Arris Enterprises LLC

General Instrument Corporation

Google Inc.

Arris Technology, Inc.

Motorola Mobility LLC

Motorala Mobility LLC

Google Technology Holdings LLC

Xin Qiu

Ting Yao

Alexander Medvinsky

Jason A Pasion

Eric J Sprunk

Jinsong Zheng

Tat Keung Chan

Oscar L Jiang

Liqiang Chen

Stuart Moskovics

Fan Wang

Paul Moroney

Ying Hai Chen

John I Okimoto

Christopher P Gardner

Lawrence W Tang

Rafie Shamsaasef

Paul Douglas Baker

Douglas M Petty

Eric Eugene Berry

Thomas J Barbour

Reshma Shahabuddin

Annie C Kuramoto

Chia Ling Tsai

Michael Ryan Pilquist

Greg N Nakanishi

Petr Peterka

Ali Negahdar

Christopher Poli

Daniel A Simon

Shanthakumar Ramakrishnan

Kent D Rager

Mark G DePietro

Cheng Li

Mark E Gregotski

Bridget Diane Kimball

Ted R Michaud

Kyle Stewart

Patrick Dizon

Kyle W Stewart

Zeya Myint

Lawrence R Cook

Wei Lin Chou

Jiajing Liu

Aye Myint

Xiaozhou Fu

Joel Yan

Tat Keung Chen

Stuart P Moskovics

Bridget D Kimball

Jason A Paison

Sasha Medvinsky

Annie Tsai

A system and method for receiving secure data in a client device. In one embodiment, the method comprises (a) receiving a token having a token ID and a digital certificate generated by a certificate authority (CA) having client device fingerprint data generated from client device parameters, (b) accepting a request in the client device to provide secure data to the client device, (c) regenerating the client device fingerprint data from the client device parameters, (d) determining, in the client device, differences between the client device fingerprint data of the digital certificate from the regenerated client device fingerprint data, and (e) transmitting a request to a secure data service to provide secure data based upon the determination.

Token node locking with fingerprints authenticated by digital certificates

A method and apparatus, and system for providing device credentials to a plurality of devices is disclosed. The system comprises a credential builder, for generating the credentials or procuring the credentials from a source external to the credential distribution system; a credential loader; a credential server, for accepting credential requests from the devices and for receiving the requested credentials from the credential loader; a first secured interface, communicatively coupling the credential loader and the credential server; a second secured interface, communicatively coupling the credential server and the device; a central credential database, communicatively coupled to the credential loader, for storing each the credentials and a provisioning history of each of the credentials; a credential server database, communicatively coupled to the credential server, for storing the credentials local to the credential server; and a cloning detection system, communicatively coupled to the central credential database and the credential server database, the cloning detection system for detecting duplicate credentials using the credentials stored in the central credential database and the credential server database.

Anti-cloning architecture for device identity provisioning

Anti-cloning of device cryptographic keys for counterfeit prevention

A method and apparatus for providing user key material from a server to a client is disclosed. The method comprises receiving a first message from the client in a server, the first message having a user key material request, an access token and an identifier of a transport key (TrK-ID), validating the user key material request according to the access token, generating a response having user key material responsive to the user key material request, encrypting the response according to the transport key (TrK), and transmitting a second message comprising the response from the server to the client. The client decrypts the second message according to the transport key (TrK) and validates the second message using the identifier of the transport key (TrK-ID).

Transmission of secure information in a content distribution network

A system and method described below prevents exploitation of a client's PKI station using the a token installed on other host (attackers') processors. This is accomplished by binding the token to the approved PKI client station (host) using the a software development kit installed in the PKI client station. Once a token is bound to a PKI client station, the token can no longer be used on another station unless permitted by authorized personnel.

