Patent ID: 11881937
Assignee: HYPORI, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC G  H

Claim 0:
1. A credential provisioning method comprising:
receiving, by a server, a request from a client application on a client device to provision a user account for the client application on the client device, the request containing a temporary password for a user and an identifier for the user;
determining, by the server using the identifier for the user, whether a user entry is stored in a data store in communication with the server;
if the user entry is not found in the data store by the server, returning an error message to the client application on the client device;
if the user entry is found in the data store by the server, determining whether the temporary password contained in the request from the client application on the client device matches a temporary password associated with the user entry stored in the data store;
if the temporary password contained in the request from the client application on the client device matches the temporary password associated with the user entry stored in the data store, accessing, by the server, a rules database;
determining, by the server based on at least one rule from the rules database, whether to proceed with the provisioning of the user account for the client application on the client device;
if the server determines to proceed with the provisioning of the user account for the client application on the client device based on the at least one rule from the rules database, the server performing:
generating a key pair using credential parameters associated with the request from the client application on the client device;
generating a certificate signing request using the key pair and user information specific to the user;
communicating, by the server, the certificate signing request to a certificate authority;
receiving, by the server, a signed certificate from the certificate authority;
encrypting, by the server using an enterprise password provided to the server by the user or using a temporary encryption password generated and provided to the server by the client application on the client device, the signed certificate received from the certificate authority and the key pair generated by the server; and
sending the signed certificate and the key pair that have been encrypted by the server and identifying information of a key store or keychain location on the client device to the client application on the client device, wherein the client application is configured to store, using the identifying information, the signed certificate and the key pair at the key store or keychain location on the client device to thereby complete the provisioning of the user account for the client application on the client device;
wherein the client application is configured to: prior to storing the signed certificate and the key pair at the key store or keychain location on the client device, decrypt the signed certificate file and the key pair using the temporary encryption password; and
establish a mutual secure connection with a trusted server over a network using the signed certificate file and the key pair stored at the key store or keychain location on the client device.