# US 2016/0366134 A1 · Usage tracking for software as a service (saas) applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366134 A1 - Document ID: US20160366134A1 - Status: Published application - Kind: A1 - Application number: 14/736,153 - Filed: 2015-06-10 - Published: 2016-12-15 - Earliest claimed: 2015-06-10 - Assignees: Flexera Software LLC - Applicants: Flexera Software LLC - Inventors: Paul HUGHES; Peter WESTHORP; Peter ALLFREY; Eddie SHOLL - Web page: https://patentgrep.com/patent/US20160366134A1 ## CPC - H04M 15/00: Arrangements for metering, time-control or time indication {; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP} - H04M 15/48: {Secure or trusted billing, e.g. trusted elements or encryption} - H04M 15/58: {based on statistics of usage or network monitoring} - H04W 4/24: Accounting or billing - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Various of the disclosed embodiments concern computer systems, methods, and programs for brokering logins to software as a service (SaaS) applications and tracking usage of the SaaS applications. First, a user, e.g. employee of an enterprise, logs into a SaaS usage proxy using a first set of credentials. The first set of credentials is known by the user, e.g. preexisting credentials for an enterprise-wide authentication system. Once a SaaS application is selected by the user, the SaaS usage proxy logs into the SaaS application using a second set of credentials. However, the second set of login credentials is encrypted and not known by the user, which causes the SaaS application to be accessible only through the SaaS usage proxy. This allows the SaaS usage proxy to monitor all usage of the SaaS application, even if multiple network-accessible devices are used to log into the SaaS usage proxy. ## Claims ### Claim 1 A method for tracking software as a service (SaaS) application usage by a user, the method comprising: initiating a client generated by a processor and presented on a display of a network-accessible device; establishing a communication link between a SaaS usage proxy and the client; logging into the SaaS usage proxy by entering a first set of credentials using the client, wherein the first set of credentials is known by the user, and wherein entry of the first set of credentials enables the user to view a plurality of SaaS applications available through the SaaS usage proxy; selecting a SaaS application from the plurality of SaaS applications offered through the SaaS usage proxy; causing the SaaS usage proxy to enter a second set of credentials on behalf of the user, wherein entry of the second set of credentials logs the user into the SaaS application and enables the user to utilize the SaaS application, and wherein the second set of credentials is for one of a plurality of accounts for the SaaS application, and wherein the second set of credentials is not known by the user; and using the SaaS application on the client, wherein the SaaS usage proxy is configured to track usage of the SaaS application by the user. ### Claim 2 (canceled) ### Claim 3 (depends on 1) The method of claim 1, wherein the second set of credentials is randomly generated and encrypted by the SaaS usage proxy. ### Claim 4 (depends on 3) The method of claim 3, wherein the SaaS usage proxy includes a mapping table that matches the second set of credentials to the first set of credentials. ### Claim 5 (depends on 1) The method of claim 1, wherein the user is one of a plurality of users, each of whom can initiate one of the plurality of accounts for the SaaS application through the SaaS usage proxy. ### Claim 6 (depends on 5) The method of claim 5, wherein the SaaS usage proxy is configured to: generate a distinct set of encrypted credentials for each of the plurality of users; identify when each distinct set of encrypted credentials is used by the SaaS usage proxy to log into the SaaS application; and determine usage of the SaaS application by each of the plurality of users. ### Claim 7 (depends on 1) The method of claim 1, wherein usage of the SaaS application is determined by tracking uniform resource locators (URLs) accessed by the user through the SaaS application. ### Claim 8 (depends on 1) The method of claim 1, wherein the first set of credentials is the user's credentials for an established authentication system employed by an enterprise and the user is an employee of the enterprise. ### Claim 9 A method for tracking SaaS usage, the method comprising: providing a server that hosts a SaaS usage proxy; generating, by the SaaS usage proxy, a client that a user is able to access, wherein the user is an employee of an enterprise; receiving, by the SaaS usage proxy, known login credentials from the client that are input by the user; validating, by the SaaS usage proxy, the known login credentials; responsive to successfully validating the known login credentials, presenting, by the SaaS usage proxy, one or more SaaS applications available through the SaaS usage proxy to the user; generating, by the SaaS usage proxy, encrypted login credentials for a SaaS application selected by the user, wherein the encrypted login credentials are for one of a plurality of accounts for the SaaS