IP Library Granted Patent US 9,888,000
Granted Patent B2
US 9,888,000 · App. 15/483,989 · Granted Feb 6, 2018

Inter-application delegated authentication

Inventors: Jeffrey Seibert, Jr. (San Francisco, CA); Michael Ducker (San Francisco, CA)
Assignee: Twitter, Inc.
H04L63/0884G06F21/44H04L9/0819H04L9/3236H04L63/102
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 9,888,000
App. No.
15/483,989
Filed
Apr 10, 2017
Granted
Feb 6, 2018
Kind
B2
Art Unit
2434
USPC
726/7
Abstract

Disclosed is a system for delegating authentication of an untrusted application executing on a client device. For delegated authentication, an untrusted application relies on a trusted application executing in the same environment for authentication purposes. The delegated authentication process avoids requiring the user of the untrusted application to provide authentication credentials. The disclosed system for delegating authentication enables any trusted application executing in the same computing environment to authenticate the untrusted application.

Claims (69)

1. A method for authenticating an application executing on a client device, the method comprising:

receiving an authentication request from a first application executing on a client device;

identifying, at a server remote from the client device, a plurality of trusted applications executing on the client device to which authentication of the first application is delegable, the plurality of trusted applications being previously authenticated using a device profile, the device profile comprising information associated with the client device;

selecting a second application from the plurality of applications based on the device profile; and

authenticating the first application with the device profile associated with the client device based on the first application continuing authentication via the selected second application.

2. The method of claim 1 , wherein authenticating the first application comprises:

receiving a verification request from the selected second application for authenticating the first application; and

in response to receiving the verification request, transmitting an authentication token to the first application indicating that the first application is authenticated with the device profile associated with the client device.

3. The method of claim 1 , wherein the device profile information includes a combination of one or more attributes of the client device selected from a group consisting of a screen size, a screen resolution, a volume setting, a list of applications executing on the client device, and carrier information.

4. The method of claim 1 , wherein authenticating the first application includes transmitting a cryptographic nonce to the first application via the second application, and further comprising storing the cryptographic nonce as a most-recently transmitted nonce in association with the authentication request.

5. The method of claim 2 , wherein the verification request received from the selected second application includes a hashed value generated from a cryptographic nonce.

6. A non-transitory computer readable storage medium storing instructions for authenticating an application executing on a client device, the instructions when executed by a processor causes the processor to:

receive an authentication request from a first application executing on a client device;

identify, at a server remote to the client device, a plurality of trusted applications executing on the client device to which authentication of the first application is delegable, the plurality of trusted applications being previously authenticated using a device profile, the device profile comprising information associated with the client device;

select a second application from the plurality of trusted application based on the device profile; and

authenticate the first application with the device profile associated with the client device based on the first application continuing authentication via the selected second application.

7. The non-transitory computer readable storage medium of claim 6 , wherein authentication of the first application further causes the processor to:

receive a verification request from the selected second application for authenticating the first application; and

responsive to the receipt of the verification request, transmit an authentication token to the first application indicating that the first application is authenticated with the device profile associated with the client device.

8. The non-transitory computer readable storage medium of claim 6 , wherein the device profile information includes a combination of one or more attributes of the client device selected from a group consisting of a screen size, a screen resolution, a volume setting, a list of applications executing on the client device, and carrier information.

9. The non-transitory computer readable storage medium of claim 6 , wherein the authentication the first application further causes the processor to transmit a cryptographic nonce to the first application via the second application, and further causing the processor to store the cryptographic nonce as a most-recently transmitted nonce in association with the authentication request.

10. The non-transitory computer readable storage medium of claim 7 , wherein the verification request received from the selected second application includes a hashed value generated from a cryptographic nonce.

