# US 12,603,780 B2 · System and method for managing an operating system using tokenized identity

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,603,780 B2
- Document ID: US12603780B2
- Status: Granted
- Kind: B2
- Application number: 18/782,801
- Filed: 2024-07-24
- Published: 2024-11-14
- Granted: 2026-04-14
- Earliest claimed: 2019-09-25
- Assignees: Amod Ashok Dange
- Applicants: Amod Ashok Dange
- Inventors: Amod Ashok Dange; Yash Mody
- Web page: https://patentgrep.com/patent/US12603780B2

## CPC

- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/0866: {involving user or device identifiers, e.g. serial number, physical or biometrical information, DNA, hand-signature or measurable physical characteristics}
- H04L 9/0869: {involving random numbers or seeds}
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 9/3231: {Biological data, e.g. fingerprint, voice or retina (network architectures or network communication protocols for supporting authentication of entities using biometrical features in a packet data network H04L63/0861)}
- H04L 9/3247: {involving digital signatures}
- H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)}
- G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints
- H04L 63/0281: {Proxies}
- H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)}
- H04L 63/102: {Entity profiles}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A System for managing an operating system using tokenized identity. The system maintains a token repository storing user tokens, Unique-Numbers, and Public-Keys. The system registers users by processing biometric samples to compute a Secret-Key, generating a Unique-Number, and computing a Public-Key. The Public-Key (P1) is stored in the token repository, on the provisioned virtual remote device, and on a thin client application on a personal local device. The Unique-Number is stored on the provisioned virtual remote device and in the token repository. Further, the system receives session signing requests from a proxy-user management application integrated with various device Operating Systems via thin client sessions. The system authenticates users through a two-step process using real-time biometric samples, and comparing computed Real-Time-Unique-Numbers with stored Unique-Numbers. Upon authentication, the system fetches user tokens, identifies corresponding proxy-user management application instances, captures user approval, and affixes biometrically authenticated signatures in session logs.

## Claims

### Claim 1

A System for managing an Operating System using tokenized identity, the system comprising:
a processor and a memory coupled to the processor, wherein the processor is configured to execute instructions stored in the memory for:
a) maintaining a token repository, wherein the token repository is configured to maintain a user token, a Unique-Number, and a Public-Key corresponding to each user from a set of users;
b) registering a user by,
receiving a set of biometric samples of the user corresponding to one or more biometric factors,
processing the set of biometric samples to compute a Secret-Key (S1) corresponding to the user,
generating a Unique-Number (N1) using a random number generation algorithm,
applying a Function (F1) to the Secret-Key (S1) and the Unique-Number (N1) to compute a Public-Key (P1),
storing the Unique-Number (N1) on a provisioned virtual remote device and in a token repository, wherein the provisioned virtual remote device is a virtual machine corresponding to the user, wherein the provisioned virtual remote device is hosted over a remote server, wherein the token repository is hosted over a centralized server and
storing the Public-Key (P1) in the token repository, on the provisioned virtual remote device, and on a thin client application on a personal local device,
receiving a user input on the thin client application corresponding to one or more immutable attributes of the user,
generating an immutable attribute token for each immutable attribute, and
storing the immutable attribute tokens along with the Public-Key (P1) in the token repository;
c) transmitting to a user, a session signing request from a proxy-user management application, wherein the proxy-user management application is integrated with a device Operating System (OS), wherein the session signing request corresponds to a user-authenticated session, on the device Operating System (OS), wherein the session signing request is received via a thin client session running on a client device;
d) initiating a first authentication process for authenticating the user via the thin client session by,
receiving a biometric sample captured from the user in real-time,
processing the biometric sample to generate a Secret-Key (S2),
when using a thin client application on a personal local device,
selecting the Public-Key (P1) from the thin client application,
fetching the corresponding Public-Key (P1) from the token repository,
computing a Real-Time-Unique-Number (N2) using the Public-Key (P1), the Secret-Key (S2) and the Function (F1), and
authenticating the user based on comparison of the Real-Time-Unique-Number (N2) with the Unique-Number (N1) stored in the token repository,
when using a thin client application on a non-personal local device,
receiving a user input corresponding to the one or more immutable attributes of the user,
generating a token corresponding to each of the one or more immutable attributes,
querying the token repository for one or more tokens,
fetching the public-keys (P1-Pn) corresponding to the one or more tokens,
computing a Real-Time-Unique-Number (N2) for each Public-Key (P1-Pn), the Secret-Key (S2) and the Function (F1), identifying a target Real-Time-Unique-Number (N2 t),
wherein the target Real-Time-Unique-Number (N2 t) matches the Unique-Number (N1) stored in the token repository, and
authenticating the user based on comparison of the target Real-Time-Unique-Numbers (N2 t) with the Unique-Number (N1) stored in the token repository;
e) fetching from the token repository, a user token (T1) corresponding to the Unique-Number (N1);
f) Identifying from a set of proxy-user management application instances, a proxy-user management application instance corresponding to the user token (T1);
g) displaying a request to sign the proxy-user management application session and the corresponding device OS session;
h) capturing the user's approval to affix the user's biometrically authenticated signature to the session;
i) initiating a second authentication process; and
j) recording the user's biometrically authenticated signature in the proxy-user management application session log.

