# US 11,451,535 B1 · System, method and computer program product for credential provisioning in a mobile device platform

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,451,535 B1
- Document ID: US11451535B1
- Status: Granted
- Kind: B1
- Application number: 16/438,569
- Filed: 2019-06-12
- Granted: 2022-09-20
- Earliest claimed: 2016-08-26
- Assignees: Hypori, Inc.
- Applicants: Intelligent Waves LLC
- Inventors: Brian J. Vetter; Mohammad Salman Dhedhi
- Web page: https://patentgrep.com/patent/US11451535B1

## CPC

- H04L 63/0838: {using one-time-passwords}
- G06F 21/36: by graphic or iconic representation
- H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)}
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 63/067: {using one-time keys (cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863)}
- H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)}
- H04W 12/068: {using credential vaults, e.g. password manager applications or one time password [OTP] applications}
- H04W 12/35: {Protecting application or service provisioning, e.g. securing SIM application provisioning}
- G06F 21/31: User authentication
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

To provision a client application on a client device, a user may be provided with a QR code, a one-time password, or a manual entry page for starting a credential provisioning process via a credential provisioning service provided by a credential provisioning server in a secure network. The client application may include information on trusted servers operating in the secure network. The credential provisioning server may operate to perform a sequence of actions to verify user credentials and determine, based on rules applicable to the user, the client device, or a combination thereof, whether the client application is to be provisioned on a client device. If so, the credential provisioning server may operate to generate a key pair, obtain a signed certificate, encrypt them, and send them to the client device such that the client application can use them to establish a mutual secure connection with a trusted server.

## Claims

### Claim 1

A method for provisioning of an account for a client application on a client device, the method being implemented by one or more processors configured to execute one or more computer program instructions, the method comprising:
obtaining a request from a client application on a client device, the request including user information; and
in response to a positive verification of the user information and a determination to proceed with provisioning of an account for the client application on the client device:
generating a key pair using one or more parameters associated with a user;
generating a certificate signing request using the key pair and the one or more parameters associated with the user;
sending the certificate signing request to a certificate authority;
receiving a signed certificate from the certificate authority;
encrypting, based on a temporary encryption password, the signed certificate and the key pair, wherein the temporary encryption password does not provide user authentication, and is used by a server computer to encrypt credentials as a result of a successful provisioning request to the server computer; and
sending the signed certificate, the key pair, and identifying information of a key store or keychain location on the client device to the client device such that the client application on the client device stores, using the identifying information, the signed certificate and the key pair at the key store or keychain location on the client device.

### Claim 2 (depends on 1)

The method of claim 1, wherein the positive verification of the user information includes:
determining that a user entry stored in a data store matches a user identifier included in the user information; and
determining that a one-time password included in the user information matches a one-time password associated with the user entry stored in the data store.

### Claim 3 (depends on 1)

The method of claim 1, wherein the determination to proceed with the provisioning of the account for the client application on the client device includes:
accessing a rules database; and
determining, based on at least one credential provisioning rule from the rules database and client device information obtained from the client device, to proceed with the provisioning of the account for the client application on the client device, the client device information including a model associated with the client device, an operating system type used by the client device, or an operating system version used by the client device.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
in response to a negative verification of the user information, returning an error message to the client device, wherein the negative verification of the user information includes determining that a user entry stored in a data store does not match a user identifier included in the user information or determining that a one-time password included in the user information does not match a one-time password associated with the user entry stored in the data store.

### Claim 5 (depends on 1)

The method of claim 1, wherein the one or more parameters includes the user's common name, the user's enterprise account information, or the user's email address.

### Claim 6 (depends on 1)

The method of claim 1, wherein the password is a one-time password included in the user information or the user's enterprise password associated with the user's enterprise account.

### Claim 7 (depends on 1)

The method of claim 1, wherein encrypting the signed certificate and the key pair includes:
creating a certificate file including the signed certificate and the key pair; and
encrypting, based on the password, the certificate file.

