# US 11,121,863 B1 · Browser login sessions via non-extractable asymmetric keys > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,121,863 B1 - Document ID: US11121863B1 - Status: Granted - Kind: B1 - Application number: 17/069,561 - Filed: 2020-10-13 - Published: 2021-09-16 - Granted: 2021-09-14 - Earliest claimed: 2020-03-12 - Assignees: Oracle International Corporation - Applicants: Oracle International Corporation - Inventors: Kevin Ross O'Neill; Daniel Music Vogel; Girish Nagaraja; Shobhank Sharma - Web page: https://patentgrep.com/patent/US11121863B1 ## CPC - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 63/0815: {providing single-sign-on or federations} - G06F 21/41: where a single sign-on provides access to a plurality of computers - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3247: {involving digital signatures} - H04W 12/06: Authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Techniques are provided for establishing a session with an application using asymmetric cryptography. Techniques include secure single-sign on capabilities using asymmetric cryptography. With asymmetric signatures, the use of browser local storage and the Web Crypto application programming interface (API), the key cannot be extracted from the browser that it was generated for. The mechanism allows a web domain to track a user login session using a non-extractable asymmetric key stored in the client's web browser, and leverage the non-extractable asymmetric key for single sign-on. ## Claims ### Claim 1 A method comprising: receiving, by a computing device comprising a processor and a memory, a first request to log on to a first application; generating, by the computing device, a first public-private key pair comprising a first public key and a first private key, wherein the first public-private key pair is associated with the first application; storing, by the computing device, the first public-private key pair on a local data store for the computing device; sending, by the computing device, a second request to authorize the first public key, wherein the second request comprises the first public key; generating, by the computing device, a second public-private key pair comprising a second public key and a second private key, wherein the second public-private key pair is associated with a server computer; receiving, by the computing device, credential information; sending, by the computing device, an authentication request including the credential information, the first public key and the second public key, to the server computer; receiving, by the computing device from the server computer, a server token, wherein the server token is generated based on the second public key; storing, by the computing device, the received server token in a second local data store; sending, by the computing device, a third request to the server computer, wherein the third request includes the server token and the third request is signed using the second private key; after sending the third request, receiving, by the computing device from the server computer, a first application token; and after receiving the first application token, authenticating, by the computing device, the first request to log on to the first application. ### Claim 2 (depends on 1) The method according to claim 1, further comprising: receiving, by the computing device, a fourth request to log on to a second application; generating, by the computing device, a third public-private key pair comprising a third public key and a third private key, wherein the third public-private key pair is associated with the second application; storing, by the computing device, the third public-private key pair on the second local data store for the computing device; sending, by the computing device, a fifth request to authorize the third public key, wherein the fifth request comprises the third public key; receiving, by the computing device, a second JavaScript; determining, by the computing device, whether the second JavaScript comprises a valid server token; obtaining, by the computing device, the server token from the second local data store; sending, by the computing device, a sixth request to the server computer, wherein the sixth request includes the server token and the sixth request is signed using the second private key; receiving, by the computing device from the server computer, a second application token; and authenticating, by the computing device, the fourth request to log on to the second application. ### Claim 3 (depends on 1) The method according to claim 1, wherein the computing device comprises a web browser. ### Claim 4 (depends on 1) The method according to claim 1, wherein the credential information comprises a user name and password. ### Claim 5 (depends on 1) The method according to claim 1, wherein before generating the first public-private key pair: receiving, by the computing device, a first JavaScript from the server computer; and determining, by the computing device, whether a valid JSON web token (JWT) exists based on the first JavaScript. ### Claim 6 (depends on 1) The method according to claim 1, wherein the first public-private key pair is stored on a first local IndexedDB associated with the first application. ### Claim 7 (depends on 1) The method according to claim 1, where the server token is stored on a second local IndexedDB associated with the server computer. ### Claim 8 A non-transitory computer-readable storage medium storing instructions which, when executed by one or more processors of a computing device, cause the one or more processors to perform a method comprising: receiving, by the computing device, a first request to log on to a first application; generating, by the computing device, a first public-private key pair comprising a first public key and a first private key, wherein the first public-private key pair is associated with the first application; storing, by the computing device, the first public-private key pair on a local data store for the computing device; sending, by the computing device, a second request to authorize the first public key, wherein the second request comprises the first public key; generating, by the computing device, a second public-private key pair comprising a second public key and a second private key, wherein the second