# US 2016/0365984 A1 · Service provider certificate management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2016/0365984 A1
- Document ID: US20160365984A1
- Status: Published application
- Kind: A1
- Application number: 14/736,055
- Filed: 2015-06-10
- Published: 2016-12-15
- Earliest claimed: 2015-06-10
- Assignees: QUALCOMM Incorporated
- Applicants: QUALCOMM Incorporated
- Inventors: Jangwon LEE; Anand PALANIGOUNDER; Soo Bum LEE; Rajat PRAKASH
- Web page: https://patentgrep.com/patent/US20160365984A1

## CPC

- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/321: {involving a third party or a trusted authority}
- H04L 9/3247: {involving digital signatures}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method includes: establishing a telecommunication link between a device and a service provider system via a telecommunication network; receiving a device public key via the telecommunication network from the device at the service provider system, the device public key predating the establishment of the telecommunication link; verifying, at the service provider system, that the device stores a device private key in a secure storage area of the device, the device private key corresponding to the device public key, the device public key and the device private key being a cryptographic key pair; and authorizing, by the service provider system, sign-up of the device for service enrollment in response to verifying that the device stores the device private key in the secure storage area of the device.

## Claims

### Claim 1

A method comprising:
establishing a telecommunication link between a device and a service provider system via a telecommunication network;
receiving a device public key via the telecommunication network from the device at the service provider system, the device public key predating the establishment of the telecommunication link;
verifying, at the service provider system, that the device stores a device private key in a secure storage area of the device, the device private key corresponding to the device public key, the device public key and the device private key being a cryptographic key pair; and
authorizing, by the service provider system, sign-up of the device for service enrollment in response to verifying that the device stores the device private key in the secure storage area of the device.

### Claim 2 (depends on 1)

The method of claim 1, wherein verifying that the device stores a device private key in a secure storage area of the device comprises finding an indication of the device public key in a whitelist database associated with a manufacturer of the device.

### Claim 3 (depends on 1)

The method of claim 1, wherein the device public key is part of a device certificate and the device public key is received by the service provider system receiving the device certificate, and wherein the verifying that the device stores a device private key in a secure storage area of the device comprises obtaining a device root certificate authority certificate indicating that the device certificate is trustworthy, and analyzing the device certificate for an indication that secure storage is used for the device private key.

### Claim 4 (depends on 3)

The method of claim 3, wherein the analyzing comprises analyzing an extended key usage portion of the device certificate for the indication that secure storage is used for the device private key.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
producing a service provider certificate by the service provider system, wherein a public key of the service provider certificate is the device public key;
signing the service provider certificate by the service provider system to produce a service-provider-signed certificate; and
sending the service-provider-signed certificate from the service provider system to the device.

### Claim 6 (depends on 5)

The method of claim 5, further comprising:
sending a certificate signing request, based on the service provider certificate, from a sign-up server of the service provider system to a service provider certificate authority of the service provider system, the service provider certificate authority performs the signing of the service provider certificate; and
receiving the service-provider-signed certificate from the service provider certificate authority at the sign-up server;
wherein the sign-up server performs the sending the service-provider-signed certificate to the device.

### Claim 7 (depends on 5)

The method of claim 5, wherein the producing the service provider certificate is performed such that at least one of a format or content of the service provider certificate is at least one of service-provider-server specific, service-provider specific, device-user specific, device specific, or subscription specific.

### Claim 8

A service provider system comprising:
a communication interface configured to establish a telecommunication link with a device via a telecommunication network; and
a processor communicatively coupled to the communication interface and configured to:
receive a device public key from the device, the device public key predating the establishment of the telecommunication link;
verify that the device stores a device private key in a secure storage area of the device, the device private key and the device public key being a cryptographic key pair; and
authorize sign-up of the device for service enrollment in response to verifying that the device stores the device private key in the secure storage area of the device.

### Claim 9 (depends on 8)

The system of claim 8, wherein to verify that the device stores a device private key in a secure storage area of the device the processor is configured to find an indication of the device public key in a whitelist database associated with a manufacturer of the device.

### Claim 10 (depends on 8)

The system of claim 8, wherein the device public key is part of a device certificate and the processor is configured to receive the device public key by receiving the device certificate, and wherein to verify that the device stores a device private key in a secure storage area of the device the processor is configured to obtain a device root certificate authority certificate indicating that the device certificate is trustworthy, and to analyze the device certificate for an indication that secure storage is used for the device private key.

