# US 2021/0243188 A1 · Methods and apparatus for authenticating devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243188 A1 - Document ID: US20210243188A1 - Status: Published application - Kind: A1 - Application number: 17/053,922 - Filed: 2019-05-08 - Published: 2021-08-05 - Earliest claimed: 2018-05-11 - Assignees: ARM IP Limited - Applicants: Arm IP Limited - Inventors: Thomas Christopher GROCUTT - Web page: https://patentgrep.com/patent/US20210243188A1 ## CPC - G06F 21/445: {by mutual authentication, e.g. between devices or programs} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - G06F 21/606: {by securing the transmission between two devices or processes} - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/3215: {using a plurality of channels (network architectures or network communication protocols using different networks H04L63/18)} - H04L 9/3273: {for mutual authentication (network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869)} - H04L 41/046: comprising network management agents or mobile agents therefor - H04L 41/28: Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04W 12/06: Authentication - H04L 2101/365: Application layer names, e.g. buddy names, unstructured names chosen by a user or home appliance name - H04W 4/80: Services using short range communication, e.g. near-field communication [NFC], radio-frequency identification [RFID] or low energy communication - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A network management agent is provided to enable a secure connection to a network to be established. The network management agent confirms the identity of a device upon receipt of a device identifier from the device, via a first communication channel, and responds with a security token, via the first communication channel, which the device uses to confirm the identity of the network management agent. The network management agent is able to trust the device and the device is able to trust the network management agent, such that the device may be granted access to a network which it trusts. The network management agent may be provided, via a second communication channel, with a device identifier and a device security token for the device from which the security token to be transmitted over the first channel is derived. ## Claims ### Claim 1 A method for a network management agent to establish trust of a device, the method comprising: receiving, at the network management agent from the device, via a first channel, a first device identifier; authenticating the device based upon the received first device identifier and a second device identifier of the device provided, via a second channel, to the network management agent to establishing at the network management agent, trust of the device; and transmitting, from the network management agent to the device, via the first channel, a security token; wherein the security token is derived from a device security token of the device provided, via the second channel, to the network management agent; and wherein the first channel is different from the second channel. ### Claim 2 (depends on 1) The method of claim 1, further comprising: in response to authenticating the device, granting the device access to a network. ### Claim 3 (depends on 1) The method of claim 1, wherein authenticating the device comprises: determining that the first device identifier corresponds to the second device identifier. ### Claim 4 (depends on 1) The method of claim 1, further comprising: storing the second device identifier of the device and the device security token of the device at the network management agent. ### Claim 5 (depends on 1) The method of claim 1, further comprising: receiving, at the network management agent from the device, via the first channel, a request for the security token; and transmitting, from the network management agent to the device, via the first channel, the security token derived from the device security token of the device, in response to the request. ### Claim 6 (depends on 1) The method of claim 1, further comprising: scanning using a scanner device, a tag of the device to obtain, via the second channel, the second device identifier of the device and the device security token of the device encoded in the tag; and receiving, at the network management agent from the scanner device the second device identifier of the device and the device security token of the device. ### Claim 7 (depends on 6) The method of claim 6, wherein the scanner device is provided at a physical entrance to an area supported by the network management agent, the method further comprising: scanning the tag of the device upon entry to the area. ### Claim 8 (depends on 1) The method of claim 1, further comprising: receiving, at the network management agent from a device retailer the second device identifier of the device and the device security token of the device. ### Claim 9 (depends on 1) The method of claim 1, further comprising: enabling the device to authenticate the network management agent based upon the security token transmitted from the network management agent to the device and another device security token of the device stored at the device; and in response to the device authenticating the network management agent, enabling the device to establish trust of the network management agent. ### Claim 10 (depends on 9) The method of claim 9, wherein authenticating the network management agent comprises: determining that the security token transmitted from the network management agent corresponds to the another device security token stored at the device. ### Claim 11 (canceled) ### Claim 12 (depends on 1) The method of claim 1, further comprising: transmitting, from the network management agent to the device, via the first channel, a request for further device data. ### Claim 13 (depends on 1) The method of claim 1, further comprising: receiving, at the network management agent, via the second channel, further device data. ### Claim 14 (depends on 1) The method of claim 1, further comprising: receiving, at the network management agent, via the first channel, further device data. ### Claim 15 (depends on 1) The method of claim 1, further comprising: receiving, at the network management agent, further device data, and storing the further device data at the network management agent. ### Claim 16 (depends on 1) The method of claim 1, further comprising: transmitting, from the network management agent to the device, via the first channel, device configurations for the device. ### Claim 17 (depends on 16) The method of claim 16, further comprising: providing a user interface enabling a user to define the device configurations for the device at the network management agent. ### Claim 18 (depends on 17) The method of claim 17, wherein the user interface further enables a user to define device configurations for a type of device at the network management agent, the method further comprising: receiving at the network management agent an indication of the type of device; and transmitting, from the network management agent to the device, via the first channel, the device configurations for the type of device. ### Claim 19 (depends on 1) The method of claim 1, further comprising: the network management agent linking the device to one or more other devices within the network; determining at the network management agent device configurations for the device in response to the device links; and transmitting, from the network management agent to the device, via the first channel, the device configurations for the device. ### Claim 20 A network management agent for establishing trust with a device, the network management agent comprising: a communications module for receiving, via a first channel, a first device identifier of the device; a storage module for storing a second device identifier of the device and a device security token of the device provided, via a second channel, to the network management agent; and a processing module for authenticating the device based upon the received first device identifier of the device and the stored second device identifier of the device and establishing trust of the device, the processing module further for instructing the communications module to transmit to the device, via the first channel, a security token derived from the device security token of the device; wherein the first channel is different from the second channel. ### Claim at position 21 21-33. (canceled) ### Claim 34 (depends on 1) A computer readable storage medium comprising program code for performing the method of claim 1.