Mobile device authentication

Patent metadata

Field	Value
Publication number	US-12418794-B2
Application number	US-201615175927-A
Country	US
Kind code	B2
Filing date	Jun 7, 2016
Priority date	Jul 15, 2011
Publication date	Sep 16, 2025
Grant date	Sep 16, 2025

Abstract

A desktop is unlocked or locked using a mobile client device, such as a smart phone, tablet, smart watch, etc. The authentication mechanism of the mobile client device, such as fingerprint, facial recognition, voice recognition, username and password, is leveraged for faster, less-cumbersome user authentication on the desktop. In this vein, a client device is added to an authentication agent on the desktop, and the desktop recognizes successful attempts to access the mobile client device as a method of unlocking or locking the desktop.

First claim

We claim:

1. A method, comprising:
prior to authorizing a client device to access a desktop:
registering the client device with an authentication agent of the desktop, the authentication agent obtaining information for an authentication mechanism from the client device, the authentication mechanism configured to authenticate a user on the client device to unlock the desktop, the desktop hosted by a hypervisor running on the client device;
receiving an indication on the client device corresponding to the authentication mechanism;
determining that the indication is an authorized unlocking indication;
upon determining that the indication is an authorized unlocking indication, transmitting client device credentials to a desktop management server, wherein the desktop management server is configured to compare the client device credentials with an enterprise administrative policy to determine whether the client device satisfies the enterprise administrative policy, the enterprise administrative policy comprising the client device being within (i) a given location and (ii) a time of day at which the indication is received; and
upon the client device being determined to satisfy the enterprise administrative policy, transmitting the authorized unlocking indication from a desktop agent of the client device to the desktop in a side channel between the desktop agent and the desktop, the side channel authorized for non-display traffic by the desktop management server, wherein the desktop is configured to determine that the client device has been registered with the authentication agent, and determine, based on the authorized unlocking indication, whether the client device is authorized to access the desktop, before unlocking the desktop.

2. The method of claim 1 , wherein the client device is provided with a token to access the desktop management server.

3. The method of claim 1 , wherein the indication comprises sequentially touching specifically displayed elements on the client device.

4. The method of claim 1 , wherein the enterprise administrative policy includes rules associated with one or more of an access level and an access frequency.

5. The method of claim 1 , wherein the authentication mechanism includes one or more of a thermogram and gait recognition.

6. The method of claim 1 , wherein the indication includes a sequence of a plurality of related events that satisfies the enterprise administrative policy.

7. The method of claim 1 , further comprising:
receiving the indication on a smart watch; and
transmitting the indication from a smart phone to the desktop to unlock the desktop.

8. The method of claim 1 , wherein authenticating the user on the client device includes receiving authentication data comprising one or more of voice recognition information and facial recognition information.

9. A system, comprising:
one or more memories storing computer-executable instructions; and
one or more processors operationally coupled to the one or more memories and configured to execute the computer-executable instructions to:
prior to authorizing a client device to access a desktop:
register the client device with an authentication agent of the desktop, the authentication agent obtaining information for an authentication mechanism from the client device, the authentication mechanism configured to authenticate a user on the client device unlock the desktop, the desktop hosted by a hypervisor running on the client device;
receive an indication, on the client device, corresponding to the authentication mechanism;
determine that the indication is an authorized unlocking indication;
upon determining that the indication is an authorized unlocking indication, transmit client device credentials of the client device to a desktop management server, wherein the desktop management server is configured to compare the client device credentials with an enterprise administrative policy to determine whether the client device satisfies the enterprise administrative policy, the enterprise administrative policy comprising the client device being within (i) a given location and (ii) a time of day at which the indication is received; and
upon the client device being determined to satisfy the enterprise administrative policy, transmit the authorized unlocking indication from a desktop agent of the client device to the desktop in a side channel between the desktop agent and the desktop, the side channel authorized for non-display traffic by the desktop management server, wherein the desktop is configured to determine that the client device has been registered with the authentication agent, and determine, based on the authorized unlocking indication, whether the client device is authorized to access the desktop, before unlocking the desktop.

10. The system of claim 9 , wherein the client device is provided with a token to access the desktop management server.

11. The system of claim 9 , wherein the indication comprises sequentially touching specifically displayed elements on the client device.

12. The system of claim 9 , wherein the indication includes a sequence of a plurality of related events that satisfies the enterprise administrative policy.

13. The system of claim 9 , wherein the authentication mechanism includes one or more of: a thermogram and gait recognition.

14. The system of claim 9 , wherein authenticating a user on a client device includes receiving authentication data comprising one or more of voice recognition information and facial recognition information.

15. A non-transitory computer-storage memory embodied with instructions executable by one or more processors to enable remote authentication of a desktop by a client device, the instructions comprising:
prior to authorizing the client device to access a desktop:
registering the client device with an authentication agent of the desktop, the authentication agent obtaining information for an authentication mechanism from the client device, the authentication mechanism configured to authenticate a user on the client device to unlock the desktop, the desktop hosted by a hypervisor running on the client device;
receiving an indication on the client device corresponding to the authentication mechanism;
determine whether the indication is an authorized unlocking indication;
upon determining that the indication is an authorized unlocking indication, transmitting client device credentials to a desktop management server, wherein the desktop management server is configured to compare the client device credentials with an enterprise administrative policy to determine, whether the client device satisfies the enterprise administrative policy, the enterprise administrative policy comprising the client device being within (i) a given location and (ii) a time of day at which the indication is received; and
upon the client device being determined to satisfy the enterprise administrative policy, transmitting the authorized unlocking indication from a desktop agent of the client device to the desktop in a side channel between the desktop agent and the desktop. the side channel authorized for non-display traffic by the desktop management server, wherein the desktop is configured to determine that the client device has been registered with the authentication agent, and determine, based on the authorized unlocking indication, whether the client device is authorized to access the desktop, before unlocking the desktop.

16. The non-transitory computer-storage memory of claim 15 , wherein the client device is provided with a token to access the desktop management server.

Assignees

• Omnissa Llc

Inventors

• Beveridge Daniel James
• Watts Blake
• Mu Jian

Classifications

• H04L67/75

  Indicating network or usage conditions on the user display · CPC title

• H04L63/0853

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title

• H04L67/08

  specially adapted for terminal emulation, e.g. Telnet · CPC title

• G06F9/452

  Remote windowing, e.g. X-Window System, desktop virtualisation (protocols for virtual reality H04L67/131) · CPC title

• G06F21/32

  using biometric data, e.g. fingerprints, iris scans or voiceprints · CPC title