# US 11,115,401 B2 · Administration portal for simulated single sign-on

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,115,401 B2
- Document ID: US11115401B2
- Status: Granted
- Kind: B2
- Application number: 16/505,041
- Filed: 2019-07-08
- Published: 2021-01-14
- Granted: 2021-09-07
- Earliest claimed: 2019-07-08
- Assignees: Bank of America Corporation
- Applicants: Bank of America Corporation
- Inventors: Stuart D. Ford; Sanjay Bhanu; Martin Sunder Singh Devasirvatham Samuel
- Web page: https://patentgrep.com/patent/US11115401B2

## CPC

- H04L 63/0815: {providing single-sign-on or federations}
- H04L 9/321: {involving a third party or a trusted authority}
- H04L 63/0421: {Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system manages security policy data used to provide access by a user to third-party applications without revealing sign-on credentials to the user. The system includes an access management server that hosts an administration portal for configuring the security policy data. The security policy data includes, for each user, a list of applications to which the user may request access and the corresponding sign-on credentials for accessing each of the applications. In response to inputs provided at the administration portal, the system associates applications with credentials and subsequently associates the credentials with a user. Before these associations are used to update the security policy data, a request for confirmation of user permission is sent to a permission server, which stores current permission data for users. If permission for the user is confirmed, security policy data is updated according to the associations provided via the administration portal.

## Claims

### Claim 1

A system for securely managing security policy data used to provide users access to third-party applications without revealing credentials to the users, the system comprising:
a permission server, comprising a hardware processor, configured to store permission data comprising a list of third-party applications to which the users are currently permitted access; and
an access management server communicatively coupled to the permission server and a network, the access management server configured to:
store security policy data, the security policy data comprising, for each user, a list of third-party applications to which the user may request access and the corresponding sign-on credentials for accessing each of the third-party applications;
host an administration portal on the network, the administration portal comprising a user interface configured to be displayed on a device of an administrator;
receive, in response to input provided by the administrator in the user interface, a selection of a first deployment to configure, the first deployment corresponding to a first third-party application and a first network address for a first sign-on page of the first third-party application;
receive, in response to input provided by the administrator at the user interface, first sign-on credentials for the first deployment, wherein the first sign-on credentials provide access to the first third-party application via the first sign-on page;
receive, in response to input provided by the administrator in the user interface, a selection of a second deployment to configure, the second deployment corresponding to a second third-party application and a second network address for a second sign-on page of the second third-party application;
receive, in response to input provided at the user interface of the administration portal, second sign-on credentials for the second deployment, wherein the second sign-on credentials provide access to the second third-party application via the second sign-on page;
in response to input provided at the user interface of the administration portal corresponding to an attempt to associate the first sign-on credentials with a first user, send a first request to the permission server to confirm that the first user is permitted access to the first third-party application;
receive a first response to the first request from the permission server, wherein the first response comprises a confirmation or denial of permission to access the first third-party application by the first user, and wherein the permission server is configured to generate the first response using the permission data stored therein;
in response to the first response comprising a confirmation of permission to access the first third-party application by the first user, associate the first user with the first sign-on credentials;
in response to input provided at the user interface of the administration portal corresponding to an attempt to associate the second sign-on credentials with a second user, send a second request to the permission server to confirm that the second user is permitted access to the second third-party application;
receive a second response to the second request from the permission server, wherein the second response comprises a confirmation or denial of permission to access the second third-party application by the second user, and wherein the permission server is configured to generate the second response using the permission data stored therein;
in response to the second response comprising a confirmation of permission to access the second third-party application by the second user, associate the second user with the second sign-on credentials; and
automatically update the security policy data, based on the association of the first sign-on credentials with the first user and the association of the second sign-on credentials with the second user, such that the security policy data stored in the access management server comprises:
a first entry for the first deployment, the first entry comprising an identifier of the first user, the first sign-on credentials, and the first network address; and
a second entry for the second deployment, the second entry comprising an identifier of the second user, the second sign-on credentials, and the second network address.

### Claim 2 (depends on 1)

The system of claim 1, wherein the first sign-on credentials comprise a first password and a first username for accessing the first third-party application and the second sign-on credentials comprise a second password and a second username for accessing the second third-party application.

### Claim 3 (depends on 1)

The system of claim 1, wherein the access management server is further configured to store one or both of the first sign-on credentials and the second sign-on credentials in an encrypted format.

### Claim 4 (depends on 1)

The system of claim 1, wherein the access management server is a virtual server hosted on the network.

### Claim 5 (depends on 1)

The system of claim 1, wherein the access management server is further configured to:
in response to input provided at the user interface of the administration portal corresponding to an attempt to associate the first sign-on credentials with the second user, send a third request to the permission server to confirm that the second user is permitted access to the first third-party application;
receive a third response to the third request from the permission server, wherein the third response comprises a confirmation or denial of permission to access the first third-party application by the second user, and wherein the permission server is configured to generate the third response using the permission data stored therein;
in response to the third response comprising a confirmation of permission to access the first third-party application by the second user, associate the second user with the first sign-on credentials; and
automatically update the security policy data, based on the association of the first sign-on credentials with the second user, such that the security policy data comprises a third entry for the first deployment, the third entry comprising the identifier of the second user, the first sign-on credentials, and the first network address.

