Granted Patent B2

US 12,615,137 · App. 18/900,144 · Granted Apr 28, 2026

Inventors: Jordan Melberg (Folsom, CA); Arpit Gupta (Newcastle, WA); Nicolas Backal Stavchansky (San Francisco, CA); Natan Becker Bessudo (San Francisco, CA); Kevin Huang (Alameda, CA); Vivek Raman (Orinda, CA)

H04L9/0825H04L9/14

Abstract

Claims (61)

1 . A method, comprising:

performing a sign-in or registration process to register a user with an application of an identity management system, wherein the sign-in or registration process comprises receiving an indication of at least one credential associated with an identity of the user;

performing a vault enrollment process to configure a secure vault for the user of the application, wherein the vault enrollment process comprises:

generating a cryptographically random identifier;

combining the cryptographically random identifier with one or more attributes of the user to generate a Recovery Key;

using a client-side encryption function to derive a symmetric key from the Recovery Key;

generating a cryptographically random asymmetric keypair that includes a private key and a public key;

encrypting the private key of the cryptographically random asymmetric keypair with the symmetric key derived from the Recovery Key;

storing one or more of the Recovery Key, a vault key, the symmetric key, the private key, and the public key on a first client device of the user; and

uploading, to the identity management system, data associated with the secure vault configured for the user of the application;

performing a device pairing operation to transfer the Recovery Key from the first client device to a second client device of the user, wherein the second client device is operable to use the Recovery Key to generate the symmetric key, the private key, the public key, or a combination thereof; and

using one or more of the symmetric key, the private key, or the public key to access the application of the identity management system via the second client device of the user.

2 . The method of claim 1 , wherein the sign-in or registration process comprises:

receiving, via the first client device or the second client device, a user input comprising the at least one credential of the user and a one-time password (OTP) provided by the identity management system.

3 . The method of claim 2 , wherein the OTP comprises a 6-digit email verification code.

4 . The method of claim 1 , wherein the first client device comprises a mobile client and the second client device comprises a web client.

5 . The method of claim 1 , wherein the first client device comprises a web client and the second client device comprises a mobile client.

6 . The method of claim 1 , further comprising:

installing the application or a browser extension associated with the application on the first client device or the second client device, wherein at least one step of the vault enrollment process is performed using the application or the browser extension.

7 . The method of claim 1 , wherein the Recovery Key is transferred from the first client device to the second client device via a quick response (QR) code, a user input, or a secure communication link between the first client device and the second client device.

8 . An apparatus, comprising:

one or more memories storing processor-executable code; and

one or more processors coupled with the one or more memories and individually or collectively operable to execute the code to cause the apparatus to:

perform a sign-in or registration process to register a user with an application of an identity management system, wherein the sign-in or registration process comprises receiving an indication of at least one credential associated with an identity of the user;

perform a vault enrollment process to configure a secure vault for the user of the application, wherein the vault enrollment process comprises:

generating a cryptographically random identifier;

combining the cryptographically random identifier with one or more attributes of the user to generate a Recovery Key;

using a client-side encryption function to derive a symmetric key from the Recovery Key;

generating a cryptographically random asymmetric keypair that includes a private key and a public key;

encrypting the private key of the cryptographically random asymmetric keypair with the symmetric key derived from the Recovery Key;

storing one or more of the Recovery Key, a vault key, the symmetric key, the private key, and the public key on a first client device of the user; and

uploading, to the identity management system, data associated with the secure vault configured for the user of the application;

perform a device pairing operation to transfer the Recovery Key from the first client device to a second client device of the user, wherein the second client device is operable to use the Recovery Key to generate the symmetric key, the private key, the public key, or a combination thereof; and

use one or more of the symmetric key, the private key, or the public key to access the application of the identity management system via the second client device of the user.

9 . The apparatus of claim 8 , wherein the sign-in or registration process comprises:

receiving, via the first client device or the second client device, a user input comprising the at least one credential of the user and a one-time password (OTP) provided by the identity management system.

10 . The apparatus of claim 9 , wherein the OTP comprises a 6-digit email verification code.

11 . The apparatus of claim 8 , wherein the first client device comprises a mobile client and the second client device comprises a web client.

12 . The apparatus of claim 8 , wherein the first client device comprises a web client and the second client device comprises a mobile client.

13 . The apparatus of claim 8 , wherein the one or more processors are individually or collectively further operable to execute the code to cause the apparatus to:

install the application or a browser extension associated with the application on the first client device or the second client device, wherein at least one step of the vault enrollment process is performed using the application or the browser extension.

14 . The apparatus of claim 8 , wherein the Recovery Key is transferred from the first client device to the second client device via a quick response (QR) code, a user input, or a secure communication link between the first client device and the second client device.

15 . A non-transitory computer-readable medium storing code that comprises instructions executable by one or more processors to:

perform a sign-in or registration process to register a user with an application of an identity management system, wherein the sign-in or registration process comprises receiving an indication of at least one credential associated with an identity of the user;

perform a vault enrollment process to configure a secure vault for the user of the application, wherein the vault enrollment process comprises:

generating a cryptographically random identifier;

combining the cryptographically random identifier with one or more attributes of the user to generate a Recovery Key;

using a client-side encryption function to derive a symmetric key from the Recovery Key;

generating a cryptographically random asymmetric keypair that includes a private key and a public key;

encrypting the private key of the cryptographically random asymmetric keypair with the symmetric key derived from the Recovery Key;

storing one or more of the Recovery Key, a vault key, the symmetric key, the private key, and the public key on a first client device of the user; and

uploading, to the identity management system, data associated with the secure vault configured for the user of the application;

perform a device pairing operation to transfer the Recovery Key from the first client device to a second client device of the user, wherein the second client device is operable to use the Recovery Key to generate the symmetric key, the private key, the public key, or a combination thereof; and

use one or more of the Recovery Key, the symmetric key, the private key, or the public key to access the application of the identity management system via the second client device of the user.

16 . The non-transitory computer-readable medium of claim 15 , wherein the instructions to sign-in or registration process are executable by the one or more processors to:

receive, via the first client device or the second client device, a user input comprising the at least one credential of the user and a one-time password (OTP) provided by the identity management system.

17 . The non-transitory computer-readable medium of claim 16 , wherein the OTP comprises a 6-digit email verification code.

18 . The non-transitory computer-readable medium of claim 15 , wherein the first client device comprises a mobile client and the second client device comprises a web client.

19 . The non-transitory computer-readable medium of claim 15 , wherein the first client device comprises a web client and the second client device comprises a mobile client.

20 . The non-transitory computer-readable medium of claim 15 , wherein the instructions are further executable by the one or more processors to:

install the application or a browser extension associated with the application on the first client device or the second client device, wherein at least one step of the vault enrollment process is performed using the application or the browser extension.

Assignments (1)

Continuity (2)

References Cited (101)