Granted Patent B2

US 12,634,276 · App. 18/095,984 · Granted May 19, 2026

Inventors: Sukhesh Halemane (Santa Clara, CA); Mahantesh Pattanshetti (Pleasanton, CA); Suman Sharma (Saratoga, CA)

Assignee: Ping Identity Corporation

H04L63/083H04L63/0861

Abstract

Claims (36)

1 . A computer-implemented method of authenticating a client device with a provider without sending a password to or from the client device, the computer-implemented method comprising:

receiving an authentication request from the client device;

sending a challenge to a platform configuration register (PCR) bank from a plurality of PCR banks of a trusted platform module of the client device based on the authentication request, a first PCR bank from the plurality of PCR banks being associated with a Rivest-Shamir-Adleman (RSA) challenge from a plurality of challenges, and a second PCR bank from the plurality of PCR banks being associated with an elliptic-curve cryptography (ECC) challenge from the plurality of challenges;

receiving a response to the challenge;

identifying the provider corresponding to the authentication request; and

authenticating the client device with the provider based on the authentication request and the response to the challenge.

2 . The computer-implemented method of claim 1 , further comprising proxying communications between the client device and the provider.

3 . The computer-implemented method of claim 2 , wherein proxying communications between the client device and the provider comprises, receiving a domain name server (DNS) request from the client device corresponding to the provider.

4 . The computer-implemented method of claim 3 , wherein proxying communications between the client device and the provider comprises responding to the DNS request with an authenticating server address.

5 . The computer-implemented method of claim 1 , wherein;

the challenge includes the elliptic-curve cryptography (ECC) challenge; and

the PCR bank is the first PCR bank.

6 . The computer-implemented method of claim 1 , wherein sending the challenge to the PCR bank of the trusted platform module comprises sending, to the second PCR bank, an asymmetric cryptographic challenge generated using a public key.

7 . The computer-implemented method of claim 1 , wherein the authentication request comprises data derived from a user biometric marker.

8 . The computer-implemented method of claim 1 , wherein authenticating the client device with the provider repeats periodically.

9 . The computer-implemented method of claim 8 , wherein sending the challenge to the platform configuration register (PCR) bank of the trusted platform module of the client device repeats periodically.

10 . The computer-implemented method of claim 1 , wherein authenticating the client device with the provider comprises receiving a short-term credential.

11 . The computer-implemented method of claim 1 , wherein the challenge is a first challenge from the plurality of challenges, the computer-implemented method further comprising:

sending a second challenge from the plurality of challenges to the client device; and

receiving a response to the second challenge,

wherein authenticating the client device with the provider is based on the response to the second challenge.

12 . The computer-implemented method of claim 11 , wherein the second challenge comprises a proximity challenge that the client device is proximate a second client device.

13 . The computer-implemented method of claim 11 , wherein the second challenge comprises a biometric challenge.

14 . A non-transitory computer readable storage medium storing computer program instructions, the computer program instructions, when executed on a processor, implement a method of authenticating a client device including:

receiving an authentication request from the client device;

sending a challenge to a platform configuration register (PCR) bank from a plurality of PCR banks of a trusted platform module of the client device based on the authentication request, a first PCR bank from the plurality of PCR banks being associated with a Rivest-Shamir-Adleman (RSA) challenge from a plurality of challenges, and a second PCR bank from the plurality of PCR banks being associated with an elliptic-curve cryptography (ECC) challenge from the plurality of challenges;

receiving a response to the challenge;

identifying a provider corresponding to the authentication request; and

authenticating the client device with the provider based on the authentication request and the response.

15 . The non-transitory computer readable storage medium of claim 14 , wherein the sending the challenge to the PCR bank of the trusted platform module comprises sending a private key possession challenge to the second PCR bank.

16 . The non-transitory computer readable storage medium of claim 14 , wherein receiving the authentication request from the client device includes receiving the authentication request from routing trigger software on the client device.

17 . The non-transitory computer readable storage medium of claim 14 , wherein sending the challenge to the PCR bank of the trusted platform module of the client device repeats periodically at a frequency determined by a risk assessment module.

18 . The non-transitory computer readable storage medium of claim 14 , wherein the challenge is a first challenge from the plurality of challenges, the method further comprising:

sending a second challenge from the plurality of challenges to the client device; and

receiving a response to the second challenge,

wherein authenticating the client device with the provider is based on the response to the second challenge.

Assignments (3)

Continuity (2)

References Cited (321)