US 7,613,919 Single-use password authentication

5 defendants · 5 suits · updated September 14, 2026

Also cited as U.S. Patent No. 7,613,919 · US7613919B2 · US 7,613,919 B2 · 7613919 · the '919 patent

SynchroFi LLC has filed 5 patent-infringement suits on US 7,613,919, "Single-use password authentication" since July 1, 2026, all in the D. Del., against 5 distinct defendants including Coursera, Inc., Datto, Inc. and Figma, Inc.. The patent was granted November 3, 2009 on a priority date of October 12, 2004. Its abstract opens: "Systems, computer program products and methods for authentication using a one-time password." The examiner cited 4 references during prosecution.

Assignee: Synchrofi LLC
Priority date: October 12, 2004
Granted: November 3, 2009
Expires: October 12, 2024
Status: Active
Claims: 29 (5 independent)
Inventors: Brian B. Bagley
Full text: Google Patents

The suits

5 cases · D. Del. (5)

Filed	Defendant	Plaintiff	Court	Docket
2026-07-01	Coursera, Inc.	SynchroFi LLC	D. Del.	1:26-cv-00780
2026-07-01	Datto, Inc.	SynchroFi LLC	D. Del.	1:26-cv-00781
2026-07-01	Figma, Inc.	SynchroFi LLC	D. Del.	1:26-cv-00782
2026-07-01	SonicWall Inc.	SynchroFi LLC	D. Del.	1:26-cv-00783
2026-07-01	Twitch Interactive, Inc.	SynchroFi LLC	D. Del.	1:26-cv-00784

Docket links open the public record on CourtListener. Filing dates are the complaint's.

Independent claims

What is actually asserted, verbatim.

Claim 1

1. At an authentication service in a computerized environment that includes a client, a service provider, and an authentication service, a method of the authentication service authenticating the client to the service provider using a one-time password that was previously exchanged between the authentication service and the client, the method comprising the acts of: the authentication service generating an authentication service identifier for the client; the authentication service receiving a client moniker from the client; after receiving the client moniker, the authentication service sending a one-time password to the client for the client to use in accessing the service provider; after sending the one-time password to the client, the authentication service receiving a one-time password from the service provider; if the one-time password received from the service provider matches the one-time password sent by the authentication service to the client, then the authentication service sending the authentication service identifier for the client to the service provider to authenticate the client; and if the one-time password received from the service provider does not match the one-time password sent by the authentication service to the client, then the authentication service indicating to the service provider that the one-time password received from the service provider does not match the one-time password sent to the client.

Claim 6

6. At an authentication service in a computerized environment that includes a client, a service provider, and an authentication service, a computer program storage product comprising one or more computer readable media carrying computer executable instructions that, when executed, cause one or more processors in the authentication service to perform a method of the authentication service authenticating the client to the service provider using a one-time password previously exchanged between the authentication service and the client, the method comprising the authentication service performing acts of: the authentication service generating an authentication service identifier for the client; the authentication service receiving a client moniker from the client; after receiving the client moniker, the authentication service sending a one-time password to the client for use with the service provider; after sending the one-time password to the client, the authentication service receiving a one-time password from the service provider; and the authentication service identifying that the one-time password received from the service provider matches the one-time password sent by the authentication service to the client; and the authentication service sending the authentication service identifier for the client to the service provider to authenticate the client.

Claim 13

13. At a service provider in a computerized environment that includes a client, a service provider, and an authentication service, a method of the service provider authenticating the client through a one-time password previously exchanged between the authentication service and the client, the method comprising the service provider performing acts of: the service provider associating a prior authentication service identifier for the client with a prior service provider identifier for the client; the service provider receiving from the client a service provider identifier for the client and a one-time password from the client to use in authenticating the client through the authentication service, wherein the authentication service sent the one-time password to the client in exchange for a client moniker; the service provider verifying that the service provider identifier received from the client matches the prior service provider identifier, and represents a valid service provider identifier; the service provider sending the one-time password to the authentication service in order to receive a client authentication service identifier from the authentication service; identifying that a received authentication service identifier for the client matches the prior authentication service identifier for the client associated with the service provider identifier for the client at the service provider.

