Patent US6092196A successfully refreshed from Google Patents.
US6092196A
Expired / Lapsed
US
⏱️ 0.0 years remaining
HTTP distributed remote user authentication system
Assignee: RPX Clearinghouse LLC
•
Filing: 1997-11-25
•
Granted: 2000-07-18
•
Expires: 2017-11-25
Abstract
Abstract The present invention relates to the field of data and computer network security. Data and computer network security is of the utmost importance to most organizations that possess such networks. One of the difficulties that users and managers of these networks face is that the users have to provide a user ID and password every time they wish to access one of the organization's secured HTTP servers or URLs. This creates a problem for users and managers since lists of numerous user IDs and passwords need to be maintained and therefore can easily be lost or their confidentiality compromised. This invention addresses these problems by providing a transparent, scalable, single point of authentication for remote users across any number of HTTP servers anywhere on a data network, such as an Intranet, using any user ID and password scheme implemented by a main authentication HTTP server.
Inventors
- 👤 Albert Reiche
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-30 06:01
CPC Classifications
G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/41
Claims Analysis
Total Claims: 34
Claim 1
Independent Claim
182 words
An authentication server for use in a data network that includes a plurality of nodes connected to one another by data transmission pathways, comprising: a database for holding user identification data on a plurality of users that may potentially seek access to a resource at a first node accessible through the data network; said authentication server being operable for issuing a message in the data network for prompting a user residing at a second node of the data network to enter at the second node a user identification data element; said authentication server being operable to process the user identification data element entered by the user at the second node to determine if an access right should be granted to the user; said authentication server being operable to direct to the first node a communication containing data permitting the first node to generate and transmit to the second node an access grant mark, the access grant mark being retained by the second node and subsequently recognizable by the first node as indication of past occurrence of access grant by said authentication server.
Claim 2
Dependent Claim
182 words
An authentication server for use in a data network that includes a plurality of nodes connected to one another by data transmission pathways, comprising: a database for holding user identification data on a plurality of users that may potentially seek access to a resource at a first node accessible through the data network; said authentication server being operable for issuing a message in the data network for prompting a user residing at a second node of the data network to enter at the second node a user identification data element; said authentication server being operable to process the user identification data element entered by the user at the second node to determine if an access right should be granted to the user; said authentication server being operable to direct to the first node a communication containing data permitting the first node to generate and transmit to the second node an access grant mark, the access grant mark being retained by the second node and subsequently recognizable by the first node as indication of past occurrence of access grant by said authentication server.
Claim 3
Dependent Claim
41 words
An authentication server as defined in claim 1, wherein said authentication server includes a database holding a list of individual user identification data elements, each of said user identification data elements characterizing a user that may potentially seek an access right.
Claim 4
Dependent Claim
49 words
An authentication server as defined in claim 2, wherein said authentication server is also operable in response to a query from the first node to grant a resource access right to a particular user in dependence of the user identification data elements in said database characterizing the particular user.
Claim 5
Dependent Claim
20 words
An authentication server as defined in claim 3, wherein each individual user identification data element includes a user ID portion.
Claim 6
Dependent Claim
19 words
An authentication server as defined in claim 4, wherein each individual user identification data element includes a password portion.
Claim 7
Dependent Claim
16 words
An authentication server as defined in claim 5, wherein the access grant mark is a cookie.
Claim 8
Dependent Claim
38 words
An authentication server as defined in claim 6, wherein the communication directed from said authentication server to the first node includes a status code indicative of whether said verification unit has granted an access right to the user.
Claim 9
Dependent Claim
68 words
An authentication server as defined in claim 5, wherein said authentication server is responsive to a communication received from the second node including a URL string, a portion of the URL string containing transaction ID data, to issue a message in the data network for prompting the user residing at the second node of the data network to enter at the second node the user identification data element.
Claim 10
Dependent Claim
32 words
An authentication server as defined in claim 8, wherein said server is responsive to the communication including the URL string to create a record of data indicative of the transaction ID data.