### Claim 11 (depends on 10)

The system of claim 10, wherein to analyze the device certificate the processor is configured to analyze an extended key usage portion of the device certificate for the indication that secure storage is used for the device private key.

### Claim 12 (depends on 8)

The system of claim 8, wherein the processor is further configured to:
produce a service provider certificate, wherein a public key of the service provider certificate is the device public key;
sign the service provider certificate to produce a service-provider-signed certificate; and
send the service-provider-signed certificate to the device.

### Claim 13 (depends on 12)

The system of claim 12, wherein the processor is further configured to:
send a certificate signing request from a sign-up module to a service-provider-signed certificate module;
produce the service-provider-signed certificate, based on the device certificate, in the service-provider-signed certificate module;
send the service-provider-signed certificate from the service-provider-signed certificate module to the sign-up module; and
receive the service-provider-signed certificate at the sign-up module from the service-provider-signed certificate module;
wherein the processor is configured to send the service-provider-signed certificate to the device from the sign-up module.

### Claim 14 (depends on 12)

The system of claim 12, wherein the processor is configured to produce the service provider certificate such that at least one of a format or content of the service-provider-signed certificate is at least one of service-provider-server specific, service-provider specific, device-user specific, device specific, or subscription specific.

### Claim 15

A method comprising:
establishing a telecommunication link between a device and service provider system via a telecommunication network;
sending a device certificate via the telecommunication network from the device to the service provider system, the device certificate including a device public key, a device identity, and a digital signature, the device public key predating the establishing of the telecommunication link, the device public key corresponding to a device private key stored in secure memory of the device, the device public key and the device private key being a cryptographic key pair, the device certificate further including an indication that the device private key is stored in the secure memory of the device; and
receiving, at the device from the service provider system, an authorization to sign up the device for service enrollment.

### Claim 16 (depends on 15)

The method of claim 15, wherein sending the device certificate comprises sending the device certificate to a plurality of service provider systems, the method further comprising receiving a respective service-provider-signed certificate from each of the plurality of service provider systems.

### Claim 17 (depends on 16)

The method of claim 16, wherein each of the plurality of service-provider-signed certificates has at least one of a format or content specific to at least one of a respective service provider system, a respective service provider, a service subscribed to by a user of the device, a user of the device, or the device.

### Claim 18 (depends on 15)

The method of claim 15, further comprising storing the device private key and the device public key in the device during manufacture of the device.

### Claim 19 (depends on 18)

The method of claim 18, wherein the storing stores the device private key in a trusted execution environment of the device during manufacture of the device.

### Claim 20

A device comprising:
a communication interface configured to establish a telecommunication link between the device and a service provider system via a telecommunication network;
a secure memory storing a device private key; and
a processor communicatively coupled to the communication interface and the secure memory and configured to:
send a device certificate via the telecommunication network from the device to the service provider system, the device certificate including a device public key corresponding to the device private key, a device identity, and a digital signature, the device public key predating establishment of the telecommunication link, the device public key and the device private key being a cryptographic key pair, the device certificate further including an indication that the device private key is stored in the secure memory; and
receive, via the communication interface from the service provider system, at least one of a service-provider-signed certificate, corresponding to the device certificate, or an authorization to sign up the device for service enrollment.

### Claim 21 (depends on 20)

The device of claim 20, wherein the processor is configured to send the device certificate to a plurality of service provider systems and to receive a respective service-provider-signed certificate from each of the plurality of service provider systems.

### Claim 22 (depends on 21)

The device of claim 21, wherein each of the plurality of service-provider-signed certificates has at least one of a format or content specific to at least one of the respective service provider system, a respective service provider, a service subscribed to by a user of the device, a user of the device, or the device.

### Claim 23 (depends on 20)

The device of claim 20, wherein the secure memory is a trusted execution environment.

### Claim 24 (depends on 18)

The device of claim 18 wherein the processor is further configured to decrypt the service-provider-signed certificate using the device private key.

### Claim 25 (depends on 20)

The device of claim 20 wherein the processor is further configured to send, via the communication interface, the service-provider-signed certificate to a service provider server as at least part of a request for the service provider server to provide a service to the device.