Method and system for globally restricting client access to a secured web site

• US 20030005308A1
• Filed: 05/30/2001
• Published: 01/02/2003
• Est. Priority Date: 05/30/2001
• Status: Abandoned Application

• Current Assignee: Matthew Todd Kromer, Michael Joseph Konopka, Paul L. Rathbun
• Original Assignee: Matthew Todd Kromer, Michael Joseph Konopka, Paul L. Rathbun
• Inventors: Rathbun, Paul L., Konopka, Michael Joseph, Kromer, Matthew Todd
• Application Number:
  US09/681,737
• Publication Number:
  US 20030005308A1
• Time in Patent Office: Days
• US Class Current: 713/185
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/168 above the transport layer

Abstract

A method and system are provided for restricting client access to a web site. A first web server receives a client login and, in response, allocates a cookie to the client containing an access credential having at least one client role-based attribute. A second web server hosts the secured web site, the web site having an associated security file containing at least one client role-based access privilege. In response to the client'"'"'s HTTP request at the second server, the cookie is retrieved, decoded and the access credential is compared to the at least one client role-based access privilege. If the access credential has at least one role-based attribute in common with the at least one client role-based access privilege, the client is granted access to the site. Alternately, a site owner defines a token access credential attribute and security file privilege for hierarchal group access to the secured web site.

Claims

1. A system for globally restricting client access to a secured web site comprising:

a first web server configured to;

receive a client login; and

return a cookie to the client containing an access credential wherein the access credential contains at least one role-based attribute specific to the client; and

a second web server hosting a secured web site having an associated security expression wherein the security expression contains at least one role-based access privilege for the web site, the second web server configured to;

receive the cookie containing the access credential in response to an HTTP request from the client; and

if the access credential contains a role-based attribute in common with the security expression, grant the client access to the secured web site.

2. The system of claim 1 wherein the access credential and security expression additionally contain a token attribute for locally defined access to the secured web site.

3. The system of claim 2 wherein the token attribute contains permission re-granting capability.

4. The system of claim 1 wherein the access credential is digitally signed.

5. The system of claim 1 wherein role based attributes are assigned to the client based on the client'"'"'s login password.

6. The system of claim 5 wherein the first web server is additionally configured to synchronize client passwords among more than one password repository.

7. The system of claim 1 wherein the web site contains a web-based application.

8. The system of claim 1 wherein the access credential expires after a predefined period of time.

9. The system of claim 1 wherein the access credential is encoded.

10. A method for globally restricting client access to a secured web site comprising:

receiving a client login at a first web server;

returning a cookie to the client containing an access credential wherein the access credential contains at least one role-based attribute specific to the client;

receiving the cookie containing the access credential from the client in response to an HTTP request at a second web server wherein the second web server hosts a secured web site having an associated security expression containing at least one role-based access privilege; and

if the access credential contains a role-based attribute in common with the security expression, granting the client access to the secured web site.

11. The method of claim 10 wherein the access credential and security expression additionally contain a token attribute for locally defined access to the secured web site.

12. The method of claim 11 wherein the token attribute contains permission re-granting capability.

13. The method of claim 10 wherein the access credential is digitally signed.

14. The method of claim 10 wherein role based attributes are assigned to the client based on the client'"'"'s login password.

15. The system of claim 14 wherein the first web server is configured to synchronize client passwords among more than one password repository.

16. The system of claim 10 wherein the web site contains a web-based application.

17. The system of claim 10 wherein the access credential expires after a predefined period of time.

18. The system of claim 10 wherein the access credential is encoded.