IP Library › Granted Patent US 12,107,844

Granted Patent B2

US 12,107,844 · App. 17/652,191 · Granted Oct 1, 2024

Single sign on for a remote user session

Inventors: Anthony J. Wilkinson (Princess Risborough, GB); Per Olov Larsson (London, GB); Ashley Nuttall (Farnham, GB); Hans Christenson (Huddinge, SE); Tom Elliott (New York, NY); Steven Sigel (North Andover, MA); Adam Gross (Palo Alto, CA)

Assignee: Omnissa, LLC

H04L63/0815 G06F21/335 G06F21/34 G06F21/41 G06F21/445 H04L9/3226 H04L9/3234 H04L9/3263 H04L9/3273 H04L63/0428 H04L63/0823 H04L63/083 H04L63/0853 H04L63/10 G06F2009/45587 H04L63/0807 H04L63/0884 H04L2209/56

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 12,107,844
App. No.: 17/652,191
Granted: Oct 1, 2024
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

A user accesses a remote session, the connection to which is managed by a connection broker, according to a single sign-on (SSO) process. The SSO process includes the user entering his or her credentials and being authenticated to the connection broker. In addition to user authentication, the SSO process includes connection broker authentication to confirm that the connection broker is trustworthy. When the connection broker is authenticated, the user credentials are transmitted to the connection broker in a secure manner and the connection broker forwards them onto a machine hosting the remote session so that the user can be logged into the remote session without entering his or her credentials again.

Claims (48)

1. A method of authenticating a user to a remote desktop in a system having a connection broker that manages connections to the remote desktop, comprising:

responsive to receiving an input of credentials of the user at a client computing device, authenticating the user to the client computing device;

storing a secret component of the credentials of the user in an internal cache of the client computing device that can only be accessed by an endpoint system service running in the client computing device;

responsive to receiving an input at the client computing device to access the remote desktop using the credentials of the user, authenticating the connection broker to the client computing device; and

responsive to successful authentication of the connection broker to the client computing device, granting a service ticket containing a session key to the connection broker and transmitting an encrypted version of the secret component of the credentials of the user from the client computing device to the connection broker, wherein:

the connection broker, in response to receiving the encrypted version of the secret component of the credentials of the user from the client computing device, decrypts the encrypted version of the secret component of the credentials of the user using the session key and forwards the secret component of the credentials of the user to a virtual machine running the remote desktop; and

the virtual machine, in response to receiving the secret component of the credentials of the user from the connection broker, authenticates the user to the remote desktop using the secret component of the credentials of the user.

2. The method of claim 1 , wherein:

the credentials of the user comprise a user identification (ID) and a password and the password is the secret component; or

the credentials of the user comprise a certificate stored in a smart card and a personal identification number (PIN) to access the certificate and the PIN is the secret component.

3. The method of claim 1 , wherein authenticating the user to the client computing device comprises performing a first Kerberos authentication protocol between the client computing device and a domain controller that manages user accounts.

4. The method of claim 3 , wherein authenticating the connection broker to the client computing device comprises:

performing a second Kerberos authentication protocol between the endpoint system service running in the client computing device and the connection broker using an identifier of the connection broker registered with the domain controller,

wherein the service ticket granted to the connection broker is a Kerberos service ticket.

5. The method of claim 4 , wherein authenticating the connection broker to the client computing device further comprises:

verifying the identifier of the connection broker, wherein

verifying the identifier of the connection broker includes determining whether the connection broker is included in a list of entities supporting credential delegation.

6. The method of claim 1 , wherein:

at the connection broker, the secret component of the credentials of the user is re-encrypted; and

at the virtual machine, the re-encrypted secret component of the credentials of the user is decrypted by an endpoint system service running in the virtual machine.

7. A system comprising:

a connection broker that manages connections to a remote desktop; and

a client computing device including one or more processors and at least one memory, wherein

the one or more processors and the at least one memory are configured to cause the client computing device to carry out operations for authenticating a user to the remote desktop, said operations comprising:

responsive to receiving an input of credentials of the user, authenticating the user to the client computing device;

8. The system of claim 7 , wherein:

the credentials of the user comprise a user identification (ID) and a password and the password is the secret component; or

the credentials of the user comprise a certificate stored in a smart card and a personal identification number (PIN) to access the certificate and the PIN is the secret component.

9. The system of claim 7 , wherein the one or more processors and the at least one memory are configured to cause the system to perform a first Kerberos authentication protocol between the client computing device and a domain controller that manages user accounts to authenticate the user to the client computing device.

10. The system of claim 9 , wherein authenticating the connection broker to the client computing device comprises:

wherein the service ticket granted to the connection broker is a Kerberos service ticket.

11. A non-transitory computer-readable medium comprising instructions that, when executed by one or more processors of a client computing device, cause the client computing device to perform operations for authenticating a user to a remote desktop in a system having a connection broker that manages connections to the remote desktop, the operations comprising:

responsive to receiving an input of credentials of the user at a client computing device, authenticating the user to the client computing device;

12. The non-transitory computer-readable medium of claim 11 , wherein authenticating the user to the client computing device comprises performing a first Kerberos authentication protocol between the client computing device and a domain controller that manages user accounts.

13. The non-transitory computer-readable medium of claim 12 , wherein authenticating the connection broker to the client computing device comprises:

wherein the service ticket granted to the connection broker is a Kerberos service ticket.

Assignments (4)

PATENT ASSIGNMENT Recorded Aug 5, 2024

From: VMWARE LLC

To: OMNISSA, LLC

Reel/Frame 068327/0365 →

SECURITY INTEREST Recorded Jul 3, 2024

From: OMNISSA, LLC

To: UBS AG, STAMFORD BRANCH

Reel/Frame 068118/0004 →

CHANGE OF NAME Recorded Apr 15, 2024