# US 9,521,139 B2 · System for managing multi-user sign-on in a segmented network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,521,139 B2 - Document ID: US9521139B2 - Status: Granted - Kind: B2 - Application number: 14/634,472 - Filed: 2015-02-27 - Published: 2016-09-01 - Granted: 2016-12-13 - Earliest claimed: 2015-02-27 - Assignees: Bank of America Corporation - Applicants: Bank of America Corporation - Inventors: Jisoo Lee; Brian Joseph Smith; Yair Frankel; James P. Scopis; Eins K. Joseph; Todd Michael Goodyear; Francis George Farro, II - Web page: https://patentgrep.com/patent/US9521139B2 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/0272: {Virtual private networks} - H04L 63/0815: {providing single-sign-on or federations} - H04L 63/0853: {using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234)} - H04W 12/06: Authentication - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - H04W 12/71: Hardware identity - H04W 12/72: Subscriber identity - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Disclosed is a system for providing multi-user management for personal computing devices over an entity network. The system is typically configured to (i) receive a first request from the personal computing device to receive first user-specific information, (ii) authenticate the user identifier associated with the first user, (iii) associate the user identifier associated with the first user with the device identifier, (iv) communicate a first response to the personal computing device based on authenticating the user identifier, (v) receiving a second request from the personal computing device to receive second user-specific information associated with the first user for a second application, (vi) determining that the device identifier is associated with the user identifier associated with the first user, (vii) and communicating a second response to the personal computing device based on determining that the device identifier is associated with the user identifier associated with the first user. ## Claims ### Claim 1 A system for providing a multi-user experience on a mobile device, the system comprising: a processor; a memory; a communication interface in communication with an entity network and with the mobile device; and a multi-user management module stored in the memory, executable by the processor and configured for: receiving a security certificate from the mobile device; authenticating the security certificate; based on authenticating the security certificate, establishing network communication between the mobile device and a secured network segment; receiving a first request from the mobile device to receive first user-specific information for a first application executed by the mobile device from the secured network segment in communication with the entity network, wherein the first request comprises a device identifier and a user identifier associated with a first user; authenticating the user identifier associated with the first user; associating the user identifier associated with the first user with the device identifier; communicating a first response to the mobile device based on authenticating the user identifier associated with the first user, the first response including the first user-specific information; receiving a second request from the mobile device to receive second user-specific information associated with the first user for a second application executed by the mobile device from the secured network segment, wherein the second request comprises the device identifier; determining that the device identifier is associated with the user identifier associated with the first user; communicating a second response to the mobile device based on determining that the device identifier is associated with the user identifier associated with the first user, the second response including the second user-specific information; receiving a third request from the mobile device, wherein the third request comprises the device identifier and a second user identifier associated with a second user; disassociating the user identifier associated with the first user and the device identifier based on receiving the third request; associating the second user identifier with the device identifier based on receiving the third request; determining that a pre-defined time period has elapsed after receiving the third request; determining that the mobile device has not communicated a subsequent request before the pre-defined period has elapsed; and disassociating the second user identifier associated with the second user and the device identifier based on determining that the mobile device has not communicated a subsequent request before the pre-defined period has elapsed. ### Claim 2 (depends on 1) The system of claim 1, wherein the device identifier is the security certificate. ### Claim 3 (depends on 1) The system of claim 1, wherein the entity network further comprises a private network segment, and wherein the multi-user management module is further configured for blocking communications between the mobile device and the private network segment. ### Claim 4 (depends on 1) The system of claim 1, wherein the mobile device is a tablet computer. ### Claim 5 (depends on 1) The system of claim 1, wherein the multi-user management module is further configured for (i) receiving a fourth request, wherein the fourth request comprises a third user identifier, (ii) determining that the third user identifier is not authorized to make requests using the mobile device, (iii) blocking the fourth request based on determining that the third user identifier is not authorized to make requests using the mobile device. ### Claim 6 (depends on 5) The system of claim 5, wherein blocking the fourth request is further based on the device identifier. ### Claim 7 A computer program product for providing a multi-user experience on a mobile device in communication with an entity network, the computer program product comprising a non-transitory computer-readable storage medium having computer-executable instructions for: receiving a security certificate from the mobile device; authenticating the security certificate; based on authenticating the security certificate, establishing network communication between the mobile device and a secured network segment; receiving a first request from the mobile device to receive first user-specific information for a first application executed by the mobile device from a secured network segment in communication with the entity network, wherein the first request comprises a device identifier and a user identifier associated with a first user; authenticating the user identifier associated