# US 10,454,921 B1 · Protection of authentication credentials of cloud services > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,454,921 B1 - Document ID: US10454921B1 - Status: Granted - Kind: B1 - Application number: 14/490,297 - Filed: 2014-09-18 - Granted: 2019-10-22 - Earliest claimed: 2014-09-18 - Assignees: Trend Micro Incorporated - Applicants: Yifen Chen; Shen-Nan Huang; Chi-Chang Kung - Inventors: Yifen Chen; Shen-Nan Huang; Chi-Chang Kung - Web page: https://patentgrep.com/patent/US10454921B1 ## CPC - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - G06F 16/22: Indexing; Data structures therefor; Storage structures - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A proxy server is implemented between a user computer and the Web. The user accesses an IAM service and selects a cloud service. The proxy server intercepts the login form from the user, stores the identifier and password, and replaces the identifier and password. The proxy server allows the form to continue to the IAM service which registers the cloud service. Later, the user accesses the IAM service and selects the cloud service. The IAM service returns a login form for the cloud service with the identifier and password and redirects the user's computer to the cloud service. The proxy server intercepts the form and replaces the identifier and password with the correct identifier and password. The proxy server then allows the form to continue to the cloud service. The user is then authenticated by the cloud service and receives a Web page from the cloud service indicating logged in. ## Claims ### Claim 1 In a proxy gateway computer, a method of registering a cloud service with an access management server providing access to a plurality of different cloud services, said method comprising: passing a first request from a user computer of a user to register a selected cloud service to said access management server; passing a second request from said access management server to provide authentication credentials to said user computer; intercepting a response from said user computer that includes a user identifier and a password for said selected cloud service; storing said password in a database under control of said proxy gateway computer, wherein said password is stored within a domain trusted by said user; replacing said password in said response with an unusable password that does not provide access to said selected cloud service, said unusable password including a random string of symbols or an encrypted string of symbols; and allowing said response with said user identifier and said unusable password to continue to said access management server, wherein said access management server does not have access to said password. ### Claim 2 (depends on 1) The method as recited in claim 1 wherein said unusable password includes random characters. ### Claim 3 (depends on 1) The method as recited in claim 1 wherein said unusable password is said password encrypted with an encryption key, said method further comprising: storing said encryption key in said database under control of said user. ### Claim 4 (depends on 1) The method as recited in claim 1 further comprising: storing said user identifier in said database under control of said proxy gateway computer; and replacing said user identifier in said response with an unusable user identifier that does not provide access to said selected cloud service. ### Claim 5 (depends on 1) The method as recited in claim 1 wherein said database is not under control of said access management server. ### Claim 6 (depends on 1) The method as recited in claim 1 wherein said access management server is an identity and access management (IAM) server. ### Claim 7 (depends on 1) The method as recited in claim 1 wherein said database is located on said user computer, is located within an enterprise to which said user computer belongs, or is located on said proxy gateway computer. ### Claim 8 (depends on 1) The method as recited in claim 1 wherein said proxy gateway computer is located within an enterprise that includes said user computer or wherein said proxy gateway computer is located remotely from said user computer over an Internet connection. ### Claim 9 (depends on 1) The method as recited in claim 1, further comprising: in response to a subsequent access of the selected cloud service, using the user identifier to determine said password stored in said database. ### Claim 10 (depends on 1) The method as recited in claim 1 further comprising: passing a list of said cloud services to said user computer for display. ### Claim 11 (depends on 1) The method as recited in claim 1 wherein said access management server is located remotely from said user computer, wherein said proxy gateway computer intercepts all Web traffic between said user computer and the Internet, wherein said database is not under control of said access management server, said method further comprising: passing said first request to said access management server over an Internet connection; and intercepting said response from said user computer to said access management server. ### Claim 12 (depends on 11) The method as recited in claim 11 wherein said unusable password is said password encrypted with an encryption key, said method further comprising: storing said encryption key in said database under control of said user. ### Claim 13 In a proxy gateway computer, a method of accessing a cloud service via an access management server providing access to a plurality of different cloud services, said method comprising: passing a first request from a user computer of a user to said access management server in order to login to said access management server; passing a second request from said user computer in order to access a selected cloud service to said access management server; intercepting a response from said access management server intended for said cloud service that includes a user identifier and a password of said user for said selected cloud service, said password including a random string of symbols or an encrypted string of symbols; retrieving from a database under control of said proxy gateway computer a correct password that provides access to selected cloud service for said user, wherein said correct password is stored within a domain trusted by said