# US 10,484,364 B2 · Identity authentication using credentials

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,364 B2
- Document ID: US10484364B2
- Status: Granted
- Kind: B2
- Application number: 15/693,549
- Filed: 2017-09-01
- Published: 2018-08-16
- Granted: 2019-11-19
- Earliest claimed: 2013-03-14
- Assignees: Comcast Cable Communications, LLC
- Applicants: Comcast Cable Communications, LLC
- Inventors: Kris Bransom; Christopher Zarcone
- Web page: https://patentgrep.com/patent/US10484364B2

## CPC

- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 9/321: {involving a third party or a trusted authority}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3247: {involving digital signatures}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 9/3297: {involving time stamps, e.g. generation of time stamps}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 2463/061: applying further key derivation, e.g. deriving traffic keys from a pair-wise master key
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method and system may allow for authenticating a computing device. A computing device may send an authentication request over a network to an authentication computing device. The authentication request may include a user name and a password. The user name may include a credential and the password may be a digitally signed version of the user name. The authentication computing device may authenticate the requesting computing device by decrypting the password and comparing the received user name to the decrypted password.

## Claims

### Claim 1

A method comprising:
receiving, from a computing device, an authentication request comprising a user name and comprising a password associated with the user name, wherein:
the user name is based on a digital certificate issued by a trusted authority and comprises:
a portion of the digital certificate; and
a public key for the computing device; and
the password is encrypted, and is based on the portion of the digital certificate;
extracting the public key from the user name;
decrypting the password, based on the public key, to create a decrypted password;
hashing the portion of the digital certificate;
verifying, based on a validity of the portion of the digital certificate, the authentication request;
determining that the decrypted password corresponds to the hashed portion of the digital certificate; and
based on the verifying and the determining, granting the authentication request from the computing device.

### Claim 2 (depends on 1)

The method of claim 1, wherein the digital certificate comprises a value to authenticate the computing device.

### Claim 3 (depends on 1)

The method of claim 1, further comprising validating, based on a communication with the trusted authority, the portion of the digital certificate.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
verifying a path for the digital certificate; and
validating, based on the verifying the path, the portion of the digital certificate.

### Claim 5 (depends on 1)

The method of claim 1, wherein the user name further comprises a timestamp associated with a generation time of the user name.

### Claim 6 (depends on 5)

The method of claim 5, further comprising extracting and verifying the timestamp.

### Claim 7

A method comprising:
receiving, from a computing device, an authentication request comprising a user name and comprising a password associated with the user name, wherein:
the user name is based on a digital certificate issued by a trusted authority and comprises:
a portion of the digital certificate; and
a public key for the computing device; and
the password is encrypted, and is based on the portion of the digital certificate;
validating the portion of the digital certificate;
extracting the public key from the user name;
decrypting the password, based on the public key, to create a decrypted password;
converting, to a different format, the portion of the digital certificate;
verifying, based on the validating of the portion of the digital certificate, the authentication request;
determining that the decrypted password corresponds to the converted portion; and
based on the verifying and the determining, granting the authentication request from the computing device.

### Claim 8 (depends on 7)

The method of claim 7, wherein the converting the portion of the digital certificate to the different format comprises hashing the portion of the digital certificate.

### Claim 9 (depends on 7)

The method of claim 7, wherein the digital certificate comprises a value to authenticate the computing device.

### Claim 10 (depends on 7)

The method of claim 7, wherein the validating is performed based on a communication with the trusted authority.

### Claim 11 (depends on 7)

The method of claim 7, wherein the validating comprises:
verifying a path for the digital certificate; and
validating, based on the verifying the path, the portion of the digital certificate.

### Claim 12 (depends on 7)

The method of claim 7, wherein the user name further comprises a timestamp associated with a generation time of the user name.

### Claim 13 (depends on 12)

The method of claim 12, further comprising extracting and verifying the timestamp.

