# US 10,454,929 B2 · Authenticating for an enterprise service > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,929 B2 - Document ID: US10454929B2 - Status: Granted - Kind: B2 - Application number: 15/382,020 - Filed: 2016-12-16 - Published: 2018-06-21 - Granted: 2019-10-22 - Earliest claimed: 2016-12-16 - Assignees: BlackBerry Limited - Applicants: BlackBerry Limited - Inventors: Mendel Elliot Spencer; Manvinder Singh; Balaaji Tirouvengadam; Ying Li; Balasubrahmanyam Gattu - Web page: https://patentgrep.com/patent/US10454929B2 ## CPC - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 63/123: {received data contents, e.g. message integrity} - H04L 63/126: {the source of the received data} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L 63/0892: {by using authentication-authorization-accounting [AAA] servers or protocols} - H04L 2463/082: applying multi-factor authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and software can be used to provide authentication for an enterprise service. In some aspects, an identity server receives an authentication request. An on-premises verification command is transmitted. The on-premises verification command indicates an on-premises agent that verifies on-premises network connectivity. In response to the on-premises verification command, an on-premises verification response message is received. An authentication response is transmitted based on the received on-premises verification response message. ## Claims ### Claim 1 A method, comprising: receiving, at an identity server, from a client device, an authentication request; in response to receiving the authentication request, transmitting, from the identity server to the client device over a network, an on-premises verification command, wherein the on-premises verification command indicates an on-premises agent that verifies whether the client device has on-premises network connectivity; determining, by the identity server, whether an authentication succeeds or fails based on whether an on-premises verification response message is received from the client device in response to the on-premises verification command, wherein the on-premises verification response message indicates whether the client device has on-premises network connectivity; and transmitting, by the identity server, an authentication response, wherein the authentication response indicates whether the authentication succeeds or fails based on whether the on-premises verification response message is received from the client device in response to the on-premises verification command. ### Claim 2 (depends on 1) The method of claim 1, wherein the on-premises verification command comprises a script that, when executed, causes a browser to transmit an on-premises verification request to the on-premises agent. ### Claim 3 (depends on 2) The method of claim 2, wherein the on-premises verification request is signed using a key associated with the on-premises agent. ### Claim 4 (depends on 1) The method of claim 1, wherein the on-premises verification command is transmitted according to a Hypertext Transfer Protocol secure (HTTPS) protocol. ### Claim 5 (depends on 1) The method of claim 1, further comprising: sending a redirect command, wherein the redirect command includes a one-time-token; receiving a redirected request; verifying the redirected request based on the one-time-token; and wherein the on-premises verification command is transmitted according to a Hypertext Transfer Protocol (HTTP) protocol. ### Claim 6 (depends on 1) The method of claim 1, further comprising: receiving the on-premises verification response message; determining that the on-premises verification response message comprises a valid on-premises verification reply; and in response to determining that the on-premises verification response message comprises the valid on-premises verification reply, constructing the authentication response to indicate that the authentication succeeds. ### Claim 7 (depends on 6) The method of claim 6, wherein determining that the on-premises verification response message comprises the valid on-premises verification reply comprises verifying that the on-premises verification response message includes a signature signed by the on-premises agent. ### Claim 8 (depends on 1) The method of claim 1, further comprising: determining that the on-premises verification response message has not been received within a configured time period or that the on-premises verification response message does not comprise a valid on-premises verification reply; determining, based on a security policy associated with the on-premises agent, that an additional authentication credential is configured to be requested; and requesting the additional authentication credential based upon the determining that the additional authentication credential is configured to be requested. ### Claim 9 (depends on 1) The method of claim 1, further comprising: determining that the on-premises verification response message has not been received within a configured time period or that the on-premises verification response message does not comprise a valid on-premises verification reply; determining, based on a security policy associated with the on-premises agent, that an additional authentication credential is not configured to be requested; and constructing the authentication response to indicate that the authentication fails based upon the determining that the additional authentication credential is not configured to be requested. ### Claim 10 (depends on 1) The method of claim 1, wherein the on-premises agent operates inside of an enterprise network, and the identity server operates outside of the enterprise network. ### Claim 11 An identity server, comprising: at least one hardware processor; and