# US 11,310,034 B2 · Systems and methods for securing offline data

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,310,034 B2
- Document ID: US11310034B2
- Status: Granted
- Kind: B2
- Application number: 16/406,910
- Filed: 2019-05-08
- Published: 2020-11-12
- Granted: 2022-04-19
- Earliest claimed: 2019-05-08
- Assignees: Citrix Systems, Inc.
- Applicants: Citrix Systems, Inc.
- Inventors: Feng Huang; Andy Cooper
- Web page: https://patentgrep.com/patent/US11310034B2

## CPC

- H04L 9/0816: {Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use}
- G06F 21/1015: {to users}
- G06F 21/602: {Providing cryptographic facilities or services}
- G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database}
- H04L 9/088: {Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms (network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068)}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- G06F 16/9574: {of access to content, e.g. by caching}
- G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals
- G06F 21/805: {using a security table for the storage sub-system}
- G06F 2221/2107: File encryption
- G06F 2221/2149: Restricted operating environment
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Described embodiments provide systems and methods for securing offline data for shared accounts of a shared computing device. Cache files can be generated for a plurality of users of an application executable on the device to store user data corresponding to individual users of the application. An encryption key can be generated for one or more of the cache files and the encryption key can be associated with at least one user of the application. The encryption key can be associated with a user identifier so that the encryption key is not accessible by other users of the computing device. The user data can be encrypted in one of the cache files with the encryption key. The encrypted user data can be presented to a user via the shared computing device based on receipt of a user identifier that enables access to the encryption key.

## Claims

### Claim 1

A method comprising:
generating, by a computing device for an application executable on the computing device, cache files for a plurality of users of the application, the cache files store user data corresponding to individual users of the application, and the computing device being a shared computing device so that the cache files are viewable by the plurality of users using the computing device;
generating, by the computing device, an encryption key for one of the cache files, the encryption key being associated with a user of the application, wherein the encryption key is associated with a user identifier so that the encryption key is not accessible by other users of the computing device;
encrypting, by the computing device, user data corresponding to the user for the application in the one of the cache files with the encryption key;
associating, by the computing device, the one of the caches file with a cache lookup key generated using the user identifier;
receiving, by the computing device from the user, the user identifier and a pin that enable access to the encryption key used to decrypt the encrypted user data corresponding to the user for the application;
identifying, by the computing device responsive to receiving the user identifier, the one of the cache files for the user using the cache lookup key;
retrieving, by the computing device using the received pin, the encryption key for the identified one of the cache files configured to decrypt the encrypted user data corresponding to the user for the application; and
presenting, by the computing device to the user, the user data of the encrypted user data decrypted using the encryption key accessed with the pin, the encrypted user data and the encryption key of the user inaccessible to other users of the computing device without the user identifier and the pin.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
storing, by the computing device, the one of the cache files in a cache database, the one of the cache files comprising the encrypted user data, and wherein each of the cache files are segregated in the cache database based on the user associated with the respective cache file.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
receiving, by the computing device and responsive to a prompt provided to the user of the application, the pin from the user of the computing device; and
storing, by the computing device, the encryption key using the pin in a trusted module, wherein the pin is used to retrieve the encryption key from the trusted module, and wherein the encryption key is used to decrypt the encrypted user data in the one of the cache files.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
generating, by the computing device, a prompt for the user of the application through a browser of the computing device, the prompt requesting the pin;
receiving, by the computing device and responsive to the prompt provided to the user of the application, the pin from the user of the application; and
storing, by the computing device, the pin for the user of the application at an authentication module of a server.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
generating, by the computing device, the cache lookup key using the user identifier corresponding to the user of the application.

### Claim 6 (depends on 5)

The method of claim 5, further comprising:
storing, by the computing device, a key identifier at the one of the cache files, address data for a trusted module and the cache lookup key, wherein the key identifier corresponds to the encryption key.

### Claim 7 (depends on 1)

The method of claim 1, further comprising:
providing, by the computing device, credentials to an authentication module of a server, the credentials corresponding to the user of the application; and
receiving, by the computing device responsive to an authentication performed by the authentication module of the server for the user of the application, permission to access to one or more resources provided through the server.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
receiving, by the computing device, an indication from an authentication module of a server to replace the pin associated with the user of the application, wherein the pin is invalid or expired; and
receiving, by the computing device from the authentication module, a second pin associated with the user of the application to replace the pin associated with the user of the application, the second pin different from the pin.

### Claim 9 (depends on 8)

The method of claim 8, further comprising:
retrieving, by the computing device from a trusted module, the encryption key using the pin associated with the user of the application.

