# US 10,484,383 B2 · Pre-authorizing a client application to access a user account on a content management system

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,484,383 B2
- Document ID: US10484383B2
- Status: Granted
- Kind: B2
- Application number: 15/979,441
- Filed: 2018-05-14
- Published: 2018-09-13
- Granted: 2019-11-19
- Earliest claimed: 2013-12-19
- Assignees: Dropbox, Inc.
- Applicants: Dropbox, Inc.
- Inventors: Huy Nguyen; Josh Kaplan; Viraj Mody; Ritu Vincent; Andrew Bortz; David Euresti
- Web page: https://patentgrep.com/patent/US10484383B2

## CPC

- H04L 63/10: {for controlling access to devices or network resources}
- G06F 8/61: Installation
- G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets}
- G06F 21/41: where a single sign-on provides access to a plurality of computers
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/102: {Entity profiles}
- H04L 63/108: {when the policy decisions are valid for a limited amount of time}
- H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)}
- G06F 2221/2117: User registration
- G06F 2221/2137: Time limited access, e.g. to a computer or data
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A content management system can tag a client installer with an information tag linking the client installer to a user account. The client installer can be configured to install the client-side application on the client device and pass the identification tag to the installed client-side application. The client-side application can transmit the identification tag to the content management system, which can use the identification tag to identify the linked user account and log the client-side application into the user account. The content management system can implement several verification measures such as limiting the number of times and when an identification tag can be used, as well as IP addresses that can use the identification tag. The content management system can also use data cached by the web-browser application to determine if the web-browser application was used to access the user account in the past.

## Claims

### Claim 1

A method comprising:
while a client device is authorized to access a user account on a content management system, transmitting, by the client device, an installation request to install a client-side application on the client device;
receiving a client installer tagged with an identification tag and an identifier identifying the client device from which the installation request originated, wherein the client installer is configured to:
install the client-side application on the client device;
generate an authentication key; and
upon the client-side application being successfully installed on the client device, the client device transmitting an authorization message to the content management system, the authorization message including:
data associated with a first application cached on the client device;
the identification tag; and
the authentication key; and
receiving from the content management system, a confirmation that the content management system has authorized the client-side application to access the user account on the content management system based on the transmitted authorization message.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
prior to transmitting the installation request by the client device, receiving, from the first application running on the client device, login credentials associated with an authenticated user account;
based on the login credentials:
receiving authentication of the user account associated with the login credentials to yield the authenticated user account; and
logging the first application into the content management system via the authenticated user account;
receiving verification that the first application associated with the installation request is logged in via the authenticated user account; and
upon receiving verification that the first application associated with the installation request is logged in via the authenticated user account, transmitting the installation request associated with the authenticated user account to the content management system.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
receiving an entry, the entry including:
the identification tag,
a creation time of the identification tag,
an account identifier identifying an authenticated user account, and
an IP address.

### Claim 4 (depends on 2)

The method of claim 2, wherein the first application comprises a web-browser application and a second application comprises the client-side application, the method further comprising:
installing the client-side application on the client device prior to an expiration of a predetermined period of time associated with the identification tag;
in response to the client-side application being installed on the client device, causing the web-browser application to transmit the authentication key to the content management system;
receiving the authorization message and authentication key; and
in response to the authentication key matching a respective authentication key associated with the identification tag, logging the client-side application on to the content management system via the authenticated user account.

### Claim 5 (depends on 4)

The method of claim 4, further comprising:
receiving a determination regarding a number of times the identification tag has been previously used to pre-authorize the second application, to yield a previous-usage determination; and
based on the previous-usage determination, using a pre-authorization to authorize the second application.

### Claim 6 (depends on 5)

The method of claim 5, further comprising:
transmitting a pre-authorization request including an IP address to the content management system; and
receive, from the content management system, an indication that the IP address matches an authorized IP address.

### Claim 7 (depends on 2)

The method of claim 2, further comprising:
transmitting, to the content management system, login credentials by a web-browser application;
receiving a determination that the login credentials are associated with the user account; and
authorizing the web-browser application to access the user account.

### Claim 8

A client device associated with a content management system comprising:
one or more processors; and
at least one memory containing instructions that, when executed by the one or more processors, cause the client device to:
transmit, from a first application on the client device, an installation request to install a second application on the client device;
receive a client installer tagged with an identification tag and an identifier identifying the client device from which the installation request originated, wherein the client installer is configured to:
install the second application on the client device,
generate an authentication key, and
upon the second application being successfully installed on the client device, the client device transmitting an authorization message to the content management system, the authorization message including:
data associated with the first application cached on the client device,
the identification tag, and
the authentication key;
receive from the content management system, a confirmation that the content management system has authorized the second application to access a user account on the content management system based on the transmitted authorization message.

