# US 11,310,050 B2 · Verifying a computing device after transport > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,050 B2 - Document ID: US11310050B2 - Status: Granted - Kind: B2 - Application number: 16/244,411 - Filed: 2019-01-10 - Published: 2020-03-19 - Granted: 2022-04-19 - Earliest claimed: 2018-09-17 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Gregory J. Zavertnik; Vishwajit Tumkur Mahalingappa; Soumya Jain; Vimalraj Vasudevan Thekkoot; Karthikeyan Nagarathinam; Sampath Kumar Victor; Varsha Jagdale - Web page: https://patentgrep.com/patent/US11310050B2 ## CPC - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - G06F 8/63: {Image based installation; Cloning; Build to order} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - G06F 21/44: Program or device authentication - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB} - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/321: {involving a third party or a trusted authority} - H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model} - G06F 3/0647: {Migration mechanisms} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract One example provides a method for authenticating a computing device received from a manufacturer, the method including establishing a secured connection with the computing device, receiving, from the computing device, a first set of security artifacts, and retrieving, from a secure cloud storage location, a second set of security artifacts, the second set of security artifacts including the EK public key and the PCR values for the computing device obtained during manufacturing. The method further comprises, when the first set of security artifacts matches the second set of security artifacts, then verifying the computing device as trusted and permitting communication between the computing device and a secured computing environment, and when the first set of security artifacts does not match the second set of security artifacts, then not verifying the computing device as trusted and not permitting communication between the computing device and the secured computing environment. ## Claims ### Claim 1 A method for authenticating a computing device received from a manufacturer, the method comprising: establishing a secured connection with the computing device; receiving, from the computing device, a first set of security artifacts comprising an endorsement key (EK) public key and platform configuration register (PCR) values; retrieving, from a secure cloud storage location, a second set of security artifacts for the computing device, the second set of security artifacts comprising the EK public key and the PCR values for the computing device obtained during manufacturing of the computing device; confirming that the first set of security artifacts matches the second set of security artifacts; and verifying the computing device as trusted and permitting communication between the computing device and a secured computing environment. ### Claim 2 (depends on 1) The method of claim 1, wherein establishing the secured connection with the computing device comprises isolating the computing device such that communication between the computing device and the secured computing environment is not permitted. ### Claim 3 (depends on 1) The method of claim 1, further comprising verifying the EK public key via an attestation identity key (AIK). ### Claim 4 (depends on 1) The method of claim 1, wherein establishing the secured connection with the computing device comprises establishing the secured connection via a first virtual machine not having direct cloud access, receiving the first set of security artifacts from the computing device comprises receiving the first set of security artifacts via the secured connection to the first virtual machine, retrieving the second set of security artifacts comprises issuing a request for the second set of security artifacts to a management service configured to obtain the security artifacts from the secure cloud storage location, and wherein permitting communication between the computing device and the secured computing environment comprises permitting the computing device to communicate with a second virtual machine having direct cloud access. ### Claim 5 (depends on 1) The method of claim 1, wherein retrieving the second set of security artifacts for the computing device comprises issuing a request for the second set of security artifacts to a cloud service, the request comprising a unique identifier of the computing device, and obtaining the second set of security artifacts from a cloud storage location identified by the cloud service. ### Claim 6 (depends on 1) The method of claim 1, further comprising identifying, based on a PCR value from the first set of security artifacts received from the computing device that does not match a corresponding PCR value within the second set of security artifacts, a likely change made to the computing device. ### Claim 7 (depends on 1) The method of claim 1, wherein the computing device comprises a data migrating computing device, and wherein permitting communication between the computing device and the secured computing environment comprises permitting the data migrating computing device to migrate stored data to a cloud storage location. ### Claim 8 A method for authenticating a computing device received from a manufacturer, the method comprising: establishing a secured connection with the computing device; receiving, from the computing device, a first set of security artifacts comprising an endorsement key (EK) public key and platform configuration register (PCR) values; retrieving, from a secure cloud storage location, a second set of security artifacts for the computing device, the second set of security artifacts comprising the EK public key and the PCR values for the computing device obtained during manufacturing of the computing device; confirming that the first set of security artifacts does not match the second set of security artifacts; and not verifying the computing device as trusted and not permitting communication between the computing device and a secured computing environment. ### Claim 9 (depends on 8) The method of claim 8, wherein establishing the secured connection with the computing device comprises isolating the computing device such that communication between the computing device and the secured computing environment is not permitted. ### Claim 10 (depends on 8) The method of claim 8, further comprising verifying the EK public key via an attestation identity key (AIK). ### Claim 11 (depends on 8) The method of claim 8, wherein establishing the secured connection with the computing device comprises establishing the secured connection via a first virtual machine not having direct cloud access, receiving the first set of security artifacts from the computing device comprises receiving the first set of security artifacts via the secured connection to the first virtual machine, retrieving the second set of security artifacts comprises issuing a request for the second set of security artifacts to a management service configured to obtain the security artifacts from the secure cloud storage location, and wherein permitting communication between the computing device and the secured computing environment comprises permitting the computing device to communicate with a second virtual machine having direct cloud access. ### Claim 12 (depends on 8) The method of claim 8, further comprising identifying, based on a PCR value from the first set of security artifacts received from the computing device that does not match a corresponding PCR value within the second set of security artifacts, a likely change made to the computing device.