Mocana Corporation

Digicert, Inc.

Ruslan Ulanov

Atul Gupta

Srinivas H Kumar

Shreya Uchil

Srikesh Amrutur Srinivas

Systems and methods for configuration-driven processing of data via a configuration service include receiving a batch of archived data with contents that include a configuration file and one or more resources; validating the batch of archived data; responsive to the validating, extracting the contents of the batch of archived data; and processing the one or more resources based on the configuration file, to configure a service with the one or more resources, wherein the configuration file defines a type of each of the one or more resources, a relationship between the one or more resources, and any actions to be performed on the one or more resources.

Systems and methods for configuration-driven processing of data via a configuration service

An Internet of Things (IoT) device with zero touch provisioning includes one or more processing devices; a secure element; and memory storing software that, when executed in the one or more processing devices, cause the one or more processing devices to: install one or more clients on the IoT device for provisioning, enrollment, and updating, based on a device configuration; store an immutable device identity and a signing certificate in the secure element; and responsive to the IoT device being powered-on, cause the one or more clients and the secure element to perform the zero touch provisioning of the IoT device. The one or more clients on the IoT device for provisioning, enrollment, and updating operate with corresponding services with all communicating being encrypted, thereby protecting against cloning and counterfeiting of IoT devices.

System and method for zero touch provisioning of IoT devices

A method of building a device historian, across a supply chain of device manufactures and managers, by a plurality of device management services comprising an enrollment service, an update service, a policy service, and an analytics service, a transaction connector, a blockchain broker service participating as a node in a blockchain network, and transaction filters. The method comprises sending, by the plurality of device management services a transaction record over the transaction connector to the blockchain broker service, receiving, by the blockchain broker service, the transaction record, filtering, by the blockchain broker service, information in the transaction record based on the transaction filters, preparing, by the blockchain broker service, a versioned block based on the filtered information from the transaction record, and adding, by the blockchain broker service, the versioned block to the blockchain network.

System and method for recording device lifecycle transactions as versioned blocks in a blockchain network using a transaction connector and broker service

For zero-touch provisioning of devices at scale using device configuration templates by device type, a secure element, a provisioning wizard, a provisioning client, an enrollment client, an update client, an enrollment service, an update publisher service, signing and encryption certificates, a method including generating device configuration templates for enrollment and update by device type, sending device configuration templates signed with a device owner signing certificate, and a device owner encryption certificate to the device manufacturer, generating a device configuration for a device based on the device configuration templates using a secure element on the device for immutable device identity, an extended configuration for the device, signing the device configuration with a device manufacturer signing certificate and a secure element signing certificate, encrypting the doubly signed device configuration with an owner encryption certificate, configuring bootstrap metadata, and configuring the device provisioning client to autostart at power-on for device enrollment and update.

A method of device identification for enrollment and registration of an endpoint device that is connected to a gateway device. The method includes: sending an authenticated identity beacon with an endpoint device profile to a discovery service; generating, by the discovery service, a certificate request for the endpoint device from a privacy certificate authority; sending the certificate request for the endpoint device to an enrollment service; processing, by the enrollment service, the certificate request to translate the certificate request for a certificate authority, sending, by the enrollment service to the certificate authority, the translated certificate request; receiving, by the enrollment service, a certificate for the endpoint device issued by the certificate authority; processing, by the enrollment service, the received certificate for the endpoint device to translate the received certificate to represent a privacy certificate authority; and sending the certificate for the endpoint device to the discovery service.

System and method of device identification for enrollment and registration of a connected endpoint device, and blockchain service

A method of device identification for enrollment and registration of an endpoint device that is connected to a gateway device. The method includes: sending an authenticated identity beacon with an endpoint device profile to a discovery service; generating, by the discovery service, a certificate request for the endpoint device from a privacy certificate authority; sending the certificate request for the endpoint device to an enrollment service; processing, by the enrollment service, the certificate request to translate the certificate request for a certificate authority; sending, by the enrollment service to the certificate authority, the translated certificate request; receiving, by the enrollment service, a certificate for the endpoint device issued by the certificate authority; processing, by the enrollment service, the received certificate for the endpoint device to translate the received certificate to represent a privacy certificate authority; and sending the certificate for the endpoint device to the discovery service.

A method of securing data transport between an endpoint device, without an IP address and connected to a gateway device, and a connected service using a discovery agent, a discovery service, and an enrollment service. The method includes: sending to the discovery service on the gateway device, an authenticated identity beacon with a device profile of the endpoint device; verifying authentication of the endpoint device and the device profile and generating a certificate request for the endpoint device; processing, by the enrollment service, the certificate request for the endpoint device to translate the certificate request for a certificate authority and receiving a certificate for the endpoint device issued by the certificate authority; processing the received certificate for the endpoint device to translate the received certificate for the endpoint device to represent a privacy certificate authority; and performing cryptographic operations on data using the certificate for the endpoint device.

System and method for securing data transport between a non-IP endpoint device that is connected to a gateway device and a connected service

A method of updating a registered device using a development system and a release management system. The method includes: building an update package; signing the update package using a provider signing key, wherein a first digital signature is included in the update package; encrypting the signed update package using a publisher public key; requesting, by an update client on the device, an update package; preparing, by the update service, a set of signed update packages for the device; reencrypting and resigning, by the update service, the signed update package by decrypting the initial encryption using a publisher private key of the update publisher, signing the update package using a signing key of the update publisher, and finally encrypting the update package using a device public key from the device certificate, for final encryption of the update package; and decrypting the encrypted update package using a device private key.

System and method for securely updating a registered device using a development system and a release management system operated by an update provider and an update publisher

Growing community of inventors

Dublin, CA, United States of America

Ruslan Ulanov