# US 9,882,882 B2 · Methods and systems of data security in browser storage

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,882,882 B2
- Document ID: US9882882B2
- Status: Granted
- Kind: B2
- Application number: 15/268,454
- Filed: 2016-09-16
- Published: 2017-01-05
- Granted: 2018-01-30
- Earliest claimed: 2011-08-29
- Assignees: salesforce.com, inc.
- Applicants: salesforce.com, inc.
- Inventors: Akhilesh Gupta
- Web page: https://patentgrep.com/patent/US9882882B2

## CPC

- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- H04L 67/563: Data redirection of data network streams
- G06F 2221/2107: File encryption
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Mechanisms and methods are provided for managing OAuth access in a database network system, and extending the OAuth flow of authentication to securely store the OAuth encrypted refresh token in the storage available with current browsers or any other non-secure storage on user system.

## Claims

### Claim 1

A non-transitory machine readable medium storing one or more machine instructions, which when invoked cause a processor to implement a method comprising:
at a server that includes at least a processor system having at least one processor and memory system, receiving a passcode and content, wherein the content comprises at least a refresh token;
in response to the receiving the passcode and the content, performing the following,
placing, by the server, the content and passcode into a file/blob;
creating, by the server, a unique encryption key;
encrypting, by the server, the file having the content and the passcode as a 1-way hash generated using a cryptographic hash function with the unique encryption key; and
sending from the server to the user system the encrypted data and a unique identifier for the encrypted file having the passcode and content.

### Claim 2 (depends on 1)

The non-transitory machine readable medium of claim 1, further comprising: storing the content and passcode that were encrypted in a local database at the server.

### Claim 3 (depends on 2)

The non-transitory machine readable medium of claim 2, the content being a token for refreshing an access to another server.

### Claim 4 (depends on 2)

The non-transitory machine readable medium of claim 2, the method further comprising:
sending the content from the server to another server; and
in response to the sending, receiving a token from the other server.

### Claim 5

A non-transitory machine readable medium storing one or more machine instructions, which when invoked cause a processor to implement a method comprising:
receiving, at a server that includes at least a processor system having at least one processor and memory system, a passcode and encrypted content and a unique key identifier, wherein the content comprises at least a refresh token;
in response to the receiving, performing the following,
querying a local database for the encryption key based on the key identifier;
decrypting the encrypted content with the key;
determining whether the passcode stored previously within the content and the passcode provided by the user match one another; and
returning the decrypted content to the user if the passcode decrypted and the passcode provided by the user match one another;
wherein prior to the receiving of the encrypted passcode and encrypted content and the unique key identifier, receiving at the server, from a user device, the content and the passcode for encryption;
in response,
creating, by the server, a file;
placing, by the server, the passcode and content in the file,
generating, by the server, a unique encryption key and unique identifier of the key,
storing in a storage location of the memory system the unique encryption key in association with a unique identifier,
encrypting, by the server, the file in which the passcode and content were placed with the unique encryption key, therein creating the encrypted passcode and the encrypted content;
sending from the server to the user device the encrypted file and the unique key identifier for storage at the user device.

### Claim 6 (depends on 5)

The non-transitory machine readable medium of claim 5, the method further comprising creating a log of the receiving, of the encrypted passcode if the passcode decrypted and the passcode provided by the user do not match one another.

### Claim 7 (depends on 5)

The non-transitory machine readable medium of claim 5, the storing of the token and passcode, including at least storing the token and passcode, which were encrypted, in a database of a browser.

### Claim 8 (depends on 5)

The non-transitory machine readable medium of claim 5, the receiving of the token and the passcode including at least receiving an encrypted file containing the token and the passcode, the token and passcode being encrypted as a result of the file being encrypted.

### Claim 9 (depends on 5)

The non-transitory machine readable medium of claim 5, the method further comprising after sending the content and passcode for encryption, receiving a unique identifier identifying the encryption key and storing the unique identifier in a store area at the user device.

### Claim 10 (depends on 5)

The non-transitory machine readable medium of claim 5, the method further comprising after sending the content and passcode for encryption, receiving a unique identifier identifying the encryption key and storing the unique identifier in a store area associated with the browser at the user device.

### Claim 11 (depends on 5)

The non-transitory machine readable medium of claim 5, further comprising:
receiving at the user system the content prior to sending the content.

### Claim 12 (depends on 5)

The non-transitory machine readable medium of claim 5, the method further comprising:
after the user logs in and prior to sending the passcode and the content to the server, receiving at the user system a request to enter the passcode for the content.

### Claim 13 (depends on 5)

The non-transitory machine readable medium of claim 5, the method further comprising:
sending from the user device, to the server, an encrypted passcode, encrypted content, and a unique key identifier; and
in response, receiving at the user device, from the server, the decrypted content to the user if the passcode decrypted and the passcode provided by the user match one another.