# US 11,853,109 B1 · Securely manipulating and utilizing user credentials > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,853,109 B1 - Document ID: US11853109B1 - Status: Granted - Kind: B1 - Application number: 18/072,825 - Filed: 2022-12-01 - Granted: 2023-12-26 - Earliest claimed: 2022-11-01 - Assignees: Vim Inc. - Applicants: Vim Inc. - Inventors: Asaf David; Nicolas Mendzylewski; Moran Shemesh; Chen Rozenes; Daniel Hallel Jakobsen; Nandy Vaisman - Web page: https://patentgrep.com/patent/US11853109B1 ## CPC - G06F 21/45: Structures or tools for the administration of authentication - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method, system, and apparatus comprising: automatically identifying a login session to a first software system in a Graphical User Interface (GUI) of a user device; automatically extracting user credentials from the login session; automatically manipulating at least a portion of the user credentials to obtain manipulated credentials; automatically verifying that the login session is authentic by: encrypting the user credentials, providing the encrypted credentials to a separate environment, and reconstructing the login session at the separate environment; and automatically adding the manipulated credentials to an account of the user in a second software system that is independent from the separate environment. ## Claims ### Claim 1 A method comprising: automatically identifying a login session in a Graphical User Interface (GUI) of a user device, wherein the login session is configured to enable a user of the user device to login to a first software system; automatically extracting one or more user credentials from the login session, wherein the one or more user credentials comprise one or more user inputs to the login session; automatically manipulating at least a portion of the one or more user credentials using one or more manipulations, thereby obtaining manipulated credentials; automatically verifying the login session, wherein said verifying comprises ensuring that the login session is authentic, wherein said verifying comprises: encrypting the one or more user credentials, thereby obtaining encrypted credentials, providing the encrypted credentials to a separate environment, and reconstructing the login session at the separate environment, thereby obtaining a reconstructed login session; and automatically adding the manipulated credentials to an account of the user in a second software system, wherein the manipulated credentials can be utilized to login to the account, wherein the second software system is independent from the separate environment. ### Claim 2 (depends on 1) The method of claim 1, wherein said adding comprises creating the account for the user in the second software system. ### Claim 3 (depends on 2) The method of claim 2 further comprising: automatically extracting, at the separate environment, user details from the reconstructed login session, wherein the separate environment comprises a sandbox environment, automatically providing the user details from the sandbox environment to the second software system, and automatically populating, at the second software system, fields of the account using the user details. ### Claim 4 (depends on 3) The method of claim 3 further comprising prompting the user to confirm populated content of the fields of the account. ### Claim 5 (depends on 1) The method of claim 1, wherein said encrypting comprises encrypting the one or more user credentials using a public key of a backend browser, wherein the backend browser is executed in the separate environment, wherein said reconstructing the login session comprises navigating to the login session via the backend browser. ### Claim 6 (depends on 5) The method of claim 5, wherein the backend browser comprises a backend browser that is devoid of any GUI. ### Claim 7 (depends on 1) The method of claim 1, wherein said verifying comprises matching a domain name of the login session to a list of authorized domain names associated with the first software system. ### Claim 8 (depends on 1) The method of claim 1 further comprising: automatically extracting a domain name of the login session as part of said automatically extracting, analyzing the domain name to detect an organization name, and detecting the account of the user in the second software system based on the organization name. ### Claim 9 (depends on 1) The method of claim 1, wherein said manipulating comprises applying a one-way function on the one or more user credentials, whereby limiting an ability of deriving the one or more user credentials from the manipulated credentials. ### Claim 10 (depends on 1) The method of claim 1, wherein said manipulating comprises obtaining a user-specific salt, adding the user-specific salt to the one or more user credentials, thereby obtaining salted user credentials, and applying a one-way function to the salted user credentials, to thereby limit an ability of deriving the one or more user credentials from the manipulated credentials. ### Claim 11 (depends on 1) The method of claim 1 further comprising: identifying that at least one manipulation record is absent from a local storage of the user device, wherein the at least one manipulation record is configured to manipulate the one or more user credentials; generating the at least one manipulation record, thereby generating the one or more manipulations; and performing said manipulating using the at least one manipulation record. ### Claim 12 (depends on 1) The method of claim 1, wherein said manipulating is performed after identifying that the login session enabled the user to login to the first software system. ### Claim 13 (depends on 1) The method of claim 1, wherein the second software system is configured to extend a functionality of the first software system. ### Claim 14 (depends on 13) The method of claim 13, wherein the GUI of the first software system is executed using a browser, wherein the second software system is associated with a browser extension that is executed by the browser, whereby the second software system provides an augmented functionality providing an additional functionality to the GUI of the first software system via an overlay over a page displayed by the browser. ### Claim 15 (depends on 13) The method of claim 13, wherein the GUI of the first software system is executed using a desktop application, wherein the second software system is associated with a desktop agent that is executed over the desktop application, whereby the second software system provides an augmented functionality providing an additional functionality to the GUI of the first software system via an overlay over a page displayed by the desktop application. ### Claim 16 (depends on 1) The method of claim 1, wherein the separate environment comprises an on-premise sandbox environment. ### Claim 17 (depends on 1) The method of claim 1 further comprises: automatically identifying a second login session of the user to the first software system; automatically extracting the one or more user credentials from the second login session; automatically manipulating the at least the portion of the one or more user credentials extracted from the second login session using the one or more manipulation thereby