US 12,457,097 B2
Zero trust authentication
Ethan Heilman, Boston, MA (US); Lucie Mugnier, Boston, MA (US); Sharon Goldberg, Boston, MA (US); Yuval Marcus, Boston, MA (US); and Sebastien Lipman, Boston, MA (US)
Assigned to CLOUDFLARE, INC., San Francisco, CA (US)
Filed by CLOUDFLARE, INC., San Francisco, CA (US)
Filed on Feb. 1, 2022, as Appl. No. 17/590,657.
Claims priority of provisional application 63/149,994, filed on Feb. 16, 2021.
Prior Publication US 2023/0246816 A1, Aug. 3, 2023
Prior Publication US 2024/0356735 A9, Oct. 24, 2024
Int. Cl. H04L 29/06 (2006.01); H04L 9/08 (2006.01); H04L 9/32 (2006.01)
CPC H04L 9/0825 (2013.01) [H04L 9/085 (2013.01); H04L 9/0869 (2013.01); H04L 9/3213 (2013.01); H04L 9/3247 (2013.01)] 16 Claims
OG exemplary drawing
 
1. A method performed by a client computing system, the method comprising:
providing, to an identity provider (IdP) authority, an authentication nonce value generated by hashing together at least a random value and a public key of the client computing system;
receiving, from the IdP authority, an OAuth authorization token including the authentication nonce value generated by hashing together at least the random value and the public key of the client computing system, wherein the OAuth authorization token is signed by a private key of the IdP authority;
providing, to an intermediary co-signer (ICS) system configured to authenticate messages, a synchronization message directed to a target computing system and including the OAuth authorization token from the client computing system, wherein the synchronization message includes a value indicating to open a shell on the target computing system, wherein the shell comprises a communication channel;
receiving, at the client computing system, a synchronization acknowledgement message in response to the synchronization message;
generating, at the client computing system, a data message to the target computing system, including hashing a copy of the synchronization acknowledgement message to include in the data message; and
providing, from the client computing system, the data message directed to the target computing system via the ICS system.