### Claim 9 (depends on 8)

The client device of claim 8, the at least one memory containing instructions which, when executed by the one or more processors, cause the client device to:
receive, from the first application running on the client device prior to transmitting the installation request from the first application, login credentials associated with an authenticated user account;
based on the login credentials:
receive authentication of the user account associated with the login credentials to yield the authenticated user account; and
log the first application into the content management system via the authenticated user account;
receive verification that the first application associated with the installation request is logged in via the authenticated user account; and
upon receiving verification that the first application associated with the installation request is logged in via the authenticated user account, transmit the installation request associated with the authenticated user account to the content management system.

### Claim 10 (depends on 9)

The client device of claim 9, the at least one memory containing instructions which, when executed by the one or more processors, further cause the client device to:
receive an entry in a pre-authorization index, the entry including:
the identification tag,
an account identifier identifying the authenticated user account,
a creation time for the identification tag, and
an IP address.

### Claim 11 (depends on 9)

The client device of claim 9, wherein the first application comprises a web-browser application and the second application comprises a client-side application, the at least one memory containing additional instructions which, when executed by the one or more processors, further cause the client device to:
install the client-side application on the client device prior to an expiration of a predetermined period of time associated with the identification tag;
in response to the client-side application being installed on the client device, cause the web-browser application to transmit the authentication key to the content management system;
receive the authorization message; and
in response to authorization message matching a respective authentication key associated with the identification tag, log the client-side application on to the content management system via the authenticated user account.

### Claim 12 (depends on 9)

The client device of claim 9, the at least one memory containing instructions which, when executed by the one or more processors, further cause the client device to:
transmit a pre-authorization request including an IP address to the content management system; and
receive, from the content management system, an indication that the IP address matches an authorized IP address.

### Claim 13 (depends on 9)

The client device of claim 9, the at least one memory containing instructions which, when executed by the one or more processors, further cause the client device to:
receive a determination regarding a number of times the identification tag has been previously used to pre-authorize the second application, to yield a previous-usage determination; and
based on the previous-usage determination, use a pre-authorization to authorize the second application.

### Claim 14

A non-transitory computer-readable medium comprising instructions that, when executed by one or more processors, cause the one or more processors to:
transmit from a first application on a client device, an installation request to install a second application on the client device;
receive a client installer tagged with an identification tag and an identifier identifying the client device from which the installation request originated, wherein the client installer is configured to:
install the second application on the client device,
generate an authentication key, and
upon the second application being successfully installed on the client device, the client device transmitting an authorization message to a content management system, the authorization message including:
data associated with the first application cached on the client device,
the identification tag, and
the authentication key; and
receive from the content management system, a confirmation that the content management system has authorized the second application to access a user account on the content management system based on the transmitted authorization message.

### Claim 15 (depends on 14)

The non-transitory computer-readable medium of claim 14, storing instructions which, when executed by the one or more processors, further cause the one or more processors to:
receive, from the first application running on the client device prior to transmitting the installation request from the first application, login credentials associated with an authenticated user account;
based on the login credentials:
receive authentication of the user account associated with the login credentials to yield the authenticated user account; and
log the first application into the content management system via the authenticated user account;
receive verification that the first application associated with the installation request is logged in via the authenticated user account; and
upon receiving verification that the first application associated with the installation request is logged in via the authenticated user account, transmit the installation request associated with the authenticated user account to the content management system.

### Claim 16 (depends on 15)

The non-transitory computer-readable medium of claim 15, storing instructions which, when executed by the one or more processors, further cause the one or more processors to:
receive an entry in a pre-authorization index, the entry including:
the identification tag,
an account identifier identifying the authenticated user account,
a creation time for the identification tag, and
an IP address.

### Claim 17 (depends on 15)

The non-transitory computer-readable medium of claim 15, wherein the first application comprises a web-browser application and the second application comprises a client-side application, the non-transitory computer-readable medium including instructions which, when executed by the one or more processors, further cause the one or more processors to:
install the client-side application on the client device prior to an expiration of a predetermined period of time associated with the identification tag;
in response to the client-side application being installed on the client device, cause the web-browser application to transmit the authentication key to the content management system;
receive the authorization message; and
in response to authorization message matching a respective authentication key associated with the identification tag, log the client-side application on to the content management system via the authenticated user account.

### Claim 18 (depends on 15)

The non-transitory computer-readable medium of claim 15, storing instructions which, when executed by the one or more processors, further cause the one or more processors to:
transmit a pre-authorization request including an IP address to the content management system; and
receive, from the content management system, an indication that the IP address matches an authorized IP address.

### Claim 19 (depends on 16)

The non-transitory computer-readable medium of claim 16, wherein logging the second application into the authenticated user account comprises:
receive a determination regarding a number of times the identification tag has been previously used to pre-authorize the second application, to yield a previous-usage determination; and
based on the previous-usage determination, use a pre-authorization to authorize the second application.

### Claim 20 (depends on 15)

The non-transitory computer-readable medium of claim 15, storing instructions which, when executed by the one or more processors, further cause the one or more processors to:
transmit, to the content management system, login credentials by a web-browser application;
receive a determination that the login credentials are associated with the user account; and
authorize the web-browser application to access the authenticated user account.