US6421768B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Method and system for authentication and single sign on using cryptographically assured cookies in a distributed computer environment
Assignee: RELIANCE DATA LP
•
Filing: 1999-05-04
•
Granted: 2002-07-16
•
Expires: 2019-05-04
Abstract
Abstract Cryptographically assured data structures are created to enable a single sign on and/or authentication method for securely transferring user authentication information from a first computer to a second computer to allow the user to seamlessly interact with the second computer without necessarily re-authenticating himself thereto. Thus, if a second computer trusts the methods used by a first computer to authenticate a user, then the second computer can use a cryptographically assured cookie created by the first computer to authenticate the user, without requiring the user to perform an explicit authentication step at the second computer. More particularly, a cryptographically assured cookie is made by creating a cryptographically assured voucher of a user characteristic at the first computer, and embedding the voucher into a cookie for transmission to the user's computer and hence to the second computer.
Inventors
- 👤 Stephen J. Purpura
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-04 12:40
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/08; H04L63/0815; G; G06; G06F; G06F21/00; G06F21/30; G06F21/31; G06F21/41
Claims Analysis
Total Claims: 44
Claim 1
Independent Claim
210 words
A method for transferable authentication, by which a user accessing a first computer can be authenticated to a second computer remote from said first computer, without necessarily requiring the user to explicitly identify himself to said second computer, comprising the steps of: a) at a user's computer, accessing said first computer; b) authenticating said user to said first computer; c) receiving from said first computer a cookie including said first computer's digital voucher of a user characteristic, said voucher being cryptographically assured by said first computer, said user characteristic being encrypted and incorporated into said digital voucher by said first computer using a session key confidential to said first computer and said second computer but unknown to said user, said session key being cryptographically assured using an asymmetric key of at least one of said first computer and said second computer; d) transmitting said cryptographically assured session key to said second computer via said user's computer; and e) sending at least a portion of said cookie, including said voucher, to said second computer configured to: (1) authenticate said voucher without necessarily requiring said user to explicitly identify himself to said second computer; (2) extract said user characteristic from said voucher; and (3) perform an action based on said user characteristic.
Claim 2
Independent Claim
210 words
A method for transferable authentication, by which a user accessing a first computer can be authenticated to a second computer remote from said first computer, without necessarily requiring the user to explicitly identify himself to said second computer, comprising the steps of: a) at a user's computer, accessing said first computer; b) authenticating said user to said first computer; c) receiving from said first computer a cookie including said first computer's digital voucher of a user characteristic, said voucher being cryptographically assured by said first computer, said user characteristic being encrypted and incorporated into said digital voucher by said first computer using a session key confidential to said first computer and said second computer but unknown to said user, said session key being cryptographically assured using an asymmetric key of at least one of said first computer and said second computer; d) transmitting said cryptographically assured session key to said second computer via said user's computer; and e) sending at least a portion of said cookie, including said voucher, to said second computer configured to: (1) authenticate said voucher without necessarily requiring said user to explicitly identify himself to said second computer; (2) extract said user characteristic from said voucher; and (3) perform an action based on said user characteristic.
Claim 3
Independent Claim
195 words
A method for transferable authentication, by which a user accessing a first computer can be authenticated to a second computer remote from said first computer, without necessarily requiring the user to explicitly identify himself to said second computer, comprising the steps of: a) at said first computer, receiving an access request from said user; b) receiving authentication information from said user; c) creating a cookie containing a user characteristic; d) cryptographically assuring said cookie with a digital voucher of said user characteristic, said user characteristic being encrypted and incorporated into said digital voucher by said first computer using a session key confidential to said first computer and said second computer but unknown to said user, said session key being cryptographically assured using an asymmetric key of at least one of said first computer and said second computer; e) transmitting said cryptographically assured session key to said second computer via said user's computer; and f) sending said cookie to said user's computer to be at least partially forwarded to said second computer that can: (1) authenticate said voucher; (2) extract said user characteristic from said voucher; and (3) perform an action based on said user characteristic.
Claim 4
Independent Claim
195 words
A method for transferable authentication, by which a user accessing a first computer can be authenticated to a second computer remote from said first computer, without necessarily requiring the user to explicitly identify himself to said second computer, comprising the steps of: a) at said first computer, receiving an access request from said user; b) receiving authentication information from said user; c) creating a cookie containing a user characteristic; d) cryptographically assuring said cookie with a digital voucher of said user characteristic, said user characteristic being encrypted and incorporated into said digital voucher by said first computer using a session key confidential to said first computer and said second computer but unknown to said user, said session key being cryptographically assured using an asymmetric key of at least one of said first computer and said second computer; e) transmitting said cryptographically assured session key to said second computer via said user's computer; and f) sending said cookie to said user's computer to be at least partially forwarded to said second computer that can: (1) authenticate said voucher; (2) extract said user characteristic from said voucher; and (3) perform an action based on said user characteristic.