### Claim 6 (depends on 1)

The system of claim 1, wherein the first sign-on credentials are associated with a parameter corresponding to a maximum number of users of the first sign-on credentials; and
the access management server is further configured to:
determine, based on the parameter, whether the first sign-on credentials have been associated with the maximum number of users; and
in response to a determination that the first sign-on credentials have been associated with the maximum number of users, prevent association of the first sign-on credentials with an additional user.

### Claim 7 (depends on 1)

The system of claim 1, wherein the access management server is further configured to: receive the permission data from the permission server; determine, based on the permission data, whether the first user is still permitted access to the first third-party application; and responsive to a determination that the first user is no longer permitted access to the first third-party application, automatically remove the first entry from the security policy data.

### Claim 8

A method for securely managing security policy data used to provide users access to third-party applications without revealing credentials to the users, the method comprising:
storing security policy data, the security policy data comprising, for each user, a list of third-party applications to which the user may request access and the corresponding sign-on credentials for accessing each of the third-party applications;
hosting an administration portal on the network, the administration portal comprising a user interface configured to be displayed on a device of an administrator;
receiving, in response to input provided by the administrator in the user interface, a selection of a first deployment to configure, the first deployment corresponding to a first third-party application and a first network address for a first sign-on page of the first third-party application;
receiving, in response to input provided by the administrator at the user interface, first sign-on credentials for the first deployment, wherein the first sign-on credentials provide access to the first third-party application via the first sign-on page;
receiving, in response to input provided by the administrator in the user interface, a selection of a second deployment to configure, the second deployment corresponding to a second third-party application and a second network address for a second sign-on page of the second third-party application;
receiving, in response to input provided at the user interface of the administration portal, second sign-on credentials for the second deployment, wherein the second sign-on credentials provide access to the second third-party application via the second sign-on page;
in response to input provided at the user interface of the administration portal corresponding to an attempt to associate the first sign-on credentials with a first user, sending a first request to a permission server to confirm that the first user is permitted access to the first third-party application, wherein the permission server is configured to store permission data comprising a list of third-party applications to which the users are currently permitted access;
receiving, from the permission server, a first response to the first request, wherein the first response comprises a confirmation or denial of permission to access the first third-party application by the first user, and wherein the permission server is configured to generate the first response using the permission data stored therein;
in response to the first response comprising a confirmation of permission to access the first third-party application by the first user, associating the first user with the first sign-on credentials;
in response to input provided at the user interface of the administration portal corresponding to an attempt to associate the second sign-on credentials with a second user, sending a second request to the permission server to confirm that the second user is permitted access to the second third-party application;
receiving, from the permission server, a second response to the second request, wherein the second response comprises a confirmation or denial of permission to access the second third-party application by the second user, and wherein the permission server is configured to generate the second response using the permission data stored therein;
in response to the second response comprising a confirmation of permission to access the second third-party application by the second user, associating the second user with the second sign-on credentials; and
automatically updating the stored security policy data, based on the association of the first sign-on credentials with the first user and the association of the second sign-on credentials with the second user, such that the stored security policy data comprises:
a first entry for the first deployment, the first entry comprising an identifier of the first user, the first sign-on credentials, and the first network address; and
a second entry for the second deployment, the second entry comprising an identifier of the second user, the second sign-on credentials, and the second network address.

### Claim 9 (depends on 8)

The method of claim 8, wherein the first sign-on credentials comprise a first password and a first username for accessing the first third-party application and the second sign-on credentials comprise a second password and a second username for accessing the second third-party application.

### Claim 10 (depends on 8)

The method of claim 8, further comprising storing one or both of the first sign-on credentials and the second sign-on credentials in an encrypted format.

### Claim 11 (depends on 8)

The method of claim 8, further comprising:
in response to input provided at the user interface of the administration portal corresponding to an attempt to associate the first sign-on credentials with the second user, sending a third request to the permission server to confirm that the second user is permitted access to the first third-party application;
receiving a third response to the third request from the permission server, wherein the third response comprises a confirmation or denial of permission to access the first third-party application by the second user, and wherein the permission server is configured to generate the third response using the permission data stored therein;
in response to the third response comprising a confirmation of permission to access the first third-party application by the second user, associating the second user with the first sign-on credentials; and
automatically updating the security policy data, based on the association of the first sign-on credentials with the second user, such that the security policy data comprises a third entry for the first deployment, the third entry comprising the identifier of the second user, the first sign-on credentials, and the first network address.

### Claim 12 (depends on 8)

The method of claim 8, wherein the first sign-on credentials are associated with a parameter corresponding to a maximum number of users of the first sign-on credentials; and the method further comprising:
determining, based on the parameter, whether the first sign-on credentials have been associated with the maximum number of users; and
in response to a determination that the first sign-on credentials have been associated with the maximum number of users, preventing association of the first sign-on credentials with an additional user.

