# US 2019/0245701 A1 · Method and apparatus for online and offline generation of unique digital certificates

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0245701 A1
- Document ID: US20190245701A1
- Status: Published application
- Kind: A1
- Application number: 16/260,724
- Filed: 2019-01-29
- Published: 2019-08-08
- Earliest claimed: 2018-01-29
- Assignees: ARRIS Enterprises LLC
- Applicants: ARRIS Enterprises LLC
- Inventors: Ying Chen; Jinsong Zheng; Oscar Jiang; Xin Qiu; Ting Yao
- Web page: https://patentgrep.com/patent/US20190245701A1

## CPC

- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 9/3236: {using cryptographic hash functions}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 9/3247: {involving digital signatures}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system for generating unique digital certificates is provided that generates computed hashes public keys and compares them. The system method computes a hash of a public key, compares the computed hash of the public key with hashes of public keys previously generated, generates the digital certificate having the public key and a device identifier only if the computed hash of the public key does not match any of the hashes of public keys previously generated, and provides the digital certificate.

## Claims

### Claim 1

A method of generating a digital certificate, comprising:
computing a hash of a public key;
comparing the computed hash of the public key with hashes of public keys previously generated;
generating the digital certificate having the public key and a device identifier only if the computed hash of the public key does not match any of the hashes of public keys previously generated; and
providing the digital certificate.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
accepting a request to generate the digital certificate, the request comprising a public key.

### Claim 3 (depends on 1)

The method of claim 1, wherein:
the method further comprises:
accepting a request to generate a key pair and the digital certificate, the key pair comprising the public key and a private key;
generating the private key and the public key;
encrypting the private key;
providing the digital certificate comprises:
transmitting the encrypted private key and the digital certificate.

### Claim 4 (depends on 3)

The method of claim 3, wherein:
the request further comprises a protection paradigm for the private key; and
the private key is encrypted according to the protection paradigm.

### Claim 5 (depends on 1)

The method of claim 1, wherein the method further comprises:
(a) accepting, in a first system of a certificate authority having the first system and a second system, a request to generate a key pair and an associated digital certificate, the key pair comprising the public key and a private key, the request comprising:
a protection paradigm for the private key;
(b) conveying the request to the second system;
(c) generating, with the second system, the key pair comprising the private key and the public key;
(d) computing, with the second system, the hash of the public key;
(e) comparing, with the second system, the computed hash of the public key with hashes of public keys previously generated by the second system in response to the request;
(f) if the computed hash of the public key matches a hash of a public key of any key pair previously generated by the second system in response to the request:
performing steps (c)-(f) to generate another key pair having another private key and another public key; and
(g) if the computed hash of the public key does not match the hash of the public key of any key pair previously generated by the second system in response to the request:
generating, with the second system, the digital certificate having the public key and a device identifier;
encrypting, with the second system, the private key according to the protection paradigm;
conveying the digital certificate, the encrypted private key, and the computed hash of the public key from the first system to the second system;
comparing, with the first system, the computed hash of the public key with hashes of public keys previously generated by the first system;
if the computed hash of the public key matches a hash of a public key of any key pair previously generated by the first system:
abandoning the digital certificate; and
performing steps (c)-(g) for another key pair and another digital certificate;
if the computed hash of the public key does not match a hash of a public key of any key pair previously generated by the first system:
transmitting, with the first system, the digital certificate, the public key, and the encrypted private key.

### Claim 6 (depends on 5)

The method of claim 5, wherein conveying the digital certificate and the encrypted private key from the first system to the second system comprises:
signing the encrypted private key with the private key;
conveying the encrypted private key, the signed encrypted private key and the digital certificate to the first system; and
verifying the signed encrypted private key using the public key of the digital certificate.

### Claim 7 (depends on 6)

The method of claim 6, wherein conveying the request to the second system comprises:
generating, in the first system a file having the device identifier and the protection paradigm for the private key;
signing the file in the first system; and
verifying the signature of the file in the second system.

### Claim 8 (depends on 5)

The method of claim 5, wherein the second system is processingly isolated from the first system.

### Claim 9 (depends on 8)

The method of claim 8, wherein the first system is an online system and the second system is an offline system.