public-private key pair is associated with a server computer; receiving, by the computing device, credential information; sending, by the computing device, an authentication request including the credential information, the first public key and the second public key, to the server computer; receiving, by the computing device from the server computer, a server token, wherein the server token is generated based on the second public key; storing, by the computing device, the received server token in a second local data store; sending, by the computing device, a third request to the server computer, wherein the third request includes the server token and the third request is signed using the second private key; after sending the third request, receiving, by the computing device from the server computer, a first application token; and after receiving the first application token, authenticating, by the computing device, the first request to log on to the first application. ### Claim 9 (depends on 8) The non-transitory computer-readable storage medium according to claim 8, comprising instructions that cause the one or more processors to perform the method further comprising: receiving, by the computing device, a fourth request to log on to a second application; generating, by the computing device, a third public-private key pair comprising a third public key and a third private key, wherein the third public-private key pair is associated with the second application; storing, by the computing device, the third public-private key pair on the second local data store for the computing device; sending, by the computing device, a fifth request to authorize the third public key, wherein the fifth request comprises the third public key; receiving, by the computing device, a second JavaScript; determining, by the computing device, whether the second JavaScript comprises a valid server token; obtaining, by the computing device, the server token from the second local data store; sending, by the computing device, a sixth request to the server computer, wherein the sixth request includes the server token and the sixth request is signed using the second private key; receiving, by the computing device from the server computer, a second application token; and authenticating, by the computing device, the fourth request to log on to the second application. ### Claim 10 (depends on 8) The non-transitory computer-readable storage medium according to claim 8, wherein the computing device comprises a web browser. ### Claim 11 (depends on 8) The non-transitory computer-readable storage medium according to claim 8, wherein the credential information comprises a user name and password. ### Claim 12 (depends on 8) The non-transitory computer-readable storage medium according to claim 8, wherein before generating the first public-private key pair: receiving, by the computing device, a first JavaScript from the server computer; and determining, by the computing device, whether a valid JSON web token (JWT) exists based on the first JavaScript. ### Claim 13 (depends on 8) The non-transitory computer-readable storage medium according to claim 8, wherein the first public-private key pair is stored on a first local IndexedDB associated with the first application. ### Claim 14 A computing device, comprising: a memory; and one or more processors configured to: receive a first request to log on to a first application; generate a first public-private key pair comprising a first public key and a first private key, wherein the first public-private key pair is associated with the first application; store the first public-private key pair on a local data store for the computing device; send a second request to authorize the first public key, wherein the second request comprises the first public key; generate a second public-private key pair comprising a second public key and a second private key, wherein the second public-private key pair is associated with a server computer; receive credential information; send an authentication request including the credential information, the first public key and the second public key, to the server computer; receive a server token, wherein the server token is generated based on the second public key; store the received server token in a second local data store; send a third request to the server computer, wherein the third request includes the server token and the third request is signed using the second private key; after sending the third request, receive from the server computer, a first application token; and after receiving the first application token, authenticate the first request to log on to the first application. ### Claim 15 (depends on 14) The computing device according to claim 14, further comprising one or more processors configured to: receive a fourth request to log on to a second application; generate a third public-private key pair comprising a third public key and a third private key, wherein the third public-private key pair is associated with the second application; store the third public-private key pair on the second local data store for the computing device; send a fifth request to authorize the third public key, wherein the fifth request comprises the third public key; receive a second JavaScript determine whether the second JavaScript comprises a valid server token; obtain the server token from the second local data store; send a sixth request to the server computer, wherein the sixth request includes the server token and the sixth request is signed using the second private key; receive from the server computer, a second application token; and authenticate the fourth request to log on to the second application. ### Claim 16 (depends on 14) The computing device according to claim 14, wherein the second request is signed using a digital signature. ### Claim 17 (depends on 14) The computing device according to claim 14, wherein the computing device is comprises a web browser storing the second private key that is unextractable. ### Claim 18 (depends on 14) The computing device according to claim 14, a WebCrypto library facilitates storage of the second private key that is unextractable. ### Claim 19 (depends on 14) The computing device according to claim 14, wherein the computing device is a client side computing device.