Subscription-notification mechanisms for synchronization of distributed states

Patent metadata

Field	Value
Publication number	US-11516275-B2
Application number	US-202117410569-A
Country	US
Kind code	B2
Filing date	Aug 24, 2021
Priority date	Sep 22, 2012
Publication date	Nov 29, 2022
Grant date	Nov 29, 2022

Abstract

A method of rotating assigned credentials for client devices registering with servers may include determining that assigned credentials for a client device are expired; in response to determining that the assigned credentials have expired, generating new credentials for the client device; sending the new credentials to the client device; generating an encrypted version of the new credentials and storing the encrypted version of the new credentials at the server during a grace period, where during the grace period the client device can be authenticated using the assigned credentials or the new credentials; and deleting the encrypted version of the new credentials at an expiration of the grace period.

First claim

What is claimed is:

1. A method of rotating assigned credentials for client devices registering with servers, the method comprising:
determining, by a server, that assigned credentials for a client device are expired;
in response to determining that the assigned credentials have expired, generating, by the server, new credentials for the client device;
sending, by the server, the new credentials to the client device;
generating, by the server, an encrypted version of the new credentials and storing the encrypted version of the new credentials at the server during a grace period, wherein during the grace period the client device can be authenticated using the assigned credentials or the new credentials; and
deleting, by the server, the encrypted version of the new credentials at an expiration of the grace period.

2. The method of claim 1 , further comprising:
receiving, by the server, the assigned credentials from the client device during the grace period; and
in response to receiving the assigned credentials from the client device, sending, by the server, the new credentials to the client device.

3. The method of claim 2 , wherein the new credentials are generated by the server by decrypting the encrypted version of the new credentials that are stored at the server.

4. The method of claim 1 , further comprising:
generating, by the server, a hashed version of the new credentials and storing the hashed version of the new credentials at the server.

5. The method of claim 4 , further comprising:
receiving, by the server, the new credentials from the client device during the grace period;
generating, by the server, a temporary hash of the new credentials; and
authenticating the client device by comparing the temporary hash of the new credentials with the hashed version of the new credentials stored at the server.

6. The method of claim 1 , further comprising:
storing the encrypted version of the new credentials in a secure storage that is separate from the server at the expiration of the grace period.

7. The method of claim 1 , furthering comprising:
determining, by the server, whether a secure connection exists between the server and the client device, wherein the new credentials are sent to the client device in response to a determination that the secure connection exists.

8. The method of claim 1 , wherein the new credentials comprise an assigned identifier and an assigned secret for the client device, wherein the assigned identifier comprises a serial number of the client device.

9. The method of claim 8 , wherein the assigned secret comprises a random number generated by the server, and a hashed version of the new credentials comprises a hash of the assigned secret.

10. The method of claim 1 , wherein the assigned credentials expire after a predetermined number of uses.

11. A server comprising:
one or more processors; and
one or more memory devices comprising instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
determining, by the server, that assigned credentials for a client device are expired;
in response to determining that the assigned credentials are expired, generating, by the server, new credentials for the client device;
sending, by the server, the new credentials to the client device;
generating, by the server, an encrypted version of the new credentials and storing the encrypted version of the new credentials at the server during a grace period, wherein during the grace period the client device can be authenticated using the assigned credentials or the new credentials; and
deleting, by the server, the encrypted version of the new credentials at an expiration of the grace period.

12. The server of claim 11 , wherein the operations further comprise:
receiving, by the server, the assigned credentials from the client device during the grace period; and
in response to receiving the assigned credentials from the client device, sending, by the server, the new credentials to the client device.

13. The server of claim 12 , wherein the new credentials are generated by the server by decrypting the encrypted version of the new credentials that are stored at the server.

14. The server of claim 11 , wherein the operations further comprise:
generating, by the server, a hashed version of the new credentials and storing the hashed version of the new credentials at the server.

15. The server of claim 14 , wherein the operations further comprise:
receiving, by the server, the new credentials from the client device during the grace period;
generating, by the server, a temporary hash of the new credentials; and
authenticating the client device by comparing the temporary hash of the new credentials with the hashed version of the new credentials stored at the server.

16. The server of claim 11 , wherein the operations further comprise:
storing the encrypted version of the new credentials in a secure storage that is separate from the server at the expiration of the grace period.

17. The server of claim 11 , wherein the operations further comprise:
determining, by the server, whether a secure connection exists between the server and the client device, wherein the new credentials are sent to the client device in response to a determination that the secure connection exists.

18. The server of claim 11 , wherein the new credentials comprise an assigned identifier and an assigned secret for the client device, wherein the assigned identifier comprises a serial number of the client device.

19. The server of claim 18 , wherein the assigned secret comprises a random number generated by the server, and a hashed version of the new credentials comprises a hash of the assigned secret.

20. The server of claim 11 , wherein the assigned credentials expire after a predetermined number of uses.

Assignees

• Google Llc

Inventors

• Supramaniam Senthilvasan
• Hardison Osborne B
• Logue Jay D
• Luxemberg Jared A

Classifications

• H04L67/1095 Primary

  Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L67/01 Primary

  Protocols · CPC title