Granted Patent B2

US 12,468,822 · App. 18/129,918 · Granted Nov 11, 2025

Inventors: Siavash James Joorabchian Hawkins (Canterbury, GB); Krishna Shanbhag B (Bangalore, IN)

Assignee: Omnissa, LLC

G06F21/602G06F21/31G06F21/72

Abstract

Claims (60)

1 . A system comprising:

a client device comprising a processor and a memory; and

a cryptographic interface application stored in the memory that, when executed by the processor, causes the client device to at least:

detect a hardware security module associated with the client device;

receive, from a management service over a network, a policy containing a set of rules for operating the hardware security module;

set a provisioning passcode for the hardware security module that complies with the set of rules of the policy received from the management service;

set a usage passcode for the hardware security module;

remove an unblock passcode for the hardware security module;

install at least one credential on the hardware security module using the provisioning passcode;

receive, from a client application installed on the client device, a request for the at least one credential installed on the hardware security module;

determine that the client application is permitted to access the at least one credential installed on the hardware security module based on the set of rules of the policy received from the management service; and

provide the client application access to the at least one credential.

2 . The system of claim 1 , wherein the hardware security module comprises a trusted platform module (TPM) chip installed in the client device or an external portable hardware authentication device that is connectable to the client device.

3 . The system of claim 1 , wherein the provisioning passcode is used to modify a credential store of the hardware security module.

4 . The system of claim 1 , wherein the usage passcode causes the hardware security module to process cryptographic operations with stored credentials.

5 . The system of claim 4 , wherein the unblock passcode clears a blocked state of the hardware security module, the blocked state comprising a state in which the usage passcode will not cause the hardware security module to process the cryptographic operations.

6 . The system of claim 1 , wherein the cryptographic interface application, when executed by the processor, further causes the client device to at least:

receive an updated policy from the management service;

determine that the client device fails to comply with the updated policy; and

reject a second request for the at least one credential from the client application.

7 . The system of claim 1 , wherein the cryptographic interface application, when executed by the processor, further causes the client device to at least, in response to receiving a factory reset command:

delete the at least one credential; and

reset the provisioning passcode, the usage passcode, and the unblock passcode.

8 . The system of claim 1 , wherein the cryptographic interface application, when executed by the processor, further causes the client device to at least:

receive a public key and a key pair locator that enables locating a passcode recovery service;

generate a passcode recovery file comprising the key pair locator and the usage passcode, the passcode recovery file being encrypted using the public key; and

provide the passcode recovery file to a remote data store.

9 . A method, comprising:

detecting a hardware security module associated with a client device;

receiving, by the client device from a management service over a network, a policy including a set of rules for operating the hardware security module;

setting a provisioning passcode for the hardware security module that complies with the set of rules of the policy received from the management service;

setting a usage passcode for the hardware security module;

removing an unblock passcode for the hardware security module; and

installing at least one credential on the hardware security module using the provisioning passcode;

receiving, from a client application installed on the client device, a request for the at least one credential installed on the hardware security module;

determining that the client application is permitted to access the at least one credential installed on the hardware security module based on the set of rules of the policy received from the management service; and

providing the client application access to the at least one credential.

10 . The method of claim 9 , wherein the provisioning passcode is used to modify a credential store.

11 . The method of claim 9 , wherein the usage passcode is used to process cryptographic operations with stored credentials.

12 . The method of claim 9 , wherein the unblock passcode clears a blocked state of the hardware security module.

13 . The method of claim 9 , further comprising:

receiving an updated policy from the management service;

determining that the client device fails to comply with the updated policy; and

rejecting a second request for the at least one credential from the client application.

14 . A non-transitory, computer-readable medium comprising machine-readable instructions that, when executed by a processor of a client device, cause the processor to at least:

detect a hardware security module connected to the client device;

receive, by the client device from a management service over a network, a policy including a set of rules for operating the hardware security module;

set a provisioning passcode for the hardware security module that complies with the set of rules of the policy received from the management service;

set a usage passcode for the hardware security module;

remove an unblock passcode for the hardware security module; and

install at least one credential on the hardware security module using the provisioning passcode;

receive, from a client application installed on the client device, a request for the at least one credential installed on the hardware security module;

determine that the client application is permitted to access the at least one credential installed on the hardware security module based on the set of rules of the policy received from the management service; and

provide the client application access to the at least one credential.

15 . The non-transitory computer-readable medium of claim 14 , wherein the hardware security module comprises a trusted platform module (TPM) chip installed in the client device or an external portable hardware authentication device that is connectable to the client device.

16 . The non-transitory computer-readable medium of claim 14 , wherein the provisioning passcode is used to modify a credential store, the usage passcode is used to process cryptographic operations with stored credentials, and the unblock passcode clears a blocked state of the hardware security module.

17 . The non-transitory computer-readable medium of claim 14 , further comprising machine-readable instructions that, when executed by the processor, further causes the processor to at least:

receive an updated policy from the management service;

determine that the client device fails to comply with the updated policy; and

reject a second request for the at least one credential from the client application.

Assignments (4)

Priority Claims (1)

Continuity (1)

References Cited (12)