Patent ID: 9569602
Date: 2017-02-14
CPC Classifications: G06F

Claim:
1. A method comprising: receiving from an authenticated user, at an authorization server, via a service provider, an authorization request to perform a sensitive operation on a first device; generating, by the authorization server and in response to receiving the authorization request, an authorization token comprising a device constraint and a binding code constraint comprising a binding code, wherein the binding code is provided to the authenticated user by the service provider after the authenticated user makes the authorization request and before the authorization token is sent to the first device; transmitting, by the authorization server, the authorization token to an isolated execution environment of the first device, wherein the sensitive operation is not permitted on the first device unless the first device successfully performs a verification in the isolated execution environment using the authorization token, wherein performing the verification by the first device comprises: permitting the sensitive operation based on the verification.