### Claim 14

A method comprising:
receiving, by a computing device and from a trusted authority, a digital certificate issued to the computing device;
generating a user name based on the digital certificate, wherein:
the user name is converted from the digital certificate and comprises:
a portion of the digital certificate; and
a public key for the computing device; and;
generating a password associated with the user name, wherein the password is encrypted, and is generated based on the portion of the digital certificate;
sending, from the computing device and to an authentication device, an authentication request comprising the user name and comprising the password, wherein the user name and the password are generated, by the computing device, such that a hash of the portion of the digital certificate matches a decrypted password decrypted from the password using the public key; and
receiving, based on the authentication request, approval of the authentication request.

### Claim 15 (depends on 14)

The method of claim 14, wherein the digital certificate issued to the computing device comprises a value to authenticate the computing device.

### Claim 16 (depends on 14)

The method of claim 14, wherein the password is generated by a private key for the computing device, wherein the private key is associated with the public key.

### Claim 17 (depends on 14)

The method of claim 14, further comprising:
verifying a path for the digital certificate; and
validating, based on the verifying the path, the portion of the digital certificate.

### Claim 18 (depends on 14)

The method of claim 14, wherein the user name further comprises a timestamp associated with a generation time of the user name.

### Claim 19 (depends on 18)

The method of claim 18, wherein the receiving the approval is further based on a verification of the timestamp.

### Claim 20

A system comprising:
a first computing device configured to send an authentication request; and
a second computing device comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the second computing device to:
receive, from the first computing device, the authentication request, wherein the authentication request comprises a user name and comprises a password associated with the user name, and wherein:
the user name is based on a digital certificate issued by a trusted authority and comprises:
a portion of the digital certificate; and
a public key for the first computing device; and
the password is encrypted, and is based on the portion of the digital certificate;
extract the public key from the user name;
decrypt the password, based on the public key, to create a decrypted password;
hash the portion of the digital certificate;
verify, based on a validity of the portion of the digital certificate, the authentication request;
determine that the decrypted password corresponds to the hashed portion of the digital certificate; and
based on the verifying and the determining, grant the authentication request from the first computing device.

### Claim 21 (depends on 20)

The system of claim 20, wherein the instructions, when executed by the one or more processors, cause the second computing device to:
verify a path for the digital certificate; and
validate, based on the verifying the path, the portion of the digital certificate.

### Claim 22 (depends on 20)

The system of claim 20, wherein the user name further comprises a timestamp associated with a generation time of the user name.

### Claim 23

A system comprising:
a first computing device configured to send an authentication request; and
a second computing device comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the second computing device to:
receive, from the first computing device, the authentication request, wherein the authentication request comprises a user name and comprises a password associated with the user name, and wherein:
the user name is based on a digital certificate issued by a trusted authority and comprises:
a portion of the digital certificate; and
a public key for the first computing device; and
the password is encrypted, and is based on the portion of the digital certificate;
validate the portion of the digital certificate;
extract the public key from the user name;
decrypt the password, based on the public key, to create a decrypted password;
convert, to a different format, the portion of the digital certificate;
verify, based on the validating of the portion of the digital certificate, the authentication request;
determine that the decrypted password corresponds to the converted portion; and
based on the verifying and the determining, grant the authentication request from the first computing device.

### Claim 24 (depends on 23)

The system of claim 23, wherein the instructions, when executed by the one or more processors, cause the second computing device to validate the portion of the digital certificate by:
verifying a path for the digital certificate; and
validating, based on the verifying the path, the portion of the digital certificate.

### Claim 25 (depends on 23)

The system of claim 23, wherein the user name further comprises a timestamp associated with a generation time of the user name.

### Claim 26

A system comprising:
a first computing device configured to receive an authentication request; and
a second computing device comprising:
one or more processors; and
memory storing instructions that, when executed by the one or more processors, cause the second computing device to:
receive, from a trusted authority, a digital certificate issued to the second computing device;
generate a user name based on the digital certificate, wherein:
the user name is converted from the digital certificate and comprises:
a portion of the digital certificate; and
a public key for the second computing device; and;
generate a password associated with the user name, wherein the password is encrypted, and is generated based on the portion of the digital certificate;
send, from the second computing device and to the first computing device, the authentication request, wherein the authentication request comprises the user name and comprises the password, and wherein the user name and the password are generated, by the second computing device, such that a hash of the portion of the digital certificate matches a decrypted password decrypted from the password using the public key; and
receive, based on the authentication request, approval of the authentication request.

