# US 12,225,121 B2 · Accessing corporate resources through an enrolled user device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,121 B2 - Document ID: US12225121B2 - Status: Granted - Kind: B2 - Application number: 17/458,611 - Filed: 2021-08-27 - Published: 2023-01-19 - Granted: 2025-02-11 - Earliest claimed: 2021-07-13 - Assignees: Omnissa, LLC - Applicants: Omnissa, LLC - Inventors: Pranav Ashok Shenoy; Sharun Varghese Samuel; Rohit Pradeep Shetty - Web page: https://patentgrep.com/patent/US12225121B2 ## CPC - H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics} - G06F 21/44: Program or device authentication - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/0869: {involving random numbers or seeds} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04W 12/009: {specially adapted for networks, e.g. wireless sensor networks, ad-hoc networks, RFID networks or cloud networks} - H04W 12/0431: Key distribution or pre-distribution; Key agreement - H04W 12/50: Secure pairing of devices - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems and methods are described for accessing resources of a Unified Endpoint Management (“UEM”) system through an enrolled device. In an example, an unenrolled device can be paired with an enrolled device. The unenrolled device can connect to the enrolled device on a local network. The enrolled device can verify the unenrolled device using a key provided during pairing. The unenrolled device can send requests for UEM resources to the enrolled device, which the enrolled device can send to a UEM server. The UEM server can send the requested UEM resources to the enrolled device, and the enrolled device can send the UEM resources to the enrolled device over the local network. ## Claims ### Claim 1 A method for accessing system resources from an unenrolled user device, comprising: pairing a first user device with a second user device, wherein the first user device is enrolled with a device management system and the second user device is not enrolled with the device management system, the second user device includes a managed web browser that is managed by the device management system, the first user device is logged in to, under a user profile that was used to enroll the first user device, and the web browser of the second user device is logged in to, under the user profile that was used to enroll the first user device, and the pairing of the first user device and the second user device includes the web browser of the second user device sending a certificate received from the device management system to the first user device to verify the second user device to the first user device; receiving, at the first user device, a random key from the second user device, the random key having been provided by the managed web browser of the second user device; receiving, at the first user device, a request for a resource associated with the device management system, wherein the resource request includes the random key; determining, by the first user device, that the resource request came from the second user device based on the random key; sending, by the first user device, the resource request to a server associated with the device management system; receiving, at the first user device, the requested resource from the server; and sending, by the first user device, the requested resource to the managed web browser of the second user device. ### Claim 2 (depends on 1) The method of claim 1, wherein the pairing further includes: providing, by the first user device, a local network address of the first user device; receiving, at the first user device, a connection request from the second user device; displaying, on the first user device, a first randomly generated number; and receiving user input indicating that the first randomly generated number matches a second number displayed on the second user device. ### Claim 3 (depends on 1) The method of claim 1, wherein, prior to the resource request being received at the first user device, the method further comprises: detecting, on a local network, a broadcast of the random key, the broadcast having been sent by the second user device; and providing, by the first user device, a local network address of the first user device to the second user device. ### Claim 4 (depends on 1) The method of claim 1, further comprising: receiving, at the first user device, a first public encryption key from the second user device; sending, by the first user device, a second public encryption key to the second user device, wherein the resource request is received at the first user device having been encrypted with the second public encryption key; decrypting, at the first user device, the encrypted resource request using a second private key, the second private key being associated with the second public encryption key; and sending, from the first user device, the requested resource to the second user device, the requested resource having been encrypted with the first public encryption key. ### Claim 5 (depends on 1) The method of claim 1, wherein the second user device is an Internet of Things device. ### Claim 6 (depends on 1) The method of claim 1, wherein the device management system is a Unified Endpoint Management system. ### Claim 7 A non-transitory, computer-readable medium containing instructions that are executed by a hardware-based processor to perform stages for accessing system resources from an unenrolled user device, the stages comprising: pairing a first user device with a second user device, wherein the first user device is enrolled with a device management system and the second user device is not enrolled with the device management system, the second user device includes a managed web browser that is managed by the device management system, the first user device is logged in to, under a user profile that was used to enroll the first user device, and the web browser of the second user device is logged in to, under the user profile that was used to enroll the first user device, and the pairing of the first user device and the second user device includes the web browser of the second user device sending a certificate received from the device management system to the first user device to verify the second user device to the first user device; receiving, at the first user device, a random key from the