Systems and methods to secure authentication data for accessing resources in a distributed manner

Patent metadata

Field	Value
Publication number	US-12443744-B2
Application number	US-202117501500-A
Country	US
Kind code	B2
Filing date	Oct 14, 2021
Priority date	Oct 14, 2021
Publication date	Oct 14, 2025
Grant date	Oct 14, 2025

Abstract

Described embodiments provide systems and methods for securely storing private information of a user on a device of the user. A server may register a mobile device to store credentials of a user thereon, based on authentication of the user of the mobile device. The server may encrypt credentials of the user using a key of the server. The server may send the encrypted credentials to the registered mobile device for storage thereon without the key. The server may send a code to an endpoint device to initiate authentication of the user with use of the mobile device. The server may receive the encrypted credentials from the mobile device in response to the authentication. The server may decrypt the encrypted credentials using an encryption key of the server. The server may send the decrypted credentials to the endpoint device to authenticate the user at the endpoint device.

First claim

We claim:

1. A method comprising:
registering, by a server, a mobile device to store credentials of a user thereon, based on authentication of the user of the mobile device;
encrypting, by the server, credentials of the user using a key of the server;
sending, by the server, the encrypted credentials to the registered mobile device for storage thereon without the key;
sending, by the server responsive to a request for the credentials from an endpoint device different than the mobile device, a code to the endpoint device to initiate authentication of the user with use of the mobile device, to initiate a transfer of the encrypted credentials from the mobile device to the server;
receiving, by the server, the encrypted credentials from the mobile device in response to the authentication of the user;
decrypting, by the server, the encrypted credentials using an encryption key of the server; and
sending, by the server, the decrypted credentials to the endpoint device to authenticate the user at the endpoint device, to enable access to a remote application via the endpoint device;
wherein sending the credentials to the endpoint device comprises encrypting, by the server, the credentials using a key of the endpoint device.

2. The method of claim 1 , comprising:
receiving, by the server, a request from a computing device to register the mobile device; and
sending, by the server, a code to the computing device for registering the mobile device with the server.

3. The method of claim 2 , comprising:
causing the computing device to render the code as a quick response (QR) or scannable code, for the mobile device to scan.

4. The method of claim 1 , comprising:
sending, by the server, a prompt to the user to provide the credentials, responsive to the authentication of the user on the mobile device.

5. The method of claim 4 , comprising:
receiving, by the server, the credentials of the user from a computing device.

6. The method of claim 1 , comprising:
sending, by the server to the endpoint device, the credentials encrypted using the key of the endpoint device.

7. A method comprising:
registering, by a server, a mobile device to store credentials of a user, based on authentication of the user on the mobile device;
receiving, by the server, credentials of the user;
encrypting, by the server, the credentials using a key of the server;
sending, by the server, the encrypted credentials to the registered mobile device for storage thereon without the key;
receiving, by the server, the encrypted credentials responsive to the authentication of the user;
decrypting, by the server, the encrypted credentials to obtain the credentials, using the key of the server;
encrypting, by the server, the credentials using a key of an endpoint device; and
sending, by the server to the endpoint device, the credentials encrypted using the key of the endpoint device.

8. The method of claim 7 , comprising:
receiving, by the server, a request from a computing device to register the mobile device; and
sending, by the server, a code to the computing device for registering the mobile device with the server.

9. The method of claim 8 , comprising:
causing the computing device to render the code as a quick response (QR) or scannable code, for the mobile device to scan.

10. The method of claim 7 , comprising:
sending, by the server, a prompt to the user to provide the credentials, responsive to the authentication of the user on the mobile device.

11. The method of claim 10 , comprising:
receiving, by the server, the credentials of the user from a computing device.

12. The method of claim 7 , comprising:
receiving, by the server, a request from the endpoint device for the credentials; and
sending, by the server, a code to the endpoint device to initiate authentication of the user at the mobile device.

13. A method, comprising:
receiving, by a server, a request from an endpoint device for credentials of a user;
determining, by the server, a mobile device registered with the server for storing an encrypted version of the credentials;
sending, by the server, a code to the endpoint device to initiate authentication of the user at the mobile device, to initiate a transfer of the encrypted credentials from the mobile device to the server;
receiving, by the server from the mobile device, the encrypted version responsive to the authentication of the user;
obtaining, by the server, the credentials from the encrypted version, using an encryption key of the server; and
encrypting, by the server, the credentials using a key of the endpoint device.

14. The method of claim 13 , comprising:
sending, by the server to the endpoint device, the credentials encrypted using the key of the endpoint device.

Assignees

• Citrix Systems Inc

Inventors

• Pavlou Chris
• Wing Daniel G

Classifications

• H04L9/0897

  involving additional devices, e.g. trusted platform module [TPM], smartcard or USB · CPC title

• G06F21/45

  Structures or tools for the administration of authentication · CPC title

• G06K19/0723

  the record carrier comprising an arrangement for non-contact communication, e.g. wireless communication circuits on transponder cards, non-contact smart cards or RFIDs · CPC title

• G06F21/35

  communicating wirelessly · CPC title

• G06F21/6245 Primary

  Protecting personal data, e.g. for financial or medical purposes · CPC title