# US 12,120,166 B2 · System and method for multi-user session for coordinated electronic transactions > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,120,166 B2 - Document ID: US12120166B2 - Status: Granted - Kind: B2 - Application number: 17/840,424 - Filed: 2022-06-14 - Published: 2022-12-15 - Granted: 2024-10-15 - Earliest claimed: 2021-06-14 - Assignees: Royal Bank of Canada - Applicants: Royal Bank of Canada - Inventors: Arnold Badal-Badalian; Edison U. Ortiz; William Kwok Hung Cheung; Seung Bong Baek; Ravi Khandavilli - Web page: https://patentgrep.com/patent/US12120166B2 ## CPC - H04L 65/1069: Session establishment or de-establishment - H04L 65/70: Media network packetisation - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 65/1108: Web based protocols, e.g. webRTC - H04L 65/4015: {where at least one of the additional parallel sessions is real time or time sensitive, e.g. white board sharing, collaboration or spawning of a subconference} - H04L 65/403: Arrangements for multi-party communication, e.g. for conferences (data switching systems for conference H04L12/18; arrangements for connecting several subscribers to a common circuit, i.e. affording conference facilities H04M3/56; television conferencing systems H04N7/15) - H04L 65/611: for multicast or broadcast (systems for broadcast or conference H04L12/18; arrangements for broadcast or distribution combined with broadcast H04H20/00; arrangements for broadcast applications with a direct linkage to broadcast information or to broadcast space-time H04H60/00; selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS], H04W4/06) - H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, methods, and computer readable media are directed in various embodiments for providing multiuser sessions for coordinated electronic transactions. A technical solution is directed to coordinating the electronic transactions across a plurality of instances, where the underlying users of the instances can include at least two users. Access to sensitive information can be restricted using a trusted execution environment and access can be given in accordance with the coordinated electronic transactions. ## Claims ### Claim 1 A computer implemented system for persisting an instance of a multi-user session between one or more users and a target computing resource, the system including one or more computer processors and computer memory, the system comprising: a user device coupling interface configured to communicate with one or more user computing devices, the one or more user computing devices including a primary user computing device that initiates an instance of a direct session between the primary user computing device and the target computing resource; a signal interception and injection engine configured to intercept and transform signals communicated between the primary user computing device and the target computing resource; a group session coordination engine configured to maintain, in a group session data structure, the instance of the multi-user session as an extrapolation of the direct session between the primary user computing device and the target computing resource whereby data sets corresponding to each of the one or more user computing devices is segregated from the signals communicated between the primary user computing device and the target computing resource; the group session coordination engine configured to broadcast portions of the data packets received from the target computing resource to the one or more user computing devices, the broadcasted portions causing rendering of one or more interactive graphical user interface elements at each of the one or more user computing devices; the group session coordination engine configured to transform, through the signal interception and injection engine, a data stream provided in the direct session from the primary user computing device to the target computing resource by consolidating data packets received from the one or more user computing devices for transmission to the target computing resource; wherein the group session coordination engine includes a multiplexer processor configured to consolidate data packets received from the one or more user computing devices in an encapsulated data payload for transmission to the target computing resource; and wherein the encapsulated data payload includes at least one of personal information data sets or individual transaction authorization data sets, and the personal information data sets or individual transaction authorization data sets are provided as access tokens that can be utilized by the target computing resource to receive a query response from a trusted execution environment maintaining an always protected database, the trusted execution environment prohibiting direct access to the always protected database by the target computing resource. ### Claim 2 (depends on 1) The system of claim 1, wherein the group session coordination engine including the multiplexer processor is configured to parse the data packets from the one or more user computing devices or the target computing resource, and flag the data packets corresponding to each of the one or more user computing devices that is sensitive for a particular user or group of users. ### Claim 3 (depends on 2) The system of claim 2, wherein the access tokens that can be utilized by the target computing resource to receive a query response from a trusted execution environment comprise a cryptographically signed message or a public key of the target computing resource. ### Claim 4 (depends on 1) The system of claim 1, wherein the signal interception and injection engine is further configured to route communications for individualized chat sessions between the target computing resource and the one or more user computing devices. ### Claim 5 (depends on 1) The system of claim 1, wherein the group session coordination engine includes a de-multiplexer processor configured to partition the data packets received from the target computing resource establish the portions of the data packets for each individual broadcast to the each computing device of the one or more user computing devices. ### Claim 6 A computer implemented system for persisting an instance of a multi-user session between one or more users and a target computing resource, the system including one or more computer processors and computer memory, the system comprising: a user device coupling interface configured to communicate with one or more user computing devices; a