# US 10,484,359 B2 · Device-level authentication with unique device identifiers > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,359 B2 - Document ID: US10484359B2 - Status: Granted - Kind: B2 - Application number: 15/457,135 - Filed: 2017-03-13 - Published: 2017-10-19 - Granted: 2019-11-19 - Earliest claimed: 2015-07-25 - Assignees: Confia Systems, Inc. - Applicants: Confia Systems, Inc. - Inventors: Nadaradjane Ramatchandirane - Web page: https://patentgrep.com/patent/US10484359B2 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - G06F 21/305: {by remotely controlling device operation} - G06F 21/44: Program or device authentication - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 21/73: by creating or determining hardware identification, e.g. serial numbers - H04L 9/14: using a plurality of keys or algorithms - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3247: {involving digital signatures} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 9/3273: {for mutual authentication (network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869)} - H04L 63/0869: {for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/166: {at the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An embodiment may include transmitting a manufacturer security certificate to a provisioning server device, and establishing, with the provisioning server device, a secure connection based on the manufacturer security certificate. The embodiment may also involve transmitting, over the secure connection, device data that characterizes the client device, and receiving, over the secure connection, a server security certificate. The embodiment may further include obtaining a unique client device identifier. The embodiment may additionally include, possibly based on the server security certificate and the unique client device identifier, accessing protected information available to a particular pre-validated server device. ## Claims ### Claim 1 A method comprising: transmitting, by a client device, a manufacturer security certificate to a provisioning server device, wherein the manufacturer security certificate is associated with a manufacturer of the client device; establishing, between the client device and the provisioning server device, a secure connection, wherein the secure connection is established based on the manufacturer security certificate; receiving, by the client device over the secure connection, a server security certificate, wherein the server security certificate identifies secure communication parameters of a pre-validated server device, wherein the pre-validated server device is not the provisioning server device; obtaining, by the client device, a unique client device identifier, wherein the unique client device identifier is configured to support secure access to the pre-validated server device; and based on the unique client device identifier, accessing, by the client device, protected information available to the pre-validated server device, wherein accessing the protected information occurs without the client device transmitting security credentials that identify a user of the client device to the pre-validated server device, wherein the client device stores a plurality of unique tokens, each token limited to use once per an epoch defined by a pre-established number of seconds, and wherein accessing the protected information comprises transmitting a message to establish a second secure connection with the pre-validated server device, wherein the message contains a particular token, from the plurality of unique tokens, that has not been used in a current epoch. ### Claim 2 (depends on 1) The method of claim 1, wherein the accessing the protected information comprises (i) establishing, between the client device and the pre-validated server device, a second secure connection, wherein the second secure connection is established based on the server security certificate, (ii) after establishing the second secure connection, transmitting, by the client device over the second secure connection, a representation of the unique client device identifier, and (iii) receiving, by the client device over the second secure connection, the protected information, wherein the second secure connection involves mutual authentication between the client device and the pre-validated server device. ### Claim 3 (depends on 1) The method of claim 1, further comprising: transmitting, by the client device over the secure connection, device data that characterizes the client device. ### Claim 4 (depends on 3) The method of claim 3, wherein the device data comprises at least one of a manufacturer identity of the client device, a type of the client device, a model number of the client device, a serial number of the client device. ### Claim 5 (depends on 4) The method of claim 4, wherein reception of the device data by the provisioning server device causes the provisioning server device to look up the device data in a device database, and verify that the device data is consistent with known devices. ### Claim 6 (depends on 1) The method of claim 1, wherein at least one of the secure connection or the second secure connection is established, at least in part, by a web browser application operating on the client device. ### Claim 7 (depends on 1) The method of claim 1, wherein the secure connection is based on Secure Sockets Layer (SSL) or Transport Layer Security (TLS) protocols. ### Claim 8 (depends on 1) The method of claim 1, wherein, prior to transmitting the manufacturer security certificate to the provisioning server device, the client device has not communicated with the provisioning server device or the pre-validated server device. ### Claim 9 (depends on 1) The method of claim 1 further comprising: in response to receiving the server security certificate, validating, by the client device, the server security certificate. ### Claim 10 (depends on 1) The method of claim 1, wherein accessing the protected information available to the pre-validated server device comprises: