# US 2021/0344663 A1 · System and method for merging accounts

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0344663 A1
- Document ID: US20210344663A1
- Status: Published application
- Kind: A1
- Application number: 16/861,751
- Filed: 2020-04-29
- Published: 2021-11-04
- Earliest claimed: 2020-04-29
- Assignees: Shopify Inc.
- Applicants: Shopify Inc.
- Inventors: LALITH RALLABHANDI; ZHI YANG CHEN
- Web page: https://patentgrep.com/patent/US20210344663A1

## CPC

- G06F 7/14: Merging, i.e. combining at least two sets of record carriers each arranged in the same ordered sequence to produce a single set having the same ordered sequence
- G06F 16/2255: {Hash tables}
- G06F 21/31: User authentication
- G06F 21/45: Structures or tools for the administration of authentication
- G06Q 30/0609: {Qualifying participants for shopping transactions (payment transaction verification G06Q20/401)}
- H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system and method for automatically merging accounts based on matching email addresses and passwords, is provided. The assumption made is that two or more accounts that have the same user identifier or ID (e.g. email address) and the same password belong to the same user. Generally, in order to log into an account, the user requires is a user ID or username (e.g. an email address), password and store ID, for example URL. Typically, plaintext passwords are not stored centrally for security reasons, but instead hashed passwords are stored. When a user logs in with a plaintext password and username, the plaintext password is processed as it would be for other accounts with the same user ID, to see if the password works for those accounts. If it does work, then the same plaintext password applies, and the accounts are automatically merged.

## Claims

### Claim 1

A system comprising:
an account database containing for each of a plurality of accounts a stored hashed password, a user ID;
an authentication interface for receiving a plaintext password and user ID to access a first account of said plurality of accounts associated with the user ID, and for determining a first hashed password computed from the plaintext password and a first hashing function, and allowing access to the first account if the user ID and the first hashed password matches a stored user ID and hashed password for the first account;
an account merger that determines a second hashed password computed from the plaintext password and a second hashing function associated with a second account having the same user ID as said first account and merges the first and second accounts into a merged account if the user ID and second hashed password matches a stored user ID and hashed password for the second account.

### Claim 2 (depends on 1)

The system of claim 1 wherein:
for each account another hash function input value is stored in association with the account;
the first hashed password is computed using the first hashing function based on the plaintext password and the another hash function input value stored in association with the first account; and
the second hashed password is computed using the second hashing function based on the plaintext password and the another hash function input value stored in association with the second account.

### Claim 3 (depends on 2)

The system of claim 2 wherein:
the another hash function input value stored in association with the first account is a string that is combined with the plaintext password in a predetermined manner before using the first hash function or a seed to be used by the first hash function to compute the first hashed password or a repetition indicator that indicates how many times the first hash function should be iterated to produce the first hashed password; and
the another hash function input value stored in association with the second account is a string that is combined with the plaintext password in a predetermined manner before using the second hash function or a seed to be used by the second hash function to compute the second hashed password or a repetition indicator that indicates how many times the second hash function should be iterated to produce the second hashed password.

### Claim 4 (depends on 1)

The system of claim 1 wherein the first and second hash functions are the same.

### Claim 5 (depends on 1)

The system of claim 1 wherein the first and second hash functions are different.

### Claim 6 (depends on 1)

The system of claim 1 wherein the account merger, for each account feature for which there is a first value for the first account and a second different value for the second account, uses the first value or the second value in the merged account.

### Claim 7 (depends on 6)

The system of claim 6 further comprising:
a user interface for obtaining user input on which of the first value and the second value to use for at least one account feature.

### Claim 8 (depends on 6)

The system of claim 6 wherein for at least one account feature, the account merger selects the first value or the second value to be used in the single account based on a rule.

### Claim 9 (depends on 8)

The system of claim 8 wherein the rule is one of:
use value that was associated with a most recent account access;
use value that is associated with the account that was used more often;
use value that is most frequently used across the accounts being merged.