Claim 5
Dependent Claim
17 words
The method of claim 2 , wherein said first computer and said second computer are not collocated.
Claim 6
Dependent Claim
17 words
The method of claim 3 , wherein said first computer and said second computer have different owners.
Claim 7
Dependent Claim
18 words
The method of claim 3 , wherein said first computer and said second computer share a common domain.
Claim 8
Dependent Claim
13 words
The method of claim 3 , wherein said voucher includes an expiration time.
Claim 9
Dependent Claim
25 words
The method of claim 3 , wherein said voucher includes an instruction to send said user to another computer after communication with said second computer.
Claim 10
Dependent Claim
26 words
The method of claim 3 , wherein said voucher includes an instruction to return said user to said first computer after communication with said second computer.
Claim 11
Dependent Claim
17 words
The method of claim 3 , wherein said first computer and said second computer have synchronized timeouts.
Claim 12
Dependent Claim
15 words
The method of claim 3 , wherein said user characteristic comprises the user's network identity.
Claim 13
Dependent Claim
15 words
The method of claim 3 , wherein said user characteristic comprises the user's session preferences.
Claim 14
Dependent Claim
14 words
The method of claim 3 , wherein said user computer includes a web browser.
Claim 15
Dependent Claim
20 words
The method of claim 3 , wherein at least one of said first and second computers is a web site.
Claim 16
Dependent Claim
19 words
The method of claim 13 , wherein said first computer is a web site of a content service provider.
Claim 17
Dependent Claim
20 words
The method of claim 13 , wherein said second computer is a web site for electronic bill presentment and payment.
Claim 18
Dependent Claim
13 words
The method of claim 3 , wherein said cryptographic assurance includes RSA cryptography.
Claim 19
Dependent Claim
29 words
The method of claim 3 , wherein said cryptographic assurance includes encryption of said user characteristic under a symmetric key shared between said first computer and said second computer.
Claim 20
Dependent Claim
47 words
The method of claim 17 , further comprising exchanging between said first computer and said second computer via a cookie on said user's computer a cryptographic assurance of said symmetric key under an asymmetric key of at least one of said first computer or said second computer.
Claim 21
Independent Claim
187 words
A method for transferable authentication, by which a user accessing a first computer can be authenticated to a second computer remote from said first computer, without necessarily requiring the user to explicitly identify himself to said second computer, comprising the steps of: a) at said second computer, receiving at least a portion of a cookie from a user wherein said cookie was: (1) created by said first computer, (2) sent to the user, and (3) cryptographically assured with a digital voucher of a user characteristic created by said first computer, said user characteristic being encrypted and incorporated into said digital voucher by said first computer using a session key confidential to said first computer and said second computer but unknown to said user, said session key being cryptographically assured using an asymmetric key of at least one of said first computer and said second computer; b) receiving said cryptographically assured session key from said first computer via said user; c) authenticating said digital voucher created by said first computer; d) extracting said user characteristic from said voucher; and e) performing an action based on said user characteristic.
Claim 22
Independent Claim
187 words
A method for transferable authentication, by which a user accessing a first computer can be authenticated to a second computer remote from said first computer, without necessarily requiring the user to explicitly identify himself to said second computer, comprising the steps of: a) at said second computer, receiving at least a portion of a cookie from a user wherein said cookie was: (1) created by said first computer, (2) sent to the user, and (3) cryptographically assured with a digital voucher of a user characteristic created by said first computer, said user characteristic being encrypted and incorporated into said digital voucher by said first computer using a session key confidential to said first computer and said second computer but unknown to said user, said session key being cryptographically assured using an asymmetric key of at least one of said first computer and said second computer; b) receiving said cryptographically assured session key from said first computer via said user; c) authenticating said digital voucher created by said first computer; d) extracting said user characteristic from said voucher; and e) performing an action based on said user characteristic.
Claim 23
Dependent Claim
17 words
The method of claim 19 , wherein said first computer and said second computer are not collocated.
Claim 24
Dependent Claim
17 words
The method of claim 19 , wherein said first computer and said second computer have different owners.