11. A method for authenticating an application executing on a client device, the method comprising:

receiving an authentication request from a first application executing on a first client device;

identifying, at a server remote from the client device, a second application executing on a second client device to which authentication of the first application on the first client device is delegable, the second application being previously authenticated with credentials associated with the second client device;

transmitting an instruction to the first application to continue authentication via the second application; and

authenticating the first application with the credentials associated with the second client device based on the first application on the first client device continuing authentication via the second application on the second client device; and

responsive to the authentication, sharing information between the first application and the second application based on the credentials associated with the second client device.

12. The method of claim 11 , wherein authenticating the first application comprises:

receiving, at the first client device, a verification request from the second application on the second client device for authenticating the first application; and

in response to receiving the verification request, transmitting, to the second client device, an authentication token to the first application on the first client device indicating that the first application is authenticated with the credentials associated with the first client device.

13. The method of claim 11 , wherein the authentication request includes a unique parameter, the unique parameter a combination of one or more attributes of the client device selected from a group consisting of a screen size, a screen resolution, a volume setting, a list of applications executing on the client device, and carrier information.

14. The method of claim 11 , wherein the instruction transmitted to the first application on the first client device includes a cryptographic nonce, and further comprising storing the cryptographic nonce on the first client device as a most-recently transmitted nonce in association with the authentication request.

15. The method of claim 12 , wherein the verification request received at the first client device from the second application includes a hashed value generated from a cryptographic nonce.

16. A non-transitory computer readable storage medium storing instructions for authenticating an application executing on a client device, the instructions when executed by a processor causes the processor to:

receive an authentication request from a first application executing on a first client device;

identify, at a server remote from the client device, a second application executing on a second client device to which authentication of the first application on the first client device is delegable, the second application being previously authenticated with credentials associated with the second client device;

transmit an instruction to the first application to continue authentication via the second application; and

authenticate the first application with the credentials associated with the second client device based on the first application on the first client device continuing authentication via the second application on the second client device; and

responsive to the authentication, share information between the first application and the second application based on the credentials associated with the second client device.

17. The non-transitory computer readable storage medium of claim 16 , wherein authentication of the first application further causes the processor to:

receive, at a first client device, a verification request from the second application on the second client device for authenticating the first application; and

responsive to the receipt of the verification request, transmit, to the second client device, an authentication token to the first application indicating that the first application is authenticated with the credentials associated with the first client device.

18. The non-transitory computer readable storage medium of claim 16 , wherein the authentication request includes a unique parameter, the unique parameter a combination of one or more attributes of the client device selected from a group consisting of a screen size, a screen resolution, a volume setting, a list of applications executing on the client device, and carrier information.

19. The non-transitory computer readable storage medium of claim 16 , wherein the instruction transmitted to the first application on the first client device includes a cryptographic nonce, and further causing the processor to store the cryptographic nonce on the first client device as a most-recently transmitted nonce in association with the authentication request.

20. The non-transitory computer readable storage medium of claim 17 , wherein the verification request received at the first client device from the second application includes a hashed value generated from a cryptographic nonce.

21. A system comprising a processor and a memory storing computer program instructions for authenticating an application on a client device, the instructions when executed by a processor causes the processor to:

receive an authentication request from a first application executing on a client device;

identify, at a server remote to the client device, a plurality of trusted applications executing on the client device to which authentication of the first application is delegable, the plurality of trusted applications being previously authenticated using a device profile, the device profile comprising information associated with the client device;

select a second application from the plurality of trusted application based on the device profile; and

authenticate the first application with the device profile associated with the client device based on the first application continuing authentication via the selected second application.

22. The system of claim 21 , wherein authentication of the first application further causes the processor to:

receive a verification request from the selected second application for authenticating the first application; and

responsive to the receipt of the verification request, transmit an authentication token to the first application indicating that the first application is authenticated with the device profile associated with the client device.

23. The system of claim 21 , wherein the device profile information includes a combination of one or more attributes of the client device selected from a group consisting of a screen size, a screen resolution, a volume setting, a list of applications executing on the client device, and carrier information.

