# US 10,873,468 B2 · Legacy authentication for user authentication with self-signed certificate and identity verification > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,873,468 B2 - Document ID: US10873468B2 - Status: Granted - Kind: B2 - Application number: 16/796,211 - Filed: 2020-02-20 - Published: 2020-08-27 - Granted: 2020-12-22 - Earliest claimed: 2019-02-22 - Assignees: Beyond Identity Inc. - Applicants: Beyond Identity Inc. - Inventors: Nelson Melo; Michael Clark; James Clark - Web page: https://patentgrep.com/patent/US10873468B2 ## CPC - H04L 9/3265: {using certificate chains, trees or paths; Hierarchical trust model} - G06F 16/214: {Database migration support} - G06F 16/2379: {Updates performed during online database operations; commit processing} - G06F 21/46: by designing passwords or checking the strength of passwords - H04L 9/006: {involving public key infrastructure [PKI] trust models (network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates} - H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB} - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3073: {involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing} - H04L 9/3247: {involving digital signatures} - H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]} - H04L 9/3271: {using challenge-response} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/126: {the source of the received data} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 2209/64: Self-signed certificates - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In embodiments, an authentication server interfaces between a user device with a self-signed certificate and a verifying computer that accepts a user name and password. The user device generates a self-signed certificate signed by a private key on the user device. The self-signed certificate is transmitted to a verifying party computer over a network. A redirecting module redirects the self-signed certificate chain to an authentication server. The authentication server is also provided a user name, password and verifying computer address, which is stored in a password database by the authentication server, in association with the self-signed certificate. Subsequent communications intended for the verifying computer with the self-signed certificate are redirected to the authentication server, which looks up the associated user name and password and transmits the associated user name and password to the verifying computer. ## Claims ### Claim 1 A method for authenticating a user to a verifying computer over a network, comprising: generating a self-signed root certificate signed by a root private key on a user device, wherein the root private key is stored on the user device, and the signing of the self-signed root certificate by the root private key occurs on the user device; generating an intermediate private key from a hardware security module (HSM) on the user device; signing an intermediate certificate with the root private key; linking the intermediate certificate to the self-signed root certificate to form a user device certificate chain, the certificate chain including a public key corresponding to the intermediate private key; transmitting the user device certificate chain to the verifying computer over the network; redirecting the user device certificate chain to an authentication server; providing a user name, user password and verifying computer address to the authentication server; storing the user name, user password and verifying computer address in association with the user device certificate chain in a password database accessible by the authentication server; receiving, at the authentication server, a subsequent communication intended for the verifying computer, the subsequent communication including the user device certificate chain; looking up an associated user name and user password associated with the user device certificate chain in the password database; and transmitting the associated user name and user password to the verifying computer. ### Claim 2 (depends on 1) The method of claim 1 further comprising: receiving, by the authentication server, a login token from the verifying computer; and redirecting the login token to the user device. ### Claim 3 (depends on 1) The method of claim 1 further comprising: creating, by the authentication server, a new password on behalf of the user; storing the new password in association with the user device certificate chain in the password database; and providing the new password to the verifying computer. ### Claim 4 (depends on 1) The method of claim 1 where the step of redirecting the user device certificate chain to an authentication server is performed by a redirect module on the user device. ### Claim 5 (depends on 1) The method of claim 1 where the step of redirecting the user device certificate chain to an authentication server is performed by a redirect module associated with the verifying computer. ### Claim 6 (depends on 1) The method of claim 1 further comprising: determining that the verifying computer accepts certificates; and halting the redirecting of the user device certificate chain to the authentication server. ### Claim 7 (depends on 1) The method of claim 1 further comprising: determining that the self-signed root certificate belongs to the user by: issuing a challenge question to the user device, by the authentication server, using a user public key to encrypt the challenge question; decrypting the challenge question by the user device using the intermediate private key; and sending, by the user device, a response to the challenge question, encrypted with the intermediate private key. ### Claim 