# US 10,771,467 B1 · External accessibility for computing devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,771,467 B1
- Document ID: US10771467B1
- Status: Granted
- Kind: B1
- Application number: 16/863,994
- Filed: 2020-04-30
- Published: 2020-08-20
- Granted: 2020-09-08
- Earliest claimed: 2017-05-04
- Applicants: Ernest Brickell
- Inventors: Ernest Brickell
- Web page: https://patentgrep.com/patent/US10771467B1

## CPC

- G06F 21/606: {by securing the transmission between two devices or processes}
- H04L 63/10: {for controlling access to devices or network resources}
- G06F 21/602: {Providing cryptographic facilities or services}
- H04L 9/0869: {involving random numbers or seeds}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/3247: {involving digital signatures}
- H04L 63/102: {Entity profiles}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 63/306: {intercepting packet switched data communications, e.g. Web, Internet or IMS communications}
- G06F 7/588: {Random number generators, i.e. based on natural stochastic processes}
- H04L 63/302: {gathering intelligence information for situation awareness or reconnaissance}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Methods and apparati for permitting Computing Devices 200 to safely accept Payloads 220 from External Access Entity Devices 260, and to safely access external Networks 710. In an apparatus embodiment, a Computing Device 200 contains an Access Control Module 210 comprising an Access Verification Public Key 211 and a Device Signature Key 214. The Access Control Module 210 is configured to verify authorization of an External Access Payload 220 by verifying a digital signature affixed to the Payload 220 using the Access Verification Public Key 211. The authorized External Access Payload 220 is then permitted to execute on the Computing Device 200. The Access Control Module 210 is also configured to receive from a Network Access Device 600 information associated with a Network 710 access request, and to create a plurality of digital signatures, using the Device Signature Key 214, that link said information associated with the Network 710 access request with the Access Verification Public Key 211. In some embodiments, an encryption/decryption key pair 291, 292 is associated with External Access Entity Device 260 to further enhance security.

## Claims

### Claim 1

A computing device operated by a user of the computing device, said computing device comprising:
a verification public key;
an access control module configured to authorize an external access entity to access a cryptographic module located within the computing device, wherein:
said authorization comprises verifying a digital signature affixed by the external access entity using the verification public key;
the external access entity is not the user and is not a module executing on the computing device;
the cryptographic module is configured to use one or more communication encryption keys for encrypted communications with other devices; and
the cryptographic module is configured to provide access to the one or more communication encryption keys to an external access entity authorized by the access control module for a specified amount of time, and said cryptographic module is further configured to discontinue the access to any of said communication encryption keys after the specified amount of time expires;
said computer device further comprising an access archive module configured to record any authorized access of the cryptographic module by an external access entity, wherein a record stored in the access archive module cannot be modified or deleted by an authorized external access entity; and
the access archive module is further configured to output recorded information pertaining to authorized access by an external access entity.

### Claim 2 (depends on 1)

The computing device of claim 1, where said access control module is further configured to:
receive from a network access device information associated with a network access request lodged by the computing device; and
create a plurality of digital signatures, using a signature key of the computing device, linking said information associated with the network access request with the verification public key, whereby granting the network access request is facilitated.

### Claim 3

A method for providing authorized access to communication encryption keys used in a computing device, said method comprising the steps of the computing device:
using communication encryption keys in a cryptographic module located within the computing device;
receiving a request from an external access entity to access at least one of the communication encryption keys, wherein said request comprises a digital signature not created on the computing device;
validating the digital signature of the external access entity request using a public verification key embedded in the computing device;
providing the external access entity with access to the requested one or more communication encryption keys when the digital signature has been validated;
discontinuing the external access entity access to any of said communication encryption keys after a specified amount of time expires; and
recording information contained in the validated external access entity request in a record that cannot be deleted or modified by the external access entity.