### Claim 10 (depends on 9)

The method of claim 9, further comprising:
decrypting, by the computing device, the encrypted user data in the one of the cache files using the encryption key.

### Claim 11 (depends on 8)

The method of claim 8, further comprising:
transmitting, by the computing device, a request to a trusted module to generate a second encryption key using the second pin associated with the user of the application, the request including the second pin.

### Claim 12 (depends on 11)

The method of claim 11, further comprising:
encrypting, by the computing device, the user data in the one of the cache files using the second encryption key.

### Claim 13 (depends on 12)

The method of claim 12, further comprising:
updating, by the computing device, the one of the cache files at a cache database with the user data encrypted using the second encryption key.

### Claim 14

A system comprising:
one or more processors, coupled to memory, configured to:
generate, for an application executable on a computing device, cache files for a plurality of users of the application, the cache files store user data corresponding to individual users of the application, and the computing device being a shared computing device so that the cache files are viewable by the plurality of users using the computing device;
generate an encryption key for one of the cache files, the encryption key being associated with a user of the application, wherein the encryption key is associated with a user identifier so that the encryption key is not accessible by other users of the computing device;
encrypt user data corresponding to the user for the application in the one of the cache files with the encryption key;
associate the one of the caches file with a cache lookup key generated using the user identifier;
receive, from the user, the user identifier and a pin that enable access to the encryption key used to decrypt the encrypted user data corresponding to the user for the application;
identify, responsive to receipt of the user identifier, the one of the cache files for the user using the cache lookup key;
retrieve, using the received pin, the encryption key for the identified one of the cache files configured to decrypt the encrypted user data corresponding to the user for the application; and
present, to the user, the user data of the encrypted user data decrypted using the encryption key accessed with the pin, the encrypted user data and the encryption key of the user inaccessible to other users of the computing device without the user identifier and the pin.

### Claim 15 (depends on 14)

The system of claim 14, wherein the one or more processors are further configured to:
receive, responsive to a prompt provided to the user of the application, the pin from the user of the computing device; and
store the encryption key using the pin in a trusted module, wherein the pin is used to retrieve the encryption key from the trusted module, and wherein the encryption key is used to decrypt the encrypted user data in the one of the cache files.

### Claim 16 (depends on 14)

The system of claim 14, wherein the one or more processors are further configured to:
generate a prompt for the user of the application through a browser of the computing device, the prompt requesting the pin;
receive, responsive to the prompt provided to the user of the application, the pin from the user of the application; and
store the pin for the user of the application at an authentication module of a server.

### Claim 17 (depends on 14)

The system of claim 14, wherein the one or more processors are further configured to:
generate the cache lookup key using the user identifier corresponding to the user of the application.

### Claim 18

A non-transitory computer-readable medium, comprising instructions that, when executed by a processor of a device, cause the processor to:
generate, for an application executable on the device, cache files for a plurality of users of the application, the cache files store user data corresponding to individual users of the application, and the device being a shared computing device so that the cache files are viewable by the plurality of users using the device;
generate an encryption key for one of the cache files, the encryption key being associated with a user of the application, wherein the encryption key is associated with a user identifier so that the encryption key is not accessible by other users of the device;
encrypt user data corresponding to the user for the application in the one of the cache files with the encryption key;
associate the one of the caches file with a cache lookup key generated using the user identifier;
receive, from the user, the user identifier and a pin that enable access to the encryption key used to decrypt the encrypted user data corresponding to the user for the application;
identify, responsive to receipt of the user identifier, the one of the cache files for the user using the cache lookup key;
retrieve, using the received pin, the encryption key for the identified one of the cache files configured to decrypt the encrypted user data corresponding to the user for the application; and
present, to the user, the user data of the encrypted user data decrypted using the encryption key accessed with the pin, the encrypted user data and the encryption key of the user inaccessible to other users of the device without the user identifier and the pin.

### Claim 19 (depends on 18)

The computer-readable medium of claim 18, further comprising instructions that cause the processor to:
receive, responsive to a prompt provided to the user of the application, the pin from the user of the device; and
store the encryption key using the pin in a trusted module, wherein the pin is used to retrieve the encryption key from the trusted module, and wherein the encryption key is used to decrypt the encrypted user data in the one of the cache files.

### Claim 20 (depends on 18)

The computer-readable medium of claim 18, further comprising instructions that cause the processor to:
generate a prompt for the user of the application through a browser of the device, the prompt requesting the pin;
receive, responsive to the prompt provided to the user of the application, the pin from the user of the application; and
store the pin for the user of the application at an authentication module of a server.