### Claim 27 (depends on 26)

The system of claim 26, wherein the first computing device is configured to:
verify a path for the digital certificate; and
validate, based on the verifying the path, the portion of the digital certificate.

### Claim 28 (depends on 26)

The system of claim 26, wherein the user name further comprises a timestamp associated with a generation time of the user name.

### Claim 29

A non-transitory computer-readable medium storing instructions that, when executed, cause:
receiving, from a computing device, an authentication request comprising a user name and comprising a password associated with the user name, wherein:
the user name is based on a digital certificate issued by a trusted authority and comprises:
a portion of the digital certificate; and
a public key for the computing device; and
the password is encrypted, and is based on the portion of the digital certificate;
extracting the public key from the user name;
decrypting the password, based on the public key, to create a decrypted password;
hashing the portion of the digital certificate;
verifying, based on a validity of the portion of the digital certificate, the authentication request;
determining that the decrypted password corresponds to the hashed portion of the digital certificate; and
based on the verifying and the determining, granting the authentication request from the computing device.

### Claim 30 (depends on 29)

The non-transitory computer-readable medium of claim 29, wherein the instructions, when executed, cause:
verifying a path for the digital certificate; and
validating, based on the verifying the path, the portion of the digital certificate.

### Claim 31 (depends on 29)

The non-transitory computer-readable medium of claim 29, wherein the user name further comprises a timestamp associated with a generation time of the user name.

### Claim 32

A non-transitory computer-readable medium storing instructions that, when executed, cause:
receiving, from a computing device, an authentication request comprising a user name and comprising a password associated with the user name, wherein:
the user name is based on a digital certificate issued by a trusted authority and comprises:
a portion of the digital certificate; and
a public key for the computing device; and
the password is encrypted, and is based on the portion of the digital certificate;
validating the portion of the digital certificate;
extracting the public key from the user name;
decrypting the password, based on the public key, to create a decrypted password;
converting, to a different format, the portion of the digital certificate;
verifying, based on the validating of the portion of the digital certificate, the authentication request;
determining that the decrypted password corresponds to the converted portion; and
based on the verifying and the determining, granting the authentication request from the computing device.

### Claim 33 (depends on 32)

The non-transitory computer-readable medium of claim 32, wherein the instructions, when executed, cause the validating the portion of the digital certificate by:
verifying a path for the digital certificate; and
validating, based on the verifying the path, the portion of the digital certificate.

### Claim 34 (depends on 32)

The non-transitory computer-readable medium of claim 32, wherein the user name further comprises a timestamp associated with a generation time of the user name.

### Claim 35

A non-transitory computer-readable medium storing instructions that, when executed, cause:
receiving, from a trusted authority, a digital certificate issued to a computing device;
generating a user name based on the digital certificate, wherein:
the user name is converted from the digital certificate and comprises:
a portion of the digital certificate; and
a public key for the computing device; and;
generating a password associated with the user name, wherein the password is encrypted, and is generated based on the portion of the digital certificate;
sending, from the computing device and to an authentication device, an authentication request comprising the user name and comprising the password, and wherein the user name and the password are generated, by the computing device, such that a hash of the portion of the digital certificate matches a decrypted password decrypted from the password using the public key; and
receiving, based on the authentication request, approval of the authentication request.

### Claim 36 (depends on 35)

The non-transitory computer-readable medium of claim 35, wherein the user name further comprises a timestamp associated with a generation time of the user name.

### Claim 37 (depends on 35)

The non-transitory computer-readable medium of claim 35, wherein the password is generated by a private key for the computing device, wherein the private key is associated with the public key.