# US 12,764,162 B2 · Establishing endpoint agent device binding for cloud service communications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,764,162 B2 - Document ID: US12764162B2 - Status: Granted - Kind: B2 - Application number: 18/397,936 - Filed: 2023-12-27 - Published: 2025-07-03 - Granted: 2026-10-13 - Earliest claimed: 2023-12-27 - Applicants: Beyond Identity Inc. - Inventors: George Maurice Jenkins; Gregory L. Galloway - Web page: https://patentgrep.com/patent/US12764162B2 ## CPC - H04L 63/166: {at the transport layer} - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/30: {for supporting lawful interception, monitoring or retaining of communications or communication related information (circuit switched telephony call monitoring H04M3/2281)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method for providing a communications channel between a cloud service and a device is provided. A user agent of the device transmits to a coordinator service, a signal to initiate a connection between the user agent and a cloud service. The user agent establishes a connection with the coordinator service. The user agent receives, from the coordinator service, an indication of a unique subdomain of a domain hosted by a gateway service. The user agent transmits, to the gateway service, a handshake message including the subdomain. An authenticator of the device detects the handshake message including the subdomain and sends to the coordinator service, an indication that the handshake message including the subdomain was detected at the device. The user agent receives, from the gateway service, a handshake message to establish a connection with the gateway service. ## Claims ### Claim 1 A method to be implemented by a coordinator server, the method comprising: receiving, from a user agent of a device, a signal to initiate a connection between the user agent and a cloud service; establishing a transport layer security (TLS) tunnel with the user agent; allocating, to the connection, a unique subdomain of a domain hosted by a gateway server; providing, to the user agent, a redirect to the unique subdomain; receiving, from an authenticator of the device, validation that the user agent initiated a connection directed to the unique subdomain; and sending an instruction to the gateway server to permit establishment of a second TLS tunnel between the user agent and the gateway server. ### Claim 2 (depends on 1) The method of claim 1, wherein the unique subdomain includes a value of a connection nonce. ### Claim 3 (depends on 2) The method of claim 2, wherein the connection nonce is an SNI extension. ### Claim 4 (depends on 1) The method of claim 1, further comprising: transmitting, to the authenticator, a confirmation of the validation that the user agent initiated a connection directed to the unique subdomain. ### Claim 5 At least one non-transitory computer-readable medium comprising instructions that, when executed by at least one processor, perform a method comprising: receiving, from a user agent of a device, a signal to initiate a connection between the user agent and a cloud service; establishing a transport layer security (TLS) tunnel with the user agent; allocating, to the connection between the user agent and a cloud service, a unique subdomain of a domain hosted by a gateway server; providing, to the user agent, a redirect to the unique subdomain; receiving, from an authenticator of the device, validation that the user agent initiated a connection directed to the unique subdomain; and sending an instruction to the gateway server to permit establishment of a second TLS tunnel between the user agent the gateway server. ### Claim 6 A method comprising: establishing a transport layer security (TLS) tunnel with a user agent in response to receiving a request from the user agent to connect to a cloud service; generating a subdomain of a domain hosted by a gateway, the subdomain being associated with the request from the user agent; and sending a redirect to the user agent to connect to the subdomain. ### Claim 7 (depends on 6) The method of claim 6, further comprising establishing a TLS tunnel between the user agent and the subdomain of the domain hosted by the gateway. ### Claim 8 (depends on 6) The method of claim 6, further comprising, subsequent to sending the redirect to the user agent to connect to the subdomain, relaying authentication data between the user agent and the cloud service. ### Claim 9 (depends on 6) The method of claim 6, wherein the subdomain includes a value of a connection nonce. ### Claim 10 (depends on 9) The method of claim 9, wherein the connection nonce is provided in a server name indication (SNI) extension. ### Claim 11 (depends on 7) The method of claim 7, further comprising receiving, from an authenticator of a device of the user agent, a notification that a message associated with the TLS tunnel between the user agent and the subdomain of the domain hosted by the gateway was detected at the device. ### Claim 12 (depends on 11) The method of claim 11, further comprising transmitting, to the authenticator, a confirmation of the notification. ### Claim 13 (depends on 6) The method of claim 6, wherein the redirect comprises an HTTP redirect that embeds the subdomain in a URL. ### Claim 14 (depends on 6) The method of claim 6, wherein a coordinator service that establishes the TLS tunnel and the gateway are hosted by separate servers. ### Claim 15 (depends on 6) The method of claim 6, wherein sending the redirect triggers the user agent to establish a second TLS tunnel with the gateway. ### Claim 16 (depends on 1) The method of claim 1, wherein the redirect to the unique subdomain comprises an HTTP redirect that embeds the unique subdomain in a URL. ### Claim 17 (depends on 1) The method of claim 1, wherein the coordinator server and the gateway server are hosted by separate servers. ### Claim 18 (depends on 1) The method of claim 1, further comprising, subsequent to sending the instruction to the gateway server, relaying authentication data between the user agent and the cloud service.