IP Library › Granted Patent US 12706748
Granted Patent B2
US 12706748 · App. 18/678,062 · Granted Aug 11, 2026

Authentication proxy for password rotation

Inventor: Eric Le Saint (Los Altos, CA)
Assignee: Visa International Service Association
H04L9/3226
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12706748
App. No.
18/678,062
Granted
Aug 11, 2026
Kind
B2
Abstract

Disclosed is a method, system, and computer program product for rotating a password. According to the method, a proxy server receives a first service ID password from an application server. The proxy server determines whether to use the first service ID password to authenticate the application server at an authentication service based on a query of a database of password changes. Based on the determination of whether to use the first service ID password, the proxy server authenticates the application server at the authentication service using the first service ID password based on the determination or authenticates the application server at the authentication service by replacing the first service ID password with a second service ID password based on the determination.

Claims (52)

1 . A method for rotating a password, the method comprising:

receiving, by a proxy server, a first service ID password from an application server;

determining, by the proxy server, whether to use the first service ID password to authenticate the application server at an authentication service based on a query of a database of password changes;

wherein based on the determination to use the first service ID password, authenticating the application server at the authentication service using the first service ID password based on the determination; and

wherein based on the determination not to use the first service ID password, authenticating the application server at the authentication service by replacing the first service ID password with a second service ID password based on the determination.

2 . The method of claim 1 , comprising passing, by the proxy server, the first service ID password or the second service ID password to the authentication service to authenticate the application server at the authentication service.

3 . The method of claim 1 , comprising authenticating, by the authentication service, the application server at an active directory.

4 . The method of claim 1 , comprising determining, by the proxy server, whether the application server of a plurality of application servers has been updated to the second service ID password.

5 . The method of claim 4 , comprising:

replacing, by the proxy server, the second service ID password with the first service ID password based on the determination that the application server has been updated with the second service ID password; and

passing, by the proxy server, the first service ID password represented by an encryption key to the authentication service.

6 . The method of claim 5 , comprising authenticating the application server at the authentication service based on the first service ID password until each one of a plurality of application servers has been updated to the second service ID password.

7 . The method of claim 4 , comprising:

replacing, by the proxy server, the first service ID password with the second service ID password based on the determination that the application server has not been updated to the second service ID password; and

passing, by the proxy server, the first service ID password represented by an encryption key to the authentication service.

8 . The method of claim 1 , comprising:

receiving, by the proxy server, a hash of the first service ID password and a hash of the second service ID password from a password vault if a change is required; and

passing, by the proxy server, the hash of the second service ID password to the authentication service.

9 . A system, comprising:

a proxy server, the proxy server comprising a processor and a memory storage device having instruction stored thereon, that when executed, cause the processor to execute the instructions;

a proxy registry database of password changes; and

an authentication service;

wherein the proxy server is configured to:

receive a first service ID password from an application server;

determine whether to use the first service ID password to authenticate the application server at the authentication service based on a query of the proxy registry database of password changes;

wherein based on the determination to use the first service ID password, authenticate the application server at the authentication service using the first service ID password based on the determination; and

wherein based on the determination not to use the first service ID password, authenticate the application server at the authentication service by replacing the first service ID password with a second service ID password based on the determination.

10 . The system of claim 9 , wherein the proxy server is configured to pass the first service ID password or the second service ID password to the authentication service to authenticate the application server at the authentication service.

11 . The system of claim 9 , wherein the authentication service is configured to authenticate the application server at an active directory.

12 . The system of claim 9 , wherein the proxy server is configured to determine whether the application server of a plurality of application servers has been updated to the second service ID password.

13 . The system of claim 12 , wherein the proxy server is configured to:

replace the second service ID password with the first service ID password based on the determination that the application server has been updated with the second service ID password; and

pass the first service ID password represented by an encryption key to the authentication service.

14 . The system of claim 13 , wherein the authentication service is configured to authenticate the application server based on the first service ID password until each one of a plurality of application servers has been updated to the second service ID password.

15 . The system of claim 12 , wherein the proxy server is configured to:

replace the first service ID password with the second service ID password based on the determination that the application server has not been updated to the second service ID password; and

pass the first service ID password represented by an encryption key to the authentication service.

16 . The system of claim 9 , comprising:

receiving, by the proxy server, a hash of the first service ID password and a hash of the second service ID password from a password vault if a change is required; and

pass the hash of the second service ID password to the authentication service.

17 . A computer program product comprising at least one non-transitory computer-readable medium including one or more instructions that, when executed by at least one processor, cause the at least one processor to:

receive a first service ID password from an application server;

determine whether to use the first service ID password to authenticate the application server at an authentication service based on a query of a proxy registry database of password changes;

wherein based on the determination to use the first service ID password, authenticate the application server at the authentication service using the first service ID password based on the determination; and

wherein based on the determination not to use the first service ID password, authenticate the application server at the authentication service by replacing the first service ID password with a second service ID password based on the determination.

18 . The computer program product of claim 17 , wherein the one or more instructions, when executed by the at least one processor, cause the at least one processor to pass the first service ID password or the second service ID password to the authentication service to authenticate the application server at the authentication service.

19 . The computer program product of claim 17 , wherein the one or more instructions, when executed by at least one processor, cause the at least one processor to authenticate the application server at an active directory.

20 . The computer program product of claim 17 , wherein the one or more instructions, when executed by the at least one processor, cause the at least one processor to:

determine whether the application server has been updated to the second service ID password; and

one of:

replace the second service ID password with the first service ID password based on the determination that the application server of a plurality of application servers has been updated with the second service ID password; pass the first service ID password represented by an encryption key to the authentication service; and authenticate the application server based on the first service ID password until each one of a plurality of application servers has been updated to the second service ID password; or

replace the first service ID password with the second service ID password based on the determination that the application server of a plurality of application servers has not been updated to the second service ID password; and pass the first service ID password represented by an encryption key to the authentication service.