Granted Patent B2

US 11,403,402 · App. 16/842,927 · Granted Aug 2, 2022

Inventors: Srinivas Kumar (Cupertino, CA); Atul Gupta (Sunnyvale, CA); Ruslan Ulanov (Dublin, CA); Shreya Uchil (Millbrae, CA)

Assignee: DigiCert, Inc.

G06F21/575G06F8/65G06F9/4401G06F9/445G06F16/1834G06F16/27H04L9/0643H04L9/0825H04L9/0877H04L9/0891H04L9/3239H04L9/3247H04L9/3263H04L9/3297H04L12/66H04L41/08H04L63/0823H04L63/12H04L2209/38

Abstract

Claims (43)

1. A method of building a device historian across a supply chain of device manufactures and managers, the method comprising:

receiving, by a blockchain broker service operating as a first node in a blockchain network, a transaction record of a device from a plurality of device management services operating on one or more computing systems external to the first node via a transaction connector, the plurality of device management services including an enrollment service, an update service operating as a second node in the blockchain network, a policy service operating as a first node outside of the blockchain network, and an analytics service operating as a second node outside of the blockchain network;

filtering, by the blockchain broker service, information in the transaction record based on the transaction filters;

preparing, by the blockchain broker service, a versioned block based on the filtered information from the transaction record, wherein

the versioned block has a block schema comprising a nonce, a header, and an operation field,

the header comprises a version number of the block schema, and

the operation field comprises either an enrollment request for a computing device with immutable device identifiers, or a registration request for an enrolled computing device with a device management service, or a deregistration request for a registered computing device, or a revocation request for the enrolled computing device; and

adding, by the blockchain broker service, the versioned block to the blockchain network.

2. The method of claim 1 , wherein the versioned block is configured for a specific industry sector by operation type, and with at least one of a device, application and operator as an entity, wherein the operator comprises at least one of a portal user and service user.

3. The method of claim 1 , wherein the versioned block is configured to track a chain of custody of the device based on a trust chain of a root certificate, a platform certificate, and an owner certificate.

4. The method of claim 1 , wherein the versioned block is configured to track applications on the device based on a trust chain of a root certificate, a platform certificate, an owner certificate, and a service certificate.

5. The method of claim 1 , wherein the versioned block is configured to track supply chain provenance of device update packages based on a trust chain established across a plurality of provider certificates, a publisher signing certificate, and a device encryption certificate.

6. The method of claim 5 , wherein the versioned blocks are in a distributed ledger of the blockchain network and are used to trace a history of device management operations orchestrated across the supply chain from a silicon fabrication plant, an original equipment manufacturer, a device owner, a device management service of the plurality of device management services, and in-field operations.

7. The method of claim 1 , wherein the operation field comprises an enrollment request for a computing device with immutable device identifiers.

8. The method of claim 1 , wherein the operation field comprises a registration request for an enrolled computing device with a device management service.

9. The method of claim 1 , wherein the operation field comprises a deregistration request for a registered computing device.

10. The method of claim 1 , wherein the operation field comprises a revocation request for the enrolled computing device.

11. The method of claim 1 , further comprising:

preparing, by the blockchain broker service, a second versioned block, wherein an operation field of the second versioned block comprises an update request for the computing device with tamper resistant packaging of the update package by a multi-system chain of trust; and

wherein the second versioned block includes a package field, the package field including an update package name, an update package type, an update package version, a device category of the update package, a list of signer public keys, a device encryption public key, and a timestamp of the package update.

12. The method of claim 1 , comprising:

receiving, by the enrollment service, an enrollment request from the device, the enrollment request including an authentication and one or more identification artifacts;

verifying, by the enrollment service, the received authentication and identification artifacts;

based on verification of the received authentication and identification artifacts, generating, by the enrollment service, a certificate associated with the device;

generating, by the enrollment service, an enrollment record of the device; and

wherein the transaction record includes the enrollment record.

13. The method of claim 1 , comprising:

receiving, by the update service, an update request from the device, the update request including an authentication and one or more identification artifacts;

verifying, by the update service, the received authentication and identification artifacts;

based on verification of the received authentication and identification artifacts, transmitting, by the update service, an update package to the device;

generating, by the update service, an update record of the device; and

wherein the transaction record includes the update record.

14. The method of claim 1 , comprising:

receiving, by the policy service, a policy request from the device, the policy request including an authentication and one or more identification artifacts;

verifying, by the policy service, the received authentication and identification artifacts;

based on verification of the received authentication and identification artifacts, transmitting, by the policy service, one or more policies for continuous runtime monitoring to the device;

generating, by the policy service, an policy configuration record of the device; and

wherein the transaction record includes the policy configuration record.

15. The method of claim 1 , comprising:

receiving, by the analytics service, an policy trigger event from the device, the policy trigger event including an authentication, one or more identification artifacts, and a signed event related data artifacts;

verifying, by the analytics service, the received authentication, the one or more identification artifacts, and the signed event related data artifacts;

based on verification of the received authentication, the one or more identification artifacts, and the signed event related data artifacts, generating, by the analytics service, an activity record, the activity record includes activity episode information, activity runtime state measurements, and device integrity scores; and

wherein the transaction record includes the activity record.

Assignments (4)

Continuity (4)

Cited By (9)

US 12,261,838 US 12,282,535 US 12,301,563 US 12,309,262 US 12,368,580 US 12,463,802 US 12,470,372 US 12,476,793 US 12,639,507