signal injection engine configured to intercept and transform signals communicated between one or more user computing devices and the target computing resource; a group session coordination engine configured to maintain, in a group session data structure, the instance of the multi-user session; the group session coordination engine configured to broadcast portions of the data packets received from the target computing resource to the one or more user computing devices, the broadcasted portions causing rendering of one or more interactive graphical user interface elements at each of the one or more user computing devices; the group session coordination engine configured to transform, through the signal interception and injection engine, a data stream provided in the direct session from the primary user computing device to the target computing resource by consolidating data packets received from the one or more user computing devices for transmission to the target computing resource; wherein the group session coordination engine includes a multiplexer processor configured to consolidate data packets received from the one or more user computing devices in an encapsulated data payload for transmission to the target computing resource; and wherein the encapsulated data payload includes at least one of personal information data sets or individual transaction authorization data sets, and the personal information data sets or individual transaction authorization data sets are provided as access tokens that can be utilized by the target computing resource to receive a query response from a trusted execution environment maintaining an always protected database, the trusted execution environment prohibiting direct access to the always protected database by the target computing resource. ### Claim 7 (depends on 6) The system of claim 6, wherein the group session coordination engine including the multiplexer processor is configured to parse the data packets from the one or more user computing devices or the target computing resource, and flag the data packets corresponding to each of the one or more user computing devices that is sensitive for a particular user or group of users. ### Claim 8 (depends on 7) The system of claim 7, wherein the access tokens that can be utilized by the target computing resource to receive a query response from a trusted execution environment comprise a cryptographically signed message or a public key of the target computing resource. ### Claim 9 (depends on 6) The system of claim 6, wherein the signal interception and injection engine is further configured to route communications for individualized chat sessions between the target computing resource and the one or more user computing devices. ### Claim 10 (depends on 6) The system of claim 6, wherein the group session coordination engine includes a de-multiplexer processor configured to partition the data packets received from the target computing resource establish the portions of the data packets for each individual broadcast to the each computing device of the one or more user computing devices. ### Claim 11 A computer implemented method for persisting an instance of a multi-user session between one or more users and a target computing resource, the method operating on one or more computer processors and computer memory, the method comprising: communicating with one or more user computing devices, the one or more user computing devices including a primary user computing device that initiates an instance of a direct session between the primary user computing device and the target computing resource; intercepting and transforming signals communicated between the primary user computing device and the target computing resource; maintaining, in a group session data structure, the instance of the multi-user session as an extrapolation of the direct session between the primary user computing device and the target computing resource whereby data sets corresponding to each of the one or more user computing devices is segregated from the signals communicated between the primary user computing device and the target computing resource; broadcasting portions of the data packets received from the target computing resource to the one or more user computing devices, the broadcasted portions causing rendering of one or more interactive graphical user interface elements at each of the one or more user computing devices; transforming a data stream provided in the direct session from the primary user computing device to the target computing resource by consolidating data packets received from the one or more user computing devices for transmission to the target computing resource; consolidating data packets received from the one or more user computing devices in an encapsulated data payload for transmission to the target computing resource; and wherein the encapsulated data payload includes at least one of personal information data sets or individual transaction authorization data sets, and the personal information data sets or individual transaction authorization data sets are provided as access tokens that can be utilized by the target computing resource to receive a query response from a trusted execution environment maintaining an always protected database, the trusted execution environment prohibiting direct access to the always protected database by the target computing resource. ### Claim 12 (depends on 11) The method of claim 11, comprising parsing the data packets from the one or more user computing devices or the target computing resource, and flagging the data packets corresponding to each of the one or more user computing devices that is sensitive for a particular user or group of users. ### Claim 13 (depends on 12) The method of claim 12, wherein the access tokens that can be utilized by the target computing resource to receive a query response from a trusted execution environment comprise a cryptographically signed message or a public key of the target computing resource. ### Claim 14 (depends on 11) The method of claim 11, comprising routing communications for individualized chat sessions between the target computing resource and the one or more user computing devices. ### Claim 15 (depends on 11) The method of claim 11, comprising partitioning the data packets received from the target computing resource establish the portions of the data packets for each individual broadcast to the each computing device of the one or more user computing devices. ### Claim 16 A