Passing local credentials to a secure browser session

Patent metadata

Field	Value
Publication number	US-11803635-B2
Application number	US-202117239811-A
Country	US
Kind code	B2
Filing date	Apr 26, 2021
Priority date	Apr 26, 2021
Publication date	Oct 31, 2023
Grant date	Oct 31, 2023

Abstract

A computing device includes a memory and a processor configured to receive credentials stored on a client device for a website responsive to the client device initiating a launch of the website through a first browser at the client device. The processor runs a second browser to launch the website for display at the client device using the received credentials and some state information is synchronized between them for the duration of the session. The second browser isolates the website from access to other data of the client device.

First claim

That which is claimed:

1. A computing device comprising:
a memory and a processor configured to perform the following:
receive credentials stored on a client device for a website having a web page, responsive to the client device initiating a launch of the website through a first browser at the client device,
with the first browser running in a first browsing session, and run a second secure remote browser in a second browsing session to launch the website for display at the client device using the received credentials, the second secure remote browser is isolated from the first browsing session to prevent the website from accessing other data of the client device session;
display the web page; generate a refresh command by the first browser to refresh the displayed web page; intercepting by the client device the generated refresh command;
and redirecting the intercepted refresh command to the second secure remote browser, with the second secure remote browser refreshing the web page being displayed by the client device.

2. The computing device according to claim 1 wherein the isolation prevents the website from directly transferring any browsing data to or from the client device.

3. The computing device according to claim 1 wherein said processor runs the second secure remote browser in a computing session, and is further configured to discard the received credentials after the computing session has ended.

4. The computing device according to claim 1 wherein the received credentials are only for the website to be launched.

5. The computing device according to claim 1 wherein the credentials are received from the client device.

6. The computing device according to claim 1 wherein said processor is further configured to perform the following:
store the credentials during a computing session;
monitor for changes in the stored credentials made by a user of the client device during the computing session; and
provide the changes in the credentials to the client device for the client device to update the credentials stored on the client device.

7. The computing device according to claim 1 wherein said processor is assigned to the client device by a second computing device after the second computing device receives a request from the client device for the website to be launched.

8. The computing device according to claim 7 wherein said processor receives a launch address for the website from the second computing device.

9. The computing device according to claim 7 wherein the request from the client device for the website to be launched includes the credentials, and wherein said processor receives the credentials from the second computing device.

10. The computing device according to claim 7 wherein said processor is further configured to validate the client device via the second computing device prior to running the second secure remote browser.

11. The computing device according to claim 1 wherein said processor is further configured to autofill the received credentials in order to launch the website.

12. A method comprising:
receiving credentials stored on a client device for a website responsive to the client device initiating a launch of the website through a first browser at the client device, with the first browser running in a first browsing session, and running a second secure remote browser in a second browsing session to launch the website for display at the client device using the received credentials, the second secure remote browser is isolated from the first browsing session to prevent the website from accessing other data of the client device via the first browsing session;
displaying by the client device the website;
generating a refresh command by the first browser in the client device to refresh the displayed website;
intercepting by the client device the generated refresh command;
and redirecting the intercepted refresh command to the second secure remote browser, with the second secure remote browser refreshing the website being displayed by the client device.

13. The method according to claim 12 wherein the second secure remote browser is running in a computing session, and further comprising discarding the received credentials after the computing session has ended.

14. The method according to claim 12 wherein the received credentials are only for the website to be launched.

15. The method according to claim 12 wherein the credentials are received from the client device .

16. The method according to claim 12 further comprising:
storing the credentials during a computing session;
monitoring for changes in the stored credentials made by a user of the client device during the computing session; and
providing the changes in the credentials to the client device for the client device to update the credentials stored on the client device.

17. The method according to claim 12 wherein receiving the credentials and running the second secure remote browser are performed by a first computing device, with the first computing device being assigned to the client device by a second computing device after the second computing device receives a request from the client device for the website to be launched.

18. The method according to claim 17 wherein the request from the client device for the website to be launched includes the credentials, and wherein the first computing device receives the credentials from the second computing device.

19. The method according to claim 12 further comprising autofilling the received credentials in order to launch the website.

20. A method comprising:
operating a first browser in a first browsing session on a client device to select a web page to be launched;
directing the first browser to an address of a first computing device in response to selection of the web page, the first computing device to provide access to a second secure remote browser, with the second browsing session being isolated from the first browsing session to prevent the web page from accessing data of the client device via the first browsing session;
opening the web page with use of the address of the first computing device and the second secure remote browser;
modifying the display of the web page opened in the second secure remote browser provided by the first browser on the client device to include the address of the web page instead of the address of the first computing device;
displaying by the client device the web page;
generating a refresh command by the first browser in the client device to refresh the displayed web page;
intercepting by the client device the generated refresh command; and redirecting the intercepted refresh command to the second secure remote browser, with the second secure remote browser refreshing the web page being displayed by the client device.

21. The method according to claim 20 wherein the displayed address of the web page provides an identity of the web page so a user of the client device avoids interacting with a malicious site.

22. The method according to claim 20 wherein the second secure remote browser is to run in a computing session, and further comprising copying the displayed address of the web page to be used to launch the web page in a differenct computing session.

23. The method according to claim 20 further comprising updating the first browser in the client device in response to an address change in the second secure remote browser.

24. The metho

Assignees

• Citrix Systems Inc

Inventors

• Wing Daniel
• Singh Manbinder Pal

Classifications

• G06F21/53 Primary

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F21/45

  Structures or tools for the administration of authentication · CPC title

• G06F21/62

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• G06F2221/033

  Test or assess software · CPC title

• G06F21/606

  by securing the transmission between two devices or processes · CPC title