# US 10,454,974 B2 · Systems and methods for flexible, extensible authentication subsystem that enabled enhance security for applications

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,454,974 B2
- Document ID: US10454974B2
- Status: Granted
- Kind: B2
- Application number: 14/753,636
- Filed: 2015-06-29
- Published: 2016-12-29
- Granted: 2019-10-22
- Earliest claimed: 2015-06-29
- Assignees: Citrix Systems, Inc.
- Applicants: Citrix Systems, Inc.
- Inventors: Dileep Reddem; Pratap Ranjan Tiwary; Arkesh Kumar; Naresh Babu Jampani
- Web page: https://patentgrep.com/patent/US10454974B2

## CPC

- H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)}
- G06F 21/31: User authentication
- H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity}
- G06F 2221/2133: Verifying human interaction, e.g., Captcha
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The present disclosure is directed towards systems and methods of authenticating a client. A device intermediary to clients servers that provide one or more resources can receive a request from a client to access a resource of the one or more resources. The device can select a login schema associated with the request that includes a definition of a login form. The login schema may correspond to an authentication protocol. The device can generate the login form responsive to the request. The login form can be constructed according to the definition provided by the selected login schema. The device can provide the login form for display via the client. The device can receive information inputted into the login form via the client. The device can establish access to the resource responsive to authentication of the client based on the information and the authentication protocol.

## Claims

### Claim 1

A method of generating a login form to authenticate a client, comprising:
receiving, by a device intermediary to a plurality of clients and a plurality of servers that provide one or more resources, a request from a client to access a resource of the one or more resources;
selecting, by the device, a login schema associated with the request from a repository storing a plurality of login schemas, the login schema comprising a definition of a login form using an authentication protocol, the login schema including one or more of an authentication schema or a dialog schema, wherein an authentication module executing on a server is configured to authenticate the client using at least one of the plurality of login schemas;
in response to the request, generating, by a virtual server executed by the device and configured to generate forms for each of the plurality of login schemas, the login form constructed for the client to access the resource according to the definition provided by the selected login schema and based on a combination of the one or more of the authentication schema or the dialog schema, wherein the virtual server is configured to interface with the authentication module executing on the server to authenticate the client using at least one of the plurality of login schemas;
providing, by the virtual server executed by the device, the login form for display via the client;
receiving, by the device, information inputted into the login form via the client; and
establishing, by the device responsive to authentication of the client based on the information and the authentication protocol, access to the resource by the client.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
generating, by the device, a login page comprising the login form; and
providing, by the device, the login page for display via the client.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
identifying, by the device, a server specified by the login schema configured to perform authentication;
transmitting, by the device, the information to the server based on the login schema;
receiving, by the device, authentication information generated by the server; and
using, by the device, the authentication information received from the server to authenticate the client.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
identifying, by the device, a policy of the login schema;
obtaining, by the device based on the policy, the authentication module from the server, the authentication module configured with at least one of a CAPTCHA or a token; and
configuring, by the device responsive to the request, the login form with the authentication module.

### Claim 5 (depends on 1)

The method of claim 1, wherein the login schema includes the authentication schema, the dialog schema, a username expression, a password expression, and an authentication strength.

### Claim 6 (depends on 1)

The method of claim 1, further comprising:
aggregating, by the device based on the login schema, a plurality of form fields associated with a plurality of heterogeneous authentication modules; and
configuring, by the device responsive to the request, the login form with the plurality of form fields.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
extracting, by the device, a field from the request comprising a plurality of fields; and
configuring, by the device, the login form based on the extracted field from the request.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
creating, by the device, a first cascade comprising a first authentication policy of a first login schema, and a second cascade comprising a second authentication policy of a second login schema;
generating, by the device, a first login form with the first authentication policy and a second login form with the second authentication policy;
generating, by the device, a first login field for the first login form using the first login schema and a second login field for the second login form using the second login schema;
providing, by the device, the first cascade with the first login field of the first login form for display on the client; and
providing, by the device based on input received responsive to the first cascade, the second cascade with the second login field of the second login form for display on the client.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
generating, by the device, a first prompt based on the first login schema; and
providing, by the device, the first prompt for display with the first login field of the first login form.

