Method and system for providing internet services

• US 20090328174A1
• Filed: 06/25/2009
• Published: 12/31/2009
• Est. Priority Date: 06/26/2008
• Status: Active Grant

• Current Assignee: Alibaba Group Holding Ltd.
• Original Assignee: Alibaba Group Holding Ltd.
• Inventors: Zeng, Yi, Zhao, Jin, Zheng, Seshu, Wang, Lin, Cen, Wenchu
• Granted Patent: US 8,453,209 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/28 Timers or timing mechanisms used in protocols

Abstract

A service integration platform system for providing Internet services includes: an interface configured to receive a service request message that is initiated by a user of an application provided by an Independent Software Vendor (ISV), the service request message being implemented according to an Application Programming Interface (API) type and including a plurality of platform-level parameters that conform to the API type. The system further includes one or more processors coupled to the interface, configured to: locate a set of authentication checks that are appropriate for the API type, based at least in part on the plurality of platform-level parameters included in the service request message and a mapping of predefined combinations of platform-level parameters and corresponding sets of authentication checks; perform authentication of the service request according to the set of authentication checks; and route the service request to a service address of the Internet Service Provider (ISP) in the event that the service request is authenticated.

Claims

1. A method for providing Internet services comprising:

receiving a service request message that is initiated by a user of an application provided by an Independent Software Vendor (ISV), the service request message being implemented according to an Application Programming Interface (API) type and including a plurality of platform-level parameters that conform to the API type;

determining a set of authentication checks appropriate for the API type;

performing authentication of the service request message according to the set of authentication checks; and

routing the service request message to a service address of the Internet Service Provider (ISP) in the event that the service request message is authenticated.

2. The method of claim 1, wherein the API type includes an anonymity access type and the set of authentication checks includes zero elements.

3. The method of claim 2, wherein the plurality of platform-level parameters are an identity proof for invoking the ISV service and a service name.

4. The method of claim 1, wherein the API type includes an authorized service type and the set of authentication checks includes a signature check and a timestamp check.

5. The method of claim 4, wherein the platform-level parameters are an identity proof for invoking the ISV service, a service name, a service request timestamp and a signature.

6. The method of claim 1, wherein the API type includes a user authorized service type and the set of authentication checks includes a signature check, a timestamp check and a user identity check.

7. The method of claim 6, wherein the platform-level parameters are an identity proof for invoking the ISV service, a service name, a service request timestamp, a signature and a user session uniqueness identity in the ISV application.

8. The method of claim 1, wherein the API type includes an optional user authorized service type and the set of authentication checks includes a signature check, a timestamp check, and optionally, a user identity check.

9. The method of claim 8, wherein the platform-level parameters are an identity proof for invoking the ISV service, a service name, a service request timestamp and a signature.

10. The method of claim 1, wherein the set of authentication checks comprises one or more of the following:

a signature check, a timestamp check and a user identity check.

11. The method of claim 1, wherein the platform-level parameters comprises one or more of the following:

an identity proof for invoking the Independent Software Vendor service, a service name, a service request timestamp, a signature, a user session uniqueness identity in the Independent Software Vendor application and a type of returned value.

12. The method of claim 1, further comprising returning user binding error information.

13. The method of claim 12, wherein user binding error information is returned in the event that that the platform parameters include a user session uniqueness identity in the Independent Software Vendor application and the service request message authentication fails.

14. The method of claim 1, further comprising:

obtaining a token list in a cache in the event that the platform parameters include service Internet Service Provider identity, identity proof for invoking the Independent Software Vendor service and user session uniqueness identity in the Independent Software Vendor application;

determining whether a token exists and is valid; and

returning user binding error information in the event that no token exists or the token is invalid.

15. The method of claim 12, further comprising:

initiating a second service request message to a login address of the ISP upon receiving the user binding error information, wherein the second service request message includes as its platform-level parameters an identity proof for invoking the Independent Software Vendor service, a service name, a user session uniqueness identity in the Independent Software Vendor application and an address the Independent Software Vendor application to be redirected to upon passing user binding.

16. A service integration platform system for providing Internet services comprising:

an interface configured to receive a service request message that is initiated by a user of an application provided by an Independent Software Vendor (ISV), the service request message being implemented according to an Application Programming Interface (API) type and including a plurality of platform-level parameters that conform to the API type; and

one or more processors coupled to the interface, configured to;

locate a set of authentication checks that are appropriate for the API type;

perform authentication of the service request according to the set of authentication checks; and

route the service request to a service address of the Internet Service Provider (ISP) in the event that the service request is authenticated.

17. The system of claim 16, wherein the API type includes an anonymity access type and the set of authentication checks includes zero elements.

18. The system of claim 17, wherein the plurality of platform-level parameters are an identity proof for invoking the ISV service and a service name.

19. The system of claim 16, wherein the API type includes an authorized service type and the set of authentication checks includes a signature check and a timestamp check.

20. The method of claim 19, wherein the platform-level parameters are an identity proof for invoking the ISV service, a service name, a service request timestamp and a signature.

21. The system of claim 16, wherein the API type includes a user authorized service type and the set of authentication checks includes a signature check, a timestamp check and a user identity check.

22. The system of claim 21, wherein the platform-level parameters are an identity proof for invoking the ISV service, a service name, a service request timestamp, a signature and a user session uniqueness identity in the ISV application.

23. The system of claim 16, wherein the API type includes an optional user authorized service type and the set of authentication checks includes a signature check, a timestamp check and optionally, a user identity check.

24. The system of claim 23, wherein the platform-level parameters are an identity proof for invoking the ISV service, a service name, a service request timestamp and a signature.

25. The system of claim 16, wherein the set of authentication checks comprises one or more of the following:

a signature check, a timestamp check and a user identity check.

26. The system of claim 16, wherein the platform-level parameters comprises one or more of the following:

an identity proof for invoking the Independent Software Vendor service, a service name, a service request timestamp, a signature, a user session uniqueness identity in the Independent Software Vendor application and a type of returned value.

27. The system of claim 16, further comprising returning user binding error information.

28. The system of claim 27, wherein user binding error information is returned in the event that that the platform parameters include a user session uniqueness identity in the Independent Software Vendor application and the service request message authentication fails.

29. The system of claim 16, wherein the one or more processors are further configured to:

obtain a token list in a cache in the event that the platform parameters include service Internet Service Provider identity, identity proof for invoking the Independent Software Vendor service and user session uniqueness identity in the Independent Software Vendor application;

determine whether a token exists and is valid; and

return user binding error information in the event that no token exists or the token is invalid.

30. The system of claim 27, herein the one or more processors are further configured to:

initiate a second service request message to a login address of the ISP upon receiving the user binding error information, wherein the second service request message includes as its platform-level parameters an identity proof for invoking the Independent Software Vendor service, a service name, a user session uniqueness identity in the Independent Software Vendor application and an address the Independent Software Vendor application to be redirected to upon passing user binding.