# US 11,451,560 B2 · Systems and methods for pre-configuration attestation of network devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,560 B2 - Document ID: US11451560B2 - Status: Granted - Kind: B2 - Application number: 16/808,114 - Filed: 2020-03-03 - Published: 2020-10-08 - Granted: 2022-09-20 - Earliest claimed: 2019-04-05 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Sujal Sheth; Shwetha Subray Bhandari; Eric Voit; William F. Sulzen; Frank Brockners; Selvaraj Mani; Eliot Lear - Web page: https://patentgrep.com/patent/US11451560B2 ## CPC - H04L 63/126: {the source of the received data} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 61/5014: using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP] - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04W 12/61: Time-dependent - H04W 12/66: {Trust-dependent, e.g. using trust scores or trust relationships} - H04L 2101/686: using dual-stack hosts, e.g. in Internet protocol version 4 [IPv4]/Internet protocol version 6 [IPv6] networks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems, methods, and computer-readable media are disclosed for measurement of trustworthiness of network devices prior to their configuration and deployment in a network. In one aspect of the present disclosure, a method for pre-configuration of network devices includes receiving, at a dynamic host configuration server, a first request from a network device for configuration data, the configuration data including at least an IP address; sending, by the dynamic host configuration server, a second request to the network device for attestation information; verifying, by the dynamic host configuration server, the network device based on the attestation information; and assigning, by the dynamic host configuration server, the configuration data to the network device upon verifying the network device. ## Claims ### Claim 1 A method comprising: receiving, at a dynamic host configuration server, a first request from a network device for configuration data, the configuration data including at least an IP address; sending, by the dynamic host configuration server in response to the receiving, a second request to the network device for attestation information; verifying, by the dynamic host configuration server, the network device based on the attestation information, the verifying comprising: sending the attestation information to a verifying component to verify the network device; and receiving a result of verification of the network device from the verifying component; and assigning, in response to at least the verification, by the dynamic host configuration server, the configuration data to the network device upon verifying the network device. ### Claim 2 (depends on 1) The method of claim 1, wherein dynamic host configuration server and the network device are IPv6 devices operating based on Dynamic Host Configuration Parameter v6 (DHCPv6) protocol. ### Claim 3 (depends on 1) The method of claim 1, wherein dynamic host configuration server and the network device are IPv4 devices operating based on Dynamic Host Configuration Parameter v4 (DHCPv4) protocol. ### Claim 4 (depends on 1) The method of claim 1, wherein verifying the network device comprises: receiving a stapled version of the attestation information from the network device, the stapled version of the attestation information being generated by a verifying component by signing the attestation information using a digital key known to both the verifying component and the dynamic host configuration server; and verifying the stapled version using the digital key to yield a verification result of the network device. ### Claim 5 (depends on 1) The method of claim 1, wherein a verifiable timestamp validates freshness of the attestation information provided by the network device. ### Claim 6 (depends on 1) The method of claim 1, wherein the first request includes a Manufacturer Usage Description (MUD) fetch Uniform Resource Request (URL), and assigning the configuration data includes provisioning an Internet of Things (IoT) device for operation on a network. ### Claim 7 A device comprising: memory having computer-readable instructions stored therein; and one or more processors configured to execute the computer-readable instructions to: receive a first request from a client device for configuration data, the configuration data including at least an IP address; send, in response to the receive, a second request to the client network device for attestation information; verify the client network device based on the attestation information, comprising: send the attestation information to a verifying component to verify the network device; and receive a result of verification of the network device from the verifying component; and assign, in response to at least the verify, the configuration data to the client network device upon verifying the client network device. ### Claim 8 (depends on 7) The device of claim 7, wherein the device and the client network device are IPv6 devices operating based on Dynamic Host Configuration Parameter v6 (DHCPv6) protocol. ### Claim 9 (depends on 7) The device of claim 7, wherein the device and the client network device are IPv4 devices operating based on Dynamic Host Configuration Parameter v4 (DHCPv4) protocol. ### Claim 10 (depends on 7) The device of claim 7, wherein the one or more processors are configured to execute the computer-readable instructions to verify the client network device by: receiving a stapled version of the attestation information from the client network device, the stapled version of the attestation information being generated by a verifying component by signing the attestation information using a digital key known to both the verifying component and the dynamic host configuration server; and verifying the stapled version using the digital key to yield a verification result of the client network device. ### Claim 11 (depends on 7) The device of claim 7, wherein a verifiable timestamp validates freshness of the attestation information provided by the network device. ### Claim 12 (depends on 7) The device of claim 7, wherein the first request includes a Manufacturer Usage Description (MUD) fetch Uniform Resource Request (URL), and the dynamic host configuration parameter sends the MUD fetch URL to a controller for on-boarding an Internet of Things (IoT) device after verifying the IoT device based on the attestation information. ### Claim 13 One or more non-transitory computer-readable media comprising computer-readable instructions, which when executed by one or more processors of a network device, cause the network device to: receive a first request from a client device for configuration data, the configuration data including at least an IP address; send, in response to the receive, a second request to the client network device for attestation information; verify the client network device based on the attestation information, comprising: send the attestation information to a verifying component to verify the network device; and receive a result of verification of the network device from the verifying component; and assign, in response to at least the verify, the configuration data to the client network device upon verifying the client network device. ### Claim 14 (depends on 13) The one or more non-transitory computer-readable media of claim 13, wherein the device and the client network device are IPv6 devices operating based on Dynamic Host Configuration Parameter v6 (DHCPv6) protocol. ### Claim 15 (depends on 14) The one or more non-transitory computer-readable media of claim 14, wherein the device and the client network device are IPv4 devices operating based on Dynamic Host Configuration Parameter v4 (DHCPv4) protocol. ### Claim 16 (depends on 14) The one or more non-transitory computer-readable media of claim 14, wherein the execution of the computer-readable instructions by the one or more processors further cause the network device to verify the client network device by: receiving a stapled version of the attestation information from the client network device, the stapled version of the attestation information being generated by a verifying component by signing the attestation information using a digital key known to both the verifying component and the dynamic host configuration server; and verifying the stapled version using the digital key to yield a verification result of the client network device. ### Claim 17 (depends on 7) The device of claim 7, wherein the first network device is an Internet of Things (IoT) device; the first request includes a Manufacturer Usage Description (MUD) fetch Uniform Resource Request (URL), and the dynamic host configuration parameter sends the MUD fetch URL to a controller for on-boarding the IoT device after verifying the IoT device based on the attestation information.