Claim 25
Dependent Claim
18 words
The method of claim 19 , wherein said first computer and said second computer share a common domain.
Claim 26
Dependent Claim
13 words
The method of claim 19 , wherein said voucher includes an expiration time.
Claim 27
Dependent Claim
25 words
The method of claim 19 , wherein said voucher includes an instruction to send said user to another computer after communication with said second computer.
Claim 28
Dependent Claim
26 words
The method of claim 19 , wherein said voucher includes an instruction to return said user to said first computer after communication with said second computer.
Claim 29
Dependent Claim
17 words
The method of claim 19 , wherein said first computer and said second computer have synchronized timeouts.
Claim 30
Dependent Claim
15 words
The method of claim 19 , wherein said user characteristic comprises the user's network identity.
Claim 31
Dependent Claim
15 words
The method of claim 19 , wherein said user characteristic comprises the user's session preferences.
Claim 32
Dependent Claim
14 words
The method of claim 19 , wherein said user computer includes a web browser.
Claim 33
Dependent Claim
20 words
The method of claim 19 , wherein at least one of said first and second computers is a web site.
Claim 34
Dependent Claim
18 words
The method of claim 30 wherein said first computer is a web site of a content service provider.
Claim 35
Dependent Claim
20 words
The method of claim 30 , wherein said second computer is a web site for electronic bill presentment and payment.
Claim 36
Dependent Claim
13 words
The method of claim 19 , wherein said cryptographic assurance includes RSA cryptography.
Claim 37
Dependent Claim
29 words
The method of claim 19 , wherein said cryptographic assurance includes encryption of said user characteristic under a symmetric key shared between said first computer and said second computer.
Claim 38
Dependent Claim
47 words
The method of claim 34 , further comprising exchanging between said first computer and said second computer via a cookie on said user's computer a cryptographic assurance of said symmetric key under an asymmetric key of at least one of said first computer or said second computer.
Claim 39
Independent Claim
253 words
A method for transferable authentication, by which a user accessing a first computer can be authenticated to a second computer remote from said first computer, without necessarily requiring the user to explicitly identify himself to said second computer, comprising the steps of: a) transmitting an access request from a user's computer to said first computer; b) authenticating said user to said first computer; c) creating a cookie containing a user characteristic at said first computer; d) cryptographically assuring said cookie with a digital voucher of said user characteristic at said first computer, said user characteristic being encrypted and incorporated into said digital voucher by said first computer using a session key confidential to said first computer and said second computer but unknown to said user, said session key being cryptographically assured using an asymmetric key of at least one of said first computer and said second computer; e) transmitting said cryptographically assured session key from said first computer to said second computer via said user's computer; f) transmitting said cookie to said user's computer; g) receiving from said first computer a cookie including said first computer's digital voucher of said user characteristic, said voucher being cryptographically assured by said first computer; h) sending at least a portion of said cookie, including said voucher, to said second computer, i) authenticating said digital voucher created by said first computer at said second computer; j) extracting said user characteristic from said voucher at said second computer; and k) performing an action based on said user characteristic.
Claim 40
Independent Claim
253 words
A method for transferable authentication, by which a user accessing a first computer can be authenticated to a second computer remote from said first computer, without necessarily requiring the user to explicitly identify himself to said second computer, comprising the steps of: a) transmitting an access request from a user's computer to said first computer; b) authenticating said user to said first computer; c) creating a cookie containing a user characteristic at said first computer; d) cryptographically assuring said cookie with a digital voucher of said user characteristic at said first computer, said user characteristic being encrypted and incorporated into said digital voucher by said first computer using a session key confidential to said first computer and said second computer but unknown to said user, said session key being cryptographically assured using an asymmetric key of at least one of said first computer and said second computer; e) transmitting said cryptographically assured session key from said first computer to said second computer via said user's computer; f) transmitting said cookie to said user's computer; g) receiving from said first computer a cookie including said first computer's digital voucher of said user characteristic, said voucher being cryptographically assured by said first computer; h) sending at least a portion of said cookie, including said voucher, to said second computer, i) authenticating said digital voucher created by said first computer at said second computer; j) extracting said user characteristic from said voucher at said second computer; and k) performing an action based on said user characteristic.
