EP1089516A2
Expired / Lapsed
EP
⏱️ 0.0 years remaining
Method and system for single sign-on user access to multiple web servers
Assignee: Citicorp Development Center Inc
•
Filing: 2000-09-20
•
Granted: —
•
Expires: 2020-09-20
Abstract
Abstract Methods and systems for single sign-on user access to multiple web servers are provided. A user is authenticated at a first web server (e.g., by user name and password). The first web server provides a web page to the user having a service selector (e.g., a hyperlink comprising the URL of a second web server offering the service indicated by the selector). When the user activates the service selector, the first web server constructs and transmits an encrypted authentication token (e.g., a cookie) from the first web server to a second web server via the user client. The first and second web servers share a sub-domain. The authentication token comprises an expiration time and is digitally signed by the first web server and is authenticated at the second web server. Upon authentication, the second web server allows the user to conduct a session at the second web server.
Inventors
- 👤 Michael L. Grandcolas
- 👤 France Law
- 👤 Ashwin Doshi
- 👤 Michael Williams
- 👤 Yeona Jang
- 👤 Toni Merschen
- 👤 Jack Pan
Bibliographic Details
Application Number
—
Jurisdiction
EP
Data Source
google_patents
Last Synchronized
2026-11-07 15:29
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/08; H04L63/0807; G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/33; G06F21/41; H04L63/083; G06F2221/00; G06F2221/21; G06F2221/2119
Claims Analysis
Total Claims: 48
Claim 1
Independent Claim
74 words
A method of single sign-on user access to multiple web servers,
comprising: authenticating a user at a first web server; transmitting an encrypted authentication token from the first web server to
a second web server, wherein the authentication token comprises an expiration
time and is digitally signed by the first web server; authenticating the authentication token at the second web server; and allowing the user to conduct a session at the second web server.
Claim 2
Dependent Claim
18 words
The method of claim 1 wherein the first web server and the second web
server share a sub-domain.
Claim 3
Dependent Claim
41 words
The method of claim 2 further comprising examining the expiration time of
the authentication token at the second web server and allowing the user to conduct
a session at the second web server only if the expiration time has not passed.
Claim 4
Dependent Claim
12 words
The method of claim 3 wherein the authentication token comprises a
cookie.
Claim 5
Dependent Claim
45 words
The method of claim 4 wherein transmitting the encrypted authentication
token from the first web server to the second web server comprises transmitting
the encrypted authentication token from the first web server to the user, and then
from the user to the second web server.
Claim 6
Dependent Claim
21 words
The method of claim 5 wherein authenticating the user at the first web
server comprises receiving a user name and password.
Claim 7
Dependent Claim
53 words
The method of claim 6 wherein transmitting the encrypted authentication
token from the first web server to a second web server comprises transmitting the
authentication token from the first web server to a computer of the user; and
transmitting the authentication token from the computer of the user to the second
web server.
Claim 8
Dependent Claim
21 words
The method of claim 7 wherein the first web server and the second web
server comprise a federation of web servers.
Claim 9
Dependent Claim
19 words
The method of claim 8 wherein authenticating the authentication token at
the second web server comprises examining the cookie.
Claim 10
Dependent Claim
12 words
The method of claim 9 further comprising URL encoding the
authentication token.
Claim 11
Dependent Claim
17 words
The method of claim 10 further comprising URL decoding the
authentication token at the second web server.
Claim 12
Dependent Claim
18 words
The method of claim 11 further comprising providing a web page to the
user having a service selector.
Claim 13
Dependent Claim
12 words
The method of claim 12 wherein the service selector comprises a hyperlink.
Claim 14
Dependent Claim
16 words
The method of claim 13 wherein the hyperlink comprises a URL for the
second web server.
Claim 15
Independent Claim
229 words
A method for single sign-on user access to a federation of web servers,
comprising: allowing a user at a computing device to access a first web server in the
federation of web servers via a web browser of the computing device; authenticating the user with user-provided authentication information,
including at least a user identification, by the first web server; prompting the user for selection of a functionality offered via at least a
second web server; receiving a selection by the user of the functionality offered via the second
web server; creating an authentication token for the user including at least the user
identification and with a pre-defined token expiry by the first web server; digitally signing the authentication token by the first web server; qualifying the domain attribute of the authentication token with the shared
sub-domain name by the first web server; sending the digitally signed authentication token to the web browser of the
computing device by the first web server; redirecting the web browser to the second web server by the first web
server; sending the authentication token to the second web server by the web
browser; decrypting the authentication token by the second web server; checking the pre-defined expiry of the authentication token by the second
web server; and allowing the user to conduct a session with the second web server if within
the pre-defined token expiry.
Claim 16
Dependent Claim
19 words
The method of claim 15 further comprising allowing the user to conduct a
session with the first web server.
Claim 17
Dependent Claim
18 words
The method of claim 16 wherein the second web server shares a sub-domain
with the first web server.
Claim 18
Dependent Claim
26 words
The method of claim 17 wherein digitally signing the authentication token
by the first web server comprising digitally signing the authentication token using
public key encryption.
Claim 19
Dependent Claim
14 words
The method of claim 18 further comprising confirming a match with the
digital signature.
Claim 20
Independent Claim
97 words
A method of single sign-on for multiple web servers, comprising: receiving log-in data from a user in a first server; providing the user with a service selector; receiving an indication that the user selected the service selector; constructing an authentication token comprising profile data associated
with the user; encrypting and signing the authentication token; redirecting the user to a second server; transmitting the authentication token to the user; receiving the authentication token in the second server; verifying the authentication token in the second server; and allowing the user access to a service provided by the second server.
