# US 10,122,703 B2 · Federated full domain logon > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,703 B2 - Document ID: US10122703B2 - Status: Granted - Kind: B2 - Application number: 14/870,447 - Filed: 2015-09-30 - Published: 2016-03-31 - Granted: 2018-11-06 - Earliest claimed: 2014-09-30 - Assignees: Citrix Systems, Inc. - Applicants: Citrix Systems, Inc. - Inventors: Andrew Innes; Chris Mayers - Web page: https://patentgrep.com/patent/US10122703B2 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - G06F 21/33: using certificates - H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and systems for faster and more efficient smart card logon and for giving a client device full domain access in a remote computing environment are described herein. Components used to implement fast smart card logon may also be used to implement a federated full domain logon. A virtual smart card credential, which may be ephemeral, may be issued based on the acceptance of an external authentication event. Example external authentication events include logon at a Security Assertion Markup Language (SAML) Identity Provider, smart card authentication over TLS or SSL, and alternative authentication credentials such as biometrics or one-time password (OTP) without AD password. Moreover, the certificate operation interception components from fast smart card logon may be used to enable interaction with the virtual smart card without fully emulating a smart card at the PC/SC API level. The virtual smart card may be created locally at the authentication server or on a separate server that may be highly protected. ## Claims ### Claim 1 A method comprising: storing a certificate at a credential mapper of a server device; corresponding, by the server device, a token to the certificate stored at the credential mapper; receiving, at the server device and from a client device, the token; determining, at the server device, whether the client device has authenticated with an identity providing device based on the token received from the client device; in response to determining that the client device has authenticated with the identity providing device based on the token, generating a temporary certificate based on the certificate stored at the credential mapper; after generating the temporary certificate based on the certificate stored at the credential mapper, sending, to the client device, the temporary certificate for granting the client device access to a domain; encrypting, using the temporary certificate, a reference to a credential managed by the credential mapper; and sending the encrypted reference to a virtualization agent managing one or more virtual resources. ### Claim 2 (depends on 1) The method of claim 1, wherein determining whether the client device has authenticated with the identity providing device comprises: sending, by the server device to the identity providing device, information from the token received from the client device; and receiving, from the identity providing device, confirmation that the client device has authenticated with the identity providing device. ### Claim 3 (depends on 1) The method of claim 1, wherein determining whether the client device has authenticated with the identity providing device comprises performing one or more of the following: determining, by the credential mapper of the server device, whether the token received from the client device corresponds to a token issued by the identity providing device; determining, by a gateway service of the server device, whether the token received from the client device corresponds to the token issued by the identity providing device; or determining, by an application store of the server device, whether the token received from the client device corresponds to the token issued by the identity providing device. ### Claim 4 (depends on 1) The method of claim 1, further comprising: linking the temporary certificate to a proof key at the client device, wherein the sending the temporary certificate comprises sending the temporary certificate in response to a determination that the client device has the proof key. ### Claim 5 (depends on 1) The method of claim 1, wherein the temporary certificate comprises a time-limited certificate. ### Claim 6 (depends on 1) The method of claim 1, wherein the credential managed by the credential mapper comprises a virtual smart card managed by the credential mapper, and wherein the temporary certificate comprises a smart card class certificate. ### Claim 7 An apparatus comprising: a processor; and memory storing computer-executable instructions that, when executed by the processor, cause the apparatus to: store a certificate at a credential mapper of the apparatus; correspond a token to the certificate stored at the credential mapper; receive, from a client device, the token; determine whether the client device has authenticated with an identity providing device based on the token received from the client device; in response to determining that the client device has authenticated with the identity providing device based on the token, generate a temporary certificate based on the certificate stored at the credential mapper; after generating the temporary certificate based on the certificate stored at the credential mapper, send, to the client device, the temporary certificate for granting the client device access to a domain; encrypt, using the temporary certificate, a reference to a credential managed by the credential mapper; and send the encrypted reference to a virtualization agent managing one or more virtual resources. ### Claim 8 (depends on 7) The apparatus of claim 7, wherein determining whether the client device has authenticated with the identity providing device comprises: send, to the identity providing device, information from the token received from the client device; and receive, from the identity providing device, confirmation that the client device has authenticated with the identity providing device. ### Claim 9 (depends on 7) The apparatus of claim 7, wherein determining whether the client device has authenticated with the identity providing device comprises performing one or more of the following: determining, by the credential mapper of the apparatus, whether the token received from the client device corresponds to a token issued by the identity providing device; determining, by a gateway service of the apparatus, whether the token received from the client device corresponds to the token issued by the identity providing device; or determining, by an application store of the apparatus, whether the token received from the client device corresponds to the token issued by the identity providing device. ### Claim 10 (depends on 7) The apparatus of claim 7, wherein the memory stores computer-executable instructions that, when executed by the processor, cause the apparatus to: link the temporary certificate to a proof key at the client device, wherein the sending the temporary certificate comprises sending the temporary certificate in response to a determination that the client device has the proof key. ### Claim 11 (depends on 7) The apparatus of claim 7, wherein the temporary certificate comprises a time-limited certificate. ### Claim 12 (depends on 7) The apparatus of claim 7, wherein the credential managed by the credential mapper comprises a virtual smart card managed by the credential mapper, and wherein the temporary certificate comprises a smart card class certificate. ### Claim 13 A method comprising: sending, by a client device and to an identity providing device, credentials for authenticating the client device with the identity providing device; receiving, at the client device and from the identity providing device, a token indicating that the client device is authenticated with the identity providing device; sending, by the client device and to a server device, the token; receiving, by the client device and from the server device, a temporary certificate for accessing a domain, wherein the temporary certificate is generated based on a certificate stored at a credential mapper of the server device; and in response to the client device receiving the temporary certificate for accessing the domain sending, by the client device and to a virtualization agent managing one or more virtual resources, the temporary certificate for accessing the domain. ### Claim 14 (depends on 13) The method of claim 13, wherein the server device uses the token to determine whether the client device is authenticated with the identity providing device. ### Claim 15 (depends on 13) The method of claim 13, wherein the token is linked to the certificate stored at the credential mapper of the server device. ### Claim 16 (depends on 13) The method of claim 13, wherein the temporary certificate comprises a time-limited certificate. ### Claim 17 (depends on 13) The method of claim 13, wherein the temporary certificate comprises a smart card class certificate. ### Claim 18 (depends on 1) The method of claim 1, wherein the token received at the server device and from the client device comprises a token modified by the identity providing device. ### Claim 19 (depends on 7) The apparatus of claim 7, wherein the token received from the client device comprises a token modified by the identity providing device. ### Claim 20 (depends on 13) The method of claim 13, wherein the token sent by the client device to the server device comprises a token modified by the identity providing device.