Patent ID: 11863539
Assignee: ZOOM VIDEO COMMUNICATIONS, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A method comprising:
detecting, by a device management system, an attempt to access a user account by an unenrolled device;
identifying, by the device management system, a first enrolled device corresponding to the user account by accessing a signature chain of the user account, wherein the signature chain includes a first sequential record identifying the first enrolled device;
facilitating, by the device management system, a transmission of an enrollment request and a corresponding cryptographic signature from the unenrolled device to the first enrolled device, wherein the cryptographic signature of the enrollment request is generated by using a private cryptographic key of the unenrolled device, wherein the enrollment request includes a set of long-term cryptographic keys of the unenrolled device to be added into a second sequential record into the signature chain, and wherein the first enrolled device is configured to:
cryptographically validate the enrollment request at least by decrypting the cryptographic signature of the enrollment request using a public cryptographic key of the unenrolled device;
cause a passcode to de displayed on the first enrolled device;
generate an encrypted attestation message indicating that the unenrolled device has been authenticated, wherein the encrypted attestation message is encrypted using a symmetric cryptographic key derived from the passcode, and wherein the encrypted attestation message includes the set of long-term cryptographic keys; and
transmit the encrypted attestation message to the unenrolled device;
receiving, by the device management system, a decrypted attestation message from the unenrolled device, wherein the decrypted attestation message is generated by decrypting the encrypted attestation message based on the passcode being correctly inputted into the unenrolled device; and
updating, by the device management system, the signature chain to include the second sequential record for the unenrolled device, wherein the second sequential record includes the decrypted attestation message, and wherein the second sequential record indicates that the unenrolled device has been associated with the user account as a second enrolled device.