application associated with the enterprise; supplying, by the SaaS usage proxy, the encrypted login credentials to a mapping table, which causes the encrypted login credentials to be matched to the known login credentials belonging to the user; providing the user access to the SaaS application and allowing the user to initiate the SaaS application through the SaaS usage proxy; inputting, by the SaaS usage proxy upon the SaaS application being initiated, the encrypted login credentials on behalf of the user, wherein inputting the encrypted login credentials logs the user into the SaaS application and grants the user access to the SaaS application, and wherein the encrypted login credentials remain unknown to the user; and monitoring, by the SaaS usage proxy, usage of the SaaS application by the user. ### Claim 10 (depends on 9) The method of claim 9, wherein the mapping table is hosted by the server. ### Claim 11 (depends on 9) The method of claim 9, wherein the mapping table is hosted by another distinct server to which the SaaS usage proxy is communicatively coupled. ### Claim 12 (depends on 9) The method of claim 9, wherein the SaaS application is only accessible through the SaaS usage proxy. ### Claim 13 (depends on 9) The method of claim 9, further comprising: establishing, by the SaaS usage proxy, a virtual URL that directs the user to the SaaS application via the SaaS usage proxy. ### Claim 14 (depends on 13) The method of claim 13, wherein the virtual URL is transparent to the user, but a location targeted by the virtual URL remains obfuscated. ### Claim 15 (depends on 9) The method of claim 9, wherein tracking usage of the SaaS application by the user comprises: tracking URLs accessed by the user through the SaaS application; tracking login time, logout time, or both; or tracking total time spent using the SaaS application. ### Claim 16 (depends on 9) The method of claim 9, wherein the SaaS usage proxy, the SaaS application, and the mapping table are stored on one or more servers maintained by the enterprise. ### Claim 17 (depends on 9) The method of claim 9, wherein the SaaS usage proxy, the SaaS application, and the mapping table are communicatively coupled to one another over one or more networks. ### Claim 18 An authentication system comprising: a communication module communicatively coupled to a client that is presented on a network-accessible device and a SaaS application that is hosted by a server; an enterprise authentication module configured to validate a first set of credentials received from the client, wherein entry of the first set of credentials enables a user to view one or more SaaS applications available through a SaaS usage proxy, and wherein the first set of credentials is valid for an established enterprise-wide authentication system; and the SaaS usage proxy configured to: provide the client to the user; generate a second set of credentials for the SaaS application, wherein the second set of credentials are for one of a plurality of accounts for the SaaS application that are accessible to the user; encrypt the second set of credentials such that the second set of credentials remains unknown to the user; associate the second set of credentials with the first set of credentials; store the first set of credentials and the second set of credentials in a mapping table; allow the user to initiate the SaaS application using the client; log into the SaaS application by entering the second set of credentials on behalf of the user when the user elects to initiate the SaaS application; and track usage of the SaaS application by the user. ### Claim 19 (canceled) ### Claim 20 (depends on 18) The authentication system of claim 18, wherein the communication module establishes a communication link directly between the network-accessible device and the server upon the SaaS usage proxy logging into the SaaS application. ### Claim 21 (depends on 18) The authentication system of claim 18, wherein the communication module continues to facilitate and redirect communication between the network-accessible device and the server upon the SaaS usage proxy logging into the SaaS application. ### Claim 22 (depends on 18) The authentication system of claim 18, wherein the second set of credentials is entered by the SaaS usage proxy according to instructions provided by an administrator. ### Claim 23 (depends on 18) The authentication system of claim 18, wherein the network-accessible device is one of a plurality of network-accessible devices. ### Claim 24 (depends on 23) The authentication system of claim 23, wherein the first set of credentials entered by the user and the second set of credentials entered by the SaaS usage proxy on behalf of the user are used to log into the SaaS application regardless of which of the plurality of network-accessible devices is used to access the authentication system. ### Claim 25 (depends on 8) The method of claim 8, wherein the plurality of accounts for the SaaS application are associated with the enterprise, and wherein the plurality of accounts are assigned to employees of the enterprise by the SaaS usage proxy when the employees log into the SaaS usage proxy and select the SaaS application.