# US 11,909,889 B2 · Secure digital signing

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,909,889 B2
- Document ID: US11909889B2
- Status: Granted
- Kind: B2
- Application number: 17/740,254
- Filed: 2022-05-09
- Published: 2022-12-29
- Granted: 2024-02-20
- Earliest claimed: 2020-11-13
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Microsoft Technology Licensing, LLC
- Inventors: Mayukh Ray; Tolga Acar; Timothy Michael Peters
- Web page: https://patentgrep.com/patent/US11909889B2

## CPC

- H04L 9/3247: {involving digital signatures}
- H04L 63/126: {the source of the received data}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]}
- H04L 9/302: {involving the integer factorization problem, e.g. RSA or quadratic sieve [QS] schemes}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A public-private key cryptographic scheme is described for granting authenticating a client to a remote device or service in order to access a secure resource. The client is provided the public key, but the private key is stored in a hardware security module (HSM) that the client is not able to access. The client requests a digital signature be generated from the private key from a secure vault service. The secure vault service accesses the HSM and generates the digital certificate, which is then passed to the client. The digital certificate may be added to a security token request submitted to an identity provider. The identity provider determines whether the digital signature came from the private key. If so, the identity provider provides authenticates the client and provides an access token that is usable by the client for authentication to the remote device with the secure resource

## Claims

### Claim 1

A method for authenticating a client to access a secure resource on a remote device using a public key and a private key, the method comprising:
storing the private key in a hardware security module (HSM);
receiving a request from the client for a digital signature to access the secure resource;
generating the digital signature using, in part, the private key in the HSM;
generating a security token using the digital signature;
authenticating the client to access the secure resource using the security token;
determining to change the private key in the HSM;
issuing a new private key; and
replacing the private key in the HSM with the new private key.

### Claim 2 (depends on 1)

The method of claim 1, wherein the security token comprises a JSON web token (JWT).

### Claim 3 (depends on 2)

The method of claim 2, wherein the digital signature comprises a JSON Web Signature (JWS).

### Claim 4 (depends on 1)

The method of claim 1, wherein the request includes or is generated from a public key.

### Claim 5 (depends on 1)

The method of claim 1, further comprising automatically modifying the private key in the HSM.

### Claim 6 (depends on 1)

The method of claim 1, wherein the digital signature is generated from an asymmetric cryptography algorithm using the private key.

### Claim 7 (depends on 6)

The method of claim 6, wherein the asymmetric cryptography algorithm comprises at least one of Rivest-Shamir-Adleman (RSA®), Elliptic Curve Cryptography (ECC), or Digital Security Algorithm (DSA).

### Claim 8 (depends on 1)

The method of claim 1, wherein the client comprises a first cloud service attempting to access the secure resource at a second cloud service hosted on a remote device.

### Claim 9 (depends on 1)

The method of claim 1, wherein the secure resource comprises a file to be downloaded to the client.

### Claim 10 (depends on 1)

The method of claim 1, wherein the access to the secure resource comprises a client assertion portion that is generated from the private key.

### Claim 11 (depends on 1)

The method of claim 1, wherein the private key is not shared with the client.

### Claim 12 (depends on 1)

The method of claim 1, wherein the private key is not shared outside of the HSM.

### Claim 13

A method for authenticating a client to access a secure resource on a remote device, the method comprising:
receiving, at a secure vault, a security token comprising a client identifier associated with the client or a user of the client;
generating a digital signature from a private key stored in a hardware security module (HSM);
transmitting the digital signature to the client for the client to obtain an access token to a secure resource on a remote device;
determining to change the private key in the HSM;
issuing a new private key; and
replacing the private key in the HSM with the new private key.

### Claim 14 (depends on 13)

The method of claim 13, further comprising:
attaching the digital signature to the security token generated by the client; and
creating a signed signature token for the client to obtain the access token.

### Claim 15 (depends on 13)

The method of claim 13, wherein the digital signature comprises a JSON Web Signature (JWS).

### Claim 16 (depends on 13)

The method of claim 13, wherein determining to change the private key in the HSM comprises at least one of:
waiting a predetermined period of time to change the private key in the HSM, and
identifying an occurrence of a security condition.

### Claim 17 (depends on 13)

The method of claim 13, further comprising rotating the private key in the HSM with the new private key without user interaction.

### Claim 18

Computer-storage memory comprising executable instructions that cause one or more processors to perform operations for authenticating a client to access a secure resource on a remote device using a public key and a private key, wherein the private key is stored in a hardware security module (HSM) away from the client, the operations comprising:
storing the private key in the HSM;
receiving a request from the client for a digital signature to access the secure resource;
generating the digital signature using, in part, the private key in the HSM;
generating a security token using the digital signature;
authenticating the client to access a remote resource using the security token;
determining to change the private key in the HSM;
issuing a new private key; and
replacing the private key in the HSM with the new private key.

### Claim 19 (depends on 18)

The computer-storage memory of claim 18, the operations further comprising:
incident to receiving the security token, transmitting an access token to a remote device.

### Claim 20 (depends on 18)

The computer-storage memory of claim 18, wherein the HSM is not accessible by the client.