# US 2021/0342425 A1 · Self-owned authentication and identity framework > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0342425 A1 - Document ID: US20210342425A1 - Status: Published application - Kind: A1 - Application number: 17/376,983 - Filed: 2021-07-15 - Published: 2021-11-04 - Earliest claimed: 2017-06-04 - Inventors: Harsha Ramalingam - Web page: https://patentgrep.com/patent/US20210342425A1 ## CPC - G06F 21/31: User authentication - H04L 9/0891: {Revocation or update of secret information, e.g. encryption key update or rekeying} - H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage} - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)} - H04L 2463/082: applying multi-factor authentication - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A user, using a user-computing device connected to a computer network, is authenticated to access a computing resource managed by a system on the computer network. The user computing device presents a user interface to prompt the user to input a value for each of a set of user-defined credentials that the user has previously defined for a SAIF server to authenticate the user to access the computer resource, thereby forming a set of input values. Modified values, each generated from and representing a corresponding one of the input values, are transmitted and validated by comparing them with corresponding modified forms of user-defined credential values stored in a memory, thereby determining whether the user is authenticated to access the computing resource on the system. ## Claims ### Claim 1 A method for authenticating a user, using a user computing device connected to a computer network, to access a computing resource managed by a system on the computer network, the method comprising at least the following steps performed by the system: in response to a request from the user computing device to access the computing resource, calling a runtime executable code module to execute a login service, for which the user has previously established an identity and defined a set of one or more types of user-defined credentials and established values for said user-defined credentials to use to authenticate the user to the system, wherein the set of one or more types of user-defined credentials includes at least one credential type not predefined by the system, and wherein the login service: transmits information to the user computing device to cause the user computing device to present a user interface to prompt the user to input a value for each of the set of user-defined credentials that the user has previously defined for authentication by the system, thereby forming a set of input values; receives from the user computing device a set of modified values, wherein each of the modified values is generated from and represents a corresponding one of the input values; validates the set of modified values by comparing them with corresponding modified forms of user-defined credential values stored in a memory accessible to the login service; and based on validating the set of modified values, provides an indication to the system that the user has either been authenticated or not been authenticated; and in response to an indication from the login service that the user has been authenticated, permitting the user to access the computing resource as an authenticated user, or in response to an indication from the login service that the user has not been authenticated, denying the user access to the computing resource as an unauthenticated user. ### Claim 2 (depends on 1) The method of claim 1, wherein the user interface provides an option to the user to login to the system using the user-defined credentials and also provides one or more options to the user to login to the system using other credentials. ### Claim 3 (depends on 2) The method of claim 2, wherein the one or more options to the user to login to the system using other credentials includes an option to login directly to the system by providing a value for a credential established by the system. ### Claim 4 (depends on 1) The method of claim 1, wherein the set of user-defined credentials comprises one or more of a login, a password, an answer to a security question, a biometric, and data transmitted to the user by an independent channel. ### Claim 5 (depends on 1) The method of claim 1, wherein the modified value and its corresponding input value are related by a one-way function. ### Claim 6 (depends on 1) The method of claim 1, wherein the set of user-defined credentials is not known to the system outside of the login service. ### Claim 7 (depends on 1) The method of claim 1, wherein memory in which the modified forms of the user-defined credential values are stored is not accessible to the system outside of the login service. ### Claim 8 (depends on 1) The method of claim 1, wherein the set of input values is not known to the system and not known to the login service. ### Claim 9 (depends on 1) The method of claim 1, wherein the relationship between a modified value and its corresponding input value is not known to the system outside of the login service. ### Claim 10 (depends on 1) The method of claim 1, wherein the login service, prior to transmitting information to the user computing device to cause the user computing device to present a user interface to prompt the user to input a value for each of the set of user-defined credentials that the user has previously defined for authentication by the system, further: transmits information to the user computing device to cause the user computing device to present a user interface to prompt the user to login to the login service; and authorizes the user to use the login service before prompting the user to input a value for each of the set of user-defined credentials that the user has previously defined for authentication by the system. ### Claim 11 (depends on 1) The method of claim 1, wherein the modified value is transmitted over a secure encrypted channel. ### Claim 12 (depends on 1) The method of claim 1, wherein the server is a federated server. ### Claim 13 (depends on 1) The method of claim 1, wherein the computing resource to be accessed is configured using the login service to access information regarding the user after the user has been authenticated. ### Claim 14 (depends