# US 11,443,023 B2 · Distributed profile and key management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,443,023 B2 - Document ID: US11443023B2 - Status: Granted - Kind: B2 - Application number: 15/685,299 - Filed: 2017-08-24 - Published: 2019-02-28 - Granted: 2022-09-13 - Earliest claimed: 2017-08-24 - Assignees: VMware, Inc. - Applicants: VMware, Inc. - Inventors: Eugene Liderman; Jonathon Deriso; William Thomas Hooper; Sagar Date; Tejas Mehrotra; Stephen Turner; Amogh Datar; Dipanshu Gupta - Web page: https://patentgrep.com/patent/US11443023B2 ## CPC - G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards - G06F 21/33: using certificates - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04W 12/04: Key management, e.g. using generic bootstrapping architecture [GBA] - H04W 12/06: Authentication - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Disclosed are various examples for distributed profile and key management. In one example, a client device can include an agent application and a PIV-D application. The agent application can receive a partially populated device profile generated by a management service to configure a setting on the client device. The PIV-D application can generate a derived credential and provide the derived credential to the agent application. The agent application can modify the partially populated device profile to include the credential to create a fully populated device profile and configure the client device in accordance with the fully populated device profile. ## Claims ### Claim 1 A system for distributed profile and key management, comprising: a client device; and program instructions executable in the client device that, when executed by the client device, cause the client device to: receive, by a first client application of the client device, a partially populated device profile, the partially populated device profile generated by a management service remotely located from the client device to configure at least one setting on the client device, the partially populated device profile as generated comprising a credential payload portion having a temporary string or an empty portion; authenticate, by a second client application of the client device, the client device through communication with a third-party security service; in response to the client device being authenticated, generate, by the second client application, a credential, wherein the credential is a derived credential, the derived credential being generated using at least one personal identity verification (PIV) card credential; provide, by the second client application, the credential to the first client application; modify, by the first client application, the partially populated device profile to include the credential to create a fully populated device profile by replacing the temporary string or inserting the credential to generate the fully populated device profile; and cause, by the first client application, the client device to be configured in accordance with the fully populated device profile. ### Claim 2 (depends on 1) The system of claim 1, wherein the first client application is an agent application executable on the client device. ### Claim 3 (depends on 2) The system of claim 2, further comprising program instructions executable in the client device that, when executed by the client device, cause the client device to encrypt, by the agent application, the fully populated device profile. ### Claim 4 (depends on 3) The system of claim 3, further comprising program instructions executable in the client device that, when executed by the client device, cause the client device to send, by the agent application, the fully populated device profile to the management service. ### Claim 5 (depends on 1) The system of claim 1, wherein the client device is configured in accordance with the fully populated device profile using at least one device management feature of an Android® operating system. ### Claim 6 (depends on 1) The system of claim 1, wherein the derived credential is an X.509 public key certificate. ### Claim 7 A non-transitory computer-readable medium for distributed profile and key management embodying program code executable in a client device that, when executed by the client device, causes the client device to: receive, by a first client application of the client device, a partially populated device profile, the partially populated device profile generated by a management service remotely located from the client device to configure atleast one setting on the client device, the partially populated device profile as generated comprising a credential payload portion having a temporary string or an empty portion; authenticate, by a second client application, the client device through communication with a third-party security service; in response to the client device being authenticated, generate, by the second client application, a credential, wherein the credential is a derived credential, the derived credential being generated using at least one personal identity verification (PIV) card credential; provide, by the second client application, the credential to the first client application; modify, by the first client application, the partially populated device profile to include the credential to create a fully populated device profile by replacing the temporary string or inserting the credential to generate the fully populated device profile; and cause, by the first client application, the client device to be configured in accordance with the fully populated device profile. ### Claim 8 (depends on 7) The non-transitory computer-readable medium of claim 7, wherein the first client application is an agent application executable on the client device. ### Claim 9 (depends on 8) The non-transitory computer-readable medium of claim 8, further comprising program code executable in the client device that, when executed by the client device, causes the client device to encrypt, by the agent application, the fully populated device profile. ### Claim 10 (depends on 9) The non-transitory computer-readable medium of claim 9, further comprising program code executable in the client device that, when executed by the client device, causes the client device to send, by the agent application, the fully populated device profile to the management service. ### Claim 11 (depends on 7) The non-transitory computer-readable medium of claim 7, wherein the client device is configured in accordance with the fully populated device profile using at least one device management feature of an Android® operating system. ### Claim 12 (depends on 7) The non-transitory computer-readable medium of claim 7, wherein the derived credential is an X.509 public key certificate. ### Claim 13 A computer-implemented method for distributed profile and key management, comprising: receiving, by a first client application of the client device, a partially populated device profile, the partially populated device profile generated by a management service remotely located from the client device to configure at least one setting on the client device, the partially populated device profile as generated comprising a credential payload portion having a temporary string or an empty portion; authenticating, by a second client application, the client device through communication with a third-party security service; in response to the client device being authenticated, generating, by the second client application, a credential, wherein the credential is a derived credential, the derived credential being generated using at least one personal identity verification (PIV) card credential; providing, by the second client application, the credential to the first client application; modifying, by the first client application, the partially populated device profile to include the credential to create a fully populated device profile by replacing the temporary string or inserting the credential to generate the fully populated device profile; and configuring, by the first client application, the client device in accordance with the fully populated device profile. ### Claim 14 (depends on 13) The computer-implemented method of claim 13, wherein the first client application is an agent application executable on the client device. ### Claim 15 (depends on 14) The computer-implemented method of claim 14, further comprising encrypting, by the agent application, the fully populated device profile. ### Claim 16 (depends on 15) The computer-implemented method of claim 15, further comprising sending, by the agent application, the fully populated device profile to the management service. ### Claim 17 (depends on 13) The computer-implemented method of claim 13, wherein the client device is configured in accordance with the fully populated device profile using at least one device management feature of an Android® operating system.