with the first user; associating the user identifier associated with the first user with the device identifier; communicating a first response to the mobile device based on authenticating the user identifier associated with the first user; receiving a second request from the mobile device to receive second user-specific information associated with the first user for a second application executed by the mobile device from the secured network segment, wherein the second request comprises the device identifier; determining that the device identifier is associated with the user identifier associated with the first user; communicating a second response to the mobile device based on determining that the device identifier is associated with the user identifier associated with the first user; receiving a third request from the mobile device, wherein the third request comprises the device identifier and a second user identifier associated with a second user; disassociating the user identifier associated with the first user with the device identifier based on receiving the third request; associating the second user identifier with the device identifier based on receiving the third request; determining that a pre-defined time period has elapsed after receiving the third request; determining that the mobile device has not communicated a subsequent request before the pre-defined period has elapsed; and disassociating the second user identifier associated with the second user and the device identifier based on determining that the mobile device has not communicated a subsequent request before the pre-defined period has elapsed. ### Claim 8 (depends on 7) The computer program product of claim 7, wherein the device identifier is the security certificate. ### Claim 9 (depends on 7) The computer program product of claim 7, wherein the entity network further comprises a private network segment, and wherein the non-transitory computer-readable storage medium further having computer-executable instructions for blocking communications between the mobile device and the private network segment. ### Claim 10 (depends on 7) The computer program product of claim 7, wherein the mobile device is a tablet computer. ### Claim 11 (depends on 7) The computer program product of claim 7, wherein the non-transitory computer-readable storage medium further having computer-executable instructions for (i) receiving a fourth request, wherein the fourth request comprises a third user identifier, (ii) determining that the third user identifier is not authorized to make requests using the mobile device, (iii) blocking the fourth request based on determining that the third user identifier is not authorized to make requests using the mobile device. ### Claim 12 (depends on 11) The computer program product of claim 11, wherein blocking the fourth request is further based on the device identifier. ### Claim 13 A method for providing a multi-user experience on a mobile device via an entity network, the method comprising: receiving a security certificate from the mobile device; authenticating the security certificate; based on authenticating the security certificate, establishing network communication between the mobile device and a secured network segment; receiving, via a computer processor, a first request from the mobile device to receive first user-specific information for a first application executed by the mobile device from a secured network segment in communication with the entity network, wherein the first request comprises a device identifier and a user identifier associated with a first user; authenticating, via a computer processor, the user identifier associated with the first user; associating, via a computer processor, the user identifier associated with the first user with the device identifier; communicating, via a computer processor, a first response to the mobile device based on authenticating the user identifier associated with the first user; receiving, via a computer processor, a second request from the mobile device to receive second user-specific information associated with the first user for a second application executed by the mobile device from the secured network segment, wherein the second request comprises the device identifier; determining, via a computer processor, that the device identifier is associated with the user identifier associated with the first user; communicating, via a computer processor, a second response to the mobile device based on determining that the device identifier is associated with the user identifier associated with the first user; receiving, via a computer processor, a third request from the mobile device, wherein the third request comprises the device identifier and a second user identifier associated with a second user; disassociating, via a computer processor, the user identifier associated with the first user with the device identifier based on receiving the third request; and associating, via a computer processor, the second user identifier with the device identifier based on receiving the third request; determining, via a computer processor, that a pre-defined time period has elapsed after receiving the third request; determining, via a computer processor, that the mobile device has not communicated a subsequent request before the pre-defined period has elapsed; and disassociating, via a computer processor, the second user identifier associated with the second user and the device identifier based on determining that the mobile device has not communicated a subsequent request before the pre-defined period has elapsed. ### Claim 14 (depends on 13) The method of claim 13, wherein the device identifier is the security certificate. ### Claim 15 (depends on 13) The method of claim 13, wherein the entity network further comprises a private network segment, and wherein the method comprises blocking communications between the mobile device and the private network segment. ### Claim 16 (depends on 13) The method of claim 13, wherein the mobile device is a tablet computer. ### Claim 17 (depends on 13) The method of claim 13, further comprising (i) receiving, via a computer processor, a fourth request, wherein the fourth request comprises a third user identifier, (ii) determining, via a computer processor, that the third user identifier is not authorized to make requests using the mobile device, (iii) blocking, via a computer processor, the fourth request based on determining that the third user identifier is not authorized to make requests using the mobile device. ### Claim 18 (depends on 17) The method of claim 17, wherein blocking the fourth request is further based on the device identifier.