### Claim 10

An apparatus for generating a digital certificate, comprising:
at lest one processor;
at least one memory, communicatively coupled to the processor, the memory storing processor instructions comprising instructions for
computing a hash of a public key;
comparing the computed hash of the public key with hashes of public keys previously generated;
generating the digital certificate having the public key and a device identifier only if the computed hash of the public key does not match any of the hashes of public keys previously generated; and
providing the digital certificate.

### Claim 11 (depends on 10)

The apparatus of claim 10, wherein the processor instructions further comprise instructions for:
accepting a request to generate the digital certificate, the request comprising:
a public key.

### Claim 12 (depends on 10)

The apparatus of claim 10, wherein:
the processor instructions further comprise processor instructions for:
accepting a request to generate a key pair and the digital certificate, the key pair comprising the public key and a private key, the request comprising:
generating the private key and the public key;
encrypting the private key;
the processor instructions for providing the digital certificate comprise processor instructions for:
transmitting the encrypted private key and the digital certificate.

### Claim 13 (depends on 12)

The apparatus of claim 12, wherein:
the request further comprises a protection paradigm for the private key; and
the private key is encrypted according to the protection paradigm.

### Claim 14 (depends on 10)

The apparatus of claim 10, further comprising a second processor communicatively coupled to a second memory, and wherein:
the processor instructions further comprise processor instructions for:
accepting a request in a first system to generate a key pair and an associated digital certificate, the key pair comprising the public key and a private key, the request comprising a protection paradigm for the private key;
the request is conveyed to a second system, wherein the second system comprises a second processor communicatively coupled to a second memory comprising second processor instructions including processor instructions for:
(a) generating the key pair comprising the private key and the public key;
(b) computing the hash of the public key;
(c) comparing the computed hash of the public key with hashes of public keys previously generated by the second system in response to the request;
(d) if the computed hash of the public key matches a hash of a public key of any key pair previously generated by the second system in response to the request:
performing steps (a)-(d) to generate another key pair having another private key and another public key; and
(e) if the computed hash of the public key does not match the hash of the public key of any key pair previously generated by the second system in response to the request:
generating the digital certificate having the public key and a device identifier;
encrypting the private key according to the protection paradigm;
wherein the digital certificate, the encrypted private key, and the computed hash of the public key is conveyed from the first system to the second system;
wherein the processor instructions further comprise instructions for:
comparing the computed hash of the public key with hashes of public keys previously generated by the first system;
abandoning the digital certificate providing the device identifier to the second system to perform steps (a)-(e) for another key pair and another digital certificate if the computed hash of the public key matches a hash of a public key of any key pair previously generated by the first system; and
transmitting the digital certificate, the public key, and the encrypted private key if the computed hash of the public key does not match a hash of a public key of any key pair previously generated by the first system.

### Claim 15 (depends on 14)

The apparatus of claim 14, wherein the second processor instructions further comprise instructions for, before the digital certificate and the encrypted private key is conveyed from the second system to the first system:
signing the encrypted private key with the private key;
conveying the encrypted private key, the signed encrypted private key and the digital certificate to the first system; and
verifying the signed encrypted private key using the public key of the digital certificate.

### Claim 16 (depends on 15)

The apparatus of claim 15, wherein the processor instructions further comprise instructions for, before the digital certificate and the encrypted private key is conveyed from the first system to the second system:
generating a file having the device identifier and the protection paradigm for the private key;
signing the file in the first system; and
verifying the signature of the file in the second system.

### Claim 17 (depends on 14)

The apparatus of claim 14, wherein the second system is processingly isolated from the first system.

### Claim 18 (depends on 17)

The apparatus of claim 17, wherein the first system is an online system and the second system is an offline system.

### Claim 19

An apparatus for generating a digital certificate, comprising:
means for computing a hash of a public key;
means for comparing the computed hash of the public key with hashes of public keys previously generated;
means for generating the digital certificate having the public key and a device identifier only if the computed hash of the public key does not match any of the hashes of public keys previously generated; and
means for providing the digital certificate.

### Claim 20 (depends on 19)

The apparatus of claim 19, wherein:
the apparatus further comprises:
accepting a request to generate a key pair and the digital certificate, the key pair comprising the public key and a private key;
generating the private key and the public key;
encrypting the private key;
means for providing the digital certificate comprises:
means for transmitting the encrypted private key and the digital certificate.