# US 2019/0245704 A1 · Template based credential provisioning

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0245704 A1
- Document ID: US20190245704A1
- Status: Published application
- Kind: A1
- Application number: 16/271,659
- Filed: 2019-02-08
- Published: 2019-08-08
- Earliest claimed: 2018-02-08
- Assignees: Cable Television Laboratories, Inc.
- Applicants: Cable Television Laboratories, Inc.
- Inventors: Massimiliano Pala
- Web page: https://patentgrep.com/patent/US20190245704A1

## CPC

- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC}
- H04L 9/3247: {involving digital signatures}
- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- H04L 41/0803: Configuration setting
- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)}
- H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A certificate re-provisioning (CREP) protocol allows a client device to communicate with a provisioning server and be automatically provisioned, or re-provisioned, with needed credentials without the client device being aware of which credentials it needs. The CREP protocol uses a slot configuration template that defines which credentials are installed on the client device and the provisioning server responds with actions to provision the client device according to a client target configuration stored at the server.

## Claims

### Claim 1

A certificate provisioning method, comprising:
receiving, within a provisioning server and from a client device, a request message including a client identifier and a slot configuration template defining a current configuration of credentials on the client device;
retrieving a client target configuration from a configuration database based upon the client identifier;
determining differences between the current configuration and the client target configuration;
generating, based upon the differences, an action item set to include at least one action item for provisioning the client device;
generating a response message including a first action item of the action item set; and
sending the response message to the client device.

### Claim 2 (depends on 1)

The certificate provisioning method of claim 1, wherein determining differences comprises comparing each installed credential identifier of the slot configuration template with credentials defined within the client target configuration and generating the action item set to: removes ones of the installed credential identifiers not matching the credentials defined within the client target configuration; and install ones of the credentials defined within the client target configuration not matching any installed credential identifier.

### Claim 3 (depends on 1)

The certificate provisioning method of claim 1, further comprising validating a trust anchor list and of the request message.

### Claim 4 (depends on 1)

The certificate provisioning method of claim 1, further comprising validating a bootstrap credential identifier of the request message.

### Claim 5 (depends on 1)

The certificate provisioning method of claim 1, further comprising:
determining that a bootstrap credential of the request message is based upon public key cryptography; and
generating a response message authentication for the response message as a signature of a response header and a response body of the response message using a private key of a provisioning server key pair.

### Claim 6 (depends on 1)

The certificate provisioning method of claim 1, further comprising:
receiving, from the client device, an updated request message including a first action result indicating whether the first action item was performed successfully by the client device and including an updated slot configuration template defining the current configuration of the client device;
determining a next action of the action item set;
updating the response message to include the next action; and
sending the updated response message to the client device.

### Claim 7 (depends on 1)

The certificate provisioning method of claim 1, further comprising:
receiving, from the client device, an updated request message including a first action result indicating whether the first action item was performed by the client device and including an updated current configuration of the client device;
determining that the first action result indicates success;
determining there are no further actions in the action item set;
updating the response message to indicate no action; and
sending the updated response message to the client device.

### Claim 8 (depends on 1)

The certificate provisioning method of claim 1, the slot configuration template having at least one slot configuration including an installed credential identifier, wherein determining differences between the current configuration and the client target configuration comprises comparing the installed credential identifier for each of the at least one slot configuration to at least one credential identifier defined within the client target configuration.

### Claim 9 (depends on 1)

The certificate provisioning method of claim 1, further comprising:
receiving, from a device manufacturer, at least one credential identifier corresponding to certificates to be installed on the client device; and
generating the client target configuration to include the at least one credential identifier.

### Claim 10 (depends on 9)

The certificate provisioning method of claim 9, further comprising retrieving a credential corresponding to the credential identifier from a credential issuer.

### Claim 11

A certificate provisioning method, comprising:
generating, within a client device, a request message including a client identifier and a slot configuration template defining a current configuration of credentials on the client device;
sending the request message to a provisioning server;
receiving, from the provisioning server, a response message including an action;
performing the action on the client device;
updating the request message to include a result of the action on the client device; and
sending the updated request message to the provisioning server.

### Claim 12 (depends on 11)

The certificate provisioning method of claim 11, further comprising:
determining that the action is to install a credential; and
installing each of at least one credential included within a credential bundle of the response message.

### Claim 13 (depends on 12)

The certificate provisioning method of claim 12, further comprising installing the credential in a data structure corresponding to the slot configuration template.

### Claim 14 (depends on 11)

The certificate provisioning method of claim 11, further comprising generating a new key pair for one slot of the slot configuration template in response to the action.

### Claim 15 (depends on 11)

The certificate provisioning method of claim 11, further comprising deleting a key pair from one slot of the slot configuration template in response to the action.

### Claim 16 (depends on 11)

The certificate provisioning method of claim 11, further comprising installing a trust credential from the response message in response to the action.