US 11,750,384 B2
Binding with cryptographic key attestation
Prabagar Ramadasse, Redmond, WA (US); Yordan Rouskov, Redmond, WA (US); Mick Healy, Redmond, WA (US); Gaurav Dhawan, Redmond, WA (US); Venkata Raghuram Pampana, Redmond, WA (US); Aleksandr Tokarev, Redmond, WA (US); Marc Shepard, Redmond, WA (US); and Ramachandra Ravitej Vennapusa, Redmond, WA (US)
Assigned to Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed by Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed on May 27, 2021, as Appl. No. 17/332,796.
Prior Publication US 2022/0385467 A1, Dec. 1, 2022
Int. Cl. H04L 9/32 (2006.01); H04L 9/30 (2006.01); H04L 9/08 (2006.01); H04L 9/00 (2022.01)
CPC H04L 9/3073 (2013.01) [H04L 9/0866 (2013.01); H04L 9/3234 (2013.01); H04L 9/3265 (2013.01); H04L 9/3268 (2013.01); H04L 9/0877 (2013.01); H04L 9/50 (2022.05)] 14 Claims
OG exemplary drawing
 
1. A device comprising:
a hardware backed key store configured to:
generate a device key pair, the device key pair including a device private key and a device public key; and
based on the device private key, sign a first attestation resulting in a signed first attestation, the first attestation claiming the device private key originated from the hardware backed key store;
generate a first application key pair, the first application key pair including first application private key and a first application public key;
based on the device private key, sign a second attestation resulting in a signed second attestation, the second attestation claiming the first application private key originated from the hardware backed key store;
communications circuitry configured to:
based on the device public key and the signed first attestation, register the device with a trusted authority;
based on the first application public key and the signed second attestation, register a first application of the device to a first server;
receive, from the trusted authority, a certificate attesting the device private key originated from the hardware backed key store; and
wherein registering the first application of the device includes providing the certificate to the first server.