# US 10,771,450 B2 · Method and system for securely provisioning a remote device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,450 B2 - Document ID: US10771450B2 - Status: Granted - Kind: B2 - Application number: 15/869,824 - Filed: 2018-01-12 - Published: 2019-07-18 - Granted: 2020-09-08 - Earliest claimed: 2018-01-12 - Assignees: BlackBerry Limited - Applicants: BlackBerry Limited - Inventors: Edward Snow Willis; Hashim Mohammad Qaderi; Scott Hutchens; David Alan Inglis - Web page: https://patentgrep.com/patent/US10771450B2 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - G06F 8/65: Updates (security arrangements therefor G06F21/57) - H04L 41/0806: for initial configuration or provisioning, e.g. plug-and-play - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) - H04W 12/069: using certificates or pre-shared keys - H04W 12/50: Secure pairing of devices - H04L 63/10: {for controlling access to devices or network resources} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method at a computing device for provisioning a network-connected device within a security platform, the method including receiving a first connection request, the first connection request being from an electronic apparatus and including a network-connected device identifier; authenticating the first connection request, thereby creating a first connection; receiving a second connection request, the second connection request being from the network-connected device and including the network-connected device identifier and a shared platform credential; receiving a request from the network-connected device to add the network-connected device to the security platform; and adding the network-connected device to the security platform based on a concurrent first connection and the request from the network-connected device to add the network-connected device to the security platform. ## Claims ### Claim 1 A method at a computing device for provisioning a network-connected device within a security platform, the method comprising: receiving a first connection request, the first connection request being from an electronic apparatus distinct from the network-connected device, and including a network-connected device identifier for the network-connected device; authenticating the first connection request, thereby creating a first connection; receiving a second connection request, the second connection request being from the network-connected device and including the network-connected device identifier and a shared platform credential; receiving a request from the network-connected device to add the network-connected device to the security platform; adding the network-connected device to the security platform based on a concurrent first connection and the request from the network-connected device to add the network-connected device to the security platform; receiving a third connection request from a second network-connected device; determining that no connection request including an identifier for the second network-connected device was received from any electronic apparatus; and ignoring the third connection request. ### Claim 2 (depends on 1) The method of claim 1, further comprising: sending an acknowledgement to the network-connected device; and receiving a public key from the network-connected device. ### Claim 3 (depends on 1) The method of claim 1, wherein the second connection request is based on a physical interaction with the network-connected device. ### Claim 4 (depends on 1) The method of claim 1, further comprising, prior to the receiving the first connection request: sending client software to the network-connected device, the client software including the shared platform credential. ### Claim 5 (depends on 4) The method of claim 4, wherein the shared platform credential includes a certificate and a private key. ### Claim 6 (depends on 1) The method of claim 1, further comprising: receiving a fourth connection request, the fourth connection request being from a second electronic apparatus and including a network-connected device identifier; determining that authentication of the second electronic apparatus fails; and ignoring the fourth connection request. ### Claim 7 (depends on 1) The method of claim 1, further comprising, prior to the adding: determining that the network-connected device has been previously added to the security platform; ignoring the request from the network-connected device to add the network-connected device to the security platform; and disabling the network-connected device from the security platform. ### Claim 8 (depends on 7) The method of claim 7, further comprising creating a security flag for the network-connected device. ### Claim 9 A computing device configured for provisioning a network-connected device within a security platform, the computing device comprising: a processor; a memory, and a communications subsystem, wherein the computing device is configured to: receive a first connection request, the first connection request being from an electronic apparatus distinct from the network-connected device and including a network-connected device identifier for the network-connected device; authenticate the first connection request, thereby creating a first connection; receive a second connection request, the second connection request being from the network-connected device and including the network-connected device identifier and a shared platform credential; receive a request from the network-connected device to add the network-connected device to the security platform; add the network-connected device to the security platform based on a concurrent first connection and the request from the network-connected device to add the network-connected device to the security platform; receive a third connection request from a second network-connected device; determine that no connection request including an identifier for the second network-connected device was received from any electronic apparatus; and ignore the third connection request. ### Claim 10 (depends on 9) The computing device of claim 9, wherein the computing device is further configured to: send an acknowledgement to the network-connected device; and receive a public key from the network-connected device. ### Claim 11 (depends on 9) The computing device of claim 9, wherein the second connection request is based on a physical interaction with the network-connected device. ### Claim 12 (depends on 9) The computing device of claim 9, wherein the computing device is further configured to, prior to receiving the first connection request: send client software to the network-connected device, the client software including the shared platform credential. ### Claim 13 (depends on 12) The computing device of claim 12, wherein the shared platform credential includes a certificate and a private key. ### Claim 14 (depends on 9) The computing device of claim 9, wherein the computing device is further configured to: receive a fourth connection request, the fourth connection request being from a second electronic apparatus and including a network-connected device identifier; determine that authentication of the second electronic apparatus fails; and ignore the fourth connection request. ### Claim 15 (depends on 9) The computing device of claim 9, wherein the computing device is further configured to, prior to adding: determine that the network-connected device has been previously added to the security platform; ignore the request from the network-connected device to add the network-connected device to the security platform; and disable the network-connected device from the security platform. ### Claim 16 (depends on 15) The computing device of claim 15, wherein the computing device is further configured to create a security flag for the network-connected device. ### Claim 17 A non-transitory computer readable medium for storing instruction code, which when executed by a processor of a computing device configured for provisioning a network-connected device within a security platform, cause the computing device to: receive a first connection request, the first connection request being from an electronic apparatus distinct from the network-connected device and including a network-connected device identifier for the network-connected device; authenticate the first connection request, thereby creating a first connection; receive a second connection request, the second connection request being from the network-connected device and including the network-connected device identifier and a shared platform credential; receive a request from the network-connected device to add the network-connected device to the security platform; add the network-connected device to the security platform based on a concurrent first connection and the request from the network-connected device to add the network-connected device to the security platform; receive a third connection request from a second network-connected device; determine that no connection request including an identifier for the second network-connected device was received from any electronic apparatus; and ignore the third connection request.