second user device, the random key having been provided by the managed web browser of the second user device; receiving, at the first user device, a request for a resource associated with the device management system, wherein the resource request includes the random key; determining, by the first user device, that the resource request came from the second user device based on the random key; sending, by the first user device, the resource request to a server associated with the device management system; receiving, at the first user device, the requested resource from the server; and sending, by the first user device, the requested resource to the managed web browser of the second user device. ### Claim 8 (depends on 7) The non-transitory, computer-readable medium of claim 7, wherein the pairing further includes: providing, by the first user device, a local network address of the first user device; receiving, at the first user device, a connection request from the second user device; displaying, on the first user device, a first randomly generated number; and receiving user input indicating that the first randomly generated number matches a second randomly generated number displayed on the second user device. ### Claim 9 (depends on 7) The non-transitory, computer-readable medium of claim 7, wherein, prior to the resource request being received at the first user device, the stages further comprise: detecting, on a local network, a broadcast of the random key, the broadcast having been sent by the second user device; and providing, by the first user device, a local network address of the first user device to the second user device. ### Claim 10 (depends on 7) The non-transitory, computer-readable medium of claim 7, the stages further comprising: receiving, at the first user device, a first public encryption key from the second user device; sending, by the first user device, a second public encryption key to the second user device, wherein the resource request is received at the first user device having been encrypted with the second public encryption key; decrypting, at the first user device, the encrypted resource request using a second private key, the second private key being associated with the second public encryption key; and sending, from the first user device, the requested resource to the second user device, the requested resource having been encrypted with the first public encryption key. ### Claim 11 (depends on 7) The non-transitory, computer-readable medium of claim 7, wherein the second user device is an Internet of Things device. ### Claim 12 (depends on 7) The non-transitory, computer-readable medium of claim 7, wherein the device management system is a Unified Endpoint Management system. ### Claim 13 A system for accessing system resources from an unenrolled user device, comprising: a memory storage including a non-transitory, computer-readable medium comprising instructions; and a computing device including a hardware-based processor that executes the instructions to carry out stages comprising: pairing a first user device with a second user device, wherein the first user device is enrolled with a device management system and the second user device is not enrolled with the device management system, the second user device includes a managed web browser that is managed by the device management system, the first user device is logged in to, under a user profile that was used to enroll the first user device, and the web browser of the second user device is logged in to, under the user profile that was used to enroll the first user device, and the pairing of the first user device and the second user device includes the web browser of the second user device sending a certificate received from the device management system to the first user device to verify the second user device to the first user device; receiving, at the first user device, a random key from the second user device, the random key having been provided by the managed web browser of the second user device; receiving, at the first user device, a request for a resource associated with the device management system, wherein the resource request includes the random key; determining, by the first user device, that the resource request came from the second user device based on the random key; sending, by the first user device, the resource request to a server associated with the device management system; receiving, at the first user device, the requested resource from the server; and sending, by the first user device, the requested resource to the managed web browser of the second user device. ### Claim 14 (depends on 13) The system of claim 13, wherein the pairing further includes: providing, by the first user device, a local network address of the first user device; receiving, at the first user device, a connection request from the second user device; displaying, on the first user device, a first randomly generated number; and receiving user input indicating that the first randomly generated number matches a second number displayed on the second user device. ### Claim 15 (depends on 13) The system of claim 13, wherein, prior to the resource request being received at the first user device, the stages further comprise: detecting, on a local network, a broadcast of the random key, the broadcast having been sent by the second user device; and providing, by the first user device, a local network address of the first user device to the second user device. ### Claim 16 (depends on 13) The system of claim 13, the stages further comprising: receiving, at the first user device, a first public encryption key from the second user device; sending, by the first user device, a second public encryption key to the second user device, wherein the resource request is received at the first user device having been encrypted with the second public encryption key; decrypting, at the first user device, the encrypted resource request using a second private key, the second private key being associated with the second public encryption key; and sending, from the first user device, the requested resource to the second user device, the requested resource having been encrypted with the first public encryption key. ### Claim 17 (depends on 13) The system of claim 13, wherein the second user device is an Internet of Things device.