### Claim 2 (depends on 1)

The system of claim 1, wherein the proxy-user management application is a device operating system, wherein the device operating system corresponds to a computer OS, an Artificial Intelligence (AI) Agent OS, or a Robot OS,
wherein the user is logged into computer, wherein the user's biometrically authenticated signature in the proxy-user management application session log corresponds to the user's authorization for the computer operation session,
wherein the AI Agent represents the user when interacting with others, wherein the user's biometrically authenticated signature in the proxy-user management application session log corresponds to the user's authorization for the AI Agent operation session, and
wherein the Robot represents the user, when interacting with others, wherein the user's biometrically authenticated signature in the proxy-user management application session log corresponds to the user's authorization for the Robot operation session.

### Claim 3 (depends on 1)

The system of claim 1, wherein the session signing request is triggered by the proxy-user management application session based on a set of predefined rules.

### Claim 4 (depends on 1)

The system of claim 1, wherein the session signing request is generated upon receiving a user command to launch the proxy-user management application session.

### Claim 5 (depends on 4)

The system of claim 4, wherein the proxy-user management application session is configured to record the user's biometrically authenticated signature, wherein the user's biometrically authenticated signature represents a promise to abide by the terms and conditions specified in respect of the proxy-user management application session.

### Claim 6 (depends on 1)

The system of claim 1, wherein the second authentication process is triggered upon capturing the user's approval through the user interface, wherein the second authentication process is the same as the first authentication process.

### Claim 7 (depends on 1)

The system of claim 1, wherein when the user is accessing the system via a thin client on the user's personal device, fetching the Public-Key (P1) corresponding to the user from the token repository.

### Claim 8

A method for managing an Operating System using tokenized identity, the method comprising steps of:
a) maintaining a token repository, wherein the token repository is configured to maintain a user token, a Unique-Number, and a Public-Key corresponding to each user from a set of users;
b) registering a user by,
receiving a set of biometric samples of the user corresponding to one or more biometric factors,
processing the set of biometric samples to compute a Secret-Key (S1) corresponding to the user,
generating a Unique-Number (N1) using a random number generation algorithm,
applying a Function (F1) to the Secret-Key (S1) and the Unique-Number (N1) to compute a Public-Key (P1),
storing the Unique-Number (N1) on a provisioned virtual remote device and in a token repository, wherein the provisioned virtual remote device is a virtual machine corresponding to the user, wherein the provisioned virtual remote device is hosted over a remote server, wherein the token repository is hosted over a centralized server and
storing the Public-Key (P1) in the token repository, on the provisioned virtual remote device, and on a thin client application on a personal local device,
receiving a user input on the thin client application corresponding to one or more immutable attributes of the user,
generating an immutable attribute token for each immutable attribute, and
storing the immutable attribute tokens along with the Public-Key (P1) in the token repository;
c) transmitting to a user, a session signing request from a proxy-user management application, wherein the proxy-user management application is integrated with a device Operating System (OS), wherein the session signing request corresponds to a user-authenticated session, on the device Operating System (OS), wherein the session signing request is received via a thin client session running on a client device;
d) initiating a first authentication process for authenticating the user via the thin client session by,
receiving a biometric sample captured from the user in real-time,
processing the biometric sample to generate a Secret-Key (S2),
when using a thin client application on a personal local device,
selecting the Public-Key (P1) from the thin client application,
fetching the corresponding Public-Key (P1) from the token repository,
computing a Real-Time-Unique-Number (N2) using the Public-Key (P1), the Secret-Key (S2) and the Function (F1), and
authenticating the user based on comparison of the Real-Time-Unique-Number (N2) with the Unique-Number (N1) stored in the token repository,
when using a thin client application on a non-personal local device,
receiving a user input corresponding to the one or more immutable attributes of the user,
generating a token corresponding to each of the one or more immutable attributes,
querying the token repository for one or more tokens;
fetching the public-keys (P1-Pn) corresponding to the one or more tokens,
computing a Real-Time-Unique-Number (N2) for each Public-Key (P1-Pn), the Secret-Key (S2) and the Function (F1),
identifying a target Real-Time-Unique-Number (N2 t), wherein the target Real-Time-Unique-Number (N2 t) matches the Unique-Number (N1) stored in the token repository, and
authenticating the user based on comparison of the target Real-Time-Unique-Numbers (N2 t) with the Unique-Number (N1) stored in the token repository;
e) fetching from the token repository, a user token (T1) corresponding to the Unique-Number (N1);
f) identifying from a set of proxy-user management application instances, a proxy-user management application instance corresponding to the user token (T1);
g) displaying a request to sign the proxy-user management application session and the corresponding device OS session;
h) capturing the user's approval to affix the user's biometrically authenticated signature to the session;
i) initiating a second authentication process; and
j) recording the user's biometrically authenticated signature in the proxy-user management application session log.

