# US 12,010,248 B2 · Systems and methods for providing authentication to a plurality of devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,248 B2 - Document ID: US12010248B2 - Status: Granted - Kind: B2 - Application number: 18/216,992 - Filed: 2023-06-30 - Published: 2023-10-26 - Granted: 2024-06-11 - Earliest claimed: 2017-04-05 - Assignees: Stripe, Inc. - Applicants: Stripe, Inc. - Inventors: Carl Jackson; Bryan Berg; David Terrence Bartley; Evan Broder - Web page: https://patentgrep.com/patent/US12010248B2 ## CPC - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3247: {involving digital signatures} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 9/3271: {using challenge-response} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 2209/127: Trusted platform modules [TPM] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and apparatus for a certificate authority system providing authentication to a plurality of devices associated with an organization are described. The method may include receiving, at the certificate authority system, a request from a device to sign authentication information of the device, wherein the device is associated with the organization. The method may also include sending a challenge to the device to perform an action with a system other than the certificate authority system, and receiving the response to the challenge from the device. Furthermore, the method may include verifying that the response was generated correctly based on the challenge, and signing the authentication information of the device with one or more keys of the certificate authority system as an authentication of an identity of the device. ## Claims ### Claim 1 A method for a certificate authority system providing authentication to a device associated with an organization, the method comprising: receiving, at the certificate authority system, a request from the device to sign authentication information of the device; sending a challenge to the device comprising a request to perform an action; receiving a response to the challenge from the device as a result of performing the action; verifying, by the certificate authority system, the response was correctly generated based on the challenge; analyzing a factor associated with the device, the factor comprising at least one of a location of the device, a role of a user of the device within the organization, one or more permissions associated with a user of the device, one or more privileges of the user within the organization, a type of device, and a purpose of the device; selecting, based on the analysis of the factor, a key from among a plurality of keys of the certificate authority system associated with a level of trust associated with the device wherein the level of trust encompasses at least one of: a device permission level of the device within the organization, a user permission level of a user of the device, an operation permission level associated with a privilege available to the device for performing an operation within the organization, and an access permission level that establishes a privilege to a resource; and signing, in response to verifying the response and selecting the key, the authentication information of the device with at least the selected key of the certificate authority system as a certificate authority system authentication of an identity of the device that certifies the device as a trusted device having the level of trust when interacting with another device associated with the organization. ### Claim 2 (depends on 1) The method of claim 1, further comprising: compartmentalizing the selected key and its associated trust level by at least one of: a geographic region, a user role, a set of user privileges, a device type, or a device purpose. ### Claim 3 (depends on 1) The method of claim 1, wherein the factor comprises a geographical location of the device and the device permission level is specific to the geographical location of the device. ### Claim 4 (depends on 1) The method of claim 1, wherein the factor comprises a user role of system administrator and the one or more privileges are specific to the user role of system administrator. ### Claim 5 (depends on 1) The method of claim 1 wherein the privilege is a limited privilege, and a limit of the limited privilege comprises at least one of a time limit or a geography limit. ### Claim 6 (depends on 1) The method of claim 1, wherein the factor associated with the device is comprised in at least one of a hardware component or a software component of the device. ### Claim 7 (depends on 1) The method of claim 1, further comprising: updating the level of trust associated with the selected key after the device has been signed with the selected key. ### Claim 8 (depends on 1) The method of claim 1, further comprising: revoking the selected key, causing the device to be no longer certified as a trusted device. ### Claim 9 (depends on 8) The method of claim 8, further comprising: generating a revocation list of one or more devices, including the device, no longer certified as trusted devices; and enabling, by devices associated with the organization, access to the revocation list to enable the devices of the organization to verifying whether signed keys are valid for a specified user and/or device. ### Claim 10 (depends on 1) The method of claim 1, wherein the authentication information comprises at least one of a key, a certificate, a password, or a serial number. ### Claim 11 (depends on 1) The method of claim 1 wherein the response to the challenge further comprises a result from a trusted platform module (TPM). ### Claim 12 (depends on 1) The method of claim 1, wherein sending the challenge to the device further comprises: instructing a cloud services provider system to allow the device to perform an action at the cloud services provider; instructing the device to perform the action at the cloud