user, and wherein said access management server does not have access to said correct password; replacing said password in said response with said correct password; and allowing said response with said user identifier and said correct password to continue to said selected cloud service. ### Claim 14 (depends on 13) The method as recited in claim 13 wherein said password includes random characters and does not provide access to said selected cloud service. ### Claim 15 (depends on 13) The method as recited in claim 13 wherein said password is said correct password encrypted with an encryption key, said method further comprising: replacing said password with said correct password by decrypting said password with said encryption key. ### Claim 16 (depends on 13) The method as recited in claim 13 further comprising: retrieving from said database under control of said user a correct user identifier that provides access to said selected cloud service; and replacing said user identifier in said response with said correct user identifier. ### Claim 17 (depends on 13) The method as recited in claim 13 wherein said database is not under control of said access management server. ### Claim 18 (depends on 13) The method as recited in claim 13 wherein said access management server is an identity and access management (IAM) server. ### Claim 19 (depends on 13) The method as recited in claim 13 wherein said database is located on said user computer, is located within an enterprise to which said user computer belongs, or is located on said proxy gateway computer. ### Claim 20 (depends on 13) The method as recited in claim 13 further comprising: passing a list of said cloud services to said user computer for display. ### Claim 21 (depends on 13) The method as recited in claim 13 wherein said access management server is located remotely from said user computer, wherein said proxy gateway computer intercepts all Web traffic between said user computer and the Internet, wherein said database is not under control of said access management server, wherein said password intercepted from said access management server is unusable and does not provide access to said selected cloud service, said method further comprising: passing said first request to said access management server over an Internet connection. ### Claim 22 (depends on 21) The method as recited in claim 21 wherein said password is said correct password encrypted with an encryption key, said method further comprising: replacing said password with said correct password by decrypting said password with said encryption key. ### Claim 23 In a proxy gateway computer, a method of accessing a cloud service via an access management server providing access to a plurality of different cloud services, said method comprising: passing a first request from a user computer of a user to access a selected cloud service to said access management server; passing a second request from said access management server to provide authentication credentials to said user computer; intercepting a first response from said user computer that includes a user identifier and a password for said selected cloud service; storing said password in a database under control of said proxy gateway server, wherein said password is stored within a domain trusted by said user; replacing said password in said response with an unusable password that does not provide access to said selected cloud service, said unusable password including a random string of symbols or an encrypted string of symbols; intercepting a second response from said access management server intended for said cloud service that includes a user identifier and said unusable password of said user for said selected cloud service, wherein said access management server does not have access to said password; replacing said unusable password in said response with said password; and allowing said second response with said user identifier and said password to continue to said selected cloud service. ### Claim 24 (depends on 23) The method as recited in claim 23 wherein said proxy gateway computer is under control of an enterprise that also controls said user computer. ### Claim 25 (depends on 23) The method as recited in claim 23 wherein said proxy gateway computer is located remotely over an Internet connection from said user computer and provides software as a service. ### Claim 26 (depends on 23) The method as recited in claim 23 further comprising: storing said password in a local database under control of said user before said step of replacing said password. ### Claim 27 (depends on 23) The method as recited in claim 23 further comprising: passing to said user computer a Web page from said selected cloud service indicating that said user has been authenticated by said selected cloud service. ### Claim 28 (depends on 23) The method as recited in claim 23 wherein said database is located on said user computer, is located within an enterprise to which said user computer belongs, or is located on said proxy gateway computer. ### Claim 29 (depends on 23) The method as recited in claim 23 further comprising: passing a list of said cloud services to said user computer for display. ### Claim 30 (depends on 23) The method as recited in claim 23 wherein said access management server is located remotely from said user computer, wherein said proxy gateway computer intercepts all Web traffic between said user computer and the Internet, wherein said database is not under control of said access management server, said method further comprising: passing said first request to said access management server over an Internet connection; and intercepting said first response from said user computer to said access management server. ### Claim 31 (depends on 30) The method as recited in claim 30 wherein said unusable password is said password encrypted with an encryption key, said method further comprising: storing said encryption key in said database. ### Claim 32 (depends on 23) The method as recited in claim 23 wherein said unusable password is said password encrypted with an encryption key, said method further comprising: storing said encryption key in said database; and replacing said unusable password in said response with said password by decrypting said unusable password with said encryption key.