Generic user authentication for network computers

• US 5,908,469 A
• Filed: 02/14/1997
• Issued: 06/01/1999
• Est. Priority Date: 02/14/1997
• Status: Expired due to Term

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: International Business Machines Corporation
• Inventors: Snyder, Devon Daniel, Moskalik, Thomas Michael, Botz, Patrick Samuel, Woodbury, Carol Jean
• Primary Examiner(s): Hua, Ly
• Application Number:
  US08/800,485
• Time in Patent Office: 837 Days
• Field of Search: 395/187.01, 395/186, 395/188.01
• US Class Current: 726/4
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/51 Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

The present invention provides a system and method of performing user authentication on web based applications, such as IBM'"'"'s Network Station Configuration Preference Manager. In particular, the system and method saves and continuously passes user information back and forth between a web client and a web server. The user information can then be used by CGI programs being executed on the web server for authentication purposes. Specifically, each CGI program will examine the user information, determine the authority privileges of the user, run the CGI program under a non-default user mode, return user information back to the web client, and return the CGI job to run in a default user mode.

Claims

1. A network having a user authentication system, said network system comprising:

a web server having an operating system that executes programs under a plurality of user modes;

a web client having a mechanism that submits user information along with program execution requests to said web server; and

a program being initially executable under a default user mode, said program having a first mechanism that examines said user information and a second mechanism that dynamically causes said operating system on said web server to run said program under a non-default user mode.

2. The network of claim 1 wherein said user information includes a user ID.

3. The network of claim 1 wherein said user information includes an IP address.

4. The network of claim 1 wherein said program comprises a common gateway interface.

5. The network of claim 1 wherein said program further includes a system that uses said user information to determine a privilege level of the user logged onto said web client.

6. The network of claim 1 wherein said program further includes a third mechanism that dynamically causes said operating system on said web server to switch said program to run back under said default user mode.

7. The network of claim 1 further comprising a system that extracts said user information from a user during a logon procedure.

8. The network of claim 1 wherein said program further includes a system that returns a new set of user information to said web client.

9. The network of claim 1 wherein said program includes a web server application program interface.

10. The network of claim 1 wherein said user information is stored in html hidden variables.

11. The network of claim 1 wherein said user information is stored in a cookie.

12. The network of claim 1 wherein said user information is transparent to the user.

13. A program product comprising:

a recordable media; and

a program recorded on said recordable media and being initially executable under a default user mode on an operating system running on a web based server, said program comprising a first mechanism that extracts user information from a plurality of hidden variables in a first html form submitted by a web client and a second mechanism that causes said operating system to run said program a non-default user mode.

14. The program product of claim 13 further comprising a mechanism that stores user information in hidden variables in a second html form and that returns said user information to said web client.

15. The program product of claim 13 further comprising a mechanism that retrieves a user password from said server based upon said user information.

16. The program product of claim 13 wherein said user information includes a user ID and an IP address.

17. A system for identifying and responding to a user'"'"'s authority level on a web-based network, said system comprising:

a mechanism that sends and receives user information back and forth between a web client and a web server;

a plurality of programs, said programs being stored on said web server and being initially executable under a default user mode;

a first subroutine callable from each of said programs, said first subroutine examines said user information sent from said web client;

a second subroutine callable from each of said programs, said second subroutine uses said user information to determine the authority level of the user on said web client; and

a third subroutine callable from each of said programs, said third subroutine uses said authority level of the user to cause each of said programs to run under a non-default user mode on said web server.

18. The system of claim 17 further comprising a fourth subroutine callable from each of said programs, said fourth subroutine causes said programs to return to run under a default user mode on said web server.

19. The system of claim 17 wherein said second routine includes a mechanism that retrieves a password for the user from said web server in order to determine the authority level of the user.

20. The system of claim 17 wherein said password is stored in a security object on said web server during a logon procedure.

21. The system of claim 17 wherein said user information is stored in html hidden variables.

22. The system of claim 17 wherein said user information is stored in a cookie.

23. A method of automatically authenticating a user on a web based network during the execution of programs on a web server when submitted from a web client comprising the steps of:

sending user information to the web client each time a program finishes executing on said web server;

returning said user information from the web client to the web server during a new execution request by said web client;

launching a new program from said web server under a default user mode;

examining said user information received with said execution request;

determining an authority level of the user based upon said user information; and

causing the new program to be run under a non-default user mode.

24. The method of claim 23 further comprising the initial one-time step of collecting user information during a logon procedure.

25. The method of claim 23 further comprising the step of storing a user password in a security object on said web server during said logon procedure.

26. The method of claim 25 wherein said step of determining the authority level of the user based upon said user information includes the step of using said user information to retrieve said password stored in said security object.

27. The method of claim 25 wherein said user information is stored in html hidden variables.

28. The method of claim 25 wherein said user information is stored in a cookie.

29. The method of claim 23 further comprising the steps of returning a new set of user information to said web client.

30. The method of claim 23 further comprising the step of causing the new program to run back under said default user mode.

31. A method of setting the appropriate level of authority during the execution of programs initiated by a web server when requested by a web client having a user logged thereon, wherein said user has a predetermined user privilege level, said method comprising the steps of:

extracting user information for said user during a logon procedure;

storing said user information as html hidden variables in an html form and returning said html hidden variables to said web client;

for each subsequent request by said web client to execute one of said programs, performing the steps of;

sending said html hidden variables back to said web server along with said execution request;

commencing execution of said program under a default mode;

examining said user information in said html hidden variables;

using said user information to determine the level of authority of the user;

dynamically causing the program to be executed under the appropriate level of user authority;

storing said user information as html hidden variables in a new html form and returning said html hidden variables to said web client; and

returning said program to its default mode.

32. The method of claim 31 wherein said user information includes an IP address.

33. The method of claim 31 wherein said user information includes a user ID.

34. The method of claim 31 wherein said user information includes an admin-user flag.

35. A method of automatically authenticating a user on a web based network during the execution of programs on any one of a plurality of web servers when submitted from a web client, comprising the steps of:

returning user information back to the web client from one of said web servers each time a program finishes executing a job for said web client, wherein said user information is stored in html hidden variables;

sending said user information from the web client to the next web server responsible for implementing the next program execution request by said web client;

initiating execution of said next program from said web server under a default user mode;

examining said user information received with said program execution request;

determining an authority level of the user based upon said user information; and

causing the new program to be run under a non-default user mode.

36. The method of claim 35 wherein said programs include a common gateway interface.

37. The method of claim 35 wherein said programs include an application program interface.

38. A program product, comprising:

a first plurality of hidden codes that store user information created by a browser, said first plurality of hidden codes being transmittable to a web server;

a second plurality of hidden codes that store user information created by a job running on said web server, said second set of hidden codes being transmittable to said browser; and

signal-bearing media bearing the first and second plurality of hidden codes.

39. The program product of claim 38 wherein said first and second plurality of hidden codes reside in an html form.

40. The program product of claim 38 wherein said first and second plurality of hidden codes are identical.

41. The program product of claim 38 wherein said first and second plurality of hidden codes include a user ID.

42. The program product of claim 38 wherein said first and second plurality of hidden codes include an IP address.

43. The program product of claim 38 wherein said first and second plurality of hidden codes include an admin-user address.