# US 10,320,571 B2 · Techniques for authenticating devices using a trusted platform module device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,571 B2 - Document ID: US10320571B2 - Status: Granted - Kind: B2 - Application number: 15/274,879 - Filed: 2016-09-23 - Published: 2018-03-29 - Granted: 2019-06-11 - Earliest claimed: 2016-09-23 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Stefan Thom; Artem Alekseyevich Zhurid; Merzin Kapadia - Web page: https://patentgrep.com/patent/US10320571B2 ## CPC - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - G06F 21/33: using certificates - G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 9/14: using a plurality of keys or algorithms - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 9/3247: {involving digital signatures} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04W 12/06: Authentication - H04L 2209/127: Trusted platform modules [TPM] - H04W 12/47: using near field communication [NFC] or radio frequency identification [RFID] modules - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Described are examples for authenticating a device including detecting an event related to communications with a trusted platform module (TPM) device, performing, in response to detecting the event, one or more security-related functions with the TPM device, such as generating and/or signing one or more digital certificates, which may be based on one or more keys on the TPM device. ## Claims ### Claim 1 A device, comprising: a memory storing one or more parameters or instructions for executing a certificate authority service; an interface configured to communicate with a removably connectable trusted platform module (TPM) device; and at least one processor coupled to the memory and the interface, wherein the at least one processor is configured to: detect an event corresponding to communications with the TPM device via the interface; execute the certificate authority service to generate, in response to detecting the event, a digital certificate for authenticating the device; provide, based on detecting the event and generating the digital certificate, the digital certificate to the TPM device for signing; obtain the digital certificate, as signed, from the TPM device; and transmit the digital certificate, as signed, to one or more other devices to authenticate the device in communicating in a network. ### Claim 2 (depends on 1) The device of claim 1, wherein the interface comprises a wired interface, wherein the event comprises insertion of the TPM device into the wired interface. ### Claim 3 (depends on 1) The device of claim 1, wherein the interface comprises a wireless interface, and wherein the event comprises pairing of the TPM device with the device via the wireless interface. ### Claim 4 (depends on 1) The device of claim 1, wherein the event comprises activation of a switch on the device. ### Claim 5 (depends on 1) The device of claim 1, wherein the one or more other devices includes a router configured to provide the device with access to a network, wherein the at least one processor is further configured to receive an indication of authentication from the router based at least in part on the digital certificate. ### Claim 6 (depends on 1) The device of claim 1, wherein the one or more other devices includes a cloud-based services node, wherein the at least one processor is further configured to receive an indication of authentication from the cloud-based services node based at least in part on the digital certificate. ### Claim 7 (depends on 1) The device of claim 1, wherein the one or more other devices includes a node in a local area network corresponding to the device, wherein the at least one processor is further configured to receive an indication of authentication from the node for communications based at least in part on a comparison of the digital certificate to a different digital certificate of the node. ### Claim 8 (depends on 1) The device of claim 1, wherein the at least one processor is further configured to: detect a termination event related to terminating the communications with the TPM device via the interface; and terminate the certificate authority service based at least in part on detecting the termination event. ### Claim 9 (depends on 1) The device of claim 1, wherein the at least one processor is further configured to transmit one or more other parameters related to the digital certificate to the TPM device via the interface. ### Claim 10 (depends on 1) The device of claim 1, wherein the at least one processor is further configured to receive one or more certificate templates of certificates that may be generated using the TPM device, wherein generating the digital certificate is based at least in part on determining whether the one or more certificate templates are supported by the certificate authority service. ### Claim 11 A method for authenticating a device, comprising: detecting an event related to communications with a removably connectable trusted platform module (TPM) device; executing a certificate authority service to generate, in response to detecting the event, a digital certificate; providing, based on detecting the event and generating the digital certificate, the digital certificate to the TPM device for signing; receiving, based on providing the digital certificate to the TPM device for signing, the digital certificate, as signed, from the TPM device; and transmitting the digital certificate, as signed, to one or more other devices to authenticate the device in communicating in a network. ### Claim 12 (depends on 11) The method of claim 11, wherein detecting the event corresponds to detecting insertion of the TPM device into an interface. ### Claim 13 (depends on 11) The method of claim 11, wherein detecting the event corresponds to detecting pairing of the TPM device using a wireless interface. ### Claim 14 (depends on 11) The method of claim 11, wherein detecting the event corresponds to activation of a switch. ### Claim 15 (depends on 11) The method of claim 11, wherein the one or more other devices includes at least one of a router configured to provide access to a network or a cloud-based services node, and further comprising receiving an indication of authentication from the router or the cloud-based services node based at least in part on the digital certificate. ### Claim 16 (depends on 11) The method of claim 11, wherein the one or more other devices includes a node in a local area network, and further comprising receiving an indication of authentication from the node for communications based at least in part on a comparison of the digital certificate to a different digital certificate of the node. ### Claim 17 (depends on 11) The method of claim 11, further comprising: detecting a termination event related to terminating the communications with the TPM device via an interface; and terminating the certificate authority service based at least in part on detecting the termination event. ### Claim 18 (depends on 11) The method of claim 11, further comprising transmitting one or more parameters related to the digital certificate to the TPM device via an interface. ### Claim 19 (depends on 11) The method of claim 11, further comprising receiving one or more certificate templates of certificates that may be generated using the TPM device, wherein generating the digital certificate is based at least in part on determining whether the one or more certificate templates are supported by the certificate authority service. ### Claim 20 A non-transitory computer-readable medium comprising code for authenticating a device, the code comprising: code for detecting an event related to communications with a trusted platform module (TPM) device; code for executing a certificate authority service to generate, in response to detecting the event, a digital certificate; code for providing, based on detecting the event and generating the digital certificate, the digital certificate to the TPM device for signing; code for receiving, based on providing the digital certificate to the TPM device for signing, the digital certificate, as signed, from the TPM device; and code for transmitting the digital certificate, as signed, to one or more other devices to authenticate the device in communicating in a network.