# US 9,438,633 B1 · System, method and computer program product for providing unified authentication services for online applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,633 B1 - Document ID: US9438633B1 - Status: Granted - Kind: B1 - Application number: 14/684,083 - Filed: 2015-04-10 - Granted: 2016-09-06 - Earliest claimed: 2000-03-23 - Assignees: Citibank, N.A. - Applicants: Citibank, N.A. - Inventors: Bikram S. Bakshi; David W. Helms; Anthony C. Rochon; Trevor J. Walker - Web page: https://patentgrep.com/patent/US9438633B1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/335: {for accessing specific resources, e.g. using Kerberos tickets} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/105: {Multiple levels of security} - G06F 2221/2117: User registration - G06F 2221/2119: Authenticating web pages, e.g. with suspicious links - G06F 2221/2141: Access rights, e.g. capability lists, access control lists, access tables, access matrices - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system and method remotely enrolls, authenticates and provides unified authentication services in an ASP setting to a user to access requested information via a communication medium. A filter is coupled to client side components via the communication medium and a user management component coupled to the client side components via the communication medium. The user management component allows end-users to register their credentials only once. In addition, the user management component allows end-users to define the level of protection of access to their web application accounts. This includes accounts that have been configured specifically for use with the present invention and particular user credentials and accounts that have been subsequently set up but configured to use the same user credentials. The present invention can then reuse those credentials to authenticate the user to one or more potentially unrelated web applications. ## Claims ### Claim 1 A computer-implemented method comprising: assigning, by a user management server, a globally unique ID (GUID) for a user; receiving, by the user management server, a first username for a first website associated with a first account of the user and a second username for a second website associated with a second account of the user; associating, by the user management server, the first username and the second username with the GUID; establishing, by the user management server, a first policy component of an authentication server for access to the first account, wherein the first policy component requires a first type of credential for access; establishing, by the user management server, a second policy component of an authentication server for access to the second account, wherein the second policy component requires a second type of credential for access; capturing, by the user management server, the first type of credential and the second type of credential; storing, by the user management component, the first type of credential as the first policy component with the GUID in a database; storing, by the user management component, the second type of credential as the second policy component with the GUID in the database; providing, by the user management component, access to the first account of the user when receiving input of the GUID and the first type of credential; and providing, by the user management server, access to the second account of the user when receiving input of the GUID and second type of credential, wherein the first type of credential comprises a first level of protection and the second type of credential requires a second level of protection, the second level of protection requiring the first type of credential and the second type of credential; and wherein the first level of protection is defined by the first policy component and the second level or protection is defined by the second policy component. ### Claim 2 (depends on 1) The method of claim 1, wherein the first type of credential comprises information from a first identification device and the second type of credential comprises information from a second identification device. ### Claim 3 (depends on 2) The method of claim 2, wherein the first identification device comprises biometric measurement. ### Claim 4 (depends on 2) The method of claim 2, wherein the first identification device and the second identification device measure credential information differently. ### Claim 5 (depends on 1) The method of claim 1, further comprising: receiving, by the user management server, a third username for a third website associated with a third account of the user; and associating, by the user management server, the third username with the GUID. ### Claim 6 (depends on 5) The method of claim 5, further comprising: establishing, by the user management server, a third policy component for access to the third account, wherein the third policy component requires a third type of credential for access. ### Claim 7 (depends on 6) The method of claim 6, further comprising: capturing, by the user management server, the third type of credential; and storing, by the user management server, the third type of credential as the third policy component with the GUID in the database. ### Claim 8 (depends on 7) The method of claim 7, further comprising: providing, by the user management server, access to the third account of the user when receiving input of the GUID and the third type of credential. ### Claim 9 (depends on 8) The method of claim 8, wherein the third type of credential comprises a third level of protection, the third level of protection requiring the first type of credential, the second type of credential, and the third type of credential. ### Claim 10 (depends on 8) The method of claim 8, wherein the third type of credential comprises a third level of protection, the third level of protection requiring the first type of credential and the third type of credential. ### Claim 11 A system comprising: a user management processor configured to execute instructions stored on a non-transitory computer-readable medium, the instructions configured to: assign a globally unique ID (GUID) for a user; receive a first username for a first website associated with a first account of the user and a second username for a second website associated with a second account of the user; associate the first username and the second username with the GUID; establish a first policy component for access to the first account, wherein the first policy component requires a first type of credential for access; establish a second policy component for access to the second account, wherein the second policy component requires a second type of credential for access; capture the first type of credential and the second type of credential; store the first type of credential as the first policy component with the GUID in a database; store the second type of credential as the second policy component with the GUID in the database; provide access to the first account of the user when receiving input of the GUID and the first type of credential; and provide access to the second account of the user when receiving input of the GUID and second type of credential, wherein the first type of credential comprises a first level of protection and the second type of credential requires a second level of protection, the second level of protection requiring the first type of credential and the second type of credential; and wherein the first level of protection is defined by the first policy component and the second level or protection is defined by the second policy component. ### Claim 12 (depends on 11) The system of claim 11, wherein the first type of credential comprises information from a first identification device and the second type of credential comprises information from a second identification device. ### Claim 13 (depends on 12) The system of claim 12, wherein the first identification device comprises biometric measurement. ### Claim 14 (depends on 13) The system of claim 13, wherein the first identification device and the second identification device measure credential information differently. ### Claim 15 (depends on 11) The system of claim 11, wherein the user management processor is further configured to: receive a third username for a third website associated with a third account of the user; and associate the third username with the GUID. ### Claim 16 (depends on 15) The system of claim 15, wherein the user management processor is further configured to: establish a third policy component for access to the third account, wherein the third policy component requires a third type of credential for access. ### Claim 17 (depends on 16) The system of claim 16, wherein the user management processor is further configured to: capture the third type of credential; and store the third type of credential as the third policy component with the GUID in the database. ### Claim 18 (depends on 17) The system of claim 17, wherein the user management processor is further configured to: provide access to the third account of the user when receiving input of the GUID and the third type of credential. ### Claim 19 (depends on 18) The system of claim 18, wherein the third type of credential comprises a third level of protection, the third level of protection requiring the first type of credential, the second type of credential, and the third type of credential. ### Claim 20 (depends on 18) The system of claim 18, wherein the third type of credential comprises a third level of protection, the third level of protection requiring the first type of credential and the third type of credential.