# US 11,947,653 B2 · Manipulating user credentials > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,947,653 B2 - Document ID: US11947653B2 - Status: Granted - Kind: B2 - Application number: 18/072,826 - Filed: 2022-12-01 - Published: 2023-05-11 - Granted: 2024-04-02 - Earliest claimed: 2021-11-08 - Assignees: Vim Inc. - Applicants: Vim Inc. - Inventors: Asaf David; Nicolas Mendzylewski; Moran Shemesh; Chen Rozenes; Nandy Vaisman - Web page: https://patentgrep.com/patent/US11947653B2 ## CPC - G06F 21/33: using certificates - G06F 21/31: User authentication - G06F 21/41: where a single sign-on provides access to a plurality of computers - G06F 21/45: Structures or tools for the administration of authentication - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A method, apparatus and product comprising: identifying a login session in a Graphical User Interface (GUI) of a user device, wherein the login session is configured to enable a user of the user device to login to a first software system; extracting one or more user credentials from the login session, wherein the one or more user credentials comprise one or more user inputs to the login session; manipulating the one or more user credentials using one or more manipulations, thereby obtaining manipulated credentials; and automatically utilizing the manipulated credentials in order to login the user into a second software system. ## Claims ### Claim 1 A method comprising: monitoring a web-based Graphical User Interface (GUI) utilized by a user using a user device, the web-based GUI is executed by a browser, the web-based GUI is a GUI of a first software system, the first software system having a backend that is responsive to operations of the web-based GUI, wherein said monitoring is performed by a software module that is separate from the first software system, wherein the software module is executed at the user device; based on said monitoring, identifying a login session in the web-based GUI, wherein the login session is configured to communicate user credentials provided by the user of the user device to the backend of the first software system and enable the user of the user device to login to the first software system; extracting, via the web-based GUI, one or more user credentials from the login session, wherein the one or more user credentials comprise one or more user inputs to the login session; manipulating the one or more user credentials using one or more manipulations, thereby obtaining manipulated credentials; and automatically utilizing the manipulated credentials in order to login the user into a second software system, the second software system is different from the first software system. ### Claim 2 (depends on 1) The method of claim 1, wherein the manipulated credentials are not identified by the backend of the second software system, wherein the method further comprises: obtaining, from the user, dedicated credentials of the second software system, wherein the dedicated credentials are different from the manipulated credentials; identifying, based on the dedicated credentials, an account of the user in the second software system; and linking the account of the user to the manipulated credentials, thereby enabling the backend of the second software system to login the user into the second software system using the manipulated credentials. ### Claim 3 (depends on 1) The method of claim 1, wherein said manipulating comprises applying a one-way function on the one or more user credentials, whereby limiting an ability of deriving the one or more user credentials from the manipulated credentials. ### Claim 4 (depends on 1) The method of claim 1, wherein said manipulating comprises obtaining a user-specific salt, adding the user-specific salt to the one or more user credentials, thereby obtaining salted user credentials, and applying a one-way function to the salted user credentials, to thereby limit an ability of deriving the one or more user credentials from the manipulated credentials. ### Claim 5 (depends on 1) The method of claim 1 further comprising: based on said monitoring, identifying a password changing session in the web-based GUI of the user device, wherein the password changing session is configured to replace the one or more user credentials with one or more second user credentials, thereby changing user credentials of the user in the first software system; extracting the one or more second user credentials from the web-based GUI; manipulating the one or more second user credentials using the one or more manipulations, thereby obtaining second manipulated credentials; and automatically linking the second manipulated credentials to an account of the user in the second software system, whereby enabling to login the user into the second software system using the second manipulated credentials instead of the manipulated credentials. ### Claim 6 (depends on 1) The method of claim 1 further comprising: identifying that at least one manipulation record is absent from a local storage of the user device, wherein the at least one manipulation record is configured to manipulate the one or more user credentials; generating the at least one manipulation record, thereby generating the one or more manipulations; and performing said manipulating using the at least one manipulation record. ### Claim 7 (depends on 1) The method of claim 1, wherein said manipulating is performed after identifying that the login session enabled the user to login to the first software system successfully. ### Claim 8 (depends on 1) The method of claim 1, wherein the second software system is associated with a browser extension that is executed by the browser, whereby the second software system is configured to extend a functionality of the first software system by providing an additional functionality to the web-based GUI of the first software system via an overlay over a page displayed by the browser. ### Claim 9 (depends on 1) The method of claim 1, wherein said monitoring is performed by a browser extension. ### Claim 10 (depends on 1) The method of claim 1, wherein said identifying the login session is based on at least one of: computer vision techniques, object detection techniques, monitoring network traffic, monitoring network Application Programming