# US 12,225,006 B2 · Secure resource access by amalgamated identities and distributed ledger > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,006 B2 - Document ID: US12225006B2 - Status: Granted - Kind: B2 - Application number: 18/305,592 - Filed: 2023-04-24 - Published: 2023-08-17 - Granted: 2025-02-11 - Earliest claimed: 2020-04-22 - Assignees: Kyndryl, Inc. - Applicants: Kyndryl, Inc. - Inventors: Suryanarayana Rao; Shiben Dutta; Clinton Vincen C; Vikas Lalwani - Web page: https://patentgrep.com/patent/US12225006B2 ## CPC - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key} - H04L 63/0407: {wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00)} - H04L 63/0838: {using one-time-passwords} - H04L 63/102: {Entity profiles} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - G06F 21/40: by quorum, i.e. whereby two or more security principals are required - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L 2463/082: applying multi-factor authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A server receives encrypted data from a protected-resource-requesting device that includes an encrypted combination of the device and user identification. The first server requests a most recent copy of data of a distributed ledger from a randomly selected logged-in workstation. The first server searches for a match of the encrypted data from the first device in the distributed ledger data received from the randomly selected workstation. In response to determining a match, the first server updates a table of a second server with a one-time-password (OTP) and a copy of the encrypted data received from the device. The first server sends the OTP and an instruction to the device to send the OTP and the encrypted data to the second server, which determines whether a match exists. In response to a confirmed match, the first server grants access to the device. ## Claims ### Claim 1 A method of onboarding a device to a network for access to protected resources accessible on the network, the method comprising: receiving, by one or more processors, from the device, an encrypted media access control (MAC) address of the device and an Internet Protocol (IP) address associated with the device; sending, by the one or more processors, a first instruction to the device to send the MAC address of the device to a predetermined plurality of workstations performing onboarding decisions; sending, by the one or more processors, a second instruction to the device to send a decryption key to the predetermined plurality of workstations performing the onboarding decisions; sending, by the one or more processors, the encrypted MAC address of the device and the Internet Protocol (IP) address associated with the device to the predetermined plurality of workstations performing the onboarding decisions; and receiving, by the one or more processors, from the predetermined plurality of workstations performing the onboarding decisions, a result of whether a decrypted MAC address, determined using the encrypted MAC address of the device and the decryption key, matches the MAC address of the device sent from the device. ### Claim 2 (depends on 1) The method of claim 1, further comprising: determining, by the one or more processors, whether a threshold level of approval for onboarding of the device is exceeded by the predetermined plurality of workstations performing the onboarding decisions; and in response to determining the threshold level of approval for onboarding of the device is exceeded by the predetermined plurality of workstations performing the onboarding decisions, inserting, by the one or more processors, an encrypted amalgamated single entity into a blockchain distributed ledger of credentials of a plurality of onboarded devices. ### Claim 3 (depends on 1) The method of claim 1, further comprising: responsive to receiving the result of the decrypted MAC address matching the encrypted MAC address of the device sent from the device to the predetermined plurality of workstations performing the onboarding decisions, requesting from the device, by the one or more processors, the MAC address of the device and a user ID (UID) of a user of the device, as an encrypted amalgamated single entity; receiving, by the one or more processors, the encrypted amalgamated single entity of the MAC address and the UID; and inserting, by the one or more processors, the encrypted amalgamated single entity into a blockchain distributed ledger of credentials of a plurality of onboarded devices. ### Claim 4 (depends on 3) The method of claim 3, wherein the inserting comprises adding a block to the blockchain distributed ledger, the block including the encrypted amalgamated single entity, thereby creating an updated blockchain distributed ledger. ### Claim 5 (depends on 4) The method of claim 4, further comprising distributing the updated blockchain distributed ledger to all onboarded devices. ### Claim 6 (depends on 5) The method of claim 5, wherein the all onboarded devices include: the predetermined plurality of workstations; all previously onboarded devices that have not been subsequently off-boarded; and the device. ### Claim 7 (depends on 1) The method of claim 1, further comprising: receiving, by the one or more processors, from the predetermined plurality of workstations performing the onboarding decisions, a notification to off-board the device; and generating, by the one or more processors, an off-boarding transaction and applying the off-boarding transaction to an encrypted amalgamated single entity of the device added to a blockchain distributed ledger of credentials of the plurality of onboarded devices. ### Claim 8 (depends on 1) The method of claim 1, wherein the encrypted MAC address of the device and the IP address associated with the device are received from a login app of the device. ### Claim 9 (depends on 1) The method of claim 1, wherein the encrypted MAC address of the device and the IP address associated with the device are received by an authentication program of a server. ### Claim 10 (depends on 1) The method of claim 1, further comprising subsequently authenticating the device using an encrypted