# US 10,122,698 B2 · Passporting credentials between a mobile app and a web browser > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,698 B2 - Document ID: US10122698B2 - Status: Granted - Kind: B2 - Application number: 15/676,779 - Filed: 2017-08-14 - Published: 2018-02-22 - Granted: 2018-11-06 - Earliest claimed: 2011-06-17 - Assignees: Paypal, Inc. - Applicants: Paypal, Inc. - Inventors: Igor Yefimov; Scott Atwood - Web page: https://patentgrep.com/patent/US10122698B2 ## CPC - H04W 4/00: Services specially adapted for wireless communication networks; Facilities therefor - G06F 21/41: where a single sign-on provides access to a plurality of computers - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 67/00: Network arrangements or protocols for supporting network services or applications (user-to-user messaging H04L51/00; network arrangements, protocols or services for supporting real-time applications in data packet communications networks H04L65/00) - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding - H04W 12/06: Authentication - H04W 12/062: Pre-authentication - H04L 67/04: specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods for passporting credentials provide a mechanism by which a native app on a client device can invoke a service provider's core web site web addresses (URL) while keeping the existing session active and shared between the two experiences (native app and web flow) so that the end user does not need to re-login at each context switch. The mechanism can include a unique way for the web flow context to communicate conditions and pass control back to the native app context of the shared session. ## Claims ### Claim 1 A system, comprising: a non-transitory memory; and one or more hardware processors coupled to the non-transitory memory and configured to read instructions from the non-transitory memory to cause the system to perform operations comprising: in response to receiving authentication credentials associated with a user via a user interface (UI) of a native application, transmitting the authentication credentials to a server to request for a session token; in response to receiving the session token from the server, initiating a device session between the native application and the server based on the session token; launching an embedded web browser to provide a web UI within the native application by providing the session token and a web address to the embedded web browser; transmitting the session token and the web address from the embedded web browser to the server to automatically authenticate the user in a web session between the embedded web browser and the server without requiring the authentication credentials, wherein the session token authorizes the server to share at least a portion of session data associated with the device session with the web session; in response to intercepting a first communication between the embedded web browser and the server, resuming the device session based on the session token; and displaying the UI of the native application for the resumed device session. ### Claim 2 (depends on 1) The system of claim 1, wherein the first communication comprises a first uniform resource locator (URL) request. ### Claim 3 (depends on 1) The system of claim 1, wherein the session token and the web address is transmitted from the embedded web browser to a Common Gateway Interface (CGI) of the server. ### Claim 4 (depends on 1) The system of claim 1, wherein the operations further comprise in response to intercepting a second communication between the embedded web browser and the server, refreshing the device session token. ### Claim 5 (depends on 4) The system of claim 4, wherein refreshing the device session token comprises transmitting an application programming interface (API) call from the native application to the server. ### Claim 6 (depends on 2) The system of claim 2, wherein the operations further comprise in response to intercepting a second communication between the embedded web browser and the server, refreshing the device session token, wherein the second communication comprises a second URL request. ### Claim 7 (depends on 4) The system of claim 4, wherein refreshing the device session token is based on a determination that the second communication is intercepted within a token expiration time of the session token. ### Claim 8 (depends on 1) The system of claim 1, wherein the embedded web browser receives a web flow authorization token from the server based on the user being authenticated in the web session, wherein the server shares at least the portion of the session data with the embedded web browser based on the web flow authorization token. ### Claim 9 (depends on 1) The system of claim 1, wherein the authentication credentials comprise login information of the user. ### Claim 10 (depends on 1) The system of claim 1, wherein the operations further comprise: receiving a user input via the UI of the native application during the device session; transmitting an application programming interface (API) call and the session token from the native application to the server, wherein the API call is authenticated based on the session token; and refreshing the session token based on transmitting the API call. ### Claim 11 (depends on 1) The system of claim 1, wherein the operations further comprise closing the embedded web browser in response to intercepting the first communication. ### Claim 12 A method, comprising: in response to receiving authentication credentials associated with a user via a user interface (UI) of a native application, transmitting, by one or more hardware processors, the authentication credentials to a server to request for a session token; in response to receiving the session token from the server, initiating, by the one or more hardware processors, a device session between the native application and the server based on the session token; launching, by the one or more hardware processors, an embedded web browser to provide a web UI within the native application by providing the session token and a web address to the embedded web browser; transmitting, by the one or more hardware processors, the session token and the web address from the embedded web browser to the server to automatically authenticate the user in a web session between the embedded web browser and the server without requiring the authentication credentials, wherein the session token authorizes the server to share at least a portion of session data associated with the device session with the web session; in response to intercepting a first communication between the embedded web browser and the server, resuming, by the one or more hardware processors, the device session based on the session token; and displaying, by the one or more hardware processors, the UI of the native application for the resumed device session. ### Claim 13 (depends on 12) The method of claim 12, wherein the first communication comprises a first uniform resource locator (URL) request. ### Claim 14 (depends on 12) The method of claim 12, further comprising in response to intercepting a second communication between the embedded web browser and the server, refreshing the device session token. ### Claim 15 (depends on 14) The method of claim 14, wherein refreshing the device session token comprises transmitting an application programming interface (API) call from the native application to the server. ### Claim 16 (depends on 13) The method of claim 13, further comprising in response to intercepting a second communication between the embedded web browser and the server, refreshing the device session token, wherein the second communication comprises a second URL request. ### Claim 17 (depends on 14) The method of claim 14, wherein refreshing the device session token is based on a determination that the second communication is intercepted within a token expiration time of the session token. ### Claim 18 (depends on 12) The method of claim 12, further comprising: receiving a user input via the UI of the native application during the device session; transmitting an application programming interface (API) call and the session token from the native application to the server, wherein the API call is authenticated based on the session token; and refreshing the session token based on transmitting the API call. ### Claim 19 A non-transitory machine readable medium having stored thereon machine-readable instructions executable to cause a machine to perform operations comprising: in response to receiving authentication credentials associated with a user via a user interface (UI) of a native application, transmitting the authentication credentials to a server to request for a session token; in response to receiving the session token from the server, initiating a device session between the native application and the server based on the session token; launching an embedded web browser to provide a web UI within the native application by providing the session token and a web address to the embedded web browser; transmitting the session token and the web address from the embedded web browser to the server to automatically authenticate the user in a web session between the embedded web browser and the server without requiring the authentication credentials, wherein the session token authorizes the server to share at least a portion of session data associated with the device session with the web session; in response to intercepting a first communication between the embedded web browser and the server, resuming the device session based on the session token; and displaying the UI of the native application for the resumed device session. ### Claim 20 (depends on 19) The non-transitory machine readable medium of claim 19, wherein the operations further comprise in response to intercepting a second communication between the embedded web browser and the server, refreshing the device session token.