# US 2020/0288305 A1 · Third party certificate management for native mobile apps and internet of things apps > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0288305 A1 - Document ID: US20200288305A1 - Status: Published application - Kind: A1 - Application number: 16/808,472 - Filed: 2020-03-04 - Published: 2020-09-10 - Earliest claimed: 2019-03-04 - Assignees: JPMorgan Chase Bank, N.A. - Applicants: JPMorgan Chase Bank, N.A. - Inventors: Reetu R. BOK; William H. JOHNSTON - Web page: https://patentgrep.com/patent/US20200288305A1 ## CPC - H04W 12/35: {Protecting application or service provisioning, e.g. securing SIM application provisioning} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/321: {involving a third party or a trusted authority} - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 2209/04: Masking or blinding - H04L 2209/805: Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An embodiment of the present invention is directed to providing third party certificate management for native mobile apps or IoT apps. An embodiment of the present invention is directed to performing vendor certificate pinning for trusted communications in native mobile apps without having to control vendor certificate lifecycle management. With an embodiment of the present invention, downloaded certificates may be protected by encryption, anti-tampering protection, etc. ## Claims ### Claim 1 A computer-implemented method for providing third party certificate management for a mobile device connected to a communications network, the method comprising: sending, to a trusted gateway via the communications network, a request for a first certificate chain of a third party host; receiving, from the trusted gateway via the communications network, the first certificate chain of the third party host; storing the first certificate chain of the third party host; generating and storing a hash of the first certificate chain of the third party host; applying a protection to the hash; initiating communication with the third party host; downloading, from the third party host via the communications network, a second certificate chain of the third party host; generating a hash of the second certificate chain of the third party host and storing the hash locally; determining whether the hash of first certificate chain of the third party host matches the hash of second certificate chain of the third party host; and responsive to determining a match, establishing trusted communication with the third party host. ### Claim 2 (depends on 1) The method of claim 1, wherein the mobile device comprises an Internet of Things (IoT) device. ### Claim 3 (depends on 1) The method of claim 1, wherein the request comprises a third party host domain and an identifier. ### Claim 4 (depends on 1) The method of claim 1, wherein the hash is stored in a separate file from the first certificate chain of the third party host. ### Claim 5 (depends on 1) The method of claim 1, wherein the protection comprises obfuscating at least a portion of the hash. ### Claim 6 (depends on 1) The method of claim 1, wherein the protection comprises applying anti-tamper logic to at least a portion of the hash. ### Claim 7 (depends on 1) The method of claim 1, further comprising the step of: pinning the established communication to the third party host with the first certificate chain of the third party host. ### Claim 8 (depends on 1) The method of claim 1, wherein the step of applying a protection to the hash further comprises: encrypting the hash with a symmetric encryption key, storing the symmetric encryption key in a local keychain, and applying a root detection mechanism. ### Claim 9 (depends on 1) The method of claim 1, wherein the step of applying a protection to the hash further comprises performing white box cryptography on the hash. ### Claim 10 (depends on 1) The method of claim 1, wherein the hashes are generated according to an SHA-2 based hash function. ### Claim 11 A computer-implemented system for providing third party certificate management for a mobile device connected to a communications network, the system comprising: a mobile device executing a mobile application, and a trusted gateway comprising a computer server in communication with the mobile device over a communications network; the mobile device programmed to perform the steps of: sending, to the trusted gateway via the communications network, a request for a first certificate chain of a third party host; receiving, from the trusted gateway via the communications network, the first certificate chain of the third party host; storing the first certificate chain of the third party host; generating and storing a hash of the first certificate chain of the third party host; applying a protection to the hash; initiating communication with the third party host; downloading, from the third party host via the communications network, a second certificate chain of the third party host; generating a hash of the second certificate chain of the third party host and storing the hash locally; determining whether the hash of first certificate chain of the third party host matches the hash of second certificate chain of the third party host; and responsive to determining a match, establishing trusted communication with the third party host. ### Claim 12 (depends on 11) The system of claim 11, wherein the mobile device comprises an Internet of Things (IoT) device. ### Claim 13 (depends on 11) The system of claim 11, wherein the request comprises a third party host domain and an identifier. ### Claim 14 (depends on 11) The system of claim 11, wherein the hash is stored in a separate file from the first certificate chain of the third party host. ### Claim 15 (depends on 11) The system of claim 11, wherein the protection comprises obfuscating at least a portion of the hash. ### Claim 16 (depends on 11) The system of claim 11, wherein the protection comprises applying anti-tamper logic to at least a portion of the hash. ### Claim 17 (depends on 11) The system of claim 11, wherein the mobile device is further programmed to perform the step of: pinning the established communication to the third party host with the first certificate chain of the third party host. ### Claim 18 (depends on 11) The system of claim 11, wherein applying a protection to the hash further comprises: encrypting the hash with a symmetric encryption key, storing the symmetric encryption key in a local keychain, and applying a root detection mechanism. ### Claim 19 (depends on 11) The system of claim 11, wherein applying a protection to the hash further comprises performing white box cryptography on the hash. ### Claim 20 (depends on 11) The system of claim 11, wherein the hashes are generated according to an SHA-2 based hash function.