# US 12,225,004 B2 · OpenID offloading proxy > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,004 B2 - Document ID: US12225004B2 - Status: Granted - Kind: B2 - Application number: 18/148,786 - Filed: 2022-12-30 - Published: 2024-07-04 - Granted: 2025-02-11 - Earliest claimed: 2022-12-30 - Assignees: Konica Minolta Business Solutions U.S.A., Inc. - Applicants: Konica Minolta Business Solutions U.S.A., Inc. - Inventors: Rahul Suraparaju - Web page: https://patentgrep.com/patent/US12225004B2 ## CPC - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0815: {providing single-sign-on or federations} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method, a non-transitory computer readable medium, and a computer system for accessing protected resources. The method includes receiving, by a processor, a request from an OpenID-unaware application for access to a protected resource; authenticating, by the processor, the OpenID-unaware application; establishing, by the processor, an OpenID connection with an OpenID relying party upon authentication of the OpenID-unaware application; and receiving, by the processor, an access token issued by an OpenID identity provider for the OpenID-unaware application for access to the protected resource. ## Claims ### Claim 1 A method for accessing protected resources, the method comprising: receiving, by a processor, a request from an OpenID-unaware application for access to a protected resource; authenticating, by the processor, the OpenID-unaware application; establishing, by the processor, an OpenID connection with an OpenID relying party upon authentication of the OpenID-unaware application; receiving, by the processor, an access token issued by an OpenID identity provider for the OpenID-unaware application for access to the protected resource; and facilitating, by the processor, a user associated with the OpenID-unaware application via an application OpenID life cycle over a HTTPS handshake with an application programming interface (API) call. ### Claim 2 (depends on 1) The method according to claim 1, further comprising: authenticating, by the processor, a user associated with the OpenID-unaware application; and establishing, by the processor, the OpenID connection with the OpenID relying party upon the authentication of the user associated with the OpenID-unaware application. ### Claim 3 (depends on 1) The method according to claim 1, wherein the application OpenID life cycle includes a public key infrastructure (PKI) authentication. ### Claim 4 (depends on 1) The method according to claim 1, further comprising: establishing, by the processor, the OpenID connection with the OpenID relying party upon authentication of the OpenID-unaware application to initiate a flow towards the OpenID provider. ### Claim 5 (depends on 1) The method according to claim 1, further comprising: terminating, by the processor, an incoming HTTPS connection from the OpenID-unaware application with the request from the OpenID-unaware application for access to the protected resource; and mapping, by the processor, details of the incoming HTTPS connection from the OpenID-unaware application onto a new connection with the OpenID relying party to access the protected resource for the OpenID-unaware application. ### Claim 6 (depends on 5) The method according to claim 5, further comprising: mediating, by the processor, communications for the OpenID-unaware application for access to the protected resource. ### Claim 7 (depends on 5) The method according to claim 5, further comprising: mediating, by the processor, only the access token for the OpenID-unaware application for access to the protected resource. ### Claim 8 (depends on 1) The method according to claim 1, wherein the access token is formatted as a JSON (JavaScript Object Notification) web token, a signed JSON web token, or an encrypted JSON web token. ### Claim 9 (depends on 1) The method according to claim 1, further comprising: maintaining, by the processor, a state of a plurality of OpenID-unaware applications via a finite state machine for profiling purposes. ### Claim 10 (depends on 1) The method according to claim 1, wherein the OpenID-unaware application does not include an OpenID protocol for authentication of the OpenID-unaware application. ### Claim 11 (depends on 10) The method according to claim 10, wherein the OpenID-unaware application does not include the OpenID protocol for authentication of a user of the OpenID-unaware application. ### Claim 12 (depends on 1) The method according to claim 1, further comprising: authenticating, by the processor, a user associated with the OpenID-unaware application with public key infrastructure-based (PKI-based) authentication. ### Claim 13 (depends on 1) The method according to claim 1, wherein the protected resource is a secure software application. ### Claim 14 A computer program product for accessing protected resources, the computer program product comprising: a non-transitory computer-readable storage medium having program instructions embodied therewith, the program instructions executable by a computer to cause the computer to perform a process, comprising: receiving a request from an OpenID-unaware application for access to a protected resource; authenticating the OpenID-unaware application; establishing an OpenID connection with an OpenID relying party upon authentication of the OpenID-unaware application; receiving an access token issued by an OpenID identity provider for the OpenID-unaware application for access to the protected resource; and facilitating a user associated with the OpenID-unaware application via an application OpenID life cycle over a HTTPS handshake with an application programming interface (API) call. ### Claim 15 (depends on 14) The computer program product according to claim 14, further comprising: authenticating a user associated with the OpenID-unaware application; and establishing the OpenID connection with the OpenID relying party upon the authentication of the user associated with the OpenID-unaware application. ### Claim 16 (depends on 14) The computer program product according to claim 14, wherein the application OpenID life cycle includes a public key infrastructure (PKI) authentication. ### Claim 17 A computer system comprising: a memory; and a processor configured to: receive a request from an OpenID-unaware application for access to a protected resource; authenticate the OpenID-unaware application; establish an OpenID connection with an OpenID relying party upon authentication of the OpenID-unaware application; receive an access token issued by an OpenID identity provider for the OpenID-unaware application for access to the protected resource; and facilitate a user associated with the OpenID-unaware application via an application OpenID life cycle over a HTTPS handshake with an application programming interface (API) call. ### Claim 18 (depends on 17) The computer system according to claim 17, wherein the processor is further configured to: authenticate a user associated with the OpenID-unaware application; and establish the OpenID connection with the OpenID relying party upon the authentication of the user associated with the OpenID-unaware application.