Granted Patent B1

US 11,171,964 · App. 17/132,172 · Granted Nov 9, 2021

Inventors: Feng Huang (Girton, GB); Ricardo Fernando Feijoo (Davie, FL); Tom Kludy (Cooper City, FL); John Gavin Ashman (Wareham, GB)

Assignee: Citrix Systems, Inc.

H04L63/102G06F21/45H04L9/30H04L63/0876

Abstract

Claims (79)

1. A method comprising:

receiving, by a server and from a user device, a device registration including:

authentication credentials,

first device information, for the user device, usable to identify a first plurality of applications executing on the user device at a first time, and

a public key;

generating, based on the first device information, a token;

sending, to the user device, the token;

receiving, from the user device, a request for content;

sending, to the user device, a nonce;

receiving, from the user device:

a second token, wherein the second token is a modified version of the token that indicates second device information, for the user device, usable to identify a second plurality of applications executing on the user device at a second time, wherein the second plurality of applications is different from the first plurality of applications; and

a signed version of the nonce, wherein the signed version of the nonce was signed using a private key corresponding to the public key; and

determining, based on comparing the token and the second token, based on determining whether a difference between the first plurality of applications and the second plurality of applications indicates an attempt at unauthorized access to the content, and based on processing the signed version of the nonce using the public key, to provide the user device access to the content.

2. The method of claim 1 , wherein generating the token comprises:

generating a fingerprint of the public key, wherein the token comprises an indication of the fingerprint.

3. The method of claim 1 , wherein comparing the token and the second token comprises:

determining the difference between the first plurality of applications and the second plurality of applications.

4. The method of claim 1 , wherein determining whether to provide the user device access to the content comprises a determination, based on the first device information, that the user device is of a device type permitted to access the content.

5. The method of claim 1 , wherein determining whether to provide the user device access to the content comprises:

determining that the signed version of the nonce was not signed using the private key; and

preventing the user device from accessing the content.

6. The method of claim 1 , further comprising:

generating, based on the authentication credentials and the first device information, a unique identifier.

7. The method of claim 6 , wherein determining whether to provide the user device access to the content comprises:

preventing the user device from accessing the content based on a determination that the unique identifier is not stored by a database.

8. The method of claim 1 , wherein the device registration is received via a first Uniform Resource Locator (URL), and wherein the request for content is associated with access, by the user device, of a second URL.

9. The method of claim 1 , further comprising:

storing, by the server, the public key for a period of time; and

deleting the public key after the period of time.

10. A method comprising:

generating, by a user device, a public key and a corresponding private key;

sending, to a server, a device registration comprising:

authentication credentials;

first device information, for the user device, usable to identify a first plurality of applications executing on the user device at a first time; and

the public key;

receiving, from the server, a token, wherein the token was generated based on:

the authentication credentials, and

the first device information;

sending, to the server, a request for content;

receiving, from the server, a nonce;

signing the nonce with the private key;

modifying the token to indicate second device information, for the user device, usable to identify a second plurality of applications executing on the user device at a second time, wherein the second plurality of applications is different from the first plurality of applications;

sending, to the server:

the modified token; and

the signed version of the nonce; and

receiving, in response to the modified token and the signed version of the nonce and based on a determination that a difference between the first plurality of applications and the second plurality of applications indicates an attempt at unauthorized access to the content, the content.

11. The method of claim 10 , wherein the token comprises a fingerprint of the public key.

12. The method of claim 11 , wherein the fingerprint comprises a portion of the public key.

13. The method of claim 10 , wherein the first device information further indicates an operating system of the user device.

14. The method of claim 10 , wherein the first device information further indicates one or more of:

a model of the user device, or

a manufacturer of the user device.

15. The method of claim 10 , wherein sending the device registration comprises sending the device registration via a first Uniform Resource Locator (URL), and wherein sending the request for content comprises accessing a second URL.

16. A method comprising:

receiving, by a server, from a user device, and via a first Uniform Resource Locator (URL), a device registration comprising:

authentication credentials;

first device information, for the user device, usable to identify a first plurality of applications executing on the user device at a first time; and

a public key;

generating, based on the authentication credentials and based on the first device information, a unique device identifier;

generating a fingerprint of the public key;

generating a token based on the authentication credentials, the unique device identifier, the first device information, and the fingerprint of the public key;

sending, to the user device and based on a determination, based on the first device information, that the user device is of a permitted device type, the token;

receiving, from the user device, a request for content at a second URL;

generating a random nonce;

sending, to the user device, the random nonce;

receiving, from the user device:

a second token, wherein the second token is a modified version of the token that indicates second device information, for the user device, usable to identify a second plurality of applications executing on the user device at a second time, wherein the second plurality of applications is different from the first plurality of applications; and

a signed version of the nonce, wherein the signed version of the nonce was signed using a private key corresponding to the public key; and

determining, based on comparing the token and the second token, based on determining whether a difference between the first plurality of applications and the second plurality of applications indicates an attempt at unauthorized access to the content, based on the unique device identifier, and based on processing the signed version of the nonce using the public key, to provide the user device access to the content.

17. The method of claim 16 , wherein determining whether to provide the user device access to the content comprises:

determining that the signed version of the nonce was not signed using the private key; and

preventing the user device from accessing the content.

18. The method of claim 16 , wherein determining whether to provide the user device access to the content comprises:

preventing the user device from accessing the content based on a determination that the unique device identifier is not stored by a database.

19. The method of claim 16 , further comprising:

storing, by the server, the public key for a period of time; and

deleting the public key after the period of time.

20. The method of claim 16 , wherein comparing the token and the second token comprises:

determining the difference between the first plurality of applications and the second plurality of applications.

Assignments (9)

Cited By (5)

US 12,200,122 US 12,408,221 US 12,423,392 US 12,567,981 US 12,701,116