### Claim 13 (depends on 8)

The method of claim 8, further comprising:
receiving the permission data from the permission server;
determining, based on the permission data, whether the first user is still permitted access to the first third-party application; and
responsive to a determination that the first user is no longer permitted access to the first third-party application, automatically removing the first entry from the security policy data.

### Claim 14

A device for securely managing security policy data used to provide users access to third-party applications without revealing credentials to the users, the device comprising:
a memory configured to store security policy data, the security policy data comprising, for each user, a list of third-party applications to which the user may request access and the corresponding sign-on credentials for accessing each of the third-party applications; and
a hardware processor communicatively coupled to the memory and a network, the processor configured to:
host an administration portal on the network, the administration portal comprising a user interface configured to be displayed on a device of an administrator;
receive, in response to input provided by the administrator in the user interface, a selection of a first deployment to configure, the first deployment corresponding to a first third-party application and a first network address for a first sign-on page of the first third-party application;
receive, in response to input provided by the administrator at the user interface, first sign-on credentials for the first deployment, wherein the first sign-on credentials provide access to the first third-party application via the first sign-on page;
receive, in response to input provided by the administrator in the user interface, a selection of a second deployment to configure, the second deployment corresponding to a second third-party application and a second network address for a second sign-on page of the second third-party application;
receive, in response to input provided at the user interface of the administration portal, second sign-on credentials for the second deployment, wherein the second sign-on credentials provide access to the second third-party application via the second sign-on page;
in response to input provided at the user interface of the administration portal corresponding to an attempt to associate the first sign-on credentials with a first user, send a first request to a permission server to confirm that the first user is permitted access to the first third-party application, wherein the permission server is configured to store permission data comprising a list of third-party applications to which the users are currently permitted access;
receive a first response to the first request from the permission server, wherein the first response comprises a confirmation or denial of permission to access the first third-party application by the first user, and wherein the permission server is configured to generate the first response using the permission data stored therein;
in response to the first response comprising a confirmation of permission to access the first third-party application by the first user, associate the first user with the first sign-on credentials;
in response to input provided at the user interface of the administration portal corresponding to an attempt to associate the second sign-on credentials with a second user, send a second request to the permission server to confirm that the second user is permitted access to the second third-party application;
receive a second response to the second request from the permission server, wherein the second response comprises a confirmation or denial of permission to access the second third-party application by the second user, and wherein the permission server is configured to generate the second response using the permission data stored therein;
in response to the second response comprising a confirmation of permission to access the second third-party application by the second user, associate the second user with the second sign-on credentials; and
automatically update the security policy data, based on the association of the first sign-on credentials with the first user and the association of the second sign-on credentials with the second user, such that the security policy data stored in the access management server comprises:
a first entry for the first deployment, the first entry comprising an identifier of the first user, the first sign-on credentials, and the first network address; and
a second entry for the second deployment, the second entry comprising an identifier of the second user, the second sign-on credentials, and the second network address.

### Claim 15 (depends on 14)

The device of claim 14, wherein the first sign-on credentials comprise a first password and a first username for accessing the first third-party application and the second sign-on credentials comprise a second password and a second username for accessing the second third-party application.

### Claim 16 (depends on 14)

The device of claim 14, wherein the processor is further configured to store one or both of the first sign-on credentials and the second sign-on credentials in an encrypted format.

### Claim 17 (depends on 14)

The device of claim 14, wherein the processor and the memory are implemented as a virtual server hosted on the network.

### Claim 18 (depends on 14)

The device of claim 14, wherein the processor is further configured to:
in response to input provided at the user interface of the administration portal corresponding to an attempt to associate the first sign-on credentials with the second user, send a third request to the permission server to confirm that the second user is permitted access to the first third-party application;
receive a third response to the third request from the permission server, wherein the third response comprises a confirmation or denial of permission to access the first third-party application by the second user, and wherein the permission server is configured to generate the third response using the permission data stored therein;
in response to the third response comprising a confirmation of permission to access the first third-party application by the second user, associate the second user with the first sign-on credentials; and
automatically update the security policy data, based on the association of the first sign-on credentials with the second user, such that the security policy data comprises a third entry for the first deployment, the third entry comprising the identifier of the second user, the first sign-on credentials, and the first network address.

### Claim 19 (depends on 14)

The device of claim 14, wherein the first sign-on credentials are associated with a parameter corresponding to a maximum number of users of the first sign-on credentials; and
the processor is further configured to:
determine, based on the parameter, whether the first sign-on credentials have been associated with the maximum number of users; and
in response to a determination that the first sign-on credentials have been associated with the maximum number of users, prevent association of the first sign-on credentials with an additional user.

### Claim 20 (depends on 14)

The device of claim 14, wherein the processor is further configured to:
receive the permission data from the permission server;
determine, based on the permission data, whether the first user is still permitted access to the first third-party application; and
responsive to a determination that the first user is no longer permitted access to the first third-party application, automatically remove the first entry from the security policy data.