# US 12,003,649 B2 · Anonymous event attestation with group signatures > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,649 B2 - Document ID: US12003649B2 - Status: Granted - Kind: B2 - Application number: 17/633,417 - Filed: 2021-03-16 - Published: 2022-09-15 - Granted: 2024-06-04 - Earliest claimed: 2020-07-09 - Assignees: Google Inc. - Applicants: Google LLC - Inventors: Gang Wang; Marcel M. Moti Yung - Web page: https://patentgrep.com/patent/US12003649B2 ## CPC - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 9/3255: {using group based signatures, e.g. ring or threshold signatures} - G06F 21/33: using certificates - G06F 21/44: Program or device authentication - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/3257: {using blind signatures} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/126: {the source of the received data} - H04L 2209/42: Anonymization, e.g. involving pseudonyms - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods, systems, and computer media provide attestation tokens that protect the integrity of communications transmitted from client devices, while at the same time avoiding the use of stable device identifiers that could be used to track client devices or their users. In one approach, client devices can receive anonymous certificates from a device integrity computing system signifying membership in a selected device trustworthiness group, and attestation tokens can be signed anonymously with the anonymous certificates using a group signature scheme. Client devices can include throttlers imposing limits on the quantity of attestation tokens created by the client device. ## Claims ### Claim 1 A method performed by a client device, comprising: transmitting, to a device integrity computing system, a first request for an anonymous certificate, the request including device-level fraud detection signals for the client device; receiving, from the device integrity computing system, the anonymous certificate, wherein the anonymous certificate corresponds to a given signature group selected from a set of device trustworthiness groups based at least on the device-level fraud detection signals, wherein each device trustworthiness group corresponds to a respective category of trustworthiness; creating an anonymous attestation token comprising (i) a set of data comprising a second request and an attestation token creation timestamp indicating a time of creation of the anonymous attestation token, and (ii) a digital signature of the set of data generated by applying a group signature function to the set of data and the anonymous certificate; and transmitting the attestation token to a recipient. ### Claim 2 (depends on 1) The method of claim 1, wherein the group signature scheme is a direct anonymous attestation (DAA) signing scheme. ### Claim 3 (depends on 2) The method of claim 2, wherein the DAA signing scheme is an elliptic curve cryptography (ECC) DAA signing scheme. ### Claim 4 (depends on 3) The method of claim 3, wherein the ECC DAA signing scheme is an ECC DAA signing scheme with Barreto-Naehrig curves. ### Claim 5 (depends on 1) The method of claim 1, wherein the anonymous certificate is an irrevocable anonymous certificate indicating that the client device has been irrevocably assigned to the given signature group. ### Claim 6 (depends on 1) The method of claim 1, wherein the set of device trustworthiness groups comprises at least a first trustworthiness group that includes, as members, devices having a first degree of trustworthiness and a second trustworthiness group that includes, as members, devices having a second degree of trustworthiness less than the first degree of trustworthiness, wherein the given group is one of the first trustworthiness group or the second group. ### Claim 7 (depends on 6) The method of claim 6, wherein the first and second trustworthiness groups have corresponding first and second group public keys published by the device integrity computing system. ### Claim 8 (depends on 1) The method of claim 1, further comprising: storing the anonymous certificate in a secure private keystore on the client device. ### Claim 9 (depends on 1) The method of claim 1, wherein the token creation timestamp has a time resolution that is less than a millisecond or less than a microsecond. ### Claim 10 (depends on 1) The method of claim 1, further comprising: receiving information indicating an attestation token quantity limit; and prior to the creating, verifying that the creating would not exceed the attestation token quantity limit. ### Claim 11 (depends on 10) The method of claim 10, wherein the attestation token quantity limit is a limit on a number of anonymous tokens that are eligible to be sent from the client device to selected destination domain within a selected time frame. ### Claim 12 (depends on 10) The method of claim 10, wherein the attestation token quantity limit is a limit on the number of anonymous tokens that are eligible to be sent from one or more selected applications on the client device to a selected destination domain within a selected time frame. ### Claim 13 (depends on 10) The method of claim 10, wherein the attestation token quantity limit is a limit on the number of anonymous tokens that are eligible to be sent from the client device to selected endpoint within a selected destination domain within a selected time frame. ### Claim 14 (depends on 10) The method of claim 10, wherein the attestation token quantity limit is a limit on the number of anonymous tokens that are eligible to be sent from one or more selected applications on the client device to a selected endpoint within a selected destination domain within a selected time frame. ### Claim 15 (depends on 1) The method of claim 1, further comprising verifying, by the recipient, the digital signature using a group verification key and the anonymous certificate. ### Claim 16 (depends on 1) The method of claim 1, wherein the anonymous certificate comprises a private key issued to the client device. ### Claim 17 A system, comprising: one or more processors of a client device; and one or more memories having stored thereon computer readable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising: transmitting, to a device integrity computing system, a first request for an anonymous certificate, the request including device-level fraud detection signals for the client device; receiving, from the device integrity computing system, the anonymous certificate, wherein the anonymous certificate corresponds to a given signature group selected from a set of device trustworthiness groups based at least on the device-level fraud detection signals, wherein each device trustworthiness group corresponds to a respective category of trustworthiness; creating an anonymous attestation token comprising (i) a set of data comprising a second request and an attestation token creation timestamp indicating a time of creation of the anonymous attestation token, and (ii) a digital signature of the set of data generated by applying a group signature function to the set of data and the anonymous certificate; and transmitting the attestation token to a recipient. ### Claim 18 (depends on 17) The system of claim 17, wherein the set of device trustworthiness groups comprises at least a first trustworthiness group that includes, as members, devices having a first degree of trustworthiness and a second trustworthiness group that includes, as members, devices having a second degree of trustworthiness less than the first degree of trustworthiness, wherein the given group is one of the first trustworthiness group or the second trustworthiness group. ### Claim 19 (depends on 18) The system of claim 18, wherein the first and second trustworthiness groups have corresponding first and second group public keys published by the device integrity computing system. ### Claim 20 (depends on 17) The system of claim 17, wherein the operations comprise: receiving information indicating an attestation token quantity limit; and prior to the creating, verifying that the creating would not exceed the attestation token quantity limit. ### Claim 21 A non-transitory computer readable medium storing instructions that upon execution by one or more computers cause the one or more computers to perform operations comprising: transmitting, to a device integrity computing system, a first request for an anonymous certificate, the request including device-level fraud detection signals for the client device; receiving, from the device integrity computing system, the anonymous certificate, wherein the anonymous certificate corresponds to a given signature group selected from a set of device trustworthiness groups based at least on the device-level fraud detection signals, wherein each device trustworthiness group corresponds to a respective category of trustworthiness; creating an anonymous attestation token comprising (i) a set of data comprising a second request and an attestation token creation timestamp indicating a time of creation of the anonymous attestation token, and (ii) a digital signature of the set of data generated using by applying a group signature function to the set of data and the anonymous certificate; and transmitting the attestation token to a recipient.