# US 11,122,029 B2 · Secure cloud computing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,029 B2 - Document ID: US11122029B2 - Status: Granted - Kind: B2 - Application number: 16/246,104 - Filed: 2019-01-11 - Published: 2020-07-16 - Granted: 2021-09-14 - Earliest claimed: 2019-01-11 - Assignees: Citrix Systems, Inc. - Applicants: Citrix Systems, Inc. - Inventors: Feng Huang; Andy Cooper - Web page: https://patentgrep.com/patent/US11122029B2 ## CPC - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/10: {for controlling access to devices or network resources} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 9/3247: {involving digital signatures} - H04L 61/4511: using domain name system [DNS] - H04L 63/045: {wherein the sending and receiving network entities apply hybrid encryption, i.e. combination of symmetric and asymmetric encryption (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)} - G06F 2009/45587: {Isolation or security of virtual machine instances} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L 63/126: {the source of the received data} - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and systems for securely using a web application to invoke an application to complete a task are described herein. The application may use identity information provided by the web application to determine whether to comply with requests from the web application. The web application may send the request to the application via a browser. The request may include the origin of the request in an origin header to prevent malicious websites from spoofing the origin of the request. The application may exchange information with a trust service to determine whether the web application domain is trusted and/or belongs to the same organization of the user. ## Claims ### Claim 1 A method comprising: sending, by a server, identification information to a web browser executing on a client device, the identification information being associated with the client device; receiving, by the server, a request for valid domain information from a first application executing on the client device, wherein the request comprises the identification information; sending, by the server, the valid domain information to the first application based on a determination that the identification information is signed by a key pair and is valid; and establishing, based on a determination that a domain name associated with the web browser is valid, a connection with a second application executing on a remote device, wherein the determination is made using the valid domain information. ### Claim 2 (depends on 1) The method of claim 1, wherein the identification information is generated from a user profile linked to an actively logged in account on the client device. ### Claim 3 (depends on 1) The method of claim 1, further comprising: sending, to the first application and based on a request to launch the second application, the valid domain information, wherein the request to launch the second application is received from the web browser. ### Claim 4 (depends on 3) The method of claim 3, further comprising: receiving, from the first application, a request to connect to the second application; and establishing a connection between the first application and the second application. ### Claim 5 (depends on 1) The method of claim 1, wherein the identification information comprises an identity ticket and wherein the identity ticket is linked to a user identification obtained from the web browser. ### Claim 6 (depends on 1) The method of claim 1, further comprising: signing the identification information with a private key, wherein the determination that the identification information is signed by a key pair and is valid comprises validating, using a public key that is generated by the server and is paired with the private key, that the identification information is signed by the private key. ### Claim 7 A system comprising: a server and a client device, wherein the client device comprises: one or more processors and memory, configured to: send, by a web browser executing on the client device, a first request for local information to a first application executing on the client device; and wherein the server comprises: one or more processors and memory, configured to: receive, from the first application, a second request for valid domain information, wherein the second request comprises identification information corresponding to the web browser; and send, to the first application, and based on a determination that the identification information is signed by a key pair and is valid, the valid domain information. ### Claim 8 (depends on 7) The system of claim 7, wherein the identification information is generated from a user profile linked to an actively logged in account on the client device. ### Claim 9 (depends on 7) The system of claim 7, further comprising: signing the identification information with a private key, wherein the private key corresponds to a device that is separate from the client device. ### Claim 10 (depends on 7) The system of claim 7, wherein the one or more processors and memory are further configured to: send, to the first application and based on a request to launch a second application, the valid domain information, wherein the request to launch the second application is received from the web browser. ### Claim 11 (depends on 10) The system of claim 10, wherein the one or more processors and memory are further configured to: receive, from the first application, a request to connect to the second application; and establish a connection between the first application and the second application. ### Claim 12 (depends on 7) The system of claim 7, wherein the identification information comprises an identity ticket and wherein the identity ticket is linked to a user identification obtained from the web browser. ### Claim 13 (depends on 9) The system of claim 9, wherein the determination that the identification information is signed by a key pair and is valid comprises validating, using a public key that is generated by the server and is paired with the private key, that the identification information is signed by the private key. ### Claim 14 (depends on 8) The system of claim 8, wherein the first request is sent using Hypertext Transfer Protocol, and wherein the first request comprises an origin header indicating a domain name corresponding to a source of the first request. ### Claim 15 An apparatus, comprising one or more processors and memory, configured to: receive, by a web browser executing on the apparatus, identification information from a first server, wherein the identification information is associated with the apparatus; send, from the web browser, a first request to a first application executing on the apparatus, the first request comprising the identification information and a domain name; send, from the first application and to the first server, a second request for valid domain information, wherein the second request comprises the identification information; receive, by the first application, and based on a determination that the identification information is signed by a key pair and is valid, the valid domain information; and based on a determination that the domain name is valid, establish a connection with a second server, wherein the determination is made using the valid domain information. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the identification information comprises an identity ticket and wherein the identity ticket is linked to a user identification obtained from the web browser. ### Claim 17 (depends on 15) The apparatus of claim 15, wherein the identification information is generated from a user profile linked to an actively logged in account on the client device. ### Claim 18 (depends on 15) The apparatus of claim 15, wherein the apparatus is further configured to: send, by the web browser and to the first server, a request to launch a remote application; and validate, by the first application and based on the valid domain information, the request to launch a remote application. ### Claim 19 (depends on 15) The apparatus of claim 15, wherein the first request is sent using Hypertext Transfer Protocol, and wherein the first request comprises an origin header indicating a domain name corresponding to a source of the first request. ### Claim 20 (depends on 15) The apparatus of claim 15, wherein the determination that the identification information is signed by a key pair and is valid comprises validating, using a public key that is generated by the first server and is paired with a private key, that the identification information is signed by the private key.