US 11,757,637 B2
Token node locking with signed fingerprints offloaded to clients
Jason A. Pasion, San Diego, CA (US); John Okimoto, San Diego, CA (US); Xin Qiu, San Diego, CA (US); Alexander Medvinsky, San Diego, CA (US); Ting Yao, San Diego, CA (US); Jinsong Zheng, San Diego, CA (US); and Oscar Jiang, West Covina, CA (US)
Assigned to ARRIS Enterprises LLC, Suwanee, GA (US)
Filed by ARRIS Enterprises LLC, Suwanee, GA (US)
Filed on Mar. 17, 2021, as Appl. No. 17/204,634.
Claims priority of provisional application 62/990,448, filed on Mar. 17, 2020.
Prior Publication US 2021/0297254 A1, Sep. 23, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/32 (2006.01); H04L 29/06 (2006.01); H04L 9/40 (2022.01)
CPC H04L 9/3213 (2013.01) [H04L 9/3247 (2013.01); H04L 9/3263 (2013.01); H04L 9/3268 (2013.01); H04L 9/3297 (2013.01); H04L 63/166 (2013.01); H04L 2463/121 (2013.01)] 16 Claims
OG exemplary drawing
 
1. A method of providing secure data to a client device having a token, comprising:
(a) binding the token to the client device according to first token binding information comprising a first token identifier (ID), first client device fingerprint data, and a first timestamp, comprising:
receiving the first token binding information from the client device in a token binding service;
determining if the first token ID does not match a previously stored token ID;
if the first token ID does not match a previously stored token ID, associatively storing the first token ID with the first client device fingerprint data, and the first timestamp;
signing the first token binding information; and
returning the signed first token binding information to the client device;
(b) receiving a request to provide secure data to the client device in a service, the request comprising the signed first token binding information and timestamp;
(c) determining if the request to provide the secure data to the client device was received within an acceptable temporal range of the stored timestamp; and
(d) providing the requested secure data according to the determination, comprising:
if the request to provide the secure data to the client device was received within an acceptable temporal range of the first timestamp, providing the requested secure data;
if the request to provide the secure data to the client device was not received within an acceptable temporal range of the first timestamp:
rejecting the request to provide the secure data;
receiving second token binding information from the client device in a token binding service, the second token binding information comprising a second token ID and second client device fingerprint data and a second timestamp; and
providing the requested secure data according to the received second token binding information.