### Claim 8

A system for provisioning of an account for a client application on a client device, the system comprising:
a computer system that comprises one or more processors programed with computer program instructions that, when executed, cause the computer system to:
obtain a request from a client application on a client device, the request including user information; and
in response to a positive verification of the user information and a determination to proceed with provisioning of an account for the client application on the client device:
generate a key pair using one or more parameters associated with a user;
generate a certificate signing request using the key pair and the one or more parameters associated with the user;
send the certificate signing request to a certificate authority;
receive a signed certificate from the certificate authority;
encrypt, based on a temporary encryption password, the signed certificate and the key pair, wherein the temporary encryption password does not provide user authentication, and is used by a server computer to encrypt credentials as a result of a successful provisioning request to the server computer; and
send the signed certificate, the key pair, and identifying information of a key store or keychain location on the client device to the client device such that the client application on the client device stores, using the identifying information, the signed certificate and the key pair at the key store or keychain location on the client device.

### Claim 9 (depends on 8)

The system of claim 8, wherein the positive verification of the user information includes causing the computer system to:
determine that a user entry stored in a data store matches a user identifier included in the user information; and
determine that a one-time password included in the user information matches a one-time password associated with the user entry stored in the data store.

### Claim 10 (depends on 8)

The system of claim 8, wherein the determination to proceed with the provisioning of the account for the client application on the client device includes causing the computer system to:
access a rules database; and
determine, based on at least one credential provisioning rule from the rules database and client device information obtained from the client device, to proceed with the provisioning of the account for the client application on the client device, the client device information including a model associated with the client device, an operating system type used by the client device, or an operating system version used by the client device.

### Claim 11 (depends on 8)

The system of claim 8, wherein the computer system is caused to:
in response to a negative verification of the user information, return an error message to the client device, wherein the negative verification of the user information includes causing the computer system to determine that a user entry stored in a data store does not match a user identifier included in the user information or determine that a one-time password included in the user information does not match a one-time password associated with the user entry stored in the data store.

### Claim 12 (depends on 8)

The system of claim 8, wherein the one or more parameters includes the user's common name, the user's enterprise account information, or the user's email address.

### Claim 13 (depends on 8)

The system of claim 8, wherein the password is a one-time password included in the user information or the user's enterprise password associated with the user's enterprise account.

### Claim 14 (depends on 8)

The system of claim 8, wherein encrypting the signed certificate and the key pair includes causing the computer system to:
create a certificate file including the signed certificate and the key pair; and encrypt, based on the password, the certificate file.

### Claim 15

A method for provisioning of an account for a client application on a client device, the method being implemented by one or more processors configured to execute one or more computer program instructions, the method comprising:
sending a request to a server computer, the request including user information; and
in response to a positive verification of the user information and a determination to proceed with provisioning of an account for the client application on the client device:
obtaining one or more parameters associated with a user and instructions to generate a key pair;
generating the key pair using the one or more parameters associated with the user;
generating a certificate signing request using the key pair and the one or more parameters associated with the user;
sending, to the server computer, a request to sign the certificate signing request;
receiving, from the server, a signed certificate and identifying information of a key store or keychain location on the client device wherein receiving the signed certificate and the identifying information includes receiving a certificate file including the signed certificate and the identifying information, wherein the certificate file is encrypted based on a temporary encryption password, and wherein the temporary encryption password is a one-time password included in the user information, wherein the temporary encryption password does not provide user authentication, and is used by the server computer to encrypt credentials as a result of a successful provisioning request to the server computer; and
storing, using the identifying information, the signed certificate and the key pair at the key store or keychain location on the client device.

### Claim 16 (depends on 15)

The method of claim 15, wherein the positive verification of the user information includes:
determining that a user entry stored in a data store matches a user identifier included in the user information; and
determining that a one-time password included in the user information matches a one-time password associated with the user entry stored in the data store.

### Claim 17 (depends on 15)

The method of claim 15, wherein the determination to proceed with the provisioning of the account for the client application on the client device includes:
accessing a rules database; and
determining, based on at least one credential provisioning rule from the rules database and client device information, to proceed with the provisioning of the account for the client application on the client device, the client device information including a model associated with the client device, an operating system type used by the client device, or an operating system version used by the client device.

### Claim 18 (depends on 15)

The method of claim 15, wherein the one or more parameters includes the user's common name, the user's enterprise account information, the user's email address, key size, key type, a domain, or a key store/keychain to use.

### Claim 19 (depends on 15)

The method of claim 15, further comprising:
prior to storing the signed certificate and the key pair at the key store or keychain location on the client device, decrypting the certificate file using the one-time password or the user's enterprise password associated with the user's enterprise account.