# US 12,113,792 B2 · Authenticator centralization and protection including selection of authenticator type based on authentication policy > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,792 B2 - Document ID: US12113792B2 - Status: Granted - Kind: B2 - Application number: 17/537,064 - Filed: 2021-11-29 - Published: 2022-03-17 - Granted: 2024-10-08 - Earliest claimed: 2015-09-21 - Assignees: Prove Identity, Inc. - Applicants: Prove Identity, Inc. - Inventors: Andrew Robert Rolfe; Alan Dundas; Gregory Slowiak - Web page: https://patentgrep.com/patent/US12113792B2 ## CPC - H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity} - H04L 63/06: {for supporting key management in a packet data network (cryptographic mechanisms or cryptographic arrangements for key management H04L9/08)} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04L 2463/082: applying multi-factor authentication - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Provided is a method for authenticating a user communicating with an enterprise via a network. The method includes receiving, via the network, authenticators for a user from a first user device associated with the user, and storing the received authenticators. A first authenticator from the stored authenticators is selected to be used for authenticating the user based on an authentication policy received from the enterprise. An authentication request is transmitted to a user device requesting the first authenticator and the user is authentication by comparing the received authenticator with the stored first authenticator. ## Claims ### Claim 1 An authentication server to authenticate a user in communication with an enterprise server, comprising: a memory of the authentication server to store a first plurality of user credentials received from a user device associated with the user, wherein the first plurality of user credentials: comprise one or more biometric-type parameters, one or more possession-type parameters, or one or more knowledge base-type parameters, or any combination there of, and do not comprise an identification of the user; and a processor of the authentication server coupled to the memory of the authentication server to: receive, by the authentication server from the enterprise server, a request to authenticate the user, wherein the request: does not identify the user, and does not include an identification of which at least one of the first plurality of user credentials is to be used to authenticate the user; obtain, by the authentication server from the user device, an authentication parameter, wherein: the authentication parameter is based, at least in part, on an enterprise policy of the enterprise server, the authentication parameter is derived, at least in part, from a device ID, the device ID is bound to hardware of the user device, and the device ID comprises a parameter that uniquely identifies the user device; and responsive to selecting, by the authentication server, for comparison a one or more of the first plurality of user credentials based, at least in part, on the enterprise policy, authenticate, by the authentication server, the user, at least in part, via a comparison of the obtained authentication parameter with the one or more of the first plurality of user credentials. ### Claim 2 (depends on 1) The authentication server of claim 1, wherein the device ID is not clone-able. ### Claim 3 (depends on 1) The authentication server of claim 1, wherein the device ID is immutable. ### Claim 4 (depends on 1) The authentication server of claim 1, wherein the device ID is obtained from a card inserted into the user device. ### Claim 5 (depends on 1) The authentication server of claim 1, wherein the processor is additionally to generate a relationship identifier to associate the user device with an account identifier stored on, or at least accessible to, the enterprise server. ### Claim 6 (depends on 1) The authentication server of claim 1, wherein the processor is additionally to wirelessly transmit a one-time code to the user device, the one-time code to link the user device to the enterprise server. ### Claim 7 (depends on 1) The authentication server of claim 1, wherein the processor is additionally to determine the one or more of the first plurality of user credentials from the first plurality of user credentials to be used to authenticate the user based on the enterprise policy to establish a type of user credential to be used to authenticate the user. ### Claim 8 (depends on 7) The authentication server of claim 7, wherein the processor is additionally to transmit the request to the user device, for the authentication parameter. ### Claim 9 (depends on 7) The authentication server of claim 7, wherein the enterprise policy is to establish the type of user credential to be used to authenticate the user. ### Claim 10 A method for an authentication server to authenticate a user, comprising: storing, in at least one memory of the authentication server, a first plurality of user credentials obtained by the authentication server from a user device associated with the user, wherein the first plurality of user credentials; comprise one or more biometric-type parameters, one or more possession-type parameters, or one or more knowledge base-type parameters, or any combination thereof, and do not comprise an identification of the user; utilizing a processor coupled to the at least one memory: receiving, by the authentication server from an enterprise server, a request to authenticate the user, wherein the request: does not identify the user, and does not include an identification of which at least one of the first plurality of user credentials is to be used to authenticate the user; obtaining, by the authentication server from the user device, an authentication parameter, wherein: the authentication parameter is based, at least in part, on an enterprise policy on the enterprise server, the authentication parameter is derived, at least in part, from a device ID, the device ID is bound to hardware of the user device, and the device ID comprises a parameter that uniquely identifies the user device; and responsive to selecting, by the authentication server, for comparison a one or more of the first plurality of user credentials based, at least in part, on the enterprise policy, authenticating, by the authentication server, the user, at least in part, via a comparison of the obtained authentication parameter with the one or more of the first plurality of user credentials. ### Claim 11 (depends on 10) The method of claim 10, wherein the device ID is not cloneable. ### Claim 12 (depends on 10) The method of claim 10, wherein the device ID is immutable. ### Claim 13 (depends on 10) The method of claim 10, wherein the device ID is obtained from a card inserted into the user device. ### Claim 14 An article comprising: a non-transitory storage medium, having instructions encoded thereon, which, when executed by an authentication server having at least one processor coupled to at least one memory device, are to: store, via the at least one memory device, a first plurality of user credentials received from a user device associated with a user, wherein the first plurality of user credentials: comprise one or more biometric-type parameters, one or more possession-type parameters, or one or more knowledge base-type parameters, or any combination thereof, and do not comprise identity related information of the user; receive, by the authentication server from the enterprise server, a request to authenticate the user, wherein the request: does not identify the user, and does not include an identification of which at least one of the first plurality of user credentials is to be used to authenticate the user; obtain, by the authentication server from the user device, an authentication parameter, wherein: the authentication parameter is based, at least in part, on an enterprise policy on the enterprises server, the authentication parameter is derived, at least in part, from a device ID, the device ID is bound to hardware of the user device, and the device ID comprises a parameter that uniquely identifies the user device; and to responsive to selecting, by the authentication server, for comparison a one or more of the first plurality of user credentials based, at least in part, on the enterprise policy, authenticate, by the authentication server, the user at least in part via a comparison of the obtained authentication parameter with the one or more of the first plurality of user credentials. ### Claim 15 (depends on 14) The article of claim 14, wherein the device ID is not cloneable. ### Claim 16 (depends on 14) The article of claim 14, wherein the device ID is immutable. ### Claim 17 (depends on 14) The article of claim 14, wherein the device ID is to be obtained from a card for insertion into the user device.