on 13) The method of claim 13, wherein the computing resource to be accessed is configured using the login service to have delegated access permissions to access information regarding the user after the user has been authenticated. ### Claim 15 An apparatus for authenticating a user, using a user computing device connected to a computer network, to access a computing resource managed by a system on the computer network, the apparatus comprising: a memory in which are stored modified forms of each of a set of user-defined credentials, wherein the set of user-defined credentials are of types that the user has previously defined and for which the user has previously established values, wherein the user-defined credential types include at least one credential type not predefined by the system; and a processor in or associated with the system and configured to access the memory and to perform the following in response to a request from the user computing device to access the computing resource: transmit information to the user computing device to cause the user computing device to present a user interface to prompt the user to input a value for each of the set of user-defined credentials, thereby forming a set of input values; receive from the user computing device a set of modified values, wherein each of the modified values is generated from and represents a corresponding one of the input values; validate the set of modified values by comparing them with corresponding modified forms of the user-defined credential values stored in the memory; and based on validating the set of modified values, provide an indication to the system that the user has either been authenticated or not been authenticated. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the user interface provides an option to the user to login to the system using the user-defined credentials and also provides one or more options to the user to login to the system using other credentials. ### Claim 17 (depends on 16) The apparatus of claim 16, wherein the one or more options to the user to login to the system using other credentials includes an option to login directly to the system by providing a value for a credential established by the system. ### Claim 18 (depends on 15) The apparatus of claim 15, wherein the set of user-defined credentials comprises one or more of a login, a password, an answer to a security question, a biometric, and data transmitted to the user by an independent channel. ### Claim 19 (depends on 15) The apparatus of claim 15, wherein the modified value and its corresponding input value are related by a one-way function. ### Claim 20 (depends on 15) The apparatus of claim 15, wherein the set of user-defined credentials is not known to the system. ### Claim 21 (depends on 15) The apparatus of claim 15, wherein the memory is not accessible to the system except by the processor to validate the set of modified values. ### Claim 22 (depends on 15) The apparatus of claim 15, wherein the set of input values is not known to the system and not known to the processor. ### Claim 23 (depends on 15) The apparatus of claim 15, wherein the relationship between a modified value and its corresponding input value is not known to the system except by the processor when validating the set of modified values. ### Claim 24 (depends on 15) The apparatus of claim 15, wherein the processor is further configured to perform the following prior to transmitting information to the user computing device to cause the user computing device to present a user interface to prompt the user to input a value for each of the set of user-defined credentials that the user has previously defined for authentication by the system: transmit information to the user computing device to cause the user computing device to present a user interface to prompt the user to login to the login service; and authorize the user to use the login service before prompting the user to input a value for each of the set of user-defined credentials that the user has previously defined for authentication by the system. ### Claim 25 (depends on 15) The apparatus of claim 15, wherein the server is a federated server. ### Claim 26 (depends on 14) The apparatus of claim 14, wherein the computing resource to be accessed is configured using the login service to access information regarding the user after the user has been authenticated. ### Claim 27 (depends on 26) The apparatus of claim 26, wherein the computing resource to be accessed is configured using the login service to have delegated access permissions to access information regarding the user after the user has been authenticated. ### Claim 28 A non-transitory computer-readable medium on which are embedded instructions that, when executed by a runtime executable module on a computer, cause the module to authenticate a user, using a user computing device connected to a computer network, to access a computing resource managed by a system on the computer network, the instructions comprising instructions to, in response to a request from the user computing device to access the computing resource, cause the module to: transmit information to the user computing device to cause the user computing device to present a user interface to prompt the user to input a value for each of the set of user-defined credentials for which the user has previously defined a set of one or more types of user-defined credentials and established values for said user-defined credentials to use to authenticate the user to the system, wherein the set of one or more types of user-defined credentials includes at least one credential type not predefined by the system receive from the user computing device a set of modified values, wherein each of the modified values is generated from and represents a corresponding one of the input values; validate the set of modified values by comparing them with corresponding modified forms of user-defined credential values stored in a memory accessible to the module only; and based on validating the set of modified values, provide an indication to the system that the user has either been authenticated or not been authenticated, thereby permitting the system to determine whether to allow or deny the user to access the computing resource as an authenticated user.