8 (depends on 1) The method of claim 1 further comprising: storing, by the user device, the intermediate private key in a signing application in a memory of the user device. ### Claim 9 (depends on 1) The method of claim 1 further comprising: storing, by the user device, the root private key in an external electronic device; and recovering the root private key from the external electronic device. ### Claim 10 A method for authenticating a user to a verifying computer over a network, comprising: generating a self-signed certificate signed by a private key on a user device; transmitting the self-signed certificate to a verifying computer over the network; redirecting the self-signed certificate chain to an authentication server; providing a user name, user password and verifying computer address to the authentication server; storing the user name, user password and verifying computer address in association with the self-signed certificate chain in a password database accessible by the authentication server; receiving, at the authentication server, a subsequent communication intended for the verifying computer, the subsequent communication including the self-signed certificate; looking up an associated user name and user password associated with the self-signed certificate in the password database; and transmitting the associated user name and user password to the verifying computer. ### Claim 11 (depends on 10) The method of claim 10 further comprising: generating an intermediate private key from a hardware security module (HSM) on the user device; signing an intermediate certificate with the intermediate private key; and linking the intermediate certificate to the self-signed certificate to form a user device certificate chain, the certificate chain including a public key corresponding to the intermediate private key. ### Claim 12 (depends on 11) The method of claim 11 further comprising: creating, by the authentication server, a new password on behalf of the user; storing the new password in association with the user device certificate chain in the password database; and providing the new password to the verifying computer. ### Claim 13 (depends on 10) The method of claim 10 where the step of redirecting the self-signed certificate to an authentication server is performed by a redirect module on the user device. ### Claim 14 (depends on 10) The method of claim 10 where the step of redirecting the self-signed certificate to an authentication server is performed by a redirect module associated with the verifying computer. ### Claim 15 A system for authenticating a user to a verifying computer over a network, comprising: (a) a user device including a processor and non-transitory computer readable medium having stored thereon software instructions that, when executed by the processor, cause the processor to generate control signals for executing the steps comprising generating a self-signed root certificate signed by a root private key on the user device, wherein the root private key is stored on the user device, and the signing of the self-signed root certificate by the root private key occurs on the user device; generating an intermediate private key from a hardware security module (HSM) on the user device; signing an intermediate certificate with the root private key; linking the intermediate certificate to the self-signed root certificate to form a user device certificate chain, the certificate chain including a public key corresponding to the intermediate private key; transmitting the user device certificate chain to a verifying computer over the network; (b) a password database; (c) an authenticating server including a processor and non-transitory computer readable medium having stored thereon software instructions that, when executed by the processor, cause the processor to generate control signals for authenticating a user to a verifying computer over a network, by executing the steps comprising receiving the self-signed certificate redirected to the authenticating server; receiving a user name, user password and verifying computer address from the user device; storing the user name, user password and verifying computer address in association with the self-signed certificate chain in the password database; receiving a subsequent communication intended for the verifying computer, the subsequent communication including the self-signed certificate; looking up an associated user name and user password associated with the self-signed certificate in the password database; and transmitting the associated user name and user password to the verifying computer. ### Claim 16 (depends on 15) The system of claim 15 wherein the non-transitory computer readable medium software instructions of the authenticating server, when executed by processor of the authenticating server, further cause the processor of the authenticating server to generate control signals to execute the steps comprising: creating a new password on behalf of the user; storing the new password in association with the self-signed certificate in the password database; and providing the new password to the verifying computer. ### Claim 17 (depends on 15) The system of claim 15 wherein the non-transitory computer readable medium software instructions of the authenticating server, when executed by processor of the authenticating server, further cause the processor of the authenticating server to generate control signals to execute the steps comprising: periodically changing the password associated with the self-signed certificate, and providing instructions to the verifying computer to change the user password, without involving the user device.