# US 11,443,025 B2 · Single sign-on solution using blockchain

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,443,025 B2
- Document ID: US11443025B2
- Status: Granted
- Kind: B2
- Application number: 16/836,166
- Filed: 2020-03-31
- Published: 2020-07-16
- Granted: 2022-09-13
- Earliest claimed: 2017-11-28
- Assignees: American Express Travel Related Services Company, Inc.
- Applicants: American Express Travel Related Services Company, Inc.
- Inventors: Balaji Balaraman; Andras L. Ferenczi; Dallas L. Gale; Nilesh Yashavant Jadhav; Harish R. Naik
- Web page: https://patentgrep.com/patent/US11443025B2

## CPC

- G06F 21/41: where a single sign-on provides access to a plurality of computers
- G06F 16/27: Replication, distribution or synchronisation of data between databases or within a distributed database system; Distributed database system architectures therefor
- G06F 16/958: Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
- G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures
- H04L 9/0637: {Modes of operation, e.g. cipher block chaining [CBC], electronic codebook [ECB] or Galois/counter mode [GCM]}
- H04L 9/3213: {using tickets or tokens, e.g. Kerberos (network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807)}
- H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)}
- H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD}
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04L 63/0815: {providing single-sign-on or federations}
- H04L 9/50: {using hash chains, e.g. blockchains or hash trees}
- H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A single sign-on system using blockchain is disclosed. The single sign-on system may interconnect various organization systems over a peer-to-peer network, with each organization system having a blockchain node and an application programming interface (API). The blockchain node invokes and uses a smart contract to write registration credentials to the blockchain during a registration process. During a login process, the blockchain node invokes the smart contract to determine whether login credentials match stored login credentials in the blockchain. In response to matching login credentials, the API may generate a single sign-on token that can be used by a user device to access one or more organization systems connected over the network.

## Claims

### Claim 1

A system, comprising:
at least one computing device comprising a processor and a memory; and
machine-readable instructions stored in the memory that when executed by the processor, cause the at least one computing device to at least:
receive login credentials from a client device;
generate a password hash associated with the login credentials;
transmit a login request comprising the login credentials and the password hash to a node of a distributed ledger;
receive a login confirmation from the node associated with the distributed ledger in response the login credentials matching registration data stored on the distributed ledger;
generate a single sign-on (SSO) token in response to receiving the login confirmation; and
transmit the SSO token to the client device.

### Claim 2 (depends on 1)

The system of claim 1, wherein, when executed, the machine-readable instructions further cause the at least one computing device to at least:
receive, in response to an application programming interface (API) call by the client device, a registration request comprising the registration data; and
cause the registration data to be written to the distributed ledger.

### Claim 3 (depends on 1)

The system of claim 1, wherein the node comprises a first node of a plurality of nodes of the distributed ledger, the plurality of nodes storing data according to a consensus agreement among the plurality of nodes.

### Claim 4 (depends on 1)

The system of claim 1, wherein the password hash is used by the node of the distributed ledger to locate the stored registration data.

### Claim 5 (depends on 1)

The system of claim 1, wherein the SSO token is generated to allow access by the client device to a plurality of services associated with an organization.

### Claim 6 (depends on 1)

The system of claim 1, wherein the SSO token comprises a user identifier, a token expiation time, client device data, and one or more access restrictions.

### Claim 7 (depends on 1)

The system of claim 1, wherein, when executed by the processor, the machine-readable instructions cause the at least one computing device to at least encrypt the SSO token using a private key of a key-pair associated with the client device, a public key of the key-pair being stored on the distributed ledger.

### Claim 8 (depends on 1)

The system of claim 1, wherein the password hash is generated using a cryptographic hash function.

### Claim 9

A system, comprising:
a distributed ledger comprising a plurality of nodes that store data according to a consensus agreement among the plurality of nodes; and
at least one application executable on at least one node of the plurality of nodes, wherein, when executed, the at least one application causes the at least one node to at least:
receive login request from a first computing device, the login request comprising a password hash and login credentials associated with a user interacting with a second computing device;
execute a smart contract to determine whether the login credentials match registration credentials stored on the distributed ledger;
generate a login confirmation in response to the login credentials matching the registration credentials; and
transmit the login confirmation to the first computing device, wherein the first computing device generates a single sign-on (SSO) token for the second computing device in response to receiving the login confirmation.

### Claim 10 (depends on 9)

The system of claim 9, wherein the login credentials comprise a biometric input.

### Claim 11 (depends on 9)

The system of claim 9, wherein the SSO token is encrypted using a private key of a key-pair associated with the second computing device.

### Claim 12 (depends on 11)

The system of claim 11, wherein, when executed by the at least one node, the at least one application causes the at least one node to at least store a public key of the key-pair associated with the second computing device in the distributed ledger, the SSO token is decrypted using the public key.

### Claim 13 (depends on 9)

The system of claim 9, wherein, when executed by the at least one node, the at least one application causes the at least one node to at least identify the stored registration credentials on the distributed ledger based at least in part on the password hash.

### Claim 14 (depends on 9)

The system of claim 9, wherein, when executed by the at least one node, the at least one application causes the at least one node to at least receive a registration request to record the registration credentials on the distributed ledger, wherein, when executed, the smart contract:
determines that the registration credentials fail to exist on the distributed ledger; and
writes the registration credentials to the distributed ledger by distributing the registration credentials to at least one other node of the plurality of nodes in response to determining that the registration credentials fail to exist on the distributed ledger.

### Claim 15

A method, comprising:
receiving login credentials from a computing device;
generating a password hash based at least in part on the login credentials and a cryptographic hash function;
verifying that the login credentials are valid by determining that the login credentials match registration credentials stored on a distributed ledger, the registration credentials being identified on the distributed ledger based at least in part on the password hash;
generating a single sign-on (SSO) token for the computing device in response to verifying the login credentials are valid, the SSO token being generated to allow access by the computing device to a plurality of systems associated with an organization; and
transmitting the SSO token to the computing device.

### Claim 16 (depends on 15)

The method of claim 15, further comprising:
receiving an access request from the computing device, the access request comprising the SSO token; and
authenticating the computing device based at least in part on the SSO token.

### Claim 17 (depends on 16)

The method of claim 16, further comprising:
accessing a public key associated with the computing device, the public key being stored on the distributed ledger; and
decrypting the SSO token using the public key.

### Claim 18 (depends on 15)

The method of claim 15, wherein the password hash comprises a login password hash, and further comprising:
receiving a registration request via an application programming interface (API) call from the computing device;
creating a registration password hash based at least in part on the registration credentials included in the registration request; and
causing the registration credentials to be written to the distributed ledger in association with the registration password hash.

### Claim 19 (depends on 18)

The method of claim 18, wherein the login password hash matches the registration password hash.

### Claim 20 (depends on 18)

The method of claim 18, wherein the registration credentials are written to the distributed ledger in response to a consensus agreement among a plurality of nodes associated with the distributed ledger.