# US 11,907,349 B2 · Passwordless authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,907,349 B2 - Document ID: US11907349B2 - Status: Granted - Kind: B2 - Application number: 17/469,829 - Filed: 2021-09-08 - Published: 2022-03-31 - Granted: 2024-02-20 - Earliest claimed: 2020-09-28 - Assignees: JAMF Software, LLC - Applicants: JAMF Software, LLC - Inventors: Joel Rennich; Josh Wisenbaker; Kyle Wainwright Hammond - Web page: https://patentgrep.com/patent/US11907349B2 ## CPC - G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints - G06F 21/35: communicating wirelessly - G06F 21/33: using certificates - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/3066: {involving algebraic varieties, e.g. elliptic or hyper-elliptic curves} - H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04W 12/069: using certificates or pre-shared keys - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 2209/80: Wireless - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Methods for enabling passwordless authentication to ancillary devices and services of a user by utilizing a mobile device of that same user. Systems and machine-readable media are also provided. ## Claims ### Claim 1 A computer-implemented method comprising: installing an application on a mobile device, wherein the application is received by the mobile device via a push notification service, wherein the application is configured to enable passwordless authentication to an ancillary device of the user; installing a driver and a daemon on the ancillary device, wherein the driver and the daemon are received by the ancillary device via the push notification service; generating, at the mobile device, an encrypted key pair comprising an encrypted public key associated with a user of the mobile device; receiving, at the mobile device, a signed certificate of the encrypted public key associated with the user of the mobile device; causing, at the ancillary device of the user via the driver and the daemon, responsive to receiving identity data associated with the user that is input at the ancillary device, generation of a local account of the user associated with the signed certificate of the encrypted public key; receiving, at the mobile device of the user and responsive to generation of the local account, an authentication input of the user; and causing, at the ancillary device and based on determining that the authentication input of the user is valid, transmission of instructions to allow performance of an authorized operation at the ancillary device. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, further comprising: advertising, wirelessly at the mobile device, the signed certificate of the public key associated with the user of the mobile device. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, wherein the identity data associated with the user is a personal identification number. ### Claim 4 (depends on 3) The computer-implemented method claim 3, wherein the personal identification number is generated rotatingly at the mobile device. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the signed certificate of the public key associated with the user of the mobile device is signed by a Certificate Authority in response to Certificate Signing Request. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the encrypted key pair is generated by a coprocessor of the mobile device. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the encrypted key pair is generated with elliptic-curve cryptography. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the authentication input is a biometric of the user. ### Claim 9 (depends on 8) The computer-implemented method of claim 8, wherein the biometric of the user is based on facial features of the user. ### Claim 10 (depends on 8) The computer-implemented method of claim 8, wherein the biometric of the user is based on a fingerprint of the user. ### Claim 11 A system comprising: a memory comprising instructions; and a processor configured to execute the instructions which, when executed, cause the processor to: install an application on a mobile device, wherein the application is received by the mobile device via a push notification service, wherein the application is configured to enable passwordless authentication to an ancillary device of the user; install a driver and a daemon on the ancillary device, wherein the driver and the daemon are received by the ancillary device via the push notification service; generate, at the mobile device, an encrypted key pair comprising an encrypted public key associated with a user of the mobile device; receive, at the mobile device, a signed certificate of the encrypted public key associated with the user of the mobile device; advertise, wirelessly at the mobile device, the signed certificate of the public key associated with the user of the mobile device; cause, at the ancillary device of the user via the driver and the daemon, responsive to receiving identity data associated with the user that is input at the ancillary device, generation of a local account of the user associated with the signed certificate of the encrypted public key; receive, at the mobile device of the user and responsive to generation of the local account, an authentication input of the user; and cause, at the ancillary device and based on determining that the authentication input of the user is valid, transmission of instructions to allow performance of an authorized operation at the ancillary device. ### Claim 12 (depends on 11) The system of claim 11, wherein the identity data associated with the user is a personal identification number. ### Claim 13 (depends on 12) The system of claim 12, wherein the personal identification number is generated rotatingly at the mobile device. ### Claim 14 (depends on 11) The system of claim 11, wherein the signed certificate of the public key associated with the user of the mobile device is signed by a Certificate Authority in response to Certificate Signing Request. ### Claim 15 (depends on 11) The system of claim 11, wherein the encrypted key pair is generated with elliptic-curve cryptography. ### Claim 16 (depends on 11) The system of claim 11, wherein the authentication input is a biometric of the user. ### Claim 17 A non-transitory machine-readable storage medium comprising machine-readable instructions for causing a processor to execute a method, the method comprising: installing an application on a mobile device, wherein the application is received by the mobile device via a push notification service, wherein the application is configured to enable passwordless authentication to an ancillary device of the user; installing a driver and a daemon on the ancillary device, wherein the driver and the daemon are received by the ancillary device via the push notification service; generating, at the mobile device, an encrypted key pair comprising an encrypted public key associated with a user of the mobile device; receiving, at the mobile device, a signed certificate of the encrypted public key associated with the user of the mobile device; causing, at the ancillary device of the user via the driver and the daemon, responsive to receiving identity data associated with the user that is input at the ancillary device, generation of a local account of the user associated with the signed certificate of the encrypted public key; receiving, at the mobile device of the user and responsive to generation of the local account, biometric input of the user; and causing, at the ancillary device and based on determining that the biometric input of the user is valid, transmission of instructions to allow performance of an authorized operation at the ancillary device. ### Claim 18 (depends on 17) The non-transitory machine-readable storage medium of claim 17, further including instructions for causing the processor to execute the method comprising: advertising, wirelessly at the mobile device, the signed certificate of the public key associated with the user of the mobile device. ### Claim 19 (depends on 18) The non-transitory machine-readable storage medium of claim 18, wherein the identity data associated with the user is a personal identification number. ### Claim 20 (depends on 19) The non-transitory machine-readable storage medium of claim 19, wherein the personal identification number is generated rotatingly at the mobile device.