# US 2019/0319790 A1 · Attestable and destructible device identity > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0319790 A1 - Document ID: US20190319790A1 - Status: Published application - Kind: A1 - Application number: 15/954,356 - Filed: 2018-04-16 - Published: 2019-10-17 - Earliest claimed: 2018-04-16 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Technology Licensing, LLC - Inventors: Christopher E. FENNER - Web page: https://patentgrep.com/patent/US20190319790A1 ## CPC - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 9/0869: {involving random numbers or seeds} - G06F 9/54: Interprogram communication - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Implementations described herein disclose a device identity management system using a trusted platform module (TPM) of a device. The device identity management system provides one or more computer executable instructions to receive a secret random number at a trusted platform module (TPM) of a device, generate a hash of an existing device identity stored in a non-volatile (NV) identity index using the secret random number, and store the hash as the device identity in the NV identity index. ## Claims ### Claim 1 A physical article of manufacture including one or more tangible computer-readable storage media, encoding computer-executable instructions for executing on a computer system a computer process to provide attestable and destructible device identity, the computer process comprising: receiving a secret random number at a trusted platform module (TPM) of a device; generating a hash of an existing device identity stored in a non-volatile (NV) identity index using the secret random number; and storing the hash as the device identity in the NV identity index. ### Claim 2 (depends on 1) The physical article of manufacture of claim 1, wherein the TPM receives the secret random number from an operating system of the device. ### Claim 3 (depends on 1) The physical article of manufacture of claim 1, wherein the secret random number is a 256-bit number and generating a hash comprises creating a hash using SHA-256 hashing algorithm. ### Claim 4 (depends on 1) The physical article of manufacture of claim 1, wherein the computer process further comprising attesting the identity of the device in the identify index using an attestation identity key (AIK) of the TPM. ### Claim 5 (depends on 1) The physical article of manufacture of claim 1, wherein the computer process further comprising attesting the identity of the device in the identify index using a salted encryption key (EK) of the TPM. ### Claim 6 (depends on 1) The physical article of manufacture of claim 1, wherein the computer process further comprising destroying the device identity by generating a hash of the existing device identity using a new value of the secret random number. ### Claim 7 (depends on 1) The physical article of manufacture of claim 1, wherein the computer process further comprising destroying the device identity by deleting the identify index. ### Claim 8 (depends on 1) The physical article of manufacture of claim 1, wherein the computer process further comprising exposing the identity index to applications using an application programming interface (API) that supports at least one of a create identity call and a change identity call. ### Claim 9 (depends on 1) The physical article of manufacture of claim 1, wherein the computer process further comprising relocking the device by extending a new secret random number to the TPM and generating a new hash using the new secret random number and the current device identity. ### Claim 10 In a computing environment, a method performed at least in part on at least one processor, the method comprising: receiving a secret random number at a trusted platform module (TPM) of a device; generating a hash of an existing device identity stored in a non-volatile (NV) identity index using the secret random number; and storing the hash as the device identity in the NV identity index. ### Claim 11 (depends on 10) The method of claim 10, wherein the TPM receives the secret random number from an operating system of the device. ### Claim 12 (depends on 10) The method of claim 10, wherein the secret random number is a 256-bit number and generating a hash comprises creating a hash using SHA-256 hashing algorithm. ### Claim 13 (depends on 10) The method of claim 10, further comprising attesting the identity of the device in the identify index using at least one of an attestation identity key (AIK) of the TPM and a salted EK of the TPM. ### Claim 14 (depends on 10) The method of claim 10, further comprising destroying the device identity by generating a hash of the existing device identity using a new value of the secret random number. ### Claim 15 (depends on 10) The method of claim 10, further comprising relocking the device by extending a new secret random number to the TPM and generating a new hash using the new secret random number and the current device identity. ### Claim 16 (depends on 10) The method of claim 10, further comprising exposing the identity index to applications using an application programming interface (API) that supports at least one of a create identity call and a change identity call. ### Claim 17 In a computing environment, a system comprising: memory; one or more processor units; a device identity management system stored in the memory and executable by the one or more processor units, the device identity management system encoding computer-executable instructions on the memory for executing on the one or more processor units a computer process to provide malware sequence detection, the computer process comprising: receiving a secret random number at a trusted platform module (TPM) of a device; generating a hash of an existing device identity stored in a non-volatile (NV) identity index using the secret random number; and storing the hash as the device identity in the NV identity index. ### Claim 18 (depends on 17) The system of claim 17, wherein the computer process further comprising attesting the identity of the device in the identify index using an attestation identity key (AIK) of the TPM. ### Claim 19 (depends on 17) The system of claim 17, wherein the computer process further comprising destroying the device identity by generating a hash of the existing device identity using a new value of the secret random number. ### Claim 20 (depends on 17) The system of claim 17, wherein the computer process further comprising exposing the identity index to applications using an application programming interface (API) that supports at least one of a create identity call and a change identity call.