# US 10,122,714 B2 · Secure user credential access system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,714 B2 - Document ID: US10122714B2 - Status: Granted - Kind: B2 - Application number: 15/098,312 - Filed: 2016-04-13 - Published: 2016-08-11 - Granted: 2018-11-06 - Earliest claimed: 2013-08-01 - Assignees: Bitglass, Inc. - Applicants: Bitglass, Inc. - Inventors: Anurag Kahol; Anoop Kumar Bhattacharjya; Balas Natarajan Kausik - Web page: https://patentgrep.com/patent/US10122714B2 ## CPC - G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries} - G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking - G06F 21/305: {by remotely controlling device operation} - G06F 21/602: {Providing cryptographic facilities or services} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/0471: {applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/0869: {for achieving mutual authentication (cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273)} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - G06F 2221/2107: File encryption - G06F 2221/2115: Third party - H04L 63/0272: {Virtual private networks} - H04L 63/0281: {Proxies} - H04L 63/105: {Multiple levels of security} - H04L 67/56: Provisioning of proxy services (store-and-forward switching systems in data switching networks H04L12/54) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A proxy server mitigates security risks of user credentials sent across a network in clear text. The proxy server encrypts user credentials within a client application request destined for an application server. The proxy server forwards the client application request to the application server. The application server sends the encrypted user credentials to the proxy server where the proxy server decrypts the user credentials and authenticates the user credentials with an authentication server. ## Claims ### Claim 1 A method, comprising: receiving, by a first device, an application access request from a client device across a network, the application access request including a request for access to an application and authentication credentials for a user, the authentication credentials are transmitted in clear-text to the first device; encrypting, by the first device, the authentication credentials in the application access request, the encrypted authentication credentials only decryptable by the first device; sending, by the first device, the received application access request that includes the encrypted authentication credentials to a second device; receiving, by the first device, the encrypted authentication credentials from the second device; decrypting, by the first device, the encrypted authentication credentials; and sending, by the first device, the decrypted authentication credentials to an authentication server. ### Claim 2 (depends on 1) The method as recited in claim 1, wherein the authentication server determines whether the decrypted authentication credentials are valid and sends the determination to the first device. ### Claim 3 (depends on 1) The method as recited in claim 1, wherein the first device is a proxy server. ### Claim 4 (depends on 1) The method as recited in claim 1, further comprising: receiving, by the first device, a validation determination from the authentication server; sending, by the first device, the validation determination to the second device. ### Claim 5 (depends on 1) The method as recited in claim 1, further comprising: receiving, by the first device, a validation determination from the authentication server; sending, by the first device, the validation determination to the second device; receiving, by the first device, a response to the application access request from the second device; sending, by the first device, the response to the client device. ### Claim 6 (depends on 1) The method as recited in claim 1, wherein the second device is an application server. ### Claim 7 (depends on 1) The method as recited in claim 1, wherein the application access request requests access to an application stored on the second device. ### Claim 8 (depends on 1) The method as recited in claim 1, wherein the application access request requests access to a resource managed by the second device. ### Claim 9 (depends on 1) The method as recited in claim 1, wherein the application access request requests access to application specific data stored on the second device. ### Claim 10 (depends on 1) The method as recited in claim 1, wherein prior to the encrypting the authentication credentials: receiving, by the first device, a digitally signed certificate from the client device; validating, by the first device, the digitally signed certificate by using a public key of the client device to decrypt the digitally signed certificate; upon successful decryption of the digitally signed certificate, performing the encrypting the authentication credentials step. ### Claim 11 A system, comprising: a message receiver, implemented at least partially in hardware at a first device, that receives an application access request from a client device across a network, the application access request including a request for access to an application and authentication credentials for a user, the authentication credentials are transmitted in clear-text to the first device; an authentication credential encrypter, implemented at least partially in hardware at the first device, that encrypts the authentication credentials in the application access request, the encrypted authentication credentials only decryptable by the first device; a message transmitter, implemented at least partially in hardware at the first device, that sends the received application access request that includes the encrypted authentication credentials to a second device; wherein the message receiver receives the encrypted authentication credentials from the second device; an authentication credential decrypter, implemented at least partially in hardware at the first device, that decrypts the encrypted authentication credentials; and wherein the message transmitter sends the decrypted authentication credentials to an authentication server. ### Claim 12 (depends on 11) The system as recited in claim 11, wherein the authentication server determines whether the decrypted authentication credentials are valid and sends the determination to the first device. ### Claim 13 (depends on 11) The system as recited in claim 11, wherein the first device is a proxy server and the second device is an application server. ### Claim 14 (depends on 11) The system as recited in claim 11, wherein the message receiver receives a validation determination from the authentication server, wherein the message transmitter sends the validation determination to the second device, wherein the message receiver receives a response to the application access request from the second device, and wherein the message transmitter sends the response to the client device. ### Claim 15 (depends on 11) The system as recited in claim 11, wherein the application access request requests access to a resource managed by the second device. ### Claim 16 One or more non-transitory computer-readable storage media, storing one or more sequences of instructions, which when executed by one or more processors cause performance of: receiving, by a first device, an application access request from a client device across a network, the application access request including a request for access to an application and authentication credentials for a user, the authentication credentials are transmitted in clear-text to the first device; encrypting, by the first device, the authentication credentials in the application access request, the encrypted authentication credentials only decryptable by the first device; sending, by the first device, the received application access request that includes the encrypted authentication credentials to a second device; receiving, by the first device, the encrypted authentication credentials from the second device; decrypting, by the first device, the encrypted authentication credentials; and sending, by the first device, the decrypted authentication credentials to an authentication server. ### Claim 17 (depends on 16) The one or more non-transitory computer-readable storage media as recited in claim 16, wherein the authentication server determines whether the decrypted authentication credentials are valid and sends the determination to the first device. ### Claim 18 (depends on 16) The one or more non-transitory computer-readable storage media as recited in claim 16, wherein the first device is a proxy server and the second device is an application server. ### Claim 19 (depends on 16) The one or more non-transitory computer-readable storage media as recited in claim 16, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to further perform: receiving, by the first device, a validation determination from the authentication server; sending, by the first device, the validation determination to the second device; receiving, by the first device, a response to the application access request from the second device; sending, by the first device, the response to the client device. ### Claim 20 (depends on 16) The one or more non-transitory computer-readable storage media as recited in claim 16, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to further perform: wherein prior to the encrypting the authentication credentials: receiving, by the first device, a digitally signed certificate from the client device; validating, by the first device, the digitally signed certificate by using a public key of the client device to decrypt the digitally signed certificate; upon successful decryption of the digitally signed certificate, performing the encrypting the authentication credentials step.