Claim 11
Dependent Claim
52 words
An authentication server as defined in claim 9, wherein said verification unit is responsive to an access grant inquiry message containing data corresponding to said record to direct to the first node the communication containing data permitting the first node to generate and transmit to the second node an access grant mark.
Claim 12
Dependent Claim
30 words
An authentication server as defined in claim 10, wherein said authentication server is responsive to an access grant inquiry message containing data corresponding to said record to delete said record.
Claim 13
Dependent Claim
169 words
A data network, comprising: a plurality of nodes connected to one another by data transmission pathways; an authentication server residing at one of said nodes; a customer server residing at another one of said nodes, said customer server supporting a certain resource; said customer server being responsive to a first message from a user at a certain node of said network requesting access to the certain resource to issue a response message to the certain node, said response message causing the certain node to initiate an access grant control transaction with said authentication server, said access grant control transaction characterised by requesting the user to provide a user identification data element; said authentication server capable to direct to the customer server a communication containing data permitting the customer server to generate and transmit to the certain node an access grant mark, the access grant mark being retained by the certain node and recognizable by the customer server as indication of past occurrence of access grant by said authentication server.
Claim 14
Dependent Claim
169 words
A data network, comprising: a plurality of nodes connected to one another by data transmission pathways; an authentication server residing at one of said nodes; a customer server residing at another one of said nodes, said customer server supporting a certain resource; said customer server being responsive to a first message from a user at a certain node of said network requesting access to the certain resource to issue a response message to the certain node, said response message causing the certain node to initiate an access grant control transaction with said authentication server, said access grant control transaction characterised by requesting the user to provide a user identification data element; said authentication server capable to direct to the customer server a communication containing data permitting the customer server to generate and transmit to the certain node an access grant mark, the access grant mark being retained by the certain node and recognizable by the customer server as indication of past occurrence of access grant by said authentication server.
Claim 15
Dependent Claim
18 words
A data network as defined in claim 12, wherein said user identification data element includes a user ID.
Claim 16
Dependent Claim
17 words
A data network as defined in claim 13, wherein said user identification data element includes a password.
Claim 17
Dependent Claim
41 words
A data network as defined in claim 14, wherein said authentication server is responsive to said identification data element provided by the user during said access grant control transaction to verify a right of the user to access said customer server.
Claim 18
Dependent Claim
43 words
A data network as defined in claim 15, wherein said authentication server includes a database holding a list of individual user identification data elements, each of said user identification data elements characterizing a user that may potentially seek access to said customer server.
Claim 19
Dependent Claim
27 words
A data network as defined in claim 16, wherein said authentication server is operable to create a transaction ID record indicative of said access grant control transaction.
Claim 20
Dependent Claim
16 words
A data network as defined in claim 17, wherein the access grant mark is a cookie.
Claim 21
Dependent Claim
49 words
A data network as defined in claim 18, wherein said customer server is responsive to said first message to create a transaction ID record and issue a redirect command toward said certain node for causing the certain node to establish said access grant control transaction with said authentication server.
Claim 22
Dependent Claim
24 words
A data network as defined in claim 19, wherein said customer server appends to said redirect command data indicative of said transaction ID record.
Claim 23
Dependent Claim
142 words
A customer server for use in a network including an authentication server, said customer server capable to support a certain resource potentially sought by a user from a certain node of the network, said customer server: being responsive to a first message issued from the certain node requesting access to the certain resource to issue a response message to the certain node, the response message causing the certain node to initiate an access grant control transaction with said authentication server; and being responsive at least in part to a second message issued from the authentication server containing data permitting the customer server to generate and transmit to the certain node an access grant mark, the access grant mark being retained by the certain node and recognizable by the customer server as indication of past occurrences of access grant by said authentication server.
Claim 24
Dependent Claim
142 words
A customer server for use in a network including an authentication server, said customer server capable to support a certain resource potentially sought by a user from a certain node of the network, said customer server: being responsive to a first message issued from the certain node requesting access to the certain resource to issue a response message to the certain node, the response message causing the certain node to initiate an access grant control transaction with said authentication server; and being responsive at least in part to a second message issued from the authentication server containing data permitting the customer server to generate and transmit to the certain node an access grant mark, the access grant mark being retained by the certain node and recognizable by the customer server as indication of past occurrences of access grant by said authentication server.
