# US 9,521,146 B2 · Proof of possession for web browser cookie based security tokens > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,521,146 B2 - Document ID: US9521146B2 - Status: Granted - Kind: B2 - Application number: 13/971,835 - Filed: 2013-08-21 - Published: 2015-02-26 - Granted: 2016-12-13 - Earliest claimed: 2013-08-21 - Assignees: Microsoft Technology Licensing, LLC - Applicants: Microsoft Corporation - Inventors: Sanket Kaluskar; Dejan Subotic; Tarek Kamel; Adrian Frei; Guruprasad Aphale; Allan Wetter - Web page: https://patentgrep.com/patent/US9521146B2 ## CPC - H04L 63/10: {for controlling access to devices or network resources} - G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets} - G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 63/0838: {using one-time-passwords} - H04L 63/105: {Multiple levels of security} - G06F 2221/2137: Time limited access, e.g. to a computer or data - H04L 63/168: {above the transport layer} - H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In one embodiment, a user device 110 may access a network service 122 using a secure cookie 300. A high trust process may create an authentication proof 360 using a secure key. The high trust process may provide a browsing token 310 and the authentication proof 360 to a low trust process to send to an authentication service 124. ## Claims ### Claim 1 A machine-implemented method, comprising: sending a login credential to an authentication service for a network service from a system context process executing at an operating system level administrative privilege of a client device; receiving a browsing token and a secure key from the authentication service in the system context process; storing the secure key in a system context of a memory of the client device limiting access to the secure key to the operating system level administrative privilege; creating an authentication proof by creating a time sensitive signature of a browsing token in the system context of the client device using the secure key; and providing the browsing token and the authentication proof to a user context process executing at an application level administrative privilege of the client device to send to the authentication service to access the network service. ### Claim 2 (depends on 1) The method of claim 1, further comprising: register an access of a device system by a user. ### Claim 3 (depends on 1) The method of claim 1, further comprising: receiving the login credential from a user upon access to a device system. ### Claim 4 (depends on 1) The method of claim 1, further comprising: invoking an application programming interface to request the login credential from a user with the user context process. ### Claim 5 (depends on 1) The method of claim 1, further comprising: limiting the authentication proof to a single use. ### Claim 6 (depends on 1) The method of claim 1, further comprising: limiting the authentication proof to an expiration time period. ### Claim 7 A tangible machine-readable storage device having a set of instructions detailing a method stored thereon that when executed by one or more processors cause the one or more processors to perform the method, the method comprising: sending a login credential to an authentication service for a network service from a system context process executing at an operating system level administrative privilege of a client device; receiving a browsing token and a secure key from the authentication service in the system context process; storing the secure key in a system context of a memory of the client device limiting access to the secure key to the operating system level administrative privilege; creating an authentication proof by creating a time sensitive signature of a browsing token in the system context of the client device using the secure key; and providing the browsing token and the authentication proof to a user context process executing at an application level administrative privilege of the client device to send to the authentication service to access the network service. ### Claim 8 (depends on 7) The tangible machine-readable storage device of claim 7, wherein the method further comprises: register an access of a device system by a user. ### Claim 9 (depends on 7) The tangible machine-readable storage device of claim 7, wherein the method further comprises: receiving the login credential from a user upon access to a device system. ### Claim 10 (depends on 7) The tangible machine-readable storage device of claim 7, wherein the method further comprises: invoking an application programming interface to request the login credential from a user with the user context process. ### Claim 11 (depends on 7) The tangible machine-readable storage device of claim 7, wherein the method further comprises: limiting the authentication proof to a single use. ### Claim 12 (depends on 7) The tangible machine-readable storage device of claim 7, wherein the method further comprises: limiting the authentication proof to an expiration time period. ### Claim 13 A client device, comprising: a memory configured to store a secure key from an authentication service for a network service in a system context limiting data access to an operating system level administrative privilege; a processor connected to the memory configured to create an authentication proof by creating a time sensitive signature of a browsing token in a system context process executing at the operating system level administrative privilege of the client device using the secure key and further configured to provide the browsing token and the authentication proof to a user context process executing at an application level administrative privilege of the client device; and a communication interface configured to send a login credential to the authentication service from the system context process, further configured to receive the browsing token and secure key from the authentication service in the system context process, and also configured to send the browsing token and the authentication proof to the authentication service to access the network service for the user context process. ### Claim 14 (depends on 13) The client device of claim 13, further comprising: an input device configured to register an access of a device system by the user. ### Claim 15 (depends on 13) The client device of claim 13, wherein the processor is further configured to invoke an application programming interface to request the login credential from a user with the user context process. ### Claim 16 (depends on 13) The client device of claim 13, further comprising: an input device configured to receive a login credential from a user upon access to a device system. ### Claim 17 (depends on 13) The client device of claim 13, wherein the processor is further configured to limit the authentication proof to a single use. ### Claim 18 (depends on 13) The client device of claim 13, wherein the processor is further configured to limit the authentication proof to an expiration time period. ### Claim 19 (depends on 13) The client device of claim 13, wherein the communication interface is further configured to send an additional login credential from the user context process to the authentication service. ### Claim 20 (depends on 13) The client device of claim 13, wherein the communication interface is further configured to receive for the user context process a set of service tokens bound to the browsing token by the authentication service.