or more key collectors, receiving an acknowledgement at the client from the one or more key collectors in response to pushing the one or more SOC keys and one or more SOC IDs to the key collectors, and installing the one or more SOC keys and one or more SOC IDs on a system-on-chip.

Growing community of inventors

Rosemead, CA, United States of America

Oscar L Jiang