# US 10,873,572 B1 · Transferring a single sign-on session between a browser and a client application > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,873,572 B1 - Document ID: US10873572B1 - Status: Granted - Kind: B1 - Application number: 15/931,916 - Filed: 2020-05-14 - Granted: 2020-12-22 - Earliest claimed: 2020-05-14 - Assignees: Micro Focus LLC - Applicants: Micro Focus LLC - Inventors: Vamsi Krishna - Web page: https://patentgrep.com/patent/US10873572B1 ## CPC - H04L 63/0815: {providing single-sign-on or federations} - H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key} - H04L 63/0838: {using one-time-passwords} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) - H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract This document describes techniques and apparatuses for securely transferring a single sign-on session between a browser session and a client application. Responsive to a launch request from the browser session, a server sends a launch command to launch the application on the client to transfer the single sign-on session from the browser session to the application. The launch command includes a first security credential and a second security credential. The application then initiates a registration process by sending to the server the first security credential and a client identification unique to the client. The server passes the client identification to the browser session which confirms to the server that the client identification matches the client identification unique to the client. The server then sends the application a third security credential, and the application returns the client identification and an encrypted version of the second security credential relative to the third security credential. Upon receipt and verification of these security credentials, the server establishes the single sign-on session with the application. ## Claims ### Claim 1 A method of transferring a single sign-on session between a browser session and an application, the method comprising: sending, by a server, a launch command to launch the application on a client, the launch command responsive to a launch request received by the server from the browser session and indicative of a request to transfer the single sign-on session between the browser session and the application, the launch command comprising a first security credential and a second security credential; registering, by the server, the application, the registering comprising: receiving from the application the first security credential and a client identification unique to the client; receiving from the browser session a client identification confirmation indicating that the client identification received by the server matches the client identification unique to the client; and sending the application a third security credential responsive to the client identification confirmation; and establishing, by the server, the single sign-on session with the application, the establishing responsive to the server receiving from the application the client identification and an encrypted version of the second security credential relative to the third security credential. ### Claim 2 (depends on 1) The method of claim 1 further comprising the server authenticating the browser session prior to receiving the launch request from the browser session. ### Claim 3 (depends on 1) The method of claim 1 wherein the client comprises a thick client. ### Claim 4 (depends on 1) The method of claim 1 wherein the launch request received by the server from the browser session comprises a launch request received by the server from the browser session executing on the client. ### Claim 5 (depends on 1) The method of claim 1 wherein at least one of the first security credential or the second security credential comprises a one-time password. ### Claim 6 (depends on 1) The method of claim 1 wherein the third security credential comprises a client secret. ### Claim 7 (depends on 1) The method of claim 1 wherein the client identification comprises at least one of a string or a numerical value generated with respect to uniquely identifying the client. ### Claim 8 (depends on 1) The method of claim 1 wherein registering the application further comprises: sending to the browser session, by the server, the client identification; waiting, by the server, for the browser session to display the client identification, and for the application to display the client identification on the client, and for a comparison to occur relative to the browser session displaying the client identification and the application displaying the client identification; and receiving, by the server, from the browser session, the client identification confirmation indicative of a match of the client identification displayed by the browser session and the client identification displayed by the application. ### Claim 9 (depends on 8) The method of claim 8 wherein the client identification confirmation is indicative of a completed visual comparison, by a user of the browser session, confirming the match of the client identification displayed by the browser session and the client identification displayed by the application. ### Claim 10 (depends on 1) The method of claim 1 wherein the encrypted version of the second security credential comprises a cryptographic message authentication comprising the second security credential relative to the third security credential. ### Claim 11 (depends on 10) The method of claim 10 wherein the cryptographic message authentication comprises a keyed-hash message authentication code using the second security credential with respect to the third security credential as a secret key. ### Claim 12 (depends on 1) The method of claim 1 wherein establishing the single sign-on session with the application further comprises: verifying, by the server, the client identification, and the second security credential relative to the third security credential, and responsive to the verifying, sending to the application a session authorization confirmation. ### Claim 13 (depends on 1) The method of claim 1 further comprising revoking, by the browser session, the establishing of the single sign-on session with the application. ### Claim 14 (depends on 13) The method of claim 13 further comprising establishing the single sign-on session with the application contingent on the browser session not previously revoking the single sign-on session with the application, and the browser session not previously indicating to disallow establishing the single sign-on session. ### Claim 15 A single sign-on management system comprising a first computing device and instructions that, when executed by the first computing device, cause the first computing device to: send a launch command to launch an application on a second computing device, the launch command responsive to a launch request received by the first computing device from a browser session of the second computing device, the launch command indicative of a request to transfer a single sign-on session between the browser session and the application, the launch command comprising a first security credential and a second security credential; receive, from the application, the first security credential and an identification indicative of an identification unique to the second computing device; receive, from the browser session, an identification confirmation indicating that the identification received by the first computing device matches the identification unique to the second computing device; send, to the application, a third security credential responsive to the identification confirmation; and establish the single sign-on session with the application, the establishing responsive to the first computing device receiving, from the application, the identification and an encrypted version of the second security credential relative to the third security credential. ### Claim 16 (depends on 15) The single sign-on management system of claim 15 wherein at least one of the first security credential or the second security credential comprises a one-time password. ### Claim 17 (depends on 15) The single sign-on management system of claim 15 further comprising instructions that when executed by the first computing device cause the first computing device to: send to the browser session the client identification; wait for the browser session to display the identification, and for the application to display the identification on the second computing device, and for a comparison to occur relative to the browser session displaying the identification and the application displaying the identification; and receive, from the browser session, the identification confirmation indicative of a match of the client identification displayed by the browser session and the client identification displayed by the application. ### Claim 18 (depends on 15) The single sign-on management system of claim 15 wherein the encrypted version of the second security credential comprises a cryptographic message authentication comprising the second security credential relative to the third security credential. ### Claim 19 (depends on 15) The single sign-on management system of claim 15 further comprising instructions that when executed by the first computing device cause the first computing device to: verify the client identification, and the second security credential relative to the third security credential, and responsive to the verifying, send to the application a session authorization confirmation indicative to establish the single sign-on session. ### Claim 20 A non-transitory machine-readable storage medium storing instructions that when executed by at least one computing device cause the at least one computing device to: send a launch command to launch an application on a second computing device, the launch command responsive to a launch request received by the first computing device from a browser session of the second computing device, the launch command indicative of a request to transfer a single sign-on session between the browser session and the application, the launch command comprising a first security credential and a second security credential; receive, from the application, the first security credential and an identification indicative of an identification unique to the second computing device; receive, from the browser session, an identification confirmation indicating that the identification received by the first computing device matches the identification unique to the second computing device; send, to the application, a third security credential responsive to the identification confirmation; and establish the single sign-on session with the application, the establishing responsive to the first computing device receiving from the application the identification and an encrypted version of the second security credential relative to the third security credential.