US 11,841,959 B1
Systems and methods for requiring cryptographic data protection as a precondition of system access
Adam Ghetti, Atlanta, GA (US); Ryan Speers, Silver Spring, MD (US); Jeffrey Howard, Annapolis, MD (US); Robert McColl, Atlanta, GA (US); Taylor Jay Centers, Annapolis, MD (US); and William Monte LeBlanc, Santa Cruz, CA (US)
Assigned to Ionic Security Inc., Atlanta, GA (US)
Filed by Ionic Security Inc., Atlanta, GA (US)
Filed on Nov. 18, 2021, as Appl. No. 17/529,832.
Application 17/529,832 is a continuation of application No. 15/886,527, filed on Feb. 1, 2018, granted, now 11,210,412.
Claims priority of provisional application 62/453,251, filed on Feb. 1, 2017.
Int. Cl. G06F 21/62 (2013.01); G06F 21/60 (2013.01); H04L 9/08 (2006.01); H04L 9/40 (2022.01)
CPC G06F 21/62 (2013.01) [G06F 21/604 (2013.01); H04L 9/0861 (2013.01); H04L 63/0428 (2013.01); H04L 63/083 (2013.01); H04L 63/0876 (2013.01); H04L 63/10 (2013.01); H04L 63/20 (2013.01); H04L 2463/082 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method, comprising:
requesting, via an electronic computing device, access to a third party system;
receiving, via the electronic computing device and from the third party system, a request for a cryptographic assertion, wherein the cryptographic assertion verifies to the third party system that a data protection system is operational on the electronic computing device prior to accessing the third party system;
extracting, via the electronic computing device, a common name from a certificate associated with the third party system;
generating, via the electronic computing device, a nonce corresponding to the request for the cryptographic assertion;
generating, via the electronic computing device, an encrypted client data package comprising a device identifier for the electronic computing device and the nonce;
sending, via the electronic computing device, an encrypted package to the data protection system for verification that the data protection system is operational, wherein the encrypted package comprises the common name and the encrypted client data package;
validating, via the data protection system, the request for the cryptographic assertion, wherein validating the request comprises:
determining, via the data protection system, that the request is not a replay of a previous request based at least in part on the nonce; and
comparing, via the data protection system, the device identifier to a known fingerprint hash for the electronic computing device;
in response to validating the request, sending, via the data protection system, the common name and the encrypted client data package to a key service; and
receiving, via the data protection system, a signed device assertion from the key service.