### Claim 10 (depends on 1)

The method of claim 1, further comprising:
creating, by the device based on the login schema, at least three cascades, wherein each of the at least three cascades includes a priority, an authentication policy, a login schema, and a next cascade identifier that identifies a next cascade to use responsive to authentication via a first cascade of the at least three cascades.

### Claim 11 (depends on 10)

The method of claim 10, further comprising:
using, by an authentication policy of the next cascade, information obtained from the first cascade.

### Claim 12 (depends on 1)

The method of claim 1, further comprising:
establishing, by the device, the virtual server configured to access the repository comprising the plurality of login schemas;
receiving, by the virtual server, a second request from a second client to access a second resource of the one or more resources;
selecting, by the virtual server, from the repository, a second login schema associated with the second request to authenticate the second client;
receiving, by the virtual server, a third request from a third client to access a third resource of the one or more resources; and
selecting, by the virtual server, from the repository, a third login schema associated with the third request to authenticate the third client.

### Claim 13

A system for generation of a login page to authenticate a client, comprising:
a device intermediary to a plurality of servers that provide one or more resources and a plurality of clients;
a repository storing a plurality of login schemas;
an interface of the device configured to receive a request from the client to access a resource of the one or more resources;
a form generator executed by a virtual server of the device and configured to generate forms for each of the plurality of login schemas stored in the repository, wherein an authentication module executing on a server is configured to authenticate the client using at least one of the plurality of login schemas, the form generator further configured to:
select a login schema associated with the request from the repository storing the plurality of login schemas, the login schema comprising a definition of a login form using an authentication protocol, the login schema including one or more of an authentication schema or a dialog schema, and
generate responsive to the request, the login page constructed for the client to access the resource according to the definition provided by the selected login schema and based on a combination of the one or more of the authentication schema or the dialog schema;
wherein the interface is configured to receive information inputted into the login form via the client and authenticate the client using the at least one of the plurality of login schemas via the authentication module executing on the server; and
the device is configured to establish, responsive to authentication of the client based on the information and the authentication protocol, access to the resource by the client.

### Claim 14 (depends on 13)

The system of claim 13, wherein the device is further configured to:
identify a server specified by the login schema configured to perform authentication;
transmit the information to the server based on the login schema;
receive authentication information generated by the server; and
use the authentication information received from the server to authenticate the client.

### Claim 15 (depends on 13)

The system of claim 13, wherein the device is further configured to:
identify a policy of the login schema;
retrieve, based on the policy, the authentication module from the server, the authentication module configured with at least one of a CAPTCHA or a token; and
configure, responsive to the request, the login form with the authentication module.

### Claim 16 (depends on 13)

The system of claim 13, wherein the device is further configured to:
aggregate, based on the login schema, a plurality of form fields associated with a plurality of different types of authentication modules; and
configure, responsive to the request, the login form with the plurality of form fields.

### Claim 17 (depends on 13)

The system of claim 13, wherein the device is further configured to:
extract a field from a plurality of fields in the request; and
configure the login form based on the extracted field from the request.

### Claim 18 (depends on 13)

The system of claim 13, wherein the device is further configured to:
create a first cascade comprising a first authentication policy of a first login schema, and a second cascade comprising a second authentication policy of a second login schema;
generate a first login form with the first authentication policy and a second login form with the second authentication policy;
generate a first login field for the first login form using the first login schema and a second login field for the second login form using the second login schema;
provide the first cascade with the first login field of the first login form for display on the client; and
provide, based on input received responsive to the first cascade, the second cascade with the second login field of the second login form for display on the client.

### Claim 19 (depends on 13)

The system of claim 13, wherein the device is further configured to:
create, based on the login schema, at least three cascades, wherein each of the at least three cascades includes a priority, an authentication policy, a login schema, and a next cascade identifier that identifies a next cascade to use responsive to authentication via a first cascade of the at least three cascades.

### Claim 20 (depends on 19)

The system of claim 19, wherein the device is further configured to:
determine that credential information received from the client fails to satisfy the authentication policy in the first cascade;
select, responsive to failure of the authentication policy in the first cascade, a second cascade of the at least three cascades identified by the next cascade identifier; and
authenticate the client with a second authentication policy of the second cascade.