Method and apparatus for integrating distributed shared services system

• US 20020010776A1
• Filed: 12/28/2000
• Published: 01/24/2002
• Est. Priority Date: 02/01/2000
• Status: Active Grant

• Current Assignee: Charles Schwab & Company Incorporated (Charles Schwab Corporation)
• Original Assignee: Charles Schwab & Company Incorporated (Charles Schwab Corporation)
• Inventors: Lerner, Jack Lawrence
• Granted Patent: US 6,954,799 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

Method and apparatus for integrating distributed shared services system which integrates web based applications with each other and with other centralized application to provide a single sign-on approach for authentication and authorization services for distributed web sites requiring no access time back to the authentication/authorization server is provided.

Claims

1. A method of providing a single sign-on distributed application services integration, comprising the steps of:

receiving a first indication of a user pointing a browser to a first application;

receiving a cookie file of said browser corresponding to the user;

updating said cookie file;

receiving a second indication of said user pointing said browser to a second application; and

providing said updated cookie file to said second application.

2. The method of claim 1 wherein said cookie file of said server domain received a said receiving step is encrypted.

3. The method of claim 2 further including the step of decrypting said encrypted cookie file.

4. The method of claim 1 wherein said cookie file is at most approximately 4 Kbytes.

5. The method of claim 1 wherein said first and second applications each includes one or more predetermined resources.

6. The method of claim 5 wherein said predetermined resources include one or more of a web page, a CGI script and a java servlet.

7. The method of claim 1 wherein said first and second applications reside in a central server domain.

8. The method of claim 1 wherein said first and second applications are third party applications residing in a central server domain.

9. The method of claim 1 wherein said step of updating said cookie file includes the steps of:

comparing the cookie file to one or more of predetermined parameters; and

generating said updated cookie file based on said comparing step.

10. The method of claim 9 wherein said step of comparing includes the step of reading said cookie file and retrieving a corresponding name=value pair for said user.

11. The method of claim 9 wherein said predetermined parameters include a user identification information, a user event access history information, and a user access level information.

12. The method of claim 11 wherein said user identification information includes one or more of a user name, a user social security number, a user address, a user telephone number, a user email address, a user age, a user gender, a user account type, and a user account activity history.

13. The method of claim 1 wherein said step of providing said updated cookie file is performed synchronously with the step of receiving said second indication.

14. The method of claim 1 wherein when second indication of said user pointing said browser to a second application is received, the updated cookie file is automatically provided to said second application.

15. The method of claim 1 wherein said first application resides in a central server, and further, wherein said second application is linked by a hypertext link to a remote site.

16. The method of claim 1 wherein said step of receiving said first indication includes the steps of:

receiving a user login information; and

comparing said user login information to a predetermined login data.

17. The method of claim 16 wherein said user login information includes a user name and a password.

18. The method of claim 16 wherein said predetermined login data includes a user registration information.

19. The method of claim 16 further including the step of permitting user browser access to said first application based on the outcome of the comparing step.

20. The method of claim 19 wherein said user browser is permitted access said first application when said comparing step returns a match flag.

21. The method of claim 19 wherein said user browser is not permitted access to said first application when said comparing step returns a fail flag.

22. The method of claim 21 wherein when a fail flag is returned, said method further comprising the step of prompting said user to reenter the user login information.

23. A system for providing a single sign-on distributed application services integration, comprising:

a client terminal; and

a central server coupled to said client terminal configured to receive from said client terminal a first indication of a user pointing a browser to a first application and a cookie file of said browser corresponding to the user;

wherein said central server is further configured to update said cookie file, and when a second indication of said user pointing said browser to a second application is received from said client terminal, said central server provides said updated cookie file to said second application.

24. A method of providing distributed application services integration, comprising the steps of:

detecting a user event;

generating a message corresponding to the detected user event; and

providing said message to one or more applications based on the user event.

25. The method of claim 24 wherein said step of generating said message includes the step of encrypting said message.

26. The method of claims 24 wherein said message includes one or more of a detected user event information, a user information, and an application corresponding to said detected user event.

27. The method of claim 24 wherein said step of providing said message occurs in near real time to said step of generating said message.

28. The method of claim 24 wherein said step of providing said message includes the steps of:

receiving said message by a message broker;

parsing said message to determine which one or more of said applications are to receive said message; and

transmitting said message to said applications determined based on parsing said message.

29. The method of claim 24 further including the step of storing said message.

30. The method of claim 24 wherein said user event is detected when a user provides an indication pointing a browser to a first application.

31. The method of claim 30 wherein said indication includes a mouse click on a hypertext link corresponding to a Uniform Resource Locator (URL).

32. The method of claim 31 wherein said first application is configured to receive said message.

33. The method of claim 32 wherein said first application compares said message to a predetermined setting and generates a return message for transmission.

34. The method of claim 32 further including the step of updating said message based on said return message.

35. The method of claim 33 wherein said predetermined setting includes a user setting, a user event history, and a user activity.

36. The method of claim 24 wherein said message is one of a data string, or a list of truth, false or conditional flags.

37. A system for providing distributed application services integration, comprising:

a client terminal; and

a central server coupled to said client terminal for detecting a user event at said client terminal;

wherein said central server is further configured to generate a message corresponding to the detected user event and to provide said message to one or more applications based on the user event.