Claim 41
Independent Claim
272 words
A system for transferable authentication, by which a user accessing a first computer can be authenticated to a second computer remote from said first computer, without necessarily requiring the user to explicitly identify himself to said second computer, comprising: a) means for transmitting an access request from a user's computer to a first computer; b) means for authenticating said user to said first computer; c) means for creating a cookie containing a user characteristic at said first computer; d) means for cryptographically assuring said cookie with a digital voucher of said user characteristic at said first computer, said user characteristic being encrypted and incorporated into said digital voucher by said first computer using a session key confidential to said first computer and said second computer but unknown to said user, said session key being cryptographically assured using an asymmetric key of at least one of said first computer and said second computer; e) means for transmitting said cryptographically assured session key from said first computer to said second computer via said user's computer; f) means for transmitting said cookie to said user's computer; g) means for receiving from said first computer a cookie including said first computer's digital voucher of said user characteristic, said voucher being cryptographically assured by said first computer; h) means for sending at least a portion of said cookie, including said voucher, to said second computer; i) means for authenticating said digital voucher created by said first computer at said second computer; j) means for extracting said user characteristic from said voucher at said second computer; and k) means for performing an action based on said user characteristic.
Claim 42
Independent Claim
272 words
A system for transferable authentication, by which a user accessing a first computer can be authenticated to a second computer remote from said first computer, without necessarily requiring the user to explicitly identify himself to said second computer, comprising: a) means for transmitting an access request from a user's computer to a first computer; b) means for authenticating said user to said first computer; c) means for creating a cookie containing a user characteristic at said first computer; d) means for cryptographically assuring said cookie with a digital voucher of said user characteristic at said first computer, said user characteristic being encrypted and incorporated into said digital voucher by said first computer using a session key confidential to said first computer and said second computer but unknown to said user, said session key being cryptographically assured using an asymmetric key of at least one of said first computer and said second computer; e) means for transmitting said cryptographically assured session key from said first computer to said second computer via said user's computer; f) means for transmitting said cookie to said user's computer; g) means for receiving from said first computer a cookie including said first computer's digital voucher of said user characteristic, said voucher being cryptographically assured by said first computer; h) means for sending at least a portion of said cookie, including said voucher, to said second computer; i) means for authenticating said digital voucher created by said first computer at said second computer; j) means for extracting said user characteristic from said voucher at said second computer; and k) means for performing an action based on said user characteristic.
Claim 43
Dependent Claim
201 words
A data structure for transferable authentication, by which a user accessing a first computer can be authenticated to a second computer remote from said first computer, without necessarily requiring the user to explicitly identify himself to said second computer, comprising: a) a digital voucher (1) containing a user characteristic available to said first computer; and (2) cryptographically assured by said first computer; b) said user characteristic being encrypted and incorporated into said digital voucher by said first computer using a session key confidential to said first computer and said second computer but unknown to said user, said session key being cryptographically assured using an asymmetric key of at least one of said first computer and said second computers, said session key being transmitted from said first computer to said second computer via said user's computer; c) said digital voucher embedded in a cookie configured to be transmitted from said first computer to a user's computer and then at least partially forwarded to said second computer configured to: (1) authenticate said voucher without requiring said user to explicitly identify himself to said second computer; (2) extract said user characteristic from said voucher; and (3) perform an action based on said user characteristic.
Claim 44
Dependent Claim
201 words
A data structure for transferable authentication, by which a user accessing a first computer can be authenticated to a second computer remote from said first computer, without necessarily requiring the user to explicitly identify himself to said second computer, comprising: a) a digital voucher (1) containing a user characteristic available to said first computer; and (2) cryptographically assured by said first computer; b) said user characteristic being encrypted and incorporated into said digital voucher by said first computer using a session key confidential to said first computer and said second computer but unknown to said user, said session key being cryptographically assured using an asymmetric key of at least one of said first computer and said second computers, said session key being transmitted from said first computer to said second computer via said user's computer; c) said digital voucher embedded in a cookie configured to be transmitted from said first computer to a user's computer and then at least partially forwarded to said second computer configured to: (1) authenticate said voucher without requiring said user to explicitly identify himself to said second computer; (2) extract said user characteristic from said voucher; and (3) perform an action based on said user characteristic.
References Cited (Backward Citations)
US5781629A
Cited
US6073241A
Cited
US5794207A
Cited
US6061790A
Cited
US5875296A
Cited
US5903721A
Cited
US6092196A
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2005-07-15 | 2006-01-14 | 2006-07-16 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2009-07-15 | 2010-01-14 | 2010-07-16 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2013-07-15 | 2014-01-14 | 2014-07-16 | $7700.00 | Window Closed / Lapsed |