# US 11,841,959 B1 · Systems and methods for requiring cryptographic data protection as a precondition of system access > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,841,959 B1 - Document ID: US11841959B1 - Status: Granted - Kind: B1 - Application number: 17/529,832 - Filed: 2021-11-18 - Granted: 2023-12-12 - Earliest claimed: 2017-02-01 - Assignees: Ionic Security Inc. - Applicants: Ionic Security Inc. - Inventors: Adam Ghetti; Ryan Speers; Jeffrey Howard; Robert McColl; Taylor Jay Centers; William Monte LeBlanc - Web page: https://patentgrep.com/patent/US11841959B1 ## CPC - G06F 21/33: using certificates - G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/321: {involving a third party or a trusted authority} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/102: {Entity profiles} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 2463/082: applying multi-factor authentication - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods for permitting software presence/configurations to function as a factor in a multi-factor authentication scheme so that a user's access to a different software program/application is conditioned on the presence of certain pre-specified software or software configurations that would otherwise not be necessary for access and/or operation of the different software program/application. Generally, by confirming the presence/configuration of the pre-specified software on a computing device, the system ensures that a user, in one embodiment, may only access the different software program/application with the proper configuration of the pre-specified software. ## Claims ### Claim 1 A method, comprising: requesting, via an electronic computing device, access to a third party system; receiving, via the electronic computing device and from the third party system, a request for a cryptographic assertion, wherein the cryptographic assertion verifies to the third party system that a data protection system is operational on the electronic computing device prior to accessing the third party system; extracting, via the electronic computing device, a common name from a certificate associated with the third party system; generating, via the electronic computing device, a nonce corresponding to the request for the cryptographic assertion; generating, via the electronic computing device, an encrypted client data package comprising a device identifier for the electronic computing device and the nonce; sending, via the electronic computing device, an encrypted package to the data protection system for verification that the data protection system is operational, wherein the encrypted package comprises the common name and the encrypted client data package; validating, via the data protection system, the request for the cryptographic assertion, wherein validating the request comprises: determining, via the data protection system, that the request is not a replay of a previous request based at least in part on the nonce; and comparing, via the data protection system, the device identifier to a known fingerprint hash for the electronic computing device; in response to validating the request, sending, via the data protection system, the common name and the encrypted client data package to a key service; and receiving, via the data protection system, a signed device assertion from the key service. ### Claim 2 (depends on 1) The method of claim 1, further comprising: generating, via the electronic computing device, an ephemeral encryption key; and encrypting, via the electronic computing device, a client data package with the ephemeral encryption key to generate the encrypted client data package. ### Claim 3 (depends on 2) The method of claim 2, further comprising: validating, via the key service, the encrypted client data package based at least in part on the ephemeral encryption key; and generating, via the key service, the signed device assertion, the signed device assertion comprising the common name. ### Claim 4 (depends on 1) The method of claim 1, further comprising generating, via the electronic computing device, a key service encrypted package comprising an ephemeral encryption key encrypted based on a symmetric key known to a key service, wherein the encrypted package comprises the key service encrypted package. ### Claim 5 (depends on 4) The method of claim 4, wherein the key service encrypted package comprises data necessary to perform the cryptographic assertion. ### Claim 6 (depends on 1) The method of claim 1, further comprising: generating, via the electronic computing device, a second nonce and a second identifier, wherein the second nonce differs from the nonce; and hashing, via the electronic computing device, the second identifier to generate a hashed second identifier, wherein the encrypted package comprises the second nonce and the hashed second identifier. ### Claim 7 (depends on 1) The method of claim 1, wherein the encrypted package further comprises a hardware fingerprint hash. ### Claim 8 (depends on 1) The method of claim 1, further comprising: receiving, via the electronic computing device, the cryptographic assertion from the data protection system; and sending, via the electronic computing device, the cryptographic assertion to the third party system. ### Claim 9 (depends on 1) The method of claim 1, wherein the cryptographic assertion is an assertion of identity that is encrypted. ### Claim 10 A system, comprising: a memory device; and an electronic computing device in communication with the memory device, the electronic computing device being configured to: requesting, via the electronic device, access to a third party system; receive, from the third party system, a request for a cryptographic assertion, wherein the cryptographic assertion verifies to the third party system that a data protection system is operational on the electronic computing device prior to accessing the third party system; extract a common name from a certificate associated with the third party system; generate a nonce corresponding to the request for the cryptographic assertion; generate an encrypted client data package comprising a device identifier for the electronic computing device and the nonce; send an encrypted package to the data protection system for verification that the data protection system is operational, wherein the encrypted package comprises the common name and the encrypted client data package; validate the request for the cryptographic assertion, wherein validating the request comprises: determining that the request is not a replay of a previous request based at least in part on the nonce; and comparing the device identifier to a known fingerprint hash for the electronic computing device; in response to validating the request, send the common name and the encrypted client data package to a key service; and receive a signed device assertion from the key service. ### Claim 11 (depends on 10) The system of claim 10, wherein the electronic computing device is further configured to: generate an ephemeral encryption key; and encrypt a client data package with the ephemeral encryption key to generate the encrypted client data package. ### Claim 12 (depends on 10) The system of claim 10, wherein the electronic computing device is further configured to generate a key service encrypted package comprising an ephemeral encryption key encrypted based on a symmetric key known to a key service, wherein the encrypted package comprises the key service encrypted package. ### Claim 13 (depends on 12) The system of claim 12, wherein the key service encrypted package comprises data necessary to perform the cryptographic assertion. ### Claim 14 (depends on 10) The system of claim 10, wherein the electronic computing device is further configured to: generate a second nonce and a second identifier, wherein the second nonce differs from the nonce; and hash the second identifier to generate a hashed second identifier, wherein the encrypted package comprises the second nonce and the hashed second identifier. ### Claim 15 (depends on 10) The system of claim 10, wherein the encrypted package further comprises a hardware fingerprint hash. ### Claim 16 A non-transitory computer-readable medium embodying a program that, when executed by an electronic computing device, causes the electronic computing device to: requesting, via the electronic computing device, access to a third party system; receive, from the third party system, a request for a cryptographic assertion, wherein the cryptographic assertion verifies to the third party system that a data protection system is operational on the electronic computing device prior to accessing the third party system; extract a common name from a certificate associated with the third party system; generate a nonce corresponding to the request for the cryptographic assertion; generate an encrypted client data package comprising a device identifier for the electronic computing device and the nonce; send an encrypted package to the data protection system for verification that the data protection system is operational, wherein the encrypted package comprises the common name and the encrypted client data package; validate the request for the cryptographic assertion, wherein validating the request comprises: determining that the request is not a replay of a previous request based at least in part on the nonce; and comparing the device identifier to a known fingerprint hash for the electronic computing device; in response to validating the request, send the common name and the encrypted client data package to a key service; and receive a signed device assertion from the key service. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the program further causes the electronic computing device to: generate an ephemeral encryption key; and encrypt a client data package with the ephemeral encryption key to generate the encrypted client data package. ### Claim 18 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the program further causes the electronic computing device to generate a key service encrypted package comprising an ephemeral encryption key encrypted based on a symmetric key known to a key service, wherein the encrypted package comprises the key service encrypted package. ### Claim 19 (depends on 18) The non-transitory computer-readable medium of claim 18, wherein the key service encrypted package comprises data necessary to perform the cryptographic assertion. ### Claim 20 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the program further causes the electronic computing device to: generate a second nonce and a second identifier, wherein the second nonce differs from the nonce; and hash the second identifier to generate a hashed second identifier, wherein the encrypted package comprises the second nonce and the hashed second identifier.