# US 12,003,493 B2 · Device pre-authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,493 B2 - Document ID: US12003493B2 - Status: Granted - Kind: B2 - Application number: 17/197,616 - Filed: 2021-03-10 - Published: 2022-09-15 - Granted: 2024-06-04 - Earliest claimed: 2021-03-10 - Assignees: Verizon Patent and Licensing Inc. - Applicants: Verizon Patent and Licensing Inc. - Inventors: Brent R. Bilger; Rajesh M. Patel; Shailesh K. Venugopal; Anurag Dave; Michel J. Basmaji - Web page: https://patentgrep.com/patent/US12003493B2 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - G06F 21/31: User authentication - G06F 21/44: Program or device authentication - G06F 21/45: Structures or tools for the administration of authentication - H04L 9/0863: {involving passwords or one-time passwords (network architectures or network communication protocols for using one-time keys in a packet data network H04L63/067)} - H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics} - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 9/3297: {involving time stamps, e.g. generation of time stamps} - H04L 63/166: {at the transport layer} - H04W 12/069: using certificates or pre-shared keys - H04W 12/062: Pre-authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A method, a device, and a non-transitory storage medium are described in which an pre-authentication service is provided. The service may support a transport layer security handshake and determine authentication based on the initial message. The service may provide for the generation of a message that initiates a handshake between devices in which the message includes an authentication string used for authentication. The service may provide for the generation of another authentication string for comparison. The service may also support authorization of a device. The service may minimize potential malicious attacks and activities between the devices. ## Claims ### Claim 1 A method comprising: receiving, by a first device from a second device, a first message that includes a first authentication string including a password or a message authentication code, and initiates a handshaking procedure with the first device; generating, by the first device, a second authentication string based on the first authentication string; comparing, by the first device, the second authentication string and the first authentication string; determining, by the first device based on the comparing, whether the second device is authenticated; and determining, by the first device, whether to establish a connection with the second device based on the determining. ### Claim 2 (depends on 1) The method of claim 1, wherein the handshaking procedure is a transport layer security (TLS) handshaking procedure, and the first message is a client hello of the TLS that includes the first authentication string in an extension field of the client hello. ### Claim 3 (depends on 2) The method of claim 2, further comprising: omitting, by the first device, to transmit a message to the second device based on determining that the second device is not authenticated. ### Claim 4 (depends on 1) The method of claim 1, further comprising: identifying, by the first device, a secret key based on an identifier of the second device included in the first authentication string, and wherein the generating of the second authentication string further comprises: generating, by the first device, the second authentication string based on the secret key and other data included in the first authentication string. ### Claim 5 (depends on 1) The method of claim 1, further comprising: generating, by the first device, a secret key based on a master key and an identifier of the second device included in the first authentication string, and wherein the generating of the second authentication string further comprises: generating, by the first device, the second authentication string based on the secret key and other data included in the first authentication string. ### Claim 6 (depends on 5) The method of claim 5, wherein the other data includes at least one of an identifier that identifies the master key or an identifier of an anti-malware component of the second device. ### Claim 7 (depends on 1) The method of claim 1, further comprising: issuing, by the first device to the second device before the receiving, an identifier of the second device and a secret key. ### Claim 8 (depends on 1) The method of claim 1, further comprising: determining, by the first device, whether the second device is an authorized device based on the first authentication string. ### Claim 9 A device comprising: a processor configured to: receive, from a second device, a first message that includes a first authentication string including a password or a message authentication code, and initiates a handshaking procedure with the device; generate a second authentication string based on the first authentication string; compare the second authentication string and the first authentication string; determine, based on the comparison, whether the second device is authenticated; and determine whether to establish a connection with the second device based on the determination. ### Claim 10 (depends on 9) The device of claim 9, wherein the handshaking procedure is a transport layer security (TLS) handshaking procedure, and the first message is a client hello of the TLS that includes the first authentication string in an extension field of the client hello. ### Claim 11 (depends on 9) The device of claim 9, wherein the processor is further configured to: omit to transmit a message to the second device based on a determination that the second device is not authenticated. ### Claim 12 (depends on 9) The device of claim 9, wherein the processor is further configured to: identify a secret key based on an identifier of the second device included in the first authentication string, and wherein for the generation of the second authentication string, the processor is further configured to: generate the second authentication string based on the secret key and other data included in the first authentication string. ### Claim 13 (depends on 9) The device of claim 9, wherein the processor is further configured to: generate a secret key based on a master key and an identifier of the second device included in the first authentication string, and wherein for the generation of the second authentication string, the processor is further configured to: generate the second authentication string based on the secret key and other data included in the first authentication string. ### Claim 14 (depends on 13) The device of claim 13, wherein the other data includes at least one of an identifier that identifies the master key or an identifier of an anti-malware component of the second device. ### Claim 15 (depends on 9) The device of claim 9, wherein the processor is further configured to: issue to the second device before the receipt of the first message, an identifier of the second device and a secret key. ### Claim 16 (depends on 9) The device of claim 9, wherein the processor is further configured to: determine whether the second device is an authorized device based on the first authentication string. ### Claim 17 A non-transitory computer-readable storage medium storing instructions executable by a processor of a device, which when executed cause the device to: receive, from a second device, a first message that includes a first authentication string including a password or a message authentication code, and initiates a handshaking procedure with the device; generate a second authentication string based on the first authentication string; compare the second authentication string and the first authentication string; determine, based on the comparison, whether the second device is authenticated; and determine whether to establish a connection with the second device based on the determination. ### Claim 18 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the handshaking procedure is a transport layer security (TLS) handshaking procedure, and the first message is a client hello of the TLS that includes the first authentication string in an extension field of the client hello. ### Claim 19 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein the instructions further comprise instructions, which when executed cause the device to: omit to transmit a message to the second device based on a determination that the second device is not authenticated. ### Claim 20 (depends on 17) The non-transitory computer-readable storage medium of claim 17, wherein for the generation of the second authentication string, the instruction further comprise instructions, which when executed cause the device to: generate the second authentication string based on a secret key and other data included in the first authentication string, wherein the other data includes at least one of an identifier that identifies a master key or an identifier of an anti-malware component of the second device.