a non-transitory computer-readable storage medium coupled to the at least one hardware processor and storing programming instructions, wherein the programming instructions, when executed, instruct the at least one hardware processor to: receive, at the identity server, from a client device, an authentication request; in response to receiving the authentication request, transmit, from the identity server to the client device over a network, an on-premises verification command, wherein the on-premises verification command indicates an on-premises agent that verifies whether the client device has on-premises network connectivity; determine, by the identity server, whether an authentication succeeds or fails based on whether an on-premises verification response message is received from the client device in response to the on-premises verification command, wherein the on-premises verification response message indicates whether the client device has on-premises network connectivity; and transmit, by the identity server, an authentication response, wherein the authentication response indicates whether the authentication succeeds or fails based on whether the on-premises verification response message is received from the client device in response to the on-premises verification command. ### Claim 12 (depends on 11) The identity server of claim 11, wherein the on-premises verification command comprises a script that, when executed, causes a browser to transmit an on-premises verification request to the on-premises agent. ### Claim 13 (depends on 12) The identity server of claim 12, wherein the on-premises verification request is signed using a key associated with the on-premises agent. ### Claim 14 (depends on 11) The identity server of claim 11, wherein the on-premises verification command is transmitted according to a Hypertext Transfer Protocol secure (HTTPS) protocol. ### Claim 15 (depends on 11) The identity server of claim 11, wherein the programming instructions instruct the at least one hardware processor to: send a redirect command, wherein the redirect command includes a one-time-token; receive a redirected request; verify the redirected request based on the one-time-token; and wherein the on-premises verification command is transmitted according to a Hypertext Transfer Protocol (HTTP) protocol. ### Claim 16 (depends on 11) The identity server of claim 11, wherein the programming instructions instruct the at least one hardware processor to: receive the on-premises verification response message; determine that the on-premises verification response message comprises a valid on-premises verification reply; and in response to determining that the on-premises verification response message comprises the valid on-premises verification reply, construct the authentication response to indicate that the authentication succeeds. ### Claim 17 (depends on 16) The identity server of claim 16, wherein determining that the on-premises verification response message comprises the valid on-premises verification reply comprises verifying that the on-premises verification response message includes a signature signed by the on-premises agent. ### Claim 18 (depends on 11) The identity server of claim 11, wherein the programming instructions instruct the at least one hardware processor to: determine that the on-premises verification response message has not been received within a configured time period or that the on-premises verification response message does not comprise a valid on-premises verification reply; determine, based on a security policy associated with the on-premises agent, that an additional authentication credential is configured to be requested; and request the additional authentication credential based upon the determining that the additional authentication credential is configured to be requested. ### Claim 19 (depends on 11) The identity server of claim 11, wherein the programming instructions instruct the at least one hardware processor to: determine that the on-premises verification response message has not been received within a configured time period or that the on-premises verification response message does not comprise a valid on-premises verification reply; determine, based on a security policy associated with the on-premises agent, that an additional authentication credential is not configured to be requested; and construct the authentication response to indicate that the authentication fails based upon the determining that the additional authentication credential is not configured to be requested. ### Claim 20 A non-transitory computer-readable medium containing instructions which, when executed, cause a computing device to perform operations comprising: receiving, at an identity server, from a client device, an authentication request; in response to receiving the authentication request, transmitting, from the identity server to the client device over a network, an on-premises verification command, wherein the on-premises verification command indicates an on-premises agent that verifies whether the client device has on-premises network connectivity; determining, by the identity server, whether an authentication succeeds or fails based on whether an on-premises verification response message is received from the client device in response to the on-premises verification command, wherein the on-premises verification response message indicates whether the client device has on-premises network connectivity; and transmitting, by the identity server, an authentication response, wherein the authentication response indicates whether the authentication succeeds or fails based on whether the on-premises verification response message is received from the client device in response to the on-premises verification command.