### Claim 10 (depends on 1)

The system of claim 1 wherein when a first level of security exists for the first account and a second different level of security exists for the second account, the merged account is configured with a level of security that is the higher of the first level and the second level.

### Claim 11 (depends on 1)

The system of claim 1 wherein when a first level of security exists for the first account and a second different level of security exists for the second account, the system is configured to require the level of security that is the higher of the first level and the second level to be met before merging accounts.

### Claim 12 (depends on 1)

The system of claim 1 further configured to:
when the second account is configured with multi-factor authentication, generate a user request to complete multi-factor authentication on the second account before merging the accounts.

### Claim 13 (depends on 1)

The system of claim 1 comprising an e-commerce platform, wherein each account is with a particular store implemented by the e-commerce platform.

### Claim 14

A processor implemented method comprising:
storing for each of a plurality of accounts a stored hashed password and a user ID;
receiving a plaintext password and user ID to access a first account of said plurality of accounts associated with the user ID;
determining a first hashed password computed from the plaintext password and a first hashing function, and allowing access to the first account if the user ID and the first hashed password matches a stored user ID and hashed password for the first account;
determining a second hashed password computed from the plaintext password and a second hashing function associated with a second account having the same user ID;
merging the first and second accounts into a merged account if the user ID and second hashed password matches a stored user ID and hashed password for the second account.

### Claim 15 (depends on 14)

The method of claim 14 wherein:
for each account storing another hash function input value in association with the account;
the first hashed password is computed using the first hashing function based on the plaintext password and the another hash function input value stored in association with the first account; and
the second hashed password is computed using the second hashing function based on the plaintext password and the another hash function input value stored in association with the second account.

### Claim 16 (depends on 15)

The method of claim 15 wherein:
the another hash function input value stored in association with the first account is a string that is combined with the plaintext password in a predetermined manner before using the first hash function or a seed to be used by the first hash function to compute the first hashed password or a repetition indicator that indicates how many times the first hash function should be iterated to produce the first hashed password; and
the another hash function input value stored in association with the second account is a string that is combined with the plaintext password in a predetermined manner before using the second hash function or a seed to be used by the second hash function to compute the second hashed password or a repetition indicator that indicates how many times the second hash function should be iterated to produce the second hashed password.

### Claim 17 (depends on 14)

The method of claim 14 wherein the first and second hash functions are the same.

### Claim 18 (depends on 14)

The method of claim 14 wherein the first and second hash functions are different.

### Claim 19 (depends on 14)

The method of claim 14 wherein merging the first and second accounts comprises, for each account feature for which there is a first value for the first account and a second different value for the second account, using the first value or the second value in the merged account.

### Claim 20 (depends on 19)

The method of claim 19 further comprising:
obtaining user input on which of the first value and the second value to use for at least one account feature.

### Claim 21 (depends on 19)

The method of claim 19 further comprising:
for at least one account feature, selecting the first value or the second value to be used in the single account based on a rule.

### Claim 22 (depends on 21)

The method of claim 21 wherein the rule is one of:
use value that was associated with a most recent account access;
use value that is associated with the account that was used more often;
use value that is most frequently used across the accounts being merged.

### Claim 22 (depends on 13)

The method of claim 13 further comprising:
when a first level of security exists for the first account and a second different level of security exists for the second account, configuring the merged account with a level of security that is the higher of the first level and the second level.

### Claim 24 (depends on 14)

The method of claim 14 further comprising:
when a first level of security exists for the first account and a second different level of security exists for the second account, requiring the level of security that is the higher of the first level and the second level to be met before merging accounts.

### Claim 25 (depends on 14)

The method of claim 14 further comprising:
when the second account is configured with multi-factor authentication, generating a user request to complete multi-factor authentication on the second account before merging the accounts.

### Claim 26 (depends on 14)

The method of claim 14 wherein each account is with a particular store implemented by an e-commerce platform.