# US 12,008,110 B2 · System and method for recording device lifecycle transactions as versioned blocks in a blockchain network using a transaction connector and broker service > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,008,110 B2 - Document ID: US12008110B2 - Status: Granted - Kind: B2 - Application number: 17/816,206 - Filed: 2022-07-29 - Published: 2022-12-15 - Granted: 2024-06-11 - Earliest claimed: 2017-11-30 - Assignees: DigiCert, Inc. - Applicants: DigiCert, Inc. - Inventors: Srinivas Kumar; Atul Gupta; Ruslan Ulanov; Shreya Uchil - Web page: https://patentgrep.com/patent/US12008110B2 ## CPC - G06F 8/65: Updates (security arrangements therefor G06F21/57) - G06F 9/4401: Bootstrapping (security arrangements therefor G06F21/57) - G06F 9/445: Program loading or initiating (bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57) - G06F 16/1834: {implemented based on peer-to-peer networks, e.g. gnutella (p2p communication protocols H04L67/104)} - G06F 16/27: Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor - G06F 21/575: {Secure boot} - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]} - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 9/3247: {involving digital signatures} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/3297: {involving time stamps, e.g. generation of time stamps} - H04L 12/66: Arrangements for connecting between networks having differing types of switching systems, e.g. gateways - H04L 41/082: the condition being updates or upgrades of network functionality - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 63/0464: {using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method of building a device historian, across a supply chain of device manufactures and managers, by a plurality of device management services comprising an enrollment service, an update service, a policy service, and an analytics service, a transaction connector, a blockchain broker service participating as a node in a blockchain network, and transaction filters. The method comprises sending, by the plurality of device management services a transaction record over the transaction connector to the blockchain broker service, receiving, by the blockchain broker service, the transaction record, filtering, by the blockchain broker service, information in the transaction record based on the transaction filters, preparing, by the blockchain broker service, a versioned block based on the filtered information from the transaction record, and adding, by the blockchain broker service, the versioned block to the blockchain network. ## Claims ### Claim 1 A method comprising: generating, by a gateway device, a certificate request for an endpoint device, wherein the certificate request comprises information identifying the gateway device and information identifying the endpoint device; sending, by the gateway device to a certificate authority, the certificate request; receiving, by the gateway device, a certificate for the endpoint device for enrollment thereof, wherein the certificate is issued by the certificate authority; translating, by the gateway device, the certificate to generate a translated certificate for the endpoint device; facilitating, by the gateway device, one or more data communications between the endpoint device and a computing system, wherein facilitating the one or more data communications comprises providing the translated certificate to the computing system; and recording the enrollment for the endpoint device as a transaction record in a distributed ledger and distributing one or more blocks of the transaction record to one or more blockchain peers, wherein the distributed ledger contains a reproducible history of device and service transactions for the endpoint device, wherein the one or more blockchain peers include update package providers and publishers that are configured to provide update to the endpoint device which does not have and assigned Internet Protocol (IP) address and the gateway device does have an IP address. ### Claim 2 (depends on 1) The method of claim 1, wherein the gateway device implements an enrollment service. ### Claim 3 (depends on 1) The method of claim 1, further comprising configuring, by the gateway device, the endpoint device. ### Claim 4 (depends on 1) The method of claim 1, further comprising configuring, by the gateway device, the endpoint device independent of one or more user interactions. ### Claim 5 (depends on 1) The method of claim 1, further comprising configuring, by the gateway device, the endpoint device independent of one or more user parameters for registration of the endpoint device. ### Claim 6 (depends on 1) The method of claim 1, further comprising translating, by the gateway device, the certificate request to generate a translated certificate request, wherein sending, by the gateway device to the certificate authority, the certificate request comprises sending, by the gateway device to the certificate authority, the translated certificate request. ### Claim 7 (depends on 1) The method of claim 1, further comprising translating, by the gateway device, the certificate request based at least in part on the certificate authority to generate a translated certificate request, wherein sending, by the gateway device to the certificate authority, the certificate request comprises sending, by the gateway device to the certificate authority, the translated certificate request. ### Claim 8 (depends on 1) The method of claim 1, wherein translating, by the gateway device, the certificate to generate the translated certificate for the endpoint device comprises translating, by the gateway device, the certificate to generate the translated certificate associated with a second certificate authority. ### Claim 9 (depends on 1) The method of claim 1, further comprising requesting an update package for the endpoint device utilizing the translated certificate. ### Claim 10 (depends on 1) The method of claim 1, further comprising: requesting an update package for the endpoint device utilizing the translated certificate; obtaining the update package; and routing the update package to the endpoint device. ### Claim 11 (depends on 1) The method of claim 1, further comprising storing the translated certificate. ### Claim 12 (depends on 1) The method of claim 1, further comprising storing the translated certificate in a local data store. ### Claim 13 (depends on 1) The method of claim 1, further comprising: generating a certificate revocation request for the certificate; and routing the certificate revocation request to the certificate authority for disenrollment of the endpoint device. ### Claim 14 (depends on 1) The method of claim 1, further comprising obtaining a request for enrollment of the endpoint device, wherein generating the certificate request is based at least in part on the request for enrollment. ### Claim 15 (depends on 1) The method of claim 1, further comprising: obtaining a request for enrollment of the endpoint device, wherein generating the certificate request is based at least in part on the request for enrollment; and generating a request log, the request log indicating the request for enrollment of the endpoint device. ### Claim 16 (depends on 1) The method of claim 1, further comprising: obtaining a request for enrollment of the endpoint device, wherein generating the certificate request is based at least in part on the request for enrollment; generating a request log, the request log indicating the request for enrollment of the endpoint device; and recording the request log for the endpoint device as a transaction record in a distributed ledger. ### Claim 17 Non-transitory computer-readable media including computer-executable instructions that, when executed by a computing system, cause the computing system to: generate a certificate request for an endpoint device, wherein the certificate request comprises information identifying the computing system and information identifying the endpoint device; send, to a certificate authority, the certificate request; receive a certificate for the endpoint device for enrollment thereof, wherein the certificate is issued by the certificate authority; translate certificate to generate a translated certificate for the endpoint device; facilitate one or more data communications between the endpoint device and a computing system, wherein facilitating the one or more data communications comprises providing the translated certificate to the computing system; and cause recordation of the enrollment for the endpoint device as a transaction record in a distributed ledger and distributing one or more blocks of the transaction record to one or more blockchain peers, wherein the distributed ledger contains a reproducible history of device and service transactions for the endpoint device, wherein the one or more blockchain peers include update package providers are publishers that are configured to provide updates to the endpoint device which does not have an assigned Internet Protocol (IP) address and the gateway device does have an IP address. ### Claim 18 A system comprising: a data store; and one or more processors configured to: generate a certificate request for an endpoint device, wherein the certificate request comprises information identifying the system and information identifying the endpoint device; send, to a certificate authority, the certificate request; receive a certificate for the endpoint device for enrollment thereof, wherein the certificate is issued by the certificate authority; translate certificate to generate a translated certificate for the endpoint device; facilitate one or more data communications between the endpoint device and a computing system, wherein facilitating the one or more data communications comprises providing the translated certificate to the computing system; and recordation of the enrollment for the endpoint device as a transaction record in a distributed ledger and distributing one or more blocks of the transaction record to one or more blockchain peers, wherein the distributed ledger contains a reproducible history of device and service transactions for the endpoint device, wherein the one or more blockchain peers include update package providers and publisher that are configured to provide updates to the endpoint device which does not have an assigned Internet Protocol (IP) address and the gateway device does have an IP address.