# US 2018/0026972 A1 · Authentication of a Client Device Based on Entropy from a Server or Other Device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0026972 A1 - Document ID: US20180026972A1 - Status: Published application - Kind: A1 - Application number: 15/710,999 - Filed: 2017-09-21 - Published: 2018-01-25 - Earliest claimed: 2015-04-15 - Assignees: Citrix Systems, Inc. - Applicants: Citrix Systems, Inc. - Inventors: Ola Nordstrom; Georgy Momchilov; Timothy Gaylor - Web page: https://patentgrep.com/patent/US20180026972A1 ## CPC - H04L 63/0846: {using time-dependent-passwords, e.g. periodically changing passwords} - G06F 21/31: User authentication - H04L 9/3228: {One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key} - H04L 63/068: {using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and systems for authenticating a client device using entropy provided by a server and/or a device paired with the client device are described herein. The system may generate static entropy and time-limited entropy based on data from the server and/or the paired device. The static and time-limited entropy may be used to authenticate the client device (application or a user of the client device) in addition to authentication credentials or entropy such as a PIN or password provided by the user. The time-limited entropy may have an expiration time. If the time-limited entropy is expired, the system may request the user to perform a hard authentication with the server, such as by providing a username, password, and/or optionally a two-factor authentication code, among other information. ## Claims ### Claim 1 A method comprising: transmitting, by a wireless device and to a server, a request to associate the wireless device with a client device, wherein the request comprises information indicating the wireless device and the client device; receiving, by the wireless device and from the server, first entropy and an expiration time for the first entropy, wherein the first entropy is generated by the server; storing, at the wireless device, the first entropy and the expiration time for the first entropy; generating a wireless connection between the wireless device and the client device; receiving, at the client device, a user credential; transmitting, by the client device and to the wireless device, a request for the first entropy; receiving, by the client device and from the wireless device, the first entropy; accessing, by the client device and based on the first entropy, a stored user credential; and based on a comparison of the received user credential to the stored user credential, granting a user of the client device access to one or more resources. ### Claim 2 (depends on 1) The method of claim 1, wherein accessing the stored user credential comprises: decrypting, by the client device and using the first entropy, second entropy generated by the server; and decrypting, by the client device and using the second entropy, the stored user credential. ### Claim 3 (depends on 1) The method of claim 1, further comprising: determining, by the client device, that a connection between the client device and the server cannot be established, wherein transmitting the request for the first entropy is performed in response to determining that the connection between the client device and the server cannot be established. ### Claim 4 (depends on 1) The method of claim 1, wherein receiving the first entropy and the expiration time for the first entropy is performed in response to the client device sending, to the server, approval for the server to send the first entropy to the wireless device. ### Claim 5 (depends on 1) The method of claim 1, wherein the request to associate the wireless device with the client device comprises one or more of the user credential or information associated with the wireless connection between the wireless device and the client device. ### Claim 6 (depends on 1) The method of claim 1, wherein the first entropy received by the wireless device is encrypted using a public key of the client device, and wherein the expiration time for the first entropy is not encrypted using the public key of the client device. ### Claim 7 (depends on 1) The method of claim 1, further comprising: after storing the first entropy and the expiration time for the first entropy, determining, by the wireless device, whether the expiration time for the first entropy has been exceeded; in response to determining that the expiration time has been exceeded, sending, by the wireless device and to the server, a second request to associate the wireless device with the client device, wherein the second request comprises information indicating the wireless device and the client device; receiving, by the wireless device and from the server, the first entropy and a second expiration time for the first entropy; and storing, at the wireless device, the first entropy and the second expiration time for the first entropy. ### Claim 8 (depends on 1) The method of claim 1, further comprising: determining, by the wireless device, whether the expiration time for the first entropy has been exceeded, wherein sending the first entropy to the client device is performed in response to determining that the expiration time for the first entropy has not been exceeded. ### Claim 9 (depends on 1) The method of claim 1, wherein the wireless device comprises a wireless mouse, and wherein the wireless connection comprises a Bluetooth connection or a Near Field Communication connection. ### Claim 10 (depends on 1) The method of claim 1, wherein the wireless device comprises a mobile phone, and wherein the wireless connection comprises a Bluetooth connection, a Near Field Communication connection, or a Wi-Fi connection. ### Claim 11 (depends on 1) The method of claim 1, further comprising: after the client device transmits, to the wireless device, the request for the first entropy, receiving, by the wireless device and from the client device, the request for the first entropy; and in response to receiving the request for the first entropy, sending, by the wireless device and to the client device, the first entropy. ### Claim 12 A method comprising: receiving, by a server and from a wireless device, a request to associate the wireless device with a client device, wherein the request comprises information indicating the wireless device and the client device; granting, by the server and to the wireless device, access to first entropy generated by the server; determining, by the server, an expiration time for the first entropy; encrypting, by the server and using a public key of the client device, the first entropy; and sending, by the server and to the wireless device, the expiration time for the first entropy and the encrypted first entropy, wherein the first entropy and second entropy generated by the server are configured to be used to access a stored user credential. ### Claim 13 (depends on 12) The method of claim 12, further comprising: generating, by the server, the first entropy; and generating, by the server, using a user credential provided by a user of the client device, and using the first entropy generated by the server, a key for the second entropy. ### Claim 14 (depends on 12) The method of claim 12, further comprising: signing, by the server, the expiration time for the first entropy, wherein sending the expiration time for the first entropy and the encrypted first entropy comprises sending the signed expiration time and the encrypted first entropy. ### Claim 15 (depends on 12) The method of claim 12, further comprising: after receiving the request to associate the wireless device with the client device, determining the client device based on the information received from the wireless device; transmitting, by the server and to the client device, a request to grant, to the wireless device, access to the first entropy; and receiving, by the server and from the client device, approval of the request to grant, to the wireless device, access to the first entropy, wherein granting, to the wireless device, access to the first entropy is based on the approval. ### Claim 16 (depends on 12) The method of claim 12, wherein granting, to the wireless device, access to the first entropy is based on a determination that the wireless device is paired with the client device. ### Claim 17 (depends on 12) The method of claim 12, wherein the request to associate the wireless device with the client device comprises one or more of a user credential or information associated with a wireless connection between the wireless device and the client device. ### Claim 18 (depends on 12) The method of claim 12, further comprising: receiving, by the server and from the wireless device, a second request to associate the wireless device with the client device, wherein the second request comprises information indicating the wireless device and the client device; determining, by the server, a second expiration time for the first entropy; and sending, by the server and to the wireless device, the second expiration time for the first entropy and the encrypted first entropy. ### Claim 19 An apparatus, comprising: a processor; and memory storing computer-executable instructions that, when executed by the processor, cause the apparatus to: receive, from a wireless device, a request to associate the wireless device with a client device, wherein the request comprises information indicating the wireless device and the client device; grant, to the wireless device, access to first entropy generated by the apparatus; determine an expiration time for the first entropy; encrypt, using a public key of the client device, the first entropy; and send, to the wireless device, the expiration time for the first entropy and the encrypted first entropy, wherein the first entropy and second entropy generated by the apparatus are configured to be used to access a stored user credential. ### Claim 20 (depends on 19) The apparatus of claim 19, wherein the memory stores additional computer-executable instructions that, when executed by the processor, cause the apparatus to: after receiving the request to associate the wireless device with the client device, determine the client device based on the information received from the wireless device; transmit, to the client device, a request to grant, to the wireless device, access to the first entropy; and receive, from the client device, approval of the request to grant, to the wireless device, access to the first entropy, wherein granting, to the wireless device, access to the first entropy is based on the approval.