# US 11,444,766 B2 · Combined authorization process > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,766 B2 - Document ID: US11444766B2 - Status: Granted - Kind: B2 - Application number: 16/293,541 - Filed: 2019-03-05 - Published: 2019-10-10 - Granted: 2022-09-13 - Earliest claimed: 2015-07-06 - Assignees: Apple Inc. - Applicants: Apple Inc. - Inventors: Yannick L. Sierra; Mitchell D. Adler - Web page: https://patentgrep.com/patent/US11444766B2 ## CPC - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 9/0833: {involving conference or group key (network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065)} - H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)} - H04L 9/12: Transmitting and receiving encryption devices synchronised or initially set up in a particular manner - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3247: {involving digital signatures} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 63/0892: {by using authentication-authorization-accounting [AAA] servers or protocols} - H04L 63/104: {Grouping of entities} - H04W 12/06: Authentication - H04L 2209/80: Wireless - H04L 2463/082: applying multi-factor authentication - H04W 12/08: Access security - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Some embodiments provide a method for a first device to join a group of related devices. The method receives input of a password for an account with a centralized entity and a code generated by a second device in the group. When the second device determines that the code input on the first device matches the generated code, the method receives an authentication code from the second device for authorizing the first device with the entity as a valid device for the account. The method uses the password and information regarding the first device to generate an application to the group. After sending the application to the second device, the method receives information from the second device that enables the first device to add itself to the group. The second device verifies the generated application, and the method uses the information received from the second device to join the group. ## Claims ### Claim 1 A method comprising: displaying, by a first device, a first code for entry on a second device, the second device have been established in a group of related devices and the second device having been authorized as a trusted device for a particular account with a centralized entity; receiving, by the first device and from the second device, a second code, the second code being received responsive to the first code being input on the second device; using, by the first device, the second code to authorize the first device as another trusted device for the particular account with the centralized entity; transmitting, by the first device and to the second device, a message associated with joining the group of related devices; receiving, from the second device, the message signed with a private key corresponding to the particular account; and using, by the first device, the message to join the group of related devices. ### Claim 2 (depends on 1) The method of claim 1, further comprising: prior to using the message to join the group of related devices, signing the message with a private key of the first device. ### Claim 3 (depends on 2) The method of claim 2, wherein the message comprises an application to join the group of related devices and using the message to join the group of related devices comprises: transmitting, by the first device, the message to the second device. ### Claim 4 (depends on 1) The method of claim 1, wherein the second device is previously authorized with the centralized entity as another valid device for the particular account with the centralized entity, the second device is separate from the centralized entity, and the group of related devices is exclusive of the centralized entity. ### Claim 5 (depends on 1) The method of claim 1, wherein the message comprises an identifier of the first device. ### Claim 6 (depends on 1) The method of claim 1, further comprising: transmitting, by the first device and to the second device, a request to join the group of related devices that comprises the second device. ### Claim 7 (depends on 1) The method of claim 1, wherein the centralized entity is a cloud services provider and the particular account comprises a cloud services account with the cloud services provider. ### Claim 8 (depends on 1) The method of claim 1, wherein the first code is randomly generated by the first device in a manner not reproducible by the centralized entity. ### Claim 9 (depends on 1) The method of claim 1, wherein the second code is generated in a manner reproducible by the centralized entity. ### Claim 10 A non-transitory machine-readable medium comprising code that, when executed by one or more processors, cause the one or more processors to perform operations, the code comprising: code to receive, by a first device of a group of related devices, input of a first code generated by a second device that is not established in the group of related devices; code to, responsive to the input, transmit, by the first device, a second code to the second device for authorization with a centralized entity for a particular user account; code to receive, by the first device and from the second device, a message associated with joining the group of related devices, the message being signed with a private key corresponding to the particular user account; and code to establish, by the first device, the second device in the group of related devices. ### Claim 11 (depends on 10) The non-transitory machine-readable medium of claim 10, wherein the code further comprises: code to, prior to receiving, by the first device, the message signed with the private key corresponding to the particular user account: receive, by the first device and from the second device, the message associated with joining the group of related devices, the message not being signed with the private key corresponding to the particular user account; sign, by the first device, the message with the private key corresponding to the particular user account; and transmit, by the first device, the signed message to the second device. ### Claim 12 (depends on 10) The non-transitory machine-readable medium of claim 10, wherein the first device is previously authorized with the centralized entity as another valid device for the particular user account with the centralized entity, the second device is separate from the centralized entity, and the group of related devices is exclusive of the centralized entity. ### Claim 13 (depends on 10) The non-transitory machine-readable medium of claim 10, wherein the message comprises an identifier of the second device. ### Claim 14 (depends on 10) The non-transitory machine-readable medium of claim 10, wherein the centralized entity is a cloud services provider and the particular user account comprises a cloud services account with the cloud services provider. ### Claim 15 (depends on 10) The non-transitory machine-readable medium of claim 10, wherein the first code is randomly generated by the second device in a manner not reproducible by the centralized entity. ### Claim 16 (depends on 10) The non-transitory machine-readable medium of claim 10, wherein the code further comprises: code to generate, by the first device, the second code in a manner reproducible by the centralized entity. ### Claim 17 A device comprising: a memory; and at least one processor configured to: display a first code for entry on another device, the other device having been established in a group of related devices and the other device having been authorized as a trusted device for a particular account with a centralized entity; receive, from the other device, a second code, the second code being received responsive to the first code being input on the other device; use the second code to authorize the device as another trusted device for the particular account with the centralized entity; transmit, to the other device, a message associated with joining the group of related devices; receive, from the other device, the message signed with a private key corresponding to the particular account; and use the message to join the group of related devices. ### Claim 18 (depends on 17) The device of claim 17, wherein the at least one processor is further configured to: prior to using the message to join the group of related devices, sign the message with a private key of the device. ### Claim 19 (depends on 18) The device of claim 18, wherein the message comprises an application to join the group of related devices and the at least one processor is configured to use the message to join the group of related devices by: transmitting the message to the other device. ### Claim 20 (depends on 17) The device of claim 17, wherein the other device is previously authorized with the centralized entity as another valid device for the particular account with the centralized entity, the other device is separate from the centralized entity, and the group of related devices is exclusive of the centralized entity.