combination of an identification of the device and an identification of a user of the device. ### Claim 11 A computer system for onboarding a device to a network for access to protected resources accessible on the network, the computer system comprising: one or more computer processors; one or more computer-readable storage media; program instructions stored on the one or more computer-readable storage media, the program instructions executable by the one or more computer processors to: receive from the device an encrypted media access control (MAC) address of the device and an Internet Protocol (IP) address associated with the device; send a first instruction to the device to send the MAC address of the device to a predetermined plurality of workstations performing onboarding decisions; send a second instruction to the device to send a decryption key to the predetermined plurality of workstations performing the onboarding decisions; send the encrypted MAC address of the device and the Internet Protocol (IP) address associated with the device to the predetermined plurality of workstations performing the onboarding decisions; and receive from the predetermined plurality of workstations performing the onboarding decisions, a result of whether a decrypted MAC address, determined using the encrypted MAC address of the device and the decryption key, matches the MAC address of the device sent from the device. ### Claim 12 (depends on 11) The computer system of claim 11, wherein the program instructions are executable to: determine whether a threshold level of approval for onboarding of the device is exceeded by the predetermined plurality of workstations performing the onboarding decisions; and in response to determining the threshold level of approval for onboarding of the device is exceeded by the predetermined plurality of workstations performing the onboarding decisions, insert an encrypted amalgamated single entity into a blockchain distributed ledger of credentials of a plurality of onboarded devices. ### Claim 13 (depends on 11) The computer system of claim 11, wherein the program instructions are executable to: responsive to receiving the result of the decrypted MAC address matching the encrypted MAC address of the device sent from the device to the predetermined plurality of workstations performing the onboarding decisions, request from the device the MAC address of the device and a user ID (UID) of a user of the device, as an encrypted amalgamated single entity; receive the encrypted amalgamated single entity of the MAC address and the UID; and insert the encrypted amalgamated single entity into a blockchain distributed ledger of credentials of a plurality of onboarded devices. ### Claim 14 (depends on 11) The computer system of claim 11, wherein the program instructions are executable to: receive from the predetermined plurality of workstations performing the onboarding decisions, a notification to off-board the device; and generate an off-boarding transaction and applying the off-boarding transaction to an encrypted amalgamated single entity of the device added to a blockchain distributed ledger of credentials of the plurality of onboarded devices. ### Claim 15 A computer program product comprising one or more computer readable storage media having program instructions collectively stored on the one or more computer readable storage media, the program instructions executable to: receive from a device requesting access to protected resources, an encrypted media access control (MAC) address of the device and an Internet Protocol (IP) address associated with the device; send a first instruction to the device to send the MAC address of the device to a predetermined plurality of workstations performing onboarding decisions; send a second instruction to the device to send a decryption key to the predetermined plurality of workstations performing the onboarding decisions; send the encrypted MAC address of the device and the Internet Protocol (IP) address associated with the device to the predetermined plurality of workstations performing the onboarding decisions; and receive from the predetermined plurality of workstations performing the onboarding decisions, a result of whether a decrypted MAC address, determined using the encrypted MAC address of the device and the decryption key, matches the MAC address of the device sent from the device. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the program instructions are executable to: determine whether a threshold level of approval for onboarding of the device is exceeded by the predetermined plurality of workstations performing the onboarding decisions; and in response to determining the threshold level of approval for onboarding of the device is exceeded by the predetermined plurality of workstations performing the onboarding decisions, insert an encrypted amalgamated single entity into a blockchain distributed ledger of credentials of a plurality of onboarded devices. ### Claim 17 (depends on 15) The computer program product of claim 15, wherein the program instructions are executable to: responsive to receiving the result of the decrypted MAC address matching the encrypted MAC address of the device sent from the device to the predetermined plurality of workstations performing the onboarding decisions, request from the device the MAC address of the device and a user ID (UID) of a user of the device, as an encrypted amalgamated single entity; receive the encrypted amalgamated single entity of the MAC address and the UID; and insert the encrypted amalgamated single entity into a blockchain distributed ledger of credentials of a plurality of onboarded devices. ### Claim 18 (depends on 15) The computer program product of claim 15, wherein the program instructions are executable to: receive from the predetermined plurality of workstations performing the onboarding decisions, a notification to off-board the device; and generate an off-boarding transaction and applying the off-boarding transaction to an encrypted amalgamated single entity of the device added to a blockchain distributed ledger of credentials of the plurality of onboarded devices.