Claim 25
Dependent Claim
15 words
A customer server as defined in claim 21, wherein said second message is a cookie.
Claim 26
Independent Claim
177 words
A method for access control in a data network, said data network including: a plurality of nodes connected to one another by data transmission pathways; an authentication server residing at one of said nodes; a customer server residing at another one of said nodes, said customer server supporting a certain resource, said method comprising the steps of: a) receiving at said customer server a request for access by a user residing at a certain node of the data network to the certain resource; b) issuing a control message toward the certain node to cause initiation of an access grant control transaction with said authentication server, said access grant control transaction characterised by requesting the user to provide a user identification data element; c) forwarding from said authentication server to the customer server data permitting the customer server to generate and transmit to the certain node an access grant mark, the access grant mark being retained by the certain node and recognizable by the customer server as indication of past occurrence of access grant by said authentication server.
Claim 27
Independent Claim
177 words
A method for access control in a data network, said data network including: a plurality of nodes connected to one another by data transmission pathways; an authentication server residing at one of said nodes; a customer server residing at another one of said nodes, said customer server supporting a certain resource, said method comprising the steps of: a) receiving at said customer server a request for access by a user residing at a certain node of the data network to the certain resource; b) issuing a control message toward the certain node to cause initiation of an access grant control transaction with said authentication server, said access grant control transaction characterised by requesting the user to provide a user identification data element; c) forwarding from said authentication server to the customer server data permitting the customer server to generate and transmit to the certain node an access grant mark, the access grant mark being retained by the certain node and recognizable by the customer server as indication of past occurrence of access grant by said authentication server.
Claim 28
Dependent Claim
37 words
A method as defined in claim 23, comprising the step of generating a transaction ID record at said customer server and including data in said control message toward the certain node indicative of the transaction ID record.
Claim 29
Dependent Claim
36 words
A method as defined in claim 24, comprising said authentication server issuing a message toward the certain node during said access grant control transaction to request entry by the user of a user identification data element.
Claim 30
Dependent Claim
24 words
A method as defined in claim 25, wherein said user identification data element is selected from the group consisting of user ID and password.
Claim 31
Dependent Claim
67 words
A method as defined in claim 26, including the step of receiving the user identification data element at said authentication server and searching a database holding a list of individual user identification data elements, each of said user identification data elements characterizing a user that may potentially seek an access grant, to determine if the user at the certain node is permitted to access said customer server.
Claim 32
Dependent Claim
34 words
A method as defined in claim 27, comprising the step of transmitting from the certain node to said authentication server during said access grant control transaction the data indicative of the transaction ID record.
Claim 33
Dependent Claim
47 words
A method as defined in claim 28, comprising the step of issuing from said authentication server toward the certain node a redirect message causing the certain node to request access to the certain resource and including in the redirect message the data indicative of the transaction ID.
Claim 34
Dependent Claim
45 words
A method as defined in claim 29, comprising the step of comparing the transaction ID data received at said customer server in the response to the request to access the certain resource by the certain node with the transaction ID record at said customer server.
References Cited (Backward Citations)
US5560008A
Cited
US5642515A
Cited
US5235642A
Cited
US5689638A
Cited
US5708780A
Cited
WO1996042041A2
Cited
US5841970A
Cited
US5706427A
Cited
EP0762261A2
Cited
US5790785A
Cited
US5818936A
Cited
US5684950A
Cited
US5864676A
Cited
US5875296A
Cited
US5908469A
Cited
US6006334A
Cited
WO1999000958A1
Cited
WO1999000960A1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2003-07-18 | 2004-01-17 | 2004-07-18 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2007-07-18 | 2008-01-17 | 2008-07-18 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2011-07-18 | 2012-01-17 | 2012-07-18 | $7700.00 | Window Closed / Lapsed |