computer implemented method for persisting an instance of a multi-user session between one or more users and a target computing resource, the method operating on one or more computer processors and computer memory, the method comprising: establishing communication pathways with one or more user computing devices; transforming signals communicated between one or more user computing devices and the target computing resource; maintaining, in a group session data structure, the instance of the multi-user session; broadcasting portions of the data packets received from the target computing resource to the one or more user computing devices, the broadcasted portions causing rendering of one or more interactive graphical user interface elements at each of the one or more user computing devices; encapsulating a data stream provided to the target computing resource by consolidating data packets received from the one or more user computing devices for transmission to the target computing resource; consolidating data packets received from the one or more user computing devices in an encapsulated data payload for transmission to the target computing resource; and wherein the encapsulated data payload includes at least one of personal information data sets or individual transaction authorization data sets, and the personal information data sets or individual transaction authorization data sets are provided as access tokens that can be utilized by the target computing resource to receive a query response from a trusted execution environment maintaining an always protected database, the trusted execution environment prohibiting direct access to the always protected database by the target computing resource. ### Claim 17 (depends on 16) The method of claim 16, comprising parsing the data packets from the one or more user computing devices or the target computing resource, and flagging the data packets corresponding to each of the one or more user computing devices that is sensitive for a particular user or group of users. ### Claim 18 (depends on 17) The method of claim 17, wherein the access tokens that can be utilized by the target computing resource to receive a query response from a trusted execution environment comprise a cryptographically signed message or a public key of the target computing resource. ### Claim 19 A non-transitory computer readable medium storing machine interpretable instructions, which when executed by one or more processors, cause the one or more processors to perform a method for persisting an instance of a multi-user session between one or more users and a target computing resource, the method comprising: communicating with one or more user computing devices, the one or more user computing devices including a primary user computing device that initiates an instance of a direct session between the primary user computing device and the target computing resource; intercepting and transforming signals communicated between the primary user computing device and the target computing resource; maintaining, in a group session data structure, the instance of the multi-user session as an extrapolation of the direct session between the primary user computing device and the target computing resource whereby data sets corresponding to each of the one or more user computing devices is segregated from the signals communicated between the primary user computing device and the target computing resource; broadcasting portions of the data packets received from the target computing resource to the one or more user computing devices, the broadcasted portions causing rendering of one or more interactive graphical user interface elements at each of the one or more user computing devices; transforming a data stream provided in the direct session from the primary user computing device to the target computing resource by consolidating data packets received from the one or more user computing devices for transmission to the target computing resource; consolidating data packets received from the one or more user computing devices in an encapsulated data payload for transmission to the target computing resource; and wherein the encapsulated data payload includes at least one of personal information data sets or individual transaction authorization data sets, and the personal information data sets or individual transaction authorization data sets are provided as access tokens that can be utilized by the target computing resource to receive a query response from a trusted execution environment maintaining an always protected database, the trusted execution environment prohibiting direct access to the always protected database by the target computing resource. ### Claim 20 A non-transitory computer readable medium storing machine interpretable instructions, which when executed by one or more processors, cause the one or more processors to perform a method for persisting an instance of a multi-user session between one or more users and a target computing resource, the method comprising: establishing communication pathways with one or more user computing devices; intercepting and transforming signals communicated between one or more user computing devices and the target computing resource; maintaining, in a group session data structure, the instance of the multi-user session; broadcasting portions of the data packets received from the target computing resource to the one or more user computing devices, the broadcasted portions causing rendering of one or more interactive graphical user interface elements at each of the one or more user computing devices; encapsulating a data stream provided to the target computing resource by consolidating data packets received from the one or more user computing devices for transmission to the target computing resource; consolidating data packets received from the one or more user computing devices in an encapsulated data payload for transmission to the target computing resource; and wherein the encapsulated data payload includes at least one of personal information data sets or individual transaction authorization data sets, and the personal information data sets or individual transaction authorization data sets are provided as access tokens that can be utilized by the target computing resource to receive a query response from a trusted execution environment maintaining an always protected database, the trusted execution environment prohibiting direct access to the always protected database by the target computing resource.