### Claim 9 (depends on 8)

The method of claim 8, wherein the proxy-user management application is a device operating system, wherein the device operating system corresponds to a computer OS, an Artificial Intelligence (AI) Agent OS, or a Robot OS,
wherein the user is logged into a computer, wherein the user's biometrically authenticated signature in the proxy-user management application session log corresponds to the user's authorization for the computer operation session,
wherein the AI Agent represents the user when interacting with others, wherein the user's biometrically authenticated signature in the proxy-user management application session log corresponds to the user's authorization for the AI Agent operation session,
wherein the Robot represents the user, when interacting with others, wherein the user's biometrically authenticated signature in the proxy-user management application session log corresponds to the user's authorization for the Robot operation session.

### Claim 10 (depends on 8)

The method of claim 8, wherein the session signing request is triggered by the proxy-user management application session based on a set of predefined rules.

### Claim 11 (depends on 10)

The method of claim 10, wherein the proxy-user management application session is configured to record the user's biometrically authenticated signature, wherein the user's biometrically authenticated signature represents an agreement to abide by the terms and conditions specified in respect of the proxy-user management application session.

### Claim 12 (depends on 8)

The method of claim 8, wherein the session signing request is generated upon receiving a user command to launch the proxy-user management application session.

### Claim 13 (depends on 8)

The method of claim 8, wherein the second authentication process is triggered upon capturing the user's approval through the user interface, wherein the second authentication process is the same as the first authentication process.

### Claim 14

A non-transitory computer-readable storage medium storing a computer program product comprising computer-executable instructions for managing an Operating System using tokenized identity, which when executed by one or more processors, cause the one or more processors to:
a) maintain a token repository, wherein the token repository is configured to maintain a user token, a Unique-Number, and a Public-Key corresponding to each user from a set of users;
b) registering a user by,
receiving a set of biometric samples of the user corresponding to one or more biometric factors,
processing the set of biometric samples to compute a Secret-Key (S1) corresponding to the user,
generating a Unique-Number (N1) using a random number generation algorithm,
applying a Function (F1) to the Secret-Key (S1) and the Unique-Number (N1) to compute a Public-Key (P1),
storing the Unique-Number (N1) on a provisioned virtual remote device and in a token repository, wherein the provisioned virtual remote device is a virtual machine corresponding to the user, wherein the provisioned virtual remote device is hosted over a remote server, wherein the token repository is hosted over a centralized server, and
storing the Public-Key (P1) in the token repository, on the provisioned virtual remote device, and on a thin client application on a personal local device,
receiving a user input on the thin client application corresponding to one or more immutable attributes of the user,
generating an immutable attribute token for each immutable attribute, and
storing the immutable attribute tokens along with the Public-Key (P1) in the token repository;
c) transmitting to a user, a session signing request from a proxy-user management application, wherein the proxy-user management application is integrated with a device Operating System (OS), wherein the session signing request corresponds to a user-authenticated session, on the device Operating System (OS), wherein the session signing request is received via a thin client session running on a client device;
d) initiating a first authentication process for authenticating the user via the thin client session by,
receiving a biometric sample captured from the user in real-time,
processing the biometric sample to generate a Secret-Key (S2),
when using a thin client application on a personal local device,
selecting the Public-Key (P1) from the thin client application;
fetching the corresponding Public-Key (P1) from the token repository,
computing a Real-Time-Unique-Number (N2) using the Public-Key (P1), the Secret-Key (S2) and the Function (F1), and
authenticating the user based on comparison of the Real-Time-Unique-Number (N2) with the Unique-Number (N1) stored in the token repository,
when using a thin client application on a non-personal local device,
receiving a user input corresponding to the one or more immutable attributes of the user,
generating a token corresponding to each of the one or more immutable attributes,
querying the token repository for one or more tokens,
fetching the public-keys (P1-Pn) corresponding to the one or more tokens,
computing a Real-Time-Unique-Number (N2) for each Public-Key (P1-Pn), the Secret-Key (S2) and the Function (F1),
identifying a target Real-Time-Unique-Number (N2 t), wherein the target Real-Time-Unique-Number (N2 t) matches the Unique-Number (N1) stored in the token repository, and
authenticating the user based on comparison of the target Real-Time-Unique-Numbers (N2 t) with the Unique-Number (N1) stored in the token repository,
e) fetching from the token repository, a user token (T1) corresponding to the Unique-Number (N1);
f) identifying from a set of proxy-user management application instances, a proxy-user management application instance corresponding to the user token (T1);
g) displaying a request to sign the proxy-user management application session and the corresponding device OS session;
h) capturing the user's approval to affix the user's biometrically authenticated signature to the session;
i) initiating a second authentication process; and
j) recording the user's biometrically authenticated signature in the proxy-user management application session log.