# US 11,907,382 B2 · Secure access to accessory device resources > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,382 B2 - Document ID: US11907382B2 - Status: Granted - Kind: B2 - Application number: 17/929,489 - Filed: 2022-09-02 - Published: 2022-12-29 - Granted: 2024-02-20 - Earliest claimed: 2020-04-21 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Ravi Kiran Chivukula; Robert D. Young; Nathan C. Sherman; Chirag Shah; Brandon Records; Astha Keshan; Eric Kotz; M. Nashaat Soliman - Web page: https://patentgrep.com/patent/US11907382B2 ## CPC - G06F 21/604: {Tools and structures for managing or administering access control systems} - G06F 21/44: Program or device authentication - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3247: {involving digital signatures} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04W 12/06: Authentication - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract An accessory device receives authentication information from a host computing device connected thereto and determines whether the authentication information is valid. If the authentication information is valid, the accessory device applies a first access policy that specifies whether the accessory device can provide the host computing device with access to none, some, or all of various computing resources of the accessory device. If the authentication information is not valid, the accessory device applies a second access policy that is different than the first access policy. The accessory device can also be provisioned with access policies by a host computing device if the host computing device successfully authenticates with the accessory device. In either case, authenticating the host computing device may include verifying a digital signature of a certificate provided by the host computing device using a public key of a certificate authority that has been provisioned to the accessory device. ## Claims ### Claim 1 A method performed by an accessory device, comprising: receiving a host access policy management command and authentication information from a host computing device that is connected to the accessory device, the host access policy management command indicating that a host access policy be set on, modified on, or removed from the accessory device, the host access policy specifying whether a host computing device that is subsequently connected to the accessory device is to be provided access to each of one or more computing resources accessible to the accessory device; determining whether the authentication information is valid; in response to at least determining that the authentication information is valid, executing the host access policy management command; and in response to at least determining that the authentication information is not valid, denying execution of the host access policy management command. ### Claim 2 (depends on 1) The method of claim 1, wherein the authentication information comprises an administrator certificate and wherein determining whether the authentication information is valid comprises: verifying a digital signature of the administrator certificate using a public key of a certificate authority that has been provisioned to the accessory device. ### Claim 3 (depends on 2) The method of claim 2, wherein the administrator certificate contains a public key, wherein the authentication information further comprises a digitally-signed nonce, and wherein determining whether the authentication information is valid further comprises: verifying the digitally-signed nonce using the public key contained in the administrator certificate. ### Claim 4 (depends on 2) The method of claim 2, wherein the administrator certificate contains an Extended Key Usage (EKU) value and wherein determining whether the authentication information is valid further comprises: comparing the EKU value contained in the administrator certificate to an EKU value that is stored on the accessory device. ### Claim 5 (depends on 1) The method of claim 1, wherein the authentication information comprises an identifier of the accessory device and wherein determining whether the authentication information is valid comprises: comparing the identifier of the accessory device included in the authentication information to an identifier of the accessory device that is stored on the accessory device and is not programmatically queryable by any external device. ### Claim 6 (depends on 1) The method of claim 1, wherein the accessory device comprises a docking station, a port replicator, a multimedia adapter, or a hub. ### Claim 7 (depends on 1) The method of claim 1, wherein the one or more computing resources comprise one or more of: a Universal Serial Bus (USB) port; an Ethernet port; a display port; or an audio port. ### Claim 8 (depends on 1) The method of claim 1, wherein the host access policy comprises a first host access policy that is applied by the accessory device for authenticated host computing devices and a second host access policy that is applied by the accessory device for non-authenticated host computing devices. ### Claim 9 (depends on 1) The method of claim 1, wherein the one or more computing resources comprise multiple computing resources and wherein at least one of the first access policy and the second access policy specifies that the host computing device is to be provided access to some but not all of the multiple computing resources. ### Claim 10 (depends on 1) The method of claim 1, wherein the one or more computing resources comprise multiple computing resources and wherein the first access policy specifies that the host computing device is to be provided access to a first set of the multiple computing resources and the second access policy specifies that the host computing device is to be provided access to a second set of the multiple computing resources, wherein the second set is a subset of the first set that is smaller than the first set. ### Claim 11 A method performed by a host computing device that is connected to an accessory device, the method comprising: concurrently sending authentication information and a host access policy management command to the accessory device, the authentication information sufficient to enable the accessory device to authenticate the host computing device, and the host access policy management command to be executed by the accessory device upon authenticating the host computing device, the host access policy management command indicating that a host access policy be set on, modified on, or removed from the accessory device, the host access policy specifying whether a host computing device that is subsequently connected to the accessory device should be provided with access to each of one or more computing resources accessible to the accessory device. ### Claim 12 (depends on 11) The method of claim 11, wherein the authentication information comprises an identifier of the accessory device. ### Claim 13 (depends on 11) The method of claim 11, further comprising: sending an application programming interface (API) call to the accessory device that specifies a certificate authority to be provisioned to the accessory device, a binary indicator of whether host authentication should be performed by the accessory device, and a cryptographic nonce. ### Claim 14 (depends on 13) The method of claim 13, further comprising: receiving a confirmation message from the accessory device that the API call was successful. ### Claim 15 (depends on 11) The method of claim 11, wherein when the host access policy management command indicates that the host access policy be modified on or removed from the accessory device, the method further comprises: receiving a cryptographic nonce from the accessory device; signing the cryptographic nonce with a private key associated with the host computing device; and sending an API call to the accessory device, the API call including the signed nonce. ### Claim 16 An accessory device, comprising: a processor circuit; and a memory that stores program code that, when executed by the processor circuit, performs operations, the operations comprising: receiving a host access policy management command and authentication information from a host computing device that is connected to the accessory device, the host access policy management command indicating that a host access policy be set on, modified on, or removed from the accessory device, the host access policy specifying whether a host computing device that is subsequently connected to the accessory device is to be provided access to each of one or more computing resources accessible to the accessory device; determining whether the authentication information is valid; in response to at least determining that the authentication information is valid, executing the host access policy management command; and in response to at least determining that the authentication information is not valid, denying execution of the host access policy management command. ### Claim 17 (depends on 16) The accessory device of claim 16, wherein the authentication information comprises an administrator certificate and wherein determining whether the authentication information is valid comprises: verifying a digital signature of the administrator certificate using a public key of a certificate authority that has been provisioned to the accessory device. ### Claim 18 (depends on 17) The accessory device of claim 17, wherein the administrator certificate contains a public key, wherein the authentication information further comprises a digitally-signed nonce, and wherein determining whether the authentication information is valid further comprises: verifying the digitally-signed nonce using the public key contained in the administrator certificate. ### Claim 19 (depends on 17) The accessory device of claim 17, wherein the administrator certificate contains an Extended Key Usage (EKU) value and wherein determining whether the authentication information is valid further comprises: comparing the EKU value contained in the administrator certificate to an EKU value that is stored on the accessory device. ### Claim 20 (depends on 16) The accessory device of claim 16, wherein the authentication information comprises an identifier of the accessory device and wherein determining whether the authentication information is valid comprises: comparing the identifier of the accessory device included in the authentication information to an identifier of the accessory device that is stored on the accessory device and is not programmatically queryable by any external device.