Claim 19

19. At a service provider in a computerized environment that includes a client, a service provider, and an authentication service, a computer program storage product comprising one or more computer readable media carrying computer executable instructions that, when executed, cause one or more processors in the service provider to perform a method of the service provider authenticating the client through a one-time password previously exchanged between the client and the authentication service, the method comprising the service provider performing acts of: the service provider associating an authentication service identifier for the client with a prior service provider identifier for the client; the service provider receiving from the client the service provider identifier for the client and a one-time password from the client to use in authenticating the client through the authentication service, wherein the authentication service sent the one-time password to the client in exchange for a client moniker; the service provider verifying that the service provider identifier received from the client matches the prior service provider identifier, and represents a valid service provider identifier; the service provider sending the one-time password to the authentication service in order to receive a client authentication service identifier from the authentication service; identifying that received authentication service identifier for the client matches the prior authentication service identifier for the client associated with the service provider identifier for the client at the service provider; and the service provider allowing the client access to one or more services offered by the service provider.

Claim 26

26. At a client computer system in a computerized environment that includes a client, a service provider, and an authentication service, a computer program storage product comprising one or more computer readable media carrying computer executable instructions that, when executed, cause one or more processors in the client to perform a method of the client authenticating to the service provider using a one-time password previously exchanged between the client and the authentication service, the method comprising the client performing acts of: the client sending a client moniker to the authentication service to obtain a one-time password; the client receiving the one-time password from the authentication service, wherein the one-time password is associated with an authentication service identifier for the client to use in accessing the service provider; the client sending a service provider identifier for the client to the service provider so that the service provider can locate the authentication service identifier for the client that is associated with the service provider identifier for the client at the service provider; and the client sending the one-time password previously received from the authentication service to the service provider, whereby the service provider can perform the acts of: sending the one-time password to the authentication service; upon validating the one-time password by the authentication service, receiving the authentication service identifier for the client that is associated with the one-time password from the authentication service; and matching the authentication service identifier for the client that is received from the authentication service with the authentication service identifier for the client that is associated with the service provider identifier for the client at the service provider.

Art before the examiner

4 references of record, 4 cited by the examiner.

Everything listed here was before the Office and is what a challenge must go beyond. Art the examiner never saw is where an invalidity search starts.

Examiner-cited

WO2001086393A2 — Message authentication using message gates in a distributed computing environment (Sun Microsystems, Inc.)
US20050120214A1 — Systems and methods for enhancing security of communication over a public network (Microsoft Corporation)
US20060053296A1 — Method for authenticating a user to a service of a service provider (Axel Busboom)
US7275260B2 — Enhanced privacy protection in identification in a data communications network (Sun Microsystems, Inc.)

Classification

H04L63/083primary — Network architectures or network communication protocols for network security for authentication of entities using passwords
G06F21/31 — User authentication
G06F2221/2115 — Third party
H04L63/0823 — Network architectures or network communication protocols for network security for authentication of entities using certificates
H04L63/0838 — Network architectures or network communication protocols for network security for authentication of entities using passwords using one-time-passwords
H04L9/3228 — One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key

Family

US7613919B2 — B2 (2009)
US20060080545A1 — A1 (2006)
2 foreign family members: WO2006044151A2, WO2006044151A3

Abstract

Systems, computer program products and methods for authentication using a one-time password. In system that includes a client, a service provider, and an authentication service, the authentication service generates an authentication service identifier for the client. Any suitable identifier may be used for the authentication service identifier, which generally takes the form of an arbitrary number of characters. From the client, the authentication service receives a client moniker (e.g., a username) for the client to use when accessing the authentication service. The authentication service sends a one-time password to the client for the client to use in accessing the service provider. When the authentication service receives a one-time password from the service provider, the authentication service sends the authentication service identifier for the client to the service provider to authenticate the client if the one-time password received from the service provider matches the one-time password sent to the client.

Named in one of these suits? A prior-art search is commissioned once and serves every defendant who shares it. The examiner's own search record is free on the tools page, and your first preliminary search is free — one claim, back within 24 hours — so you know whether there is art the Office never saw before anyone pays for more. Flat fees: $2,500$899 for the independent claims, $5,000$1,500 for every asserted claim.

Order a free preliminary search → How much prior art does an IPR petition need?

This page is assembled from public records — federal court dockets and the patent's own file — and is updated as the case list changes. It states what the record shows and is not an opinion on the validity or infringement of any claim. Patent data via Google Patents; docket data via CourtListener.