Interface (API) calls, invoking network API calls, and invoking Operating System (OS) specific native API calls. ### Claim 11 An apparatus comprising a processor and coupled memory, said processor being adapted to: monitor a web-based Graphical User Interface (GUI) utilized by a user using a user device, the web-based GUI is executed by a browser, the web-based GUI is a GUI of a first software system, the first software system having a backend that is responsive to operations of the web-based GUI, wherein said monitor is performed by a software module that is separate from the first software system, wherein the software module is executed at the user device; based on said monitor, identify a login session in the web-based GUI, wherein the login session is configured to communicate user credentials provided by the user of the user device to the backend of the first software system and enable the user of the user device to login to the first software system; extract, via the web-based GUI, one or more user credentials from the login session, wherein the one or more user credentials comprise one or more user inputs to the login session; manipulate the one or more user credentials using one or more manipulations, thereby obtaining manipulated credentials; and automatically utilize the manipulated credentials in order to login the user into a second software system, the second software system is different from the first software system. ### Claim 12 (depends on 11) The apparatus of claim 11, wherein the manipulated credentials are not identified by the backend of the second software system, wherein the processor is further adapted to: obtain, from the user, dedicated credentials of the second software system, wherein the dedicated credentials are different from the manipulated credentials; identify, based on the dedicated credentials, an account of the user in the second software system; and link the account of the user to the manipulated credentials, thereby enabling the backend of the second software system to login the user into the second software system using the manipulated credentials. ### Claim 13 (depends on 11) The apparatus of claim 11, wherein said manipulating comprises applying a one-way function on the one or more user credentials, whereby limiting an ability of deriving the one or more user credentials from the manipulated credentials. ### Claim 14 (depends on 11) The apparatus of claim 11, wherein said manipulating comprises obtaining a user-specific salt, adding the user-specific salt to the one or more user credentials, thereby obtaining salted user credentials, and applying a one-way function to the salted user credentials, to thereby limit an ability of deriving the one or more user credentials from the manipulated credentials. ### Claim 15 (depends on 11) The apparatus of claim 11, wherein the processor is further adapted to: based on said monitor, identify a password changing session in the web-based GUI of the user device, wherein the password changing session is configured to replace the one or more user credentials with one or more second user credentials, thereby changing user credentials of the user in the first software system; extract the one or more second user credentials from the web-based GUI; manipulate the one or more second user credentials using the one or more manipulations, thereby obtaining second manipulated credentials; and automatically link the second manipulated credentials to an account of the user in the second software system, whereby enabling to login the user into the second software system using the second manipulated credentials instead of the manipulated credentials. ### Claim 16 (depends on 11) The apparatus of claim 11, wherein the processor is further adapted to: identify that at least one manipulation record is absent from a local storage of the user device, wherein the at least one manipulation record is configured to manipulate the one or more user credentials; generate the at least one manipulation record, thereby generating the one or more manipulations; and perform said manipulating using the at least one manipulation record. ### Claim 17 (depends on 11) The apparatus of claim 11, wherein said manipulating is performed after identifying that the login session enabled the user to login to the first software system successfully. ### Claim 18 (depends on 11) The apparatus of claim 11, wherein the second software system is associated with a browser extension that is executed by the browser, whereby the second software system is configured to extend a functionality of the first software system by providing an additional functionality to the web-based GUI of the first software system via an overlay over a page displayed by the browser. ### Claim 19 (depends on 11) The apparatus of claim 11, wherein said monitoring is performed by a browser extension. ### Claim 20 A computer program product comprising a non-transitory computer readable medium retaining program instructions, which program instructions, when read by a processor, cause the processor to: monitor a web-based Graphical User Interface (GUI) utilized by a user using a user device, the web-based GUI is executed by a browser, the web-based GUI is a GUI of a first software system, the first software system having a backend that is responsive to operations of the web-based GUI, wherein said monitor is performed by a software module that is separate from the first software system, wherein the software module is executed at the user device; based on said monitor, identify a login session in the web-based GUI, wherein the login session is configured to communicate user credentials provided by the user of the user device to the backend of the first software system and enable the user of the user device to login to the first software system; extract, via the web-based GUI, one or more user credentials from the login session, wherein the one or more user credentials comprise one or more user inputs to the login session; manipulate the one or more user credentials using one or more manipulations, thereby obtaining manipulated credentials; and automatically utilize the manipulated credentials in order to login the user into a second software system, the second software system is different from the first software system.