receiving, from the pre-validated server device, an indication that the client device is permitted to establish a second secure connection with the pre-validated server device; and in response to receiving the indication, establishing the second secure connection with the pre-validated server device. ### Claim 11 (depends on 1) The method of claim 1, wherein obtaining the unique client device identifier comprises receiving the unique client device identifier from the provisioning server device. ### Claim 12 An article of manufacture including a non-transitory computer-readable medium, having stored thereon program instructions that, upon execution by a client device, cause the client device to perform operations comprising: transmitting a manufacturer security certificate to a provisioning server device, wherein the manufacturer security certificate is associated with a manufacturer of the client device; establishing, between the client device and the provisioning server device, a secure connection, wherein the secure connection is established based on the manufacturer security certificate; receiving, over the secure connection, a server security certificate, wherein the server security certificate identifies secure communication parameters of a pre-validated server device, wherein the pre-validated server device is not the provisioning server device; obtaining a unique client device identifier, wherein the unique client device identifier is configured to support secure access to the pre-validated server device; and based on the unique client device identifier, accessing protected information available to the pre-validated server device, wherein accessing the protected information occurs without the client device transmitting security credentials that identify a user of the client device to the pre-validated server device, wherein the client device stores a plurality of unique tokens, each token limited to use once per an epoch defined by a pre-established number of seconds, and wherein accessing the protected information comprises transmitting a message to establish a second secure connection with the pre-validated server device, wherein the message contains a particular token, from the plurality of unique tokens, that has not been used in a current epoch. ### Claim 13 (depends on 12) The article of manufacture claim 12, wherein the accessing the protected information comprises (i) establishing, between the client device and the pre-validated server device, a second secure connection, wherein the second secure connection is established based on the server security certificate, (ii) after establishing the second secure connection, transmitting, by the client device over the second secure connection, a representation of the unique client device identifier, and (iii) receiving, by the client device over the second secure connection, the protected information, wherein the second secure connection involves mutual authentication between the client device and the pre-validated server device. ### Claim 14 (depends on 12) The article of manufacture claim 12, the operations further comprising: transmitting, over the secure connection, device data that characterizes the client device. ### Claim 15 (depends on 14) The article of manufacture claim 14, wherein the device data comprises at least one of a manufacturer identity of the client device, a type of the client device, a model number of the client device, a serial number of the client device. ### Claim 16 (depends on 15) The article of manufacture claim 15, wherein reception of the device data by the provisioning server device causes the provisioning server device to look up the device data in a device database, and verify that the device data is consistent with known devices. ### Claim 17 (depends on 12) The article of manufacture claim 12, wherein at least one of the secure connection or the second secure connection is established, at least in part, by a web browser application operating on the client device. ### Claim 18 (depends on 12) The article of manufacture claim 12, wherein, prior to transmitting the manufacturer security certificate to the provisioning server device, the client device has not communicated with the provisioning server device or the pre-validated server device. ### Claim 19 A client device comprising: a processor; memory; and program instructions, stored in the memory, that upon execution by the processor cause the client device to perform operations comprising: transmitting a manufacturer security certificate to a provisioning server device, wherein the manufacturer security certificate is associated with a manufacturer of the client device; establishing, between the client device and the provisioning server device, a secure connection, wherein the secure connection is established based on the manufacturer security certificate; receiving, over the secure connection, a server security certificate, wherein the server security certificate identifies secure communication parameters of a pre-validated server device, wherein the pre-validated server device is not the provisioning server device; obtaining a unique client device identifier, wherein the unique client device identifier is configured to support secure access to the pre-validated server device; and based on the unique client device identifier, accessing protected information available to the pre-validated server device, wherein accessing the protected information occurs without the client device transmitting security credentials that identify a user of the client device to the pre-validated server device, wherein the client device stores a plurality of unique tokens, each token limited to use once per an epoch defined by a pre-established number of seconds, and wherein accessing the protected information comprises transmitting a message to establish a second secure connection with the pre-validated server device, wherein the message contains a particular token, from the plurality of unique tokens, that has not been used in a current epoch.