# US 11,444,938 B2 · Authentication based on one-time usernames > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,444,938 B2 - Document ID: US11444938B2 - Status: Granted - Kind: B2 - Application number: 16/793,914 - Filed: 2020-02-18 - Published: 2021-08-19 - Granted: 2022-09-13 - Earliest claimed: 2020-02-18 - Assignees: Micro Focus LLC - Applicants: Micro Focus LLC - Inventors: Umar Ashraf - Web page: https://patentgrep.com/patent/US11444938B2 ## CPC - H04L 63/068: {using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088)} - H04L 63/0838: {using one-time-passwords} - G06F 21/31: User authentication - H04L 63/067: {using one-time keys (cryptographic mechanisms or cryptographic arrangements for generation of one-time passwords H04L9/0863)} - H04L 63/0815: {providing single-sign-on or federations} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An apparatus may include a processor that may be caused to receive an authentication request to authenticate a user. The authentication request may include a one-time username associated with an identity of the user and a secret credential of the user. The processor may further identify, in a user registry, a unique user identifier based on the one-time username, and authenticate the user based on the unique user identifier and the secret credential. The apparatus may update the user registry to prevent the one-time username from being used again to identify the user for authentication. ## Claims ### Claim 1 An apparatus comprising: a database storing authentication information of a user, the authentication information including a unique user identifier of the user and a reference key, wherein the reference key is provided to the user and the unique user identifier is not provided to the user; a processor, and a non-transitory machine-readable medium storing instructions that when executed by the processor, cause the processor to: receive a first request for a one-time username from a user device, wherein the first request includes the reference key; identify, in the database, the unique user identifier that corresponds to the reference key included in the first request; in response to the unique user identifier being identified in the database, generate the one-time username to the user; receive a second request to authenticate the user, the second request comprising the one-time username and a secret credential of the user; identify, in a user registry, the unique user identifier based on the one-time username included in the second request; authenticate the user based on the unique user identifier identified in the user registry and the secret credential included in the second request; and update the user registry to prevent the one-time username from being used again to authenticate the user. ### Claim 2 (depends on 1) The apparatus of claim 1, wherein the user is registered to be authenticated during a registration process, and wherein the instructions when executed further cause the processor to: generate, during the registration process, the unique user identifier and the reference key of the user; store, in the database, an association of the unique user identifier and the reference key as the authentication information of the user; and provide the reference key, but not the unique user identifier, as an output of the registration process to maintain secrecy of the unique user identifier. ### Claim 3 (depends on 2) The apparatus of claim 2, wherein the unique user identifier is generated without user input. ### Claim 4 (depends on 2) The apparatus of claim 2, wherein the instructions when executed further cause the processor to: after the one-time username is generated, store, in the user registry, an association of the unique user identifier and the one-time username to indicate generation of the one-time username with respect to the unique user identifier. ### Claim 5 (depends on 2) The apparatus of claim 2, wherein the instructions when executed further cause the processor to: generate, during the registration process, a signature key for the user to digitally sign requests; store, in the database, an association of the signature key and the reference key; and provide the signature key as an output of the registration process. ### Claim 6 (depends on 5) The apparatus of claim 5, wherein the signature key comprises a cryptographic key. ### Claim 7 (depends on 5) The apparatus of claim 5, wherein the fir request for the one-time username is digitally signed with the signature key of the user, and wherein the instructions when executed further cause the processor to: access the signature key from the database based on the reference key included in the first request; and verify that the first request was signed with the signature key. ### Claim 8 (depends on 1) The apparatus of claim 1, wherein to generate the one-time username, the instructions when executed cause the processor to: generate a random number based on a pseudo random number generator. ### Claim 9 (depends on 1) The apparatus of claim 1, wherein the instructions when executed further cause the processor to: access an indication of a reference key renewal triggering event; generate a new reference key in response to the reference key renewal triggering event; and provide the new reference key to the user device to replace the reference key. ### Claim 10 (depends on 1) The apparatus of claim 1, wherein the user registry comprises a runtime cache of the apparatus that is overwritten with new data to remove the one-time username from the user registry. ### Claim 11 (depends on 1) The apparatus of claim 1, wherein the user registry comprises a stored association between the one-time username and the unique user identifier, and wherein to update the user registry, the instructions when executed further cause the processor to: update the stored association with an indication to prevent the one-time username from being used again. ### Claim 12 (depends on 1) The apparatus of claim 1, wherein the user registry comprises a stored association between the one-time username and the unique user identifier, and wherein to update the user registry, the instructions when executed further cause the processor to: delete the stored association from the user registry to prevent the one-time username from being used again. ### Claim 13 A non-transitory machine-readable medium storing instructions that when executed by a processor, cause the processor to: store, in a database, authentication information of a user, the authentication information including a unique user identifier of the user and a reference key, wherein the reference key is provided to the user and the unique user identifier is not provided to the user; receive a first request for a one-time username, the first request comprising the reference key associated with the user; identify, in the database, the unique user identifier of the user based on the reference key included in the first request; in response to the unique user identifier being identified in the database, generate the one-time username responsive to the first request; receive a second request to authenticate the user, the second request comprising the one-time username and a secret credential of the user; identify, in a user registry, the unique user identifier based on the one-time username included in the second request; and authenticate the user based on the unique user identifier identified in the user registry and the secret credential included in the second request. ### Claim 14 (depends on 13) The non-transitory machine-readable medium of claim 13, wherein the instructions when executed further cause the processor to: update the user registry to prevent the one-time username from being used again to authenticate the user. ### Claim 15 (depends on 13) The non-transitory machine-readable medium of claim 13, wherein the user registry comprises a temporary cache storing an association of the unique user identifier and the one-time username, the instructions when executed further cause the processor to: update the temporary cache to remove the stored association of the unique user identifier and the one-time username; receive a third request to authenticate the user, the third request comprising the one-time username; determine that the one-time username does not exist in the user registry; and deny authentication based on the determination that the one-time username does not exist in the user registry. ### Claim 16 (depends on 13) The non-transitory machine-readable medium of claim 13, wherein the first request is digitally signed with a signature key of the user, and wherein the instructions when executed further cause the processor to: access the signature key based on the reference key included in the first request; and verify that the first request was signed with the signature key. ### Claim 17 A method, comprising: storing, in a database, authentication information of a user, the authentication information including a unique user identifier of the user and a reference key, wherein the reference key is provided to the user and the unique user identifier is not provided to the user; receiving, by a processor, a first request for a one-time username from a user device, the first request comprising the reference key associated with the user; identifying, by the processor, the unique user identifier in the database based on the reference key included in the first request; and in response to the unique user identifier being identified in the database, generating, by the processor, the one-time username to the user; receiving a second request to authenticate the user, the second request comprising the one-time username and a secret credential; identifying the unique user identifier in a user registry based on the one-time username included in the second request; and authenticate the user based on the unique user identifier identified in the user registry and the secret credential included in the second request. ### Claim 18 (depends on 17) The method of claim 17, further comprising: updating the user registry to prevent the one-time username from being used again to authenticate the user. ### Claim 19 (depends on 17) The method of claim 17, wherein the first request for the one-time username is digitally signed with a signature key of the user, and the method further comprises: accessing the signature key based on the reference key included in the first request; and verifying that the first request was signed with the signature key. ### Claim 20 (depends on 19) The method of claim 19, further comprising: generating, by the processor, the unique user identifier of the user, the reference key and the signature key during a registration process of the user, and storing the unique user identifier, the reference key and the signature key as the authentication information of the user in the database.