# US 12,015,698 B2 · Centralized remote migration client credential management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,015,698 B2
- Document ID: US12015698B2
- Status: Granted
- Kind: B2
- Application number: 17/761,546
- Filed: 2019-09-17
- Published: 2022-10-20
- Granted: 2024-06-18
- Earliest claimed: 2019-09-17
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Microsoft Technology Licensing, LLC; Simon Bourdages; Hani G. Loza; Joe K. Yap; Zhigang Zhang; Hongliang Zhu; Huan Wang; Yogesh Abhaykumar Ratnaparkhi; Mrinalini Chakravarty; Dieter Jansen
- Inventors: Simon Bourdages; Hani G. Loza; Joe K. Yap; Zhigang Zhang; Hongliang Zhu; Huan Wang; Yogesh Abhaykumar Ratnaparkhi; Mrinalini Chakravarty; Dieter Jansen
- Web page: https://patentgrep.com/patent/US12015698B2

## CPC

- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- H04L 9/083: {involving central third party, e.g. key distribution center [KDC] or trusted third party [TTP]}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 63/10: {for controlling access to devices or network resources}
- G06F 2009/45587: {Isolation or security of virtual machine instances}
- H04L 2463/082: applying multi-factor authentication
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A cloud-based network receives a public key of a public/private key pair and a credential for accessing secrets associated with a user network. The cloud-based network receives, from a user interface configured to facilitate remote control of the user network, a command to be executed at the user network. The cloud-based network encrypts, using the public key, the credential and the command. The cloud-based network forwards, to one or more client devices, the encrypted credential and command. The client devices are configured to decrypt the encrypted credential and command using a private key of the public/private key pair and execute the command on the user network.

## Claims

### Claim 1

A method for remotely accessing client computing resources, the method comprising:
securely storing, at a secure key store of a cloud-based network, a public key of a public/private key pair, and a credential associated with a user network;
encrypting a symmetric key using the public key to generate an encrypted symmetric key;
receiving, at the cloud-based network from a user interface configured to facilitate remote control of the user network, a command to be executed at the user network to cause a change at the user network, wherein the user network is remote from the cloud-based network and the user interface;
encrypting, by the cloud-based network using the public key, the credential and the command or task to generate an encrypted credential and an encrypted command or task;
adding the encrypted command or task to a queue;
forwarding, by the cloud-based network to agents installed on a plurality of client devices at the user network, the encrypted credential and the encrypted symmetric key, wherein the agents are unique for a user associated with the plurality of client devices based on a unique ID or handshake and wherein the agents installed on the plurality of client devices are configured to:
decrypt the encrypted credential and the encrypted symmetric key using a private key of the public/private key pair;
wherein the plurality of client devices are configured to:
access, the user network using the credential;
obtain the encrypted command or taks from the queue;
decrypt the encrypted command or taks using the private key of the public/private key pair;
execute the command or tak on the user network to cause the change at the user network, wherein the command or task is a command or task to migrate one or more virtual machines from the user network to the cloud-based network;
encrypt a report of the executed command or task using the symmetric key to generate an encrypted report; and
add the encrypted report to the queue, wherein the cloud-based network obtains the encrypted report from the queue to view a status indicative of a progress of execution of the command or task.

### Claim 2 (depends on 1)

The method of claim 1, wherein the encrypted credential and command are sent via an HTTPS connection.

### Claim 3 (depends on 1)

The method of claim 1, wherein the user network is protected by a firewall.

### Claim 4 (depends on 1)

The method of claim 1, wherein the credential is one or more of a username, password, or MFA credential.

### Claim 5 (depends on 1)

The method of claim 1, wherein the cloud-based network does not persistently store the credential.

### Claim 6 (depends on 1)

The method of claim 1, wherein the user interface is configured to enable a remote user to send a command for execution at the user network.

### Claim 7

A system for accessing a user network, the system comprising:
one or more data processing units; and
a computer-readable memory having encoded thereon computer-executable instructions to cause the one or more data processing units to perform operations comprising:
receive, from a cloud-based network by agents installed on the system, an encrypted credential and an encrypted symmetric key encrypted using a public key of a public/private key pair, wherein the encrypted credential is associated with a user network, wherein the agents are unique for a user associated with the system based on a unique ID or handshake and wherein the user network is remote from the cloud-based network;
obtain an encrypted command or task from a queue, wherein the command or task is to be executed at the user network to cause a change at the user network, and wherein the command or task is encrypted using public key of the public/private key pair;
decrypt, by the agents installed on the system, the encrypted credential using a private key of the public/key pair to determine a decrypted credential and decrypt the command or task using the private key to determine a decrypted command or task;
access the user network using the decrypted credential;
execute, the decrypted command or task on the user network, wherein the command or task is a command or task to migrate one or more virtual machines from the system to the cloud-based network;
encrypt a report of the executed command or task using the symmetric key to generate an encrypted report; and
add the encrypted report to the queue to allow the cloud-based network to obtain the encrypted report from the queue to view a status indicative of a progress of execution of the command or task.

### Claim 8 (depends on 7)

The system of claim 7, wherein the credential and command is entered from a user interface configured to facilitate remote control of the user network.

### Claim 9 (depends on 7)

The system of claim 7, wherein the encrypted credential and command are received via an HTTPS connection.

### Claim 10 (depends on 7)

The system of claim 7, wherein the credential is one or more of a username, password, or MFA credential.

### Claim 11 (depends on 7)

The system of claim 7, wherein the private key is stored in a key store on the system.

### Claim 12

A computing device comprising:
one or more data processing units; and
a computer-readable memory having encoded thereon computer-executable instructions to cause the one or more data processing units to perform operations comprising:
receiving, a public key of a public/private key pair, and a credential associated with a user network, and a symmetric key;
receiving, from a a user interface configured to facilitate remote control of the user network, a command or task to be executed at the user network to cause a change at the user network, wherein the user network is remote from the computing device and the user interface;
encrypting, using the public key, the credential, the symmetric key, and the command or task to generate an encrypted, an encrypted symmetric key, and an encrypted command or task;
adding the encrypted command or task to a queue;
forwarding, to agents installed on a plurality of client devices at the user network, the encrypted credential and the encrypted symmetric key, wherein the agents are unique for a user associated with the plurality of client devices based on a unique ID or handshake and, wherein the agents installed on the plurlaity of client devices are configured to:
decrypt the encrypted credential and the encrypted symmetric key using a private key of the public/private key pair;
wherein the plurality of client devices are configured to:
access the user network using the credential;
obtain the encrypted command or task from the queue;
decrypt the encrypted command or task using the private key of the public/private key pair;
execute the command or task on the user network to cause the change at the user network, wherein the command or task is a command or task to migrate one or more virtual machine from the user network to a cloud-based network;
encrypt a report of the executed command or task using symmetric key to generate an encrypted report;
add the encrypted report to the queue; and
obtaining the encrypted report from the queue to view a status indicative of a progress of execution of the command or task.