services provider, wherein the cloud services provider generates a response for the device as a result of performing the action at the request of the device; and receiving, from the device, the response generated by the cloud services provider; verifying the response received from the device matches the response generated by the cloud services provider; and performing the signing in response to the verification by the certificate authority system of the match. ### Claim 13 (depends on 12) The method of claim 12, wherein sending the challenge to the device further comprises: instructing the device to perform an action at the cloud services provider, wherein the action is known by the certificate authority system not to be allowed by the cloud services provider; receiving, from the device, a response generated by the cloud services provider as a result of the device failing to perform the action at the cloud services provider, wherein the response comprises an error message generated by the cloud services provider; verifying, with the cloud services provider, that the device attempted to perform the action at the cloud services provider that resulted in the error message; and performing the signing in response to verifying the error message with the cloud services provider. ### Claim 14 A non-transitory computer readable storage medium including instructions that, when executed by a processor, cause the processor to perform a method for a certificate authority system to provide authentication to a device associated with an organization, the method comprising: receiving, at the certificate authority system, a request from the device to sign authentication information of the device; sending a challenge to the device comprising a request to perform an action; receiving a response to the challenge from the device as a result of performing the action; verifying, by the certificate authority system, the response was correctly generated based on the challenge; analyzing a factor associated with the device, the factor comprising at least one of a location of the device, a role of a user of the device within the organization, one or more permissions associated with a user of the device, one or more privileges of the user within the organization, a type of device, and a purpose of the device; selecting, based on the analysis of the factor, a key from among a plurality of keys of the certificate authority system associated with a level of trust associated with the device, wherein the level of trust encompasses at least one of: a device permission level of the device within the organization, a user permission level of a user of the device, an operation permission level associated with a privilege available to the device for performing an operation within the organization, and an access permission level that establishes a privilege to a resource; and signing, in response to verifying the response and selecting the key, the authentication information of the device with at least the selected key of the certificate authority system as a certificate authority system authentication of an identity of the device that certifies the device as a trusted device having the level of trust when interacting with another device associated with the organization. ### Claim 15 (depends on 14) The non-transitory computer readable storage medium of claim 14, further comprising: compartmentalizing the selected key and its associated trust level by at least one of: a geographic region, a user role, a set of user privileges, a device type, or a device purpose. ### Claim 16 (depends on 14) The non-transitory computer readable storage medium of claim 14, further comprising: updating the level of trust associated with the selected key after the device has been signed with the selected key. ### Claim 17 (depends on 14) The non-transitory computer readable storage medium of claim 14, further comprising: revoking the selected key, causing the device to be no longer certified as a trusted device. ### Claim 18 A certificate authority system, comprising: a memory to store a plurality of cryptographic keys of the certificate authority system; and a processor coupled with the memory, the processor configured to: receive a request from a device to sign authentication information of the device, wherein the device is associated with an organization; send a challenge to the device comprising a request to perform an action; receive a response to the challenge from the device as a result of performing the action; verify, by the certificate authority system, the response was correctly generated based on the challenge; analyze a factor associated with the device, the factor comprising at least one of a location of the device, a role of a user of the device within the organization, one or more permissions associated with a user of the device, one or more privileges of the user within the organization, a type of device, and a purpose of the device; select, based on the analysis of the factor, a key from among a plurality of keys of the certificate authority system associated with a level of trust associated with the device, wherein the level of trust encompasses at least one of: a device permission level of the device within the organization, a user permission level of a user of the device, an operation permission level associated with a privilege available to the device for performing an operation within the organization, and an access permission level that establishes a privilege to a resource; and sign, in response to verifying the response and selecting the key, the authentication information of the device with at least the selected key of the certificate authority system as a certificate authority system authentication of an identity of the device that certifies the device as a trusted device having the level of trust when interacting with another device associated with the organization.