24. The system of claim 21 , wherein the authentication the first application further causes the processor to transmit a cryptographic nonce to the first application via the second application, and further causing the processor to store the cryptographic nonce as a most-recently transmitted nonce in association with the authentication request.

25. The system of claim 22 , wherein the verification request received from the selected second application includes a hashed value generated from a cryptographic nonce.

26. A system comprising a processor and a memory storing computer program instructions for authenticating an application on a client device, the instructions when executed by a processor causes the processor to:

receive an authentication request from a first application executing on a first client device;

identify, at a server remote from the client device, a second application executing on a second client device to which authentication of the first application on the first client device is delegable, the second application being previously authenticated with credentials associated with the second client device;

transmit an instruction to the first application to continue authentication via the second application; and

authenticate the first application with the credentials associated with the second client device based on the first application on the first client device continuing authentication via the second application on the second client device; and

responsive to the authentication, share information between the first application and the second application based on the credentials associated with the second client device.

27. The system of claim 26 , wherein authentication of the first application further causes the processor to:

receive, at a first client device, a verification request from the second application on the second client device for authenticating the first application; and

responsive to the receipt of the verification request, transmit, to the second client device, an authentication token to the first application indicating that the first application is authenticated with the credentials associated with the first client device.

28. The system of claim 26 , wherein the authentication request includes a unique parameter, the unique parameter a combination of one or more attributes of the client device selected from a group consisting of a screen size, a screen resolution, a volume setting, a list of applications executing on the client device, and carrier information.

29. The system of claim 26 , wherein the instruction transmitted to the first application on the first client device includes a cryptographic nonce, and further causing the processor to store the cryptographic nonce on the first client device as a most-recently transmitted nonce in association with the authentication request.

30. The system of claim 27 , wherein the verification request received at the first client device from the second application includes a hashed value generated from a cryptographic nonce.

Assignments (7)
TERMINATION AND RELEASE OF SECURITY INTEREST IN PATENT RIGHTS (REEL 062079, FRAME 0677) Recorded Mar 3, 2026
From: MORGAN STANLEY SENIOR FUNDING, INC., AS COLLATERAL AGENT
To: X CORP. (F/K/A TWITTER, INC.)
Reel/Frame 075015/0574 →
RELEASE OF SECURITY INTEREST Recorded Apr 30, 2025
From: MORGAN STANLEY SENIOR FUNDING, INC., AS COLLATERAL AGENT
To: X CORP. (F/K/A TWITTER, INC.)
Reel/Frame 071127/0240 →
RELEASE OF SECURITY INTEREST Recorded Mar 27, 2025
From: MORGAN STANLEY SENIOR FUNDING, INC.
To: X CORP. (F/K/A TWITTER, INC.)
Reel/Frame 070670/0857 →
SECURITY INTEREST Recorded Oct 28, 2022
From: TWITTER, INC.
To: MORGAN STANLEY SENIOR FUNDING, INC.
Reel/Frame 062079/0677 →
SECURITY INTEREST Recorded Oct 28, 2022
From: TWITTER, INC.
To: MORGAN STANLEY SENIOR FUNDING, INC.
Reel/Frame 061804/0001 →
SECURITY INTEREST Recorded Oct 28, 2022
From: TWITTER, INC.
To: MORGAN STANLEY SENIOR FUNDING, INC.
Reel/Frame 061804/0086 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Apr 11, 2017
From: SEIBERT, JEFFREY, JR.; DUCKER, MICHAEL
To: TWITTER, INC.
Reel/Frame 041967/0041 →
Continuity (5)
Continuation 14699888 · Apr 29, 2015
Provisional Application 61986094 · Apr 29, 2014
Provisional Application 61986815 · Apr 30, 2014
Provisional Application 62067309 · Oct 22, 2014
Related Publication 20170223019A1 · Aug 3, 2017