Claim 21
Dependent Claim
14 words
The method of claim 20 wherein the authentication token further comprises
expiration time data.
Claim 22
Dependent Claim
12 words
The method of claim 21 wherein the authentication token comprises a
cookie.
Claim 23
Dependent Claim
15 words
The method of claim 22 wherein the log-in data comprises a user name and
password.
Claim 24
Dependent Claim
12 words
The method of claim 23 wherein the service selector comprises a hyperlink.
Claim 25
Independent Claim
86 words
A system for single sign-on user access to multiple web servers,
comprising: a means for authenticating a user at a first web server; a means for transmitting an encrypted authentication token from the first
web server to a second web server, wherein the authentication token comprises an
expiration time and is digitally signed by the first web server; a means for authenticating the authentication token at the second web
server; and a means for allowing the user to conduct a session at the second web
server.
Claim 26
Dependent Claim
18 words
The system of claim 25 wherein the first web server and the second web
server share a sub-domain.
Claim 27
Dependent Claim
23 words
The system of claim 26 further comprising a means for examining the
expiration time of the authentication token at the second web server.
Claim 28
Dependent Claim
12 words
The system of claim 27 wherein the authentication token comprises a
cookie.
Claim 29
Dependent Claim
50 words
The system of claim 28 wherein the means for transmitting the encrypted
authentication token from the first web server to the second web server comprises
means for transmitting the encrypted authentication token from the first web
server to the user, and then from the user to the second web server.
Claim 30
Dependent Claim
26 words
The system of claim 29 wherein the means for authenticating the user at the
first web server comprises means for receiving a user name and password.
Claim 31
Dependent Claim
60 words
The system of claim 30 wherein the means for transmitting the encrypted
authentication token from the first web server to a second web server comprises
means for transmitting the authentication token from the first web server to a
computer of the user and means for transmitting the authentication token from the
computer of the user to the second web server.
Claim 32
Dependent Claim
21 words
The system of claim 31 wherein the first web server and the second web
server comprise a federation of web servers.
Claim 33
Dependent Claim
24 words
The system of claim 32 wherein the means for authenticating the
authentication token at the second web server comprises means for examining the
cookie.
Claim 34
Dependent Claim
15 words
The system of claim 33 further comprising a means for URL encoding the
authentication token.
Claim 35
Dependent Claim
20 words
The system of claim 34 further comprising a means for URL decoding the
authentication token at the second web server.
Claim 36
Dependent Claim
21 words
The system of claim 35 further comprising a means for providing a web
page to the user having a service selector.
Claim 37
Dependent Claim
12 words
The system of claim 36 wherein the service selector comprises a hyperlink.
Claim 38
Dependent Claim
16 words
The system of claim 37 wherein the hyperlink comprises a URL for the
second web server.
Claim 39
Independent Claim
268 words
A system for single sign-on user access to a federation of web servers,
comprising: a means for allowing a user at a computing device to access a first web
server in the federation of web servers via a web browser of the computing device; a means for authenticating the user with user-provided authentication
information, including at least a user identification, by the first web server; a means for prompting the user for selection of a functionality offered via
at least a second web server; a means for receiving a selection by the user of the functionality offered via
the second web server; a means for creating an authentication token for the user including at least
the user identification and with a pre-defined token expiry by the first web server; a means for digitally signing the authentication token by the first web
server; a means for qualifying the domain attribute of the authentication token with
the shared sub-domain name by the first web server; a means for sending the digitally signed authentication token to the web
browser of the computing device by the first web server; a means for redirecting the web browser to the second web server by the
first web server; a means for sending the authentication token to the second web server by
the web browser; a means for decrypting the authentication token by the second web server; a means for checking the pre-defined expiry of the authentication token by
the second web server; and a means for allowing the user to conduct a session with the second web
server if within the pre-defined token expiry.
Claim 40
Dependent Claim
22 words
The system of claim 39 further comprising a means for allowing the user to
conduct a session with the first web server.
Claim 41
Dependent Claim
18 words
The system of claim 40 wherein the second web server shares a sub-domain
with the first web server.
Claim 42
Dependent Claim
31 words
The system of claim 41 wherein the means for digitally signing the
authentication token by the first web server comprising means for digitally signing
the authentication token using public key encryption.
Claim 43
Dependent Claim
17 words
The system of claim 42 further comprising a means for confirming a match
with the digital signature.
Claim 44
Independent Claim
127 words
A system of single sign-on for multiple web servers, comprising: a means for receiving log-in data from a user in a first server; a means for providing the user with a service selector; a means for receiving an indication that the user selected the service
selector; a means for constructing an authentication token comprising profile data
associated with the user; a means for encrypting and signing the authentication token; a means for redirecting the user to a second server; a means for transmitting the authentication token to the user; a means for receiving the authentication token in the second server; a means for verifying the authentication token in the second server; and a means for allowing the user access to a service provided by the second
server.
Claim 45
Dependent Claim
14 words
The system of claim 44 wherein the authentication token further comprises
expiration time data.
Claim 46
Dependent Claim
12 words
The system of claim 45 wherein the authentication token comprises a
cookie.
Claim 47
Dependent Claim
15 words
The system of claim 46 wherein the log-in data comprises a user name and
password.
Claim 48
Dependent Claim
12 words
The system of claim 47 wherein the service selector comprises a hyperlink.
References Cited (Backward Citations)
No citation records indexed.
USPTO Annuity & Maintenance Windows
Maintenance schedule is calculated for granted US utility patents.