obtaining the manipulated credentials; and logging into the second software system using the manipulated credentials, whereby the user is logged into the second software systems without the user manually providing credentials to the second software system. ### Claim 18 A method comprising: automatically identifying a login session in a Graphical User Interface (GUI) of a user device, wherein the login session is configured to enable a user of the user device to login to a first software system; automatically extracting one or more user credentials from the login session, wherein the one or more user credentials comprise one or more user inputs to the login session; automatically manipulating at least a portion of the one or more user credentials using one or more manipulations, thereby obtaining manipulated credentials; automatically verifying the login session, wherein said verifying comprises ensuring that the login session is authentic, wherein said verifying comprises: providing a session token of the login session to a separate environment, invoking Application Programming Interface (API) calls from the separate environment to the first software system, the API calls providing the session token to the first software system, and obtaining, at the separate environment, verification data from the first software system, wherein the verification data is determined by the first software system based on the session token; and automatically adding the manipulated credentials to an account of the user in a second software system, wherein the manipulated credentials can be utilized to login to the account, wherein the second software system is independent from the separate environment. ### Claim 19 (depends on 18) The method of claim 18, wherein said verifying the login session further comprises: providing a username from the one or more user credentials to the separate environment, wherein a password from the one or more user credentials is not provided to the separate environment; and utilizing the API calls to verify an identity of the user by the first software system, wherein the first software system is configured to identify an account of the user in the first software system based on the session token and to provide the verification data to the separate environment, wherein said utilizing comprises comparing the username to the verification data to ensure that they match, whereby the login session is identified without providing the password to any device that is external from the user device. ### Claim 20 (depends on 18) The method of claim 18, wherein the separate environment comprises an on-premise sandbox environment, wherein the second software system is configured to extend a functionality of the first software system. ### Claim 21 (depends on 18) The method of claim 18 further comprising: automatically extracting a domain name of the login session as part of said automatically extracting, analyzing the domain name to detect an organization name, and detecting the account of the user in the second software system based on the organization name. ### Claim 22 An apparatus comprising a processor and coupled memory, said processor being adapted to: automatically identify a login session in a Graphical User Interface (GUI) of a user device, wherein the login session is configured to enable a user of the user device to login to a first software system; automatically extract one or more user credentials from the login session, wherein the one or more user credentials comprise one or more user inputs to the login session; automatically manipulate at least a portion of the one or more user credentials using one or more manipulations, thereby obtaining manipulated credentials; automatically verify the login session, wherein said verify comprises ensuring that the login session is authentic, wherein said verify comprises: encrypting the one or more user credentials, thereby obtaining encrypted credentials, providing the encrypted credentials to a separate environment, and reconstructing the login session at the separate environment, thereby obtaining a reconstructed login session; and automatically add the manipulated credentials to an account of the user in a second software system, wherein the manipulated credentials can be utilized to login to the account, wherein the second software system is independent from the separate environment. ### Claim 23 (depends on 22) The apparatus of claim 22, wherein said encrypting comprises encrypting the one or more user credentials using a public key of a backend browser, wherein the backend browser is executed in the separate environment, wherein said reconstructing the login session comprises navigating to the login session via the backend browser, wherein the backend browser comprises a backend browser that is devoid of any GUI. ### Claim 24 A computer program product comprising a non-transitory computer readable medium retaining program instructions, which program instructions when read by a processor, cause the processor to: automatically identify a login session in a Graphical User Interface (GUI) of a user device, wherein the login session is configured to enable a user of the user device to login to a first software system; automatically extract one or more user credentials from the login session, wherein the one or more user credentials comprise one or more user inputs to the login session; automatically manipulate at least a portion of the one or more user credentials using one or more manipulations, thereby obtaining manipulated credentials; automatically verify the login session, wherein said verify comprises ensuring that the login session is authentic, wherein said verify comprises: providing a session token of the login session to a separate environment, invoking Application Programming Interface (API) calls from the separate environment to the first software system, the API calls providing the session token to the first software system, and obtaining, at the separate environment, verification data from the first software system, wherein the verification data is determined by the first software system based on the session token; and automatically add the manipulated credentials to an account of the user in a second software system, wherein the manipulated credentials can be utilized to login to the account, wherein the second software system is independent from the separate environment. ### Claim 25 (depends on 24) The computer program product of claim 24, wherein said verifying the login session further comprises: providing a username from the one or more user credentials to the separate environment, wherein a password from the one or more user credentials is not provided to the separate environment; and utilizing the API calls to verify an identity of the user by the first software system, wherein the first software system is configured to identify an account of the user in the first software system based on the session token and to provide the verification data to the separate environment, wherein said utilizing comprises comparing the username to the verification data to ensure that they match, whereby the login session is identified without providing the password to any device that is external from the user device.