Binding a hardware security token to a host device to prevent exploitation by other host devices

A system and method for providing secure data to a client device having a token is disclosed. In one embodiment, the method comprises (a) binding the token to the client device according to first token binding information comprising a first token identifier (ID), first client device fingerprint data, and a first timestamp, (b) receiving a request to provide secure data to the client device in a secure data service, (c) determining if the request to provide the secure data to the client device was received within an acceptable temporal range of the stored timestamp, and (d) providing the requested secure data according to the determination.

Token node locking

A system and method for providing secure data to a client device having a token is disclosed. In one embodiment, the method comprises: (a) binding the token to the client device according to first token binding information comprising a first token identifier (ID), first client device fingerprint data, and a first timestamp, (b) receiving a request to provide secure data to the client device in a service, the request comprising the signed first token binding information and timestamp, (c) determining if the request to provide the secure data to the client device was received within an acceptable temporal range of the stored timestamp; and (d) providing the requested secure data according to the determination.

Token node locking with signed fingerprints offloaded to clients

A system is provided for distribution of device key sets over a network in a protected software environment (PSE). In the system, a client device includes a connection interface for receiving a crypto hardware (CH) token belonging to a user, untrusted software, a quoting enclave, and a PSE for generating a provisioning request for a device key set. An attestation proxy server (APS) receives the provisioning message using a first network connection, and transmits the provisioning message to an online provisioning server (OPS) using a second network connection. The OPS constructs a provisioning response and an encrypted device key set, and delivers the provisioning response to the untrusted software using the first and second network connections. The PSE decrypts the encrypted device key set to obtain the device key set, re-encrypts the device key set with a local chip-specific key, and stores the re-encrypted device key set.

Secure distribution of device key sets over a network

In a system comprising an customer providing a service to a plurality of client devices, a method and system for providing an customer-specific digital certificate to a client device of the plurality of client devices is disclosed. The method comprises receiving, in an intermediate certificate authority, a pre-generated digital certificate and an encrypted client device private key encrypted according to a private key encryption key PrKEK, receiving, from the client device, a request for the customer-specific digital certificate, the request comprising at least one of client device identifying information and information identifying the customer, the request signed according to a pre-provisioned client device digital certificate, and transmitting the customer-specific digital certificate and the encrypted client device private key to the client device.

Secure online issuance of customer-specific certificates with offline key generation

A method provides an origin certificate that can be issued as a digital certificate online. The method includes receiving an origin digital certificate and an encrypted client device private key from an offline certificate authority wherein the client device private key is encrypted according to a private key encryption key PrKEK. The method further includes receiving from the client device, a request for a client device digital certificate and the encrypted client device private key, selecting a digital certificate template for the client device, the digital certificate template having attributes that vary according to the client devices, building the client device digital certificate from the origin digital certificate and the selected digital certificate template, signing the client device digital certificate with an online certificate authority signing key, and transmitting the signed client device digital certificate and the encrypted device private key.

Origin certificate based online certificate issuance

A system and method for preventing use of invalid digital certificates is disclosed. The method comprises receiving, in a validation service from a requesting entity, a cryptographic asset and a request to evaluate the cryptographic asset, the cryptographic asset uniquely assigned to one of the plurality of devices by an associated one of the commercially distinct entities, the request comprising the cryptographic asset, determining an evaluation state of the cryptographic asset at least in part from a database derived from a plurality of public keys currently assigned to the plurality of devices and previously received by the validation service, determining a disposition of the cryptographic asset according to a disposition policy associated with the determined evaluation state and the device and effecting the determined disposition of the cryptographic asset.

Centralized database with provisions to prevent PKI key and security certificate duplication

A system for generating unique digital certificates is provided that generates computed hashes public keys and compares them. The system method computes a hash of a public key, compares the computed hash of the public key with hashes of public keys previously generated, generates the digital certificate having the public key and a device identifier only if the computed hash of the public key does not match any of the hashes of public keys previously generated, and provides the digital certificate.

Method and apparatus for online and offline generation of unique digital certificates

Growing community of inventors

San Diego, CA, United States of America

Xin Qiu