Method for performing transactions on the world-wide web computer network

• US 6,230,202 B1
• Filed: 05/01/1995
• Issued: 05/08/2001
• Est. Priority Date: 05/01/1995
• Status: Expired due to Term

• Current Assignee: Donald A. Lewine
• Original Assignee: Donald A. Lewine
• Inventors: Lewine, Donald A
• Primary Examiner(s): Follansbee, John A.
• Application Number:
  US08/432,610
• Time in Patent Office: 2,199 Days
• Field of Search: 395/200.9, 395/401, 395/408, 709/229, 709/203, 709/219, 705/26-27, 705/43, 713/200, 380/217, 380/218
• US Class Current: 709/229
• CPC Class Codes: G06Q 20/12 specially adapted for electronic shopping systems
• CPC Class Codes: G06Q 20/4014 Identity check for transactions
• CPC Class Codes: G07F 7/00 Mechanisms actuated by objects other than coins to free or to actuate vending, hiring, coin or paper currency dispensing or refunding apparatus
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A method is disclosed for determining a user'"'"'s identity and creating a virtual session using the HTTP protocol without modifying the protocol or changing its stateless nature.

Claims

1. A method for ordering goods or services from a store on the world wide web where said store is implemented using a server computer having:

(a) the capability of being accessed by a plurality of users each said user having a browser;

(b) a plurality of user profile records, one or more unprotected pages, and one or more protected pages;

(c) a unique first username associated with each said profile record;

(d) a first password associated with each said profile record; and

(e) the capability of at least one of said users accessing at least one of said unprotected pages without supplying a username or password;

said method of associating one of said users with one of said profile records comprising;

(i) allowing said user to attempt to access one of said protected pages using the http GET method;

(ii) returning an ACCESS DENIED code in response to said attempt;

(iii) said ACCESS DENIED code causing said user'"'"'s browser to ask said user for a second username and a second password and to transmit said second username and said second password to said server computer in the http authorization header; and

(iv) locating one of said user profile records such that said second username and said second password match the first username and first password associated with said stored user profile.

2. The method according to claim 1, where said ACCESS DENIED code has the value 401.

3. The method according to claim 1, where each said user profile record comprises at least a method of payment.

4. The method according to claim 1, where said user profile records further comprise a customer'"'"'s name.

5. The method according to claim 1, where said user profile records further comprise a shipping address.

6. The method according to claim 1, where for every said protected pages there is a corresponding unprotected page.

7. The method according to claim 1, where when one of said plurality of users wants to buy an item described on one of said unprotected pages, said user is presented with a form for entering said users name and address.

8. In a computer having:

(a) the capability of being accessed using the http protocol by a first user and a second user each said user having a browser;

(b) a plurality of user profile records with a unique first username associated with each said profile record;

(c) a first password associated with each said profile record;

(d) one or more unprotected pages; and

(e) one or more protected pages;

a method for associating said first user with one of said plurality of profile records comprising;

(i) allowing said first user to attempt to access one of said protected pages using the http GET method;

(ii) returning an ACCESS DENIED code in response to said attempt;

(iii) said ACCESS DENIED code causing said user'"'"'s browser to ask said user for a second username and a second password and to transmit said second username and said second password to said computer in the http authorization header; and

(iv) locating one of said user profile records such that said second username and said second password match said first username and first password associated with said user profile record.

9. In the computer according to claim 8, a method for allowing one of said second plurality of users to make purchases without using a username and password comprising:

(i) allowing said second user to view said unprotected pages;

(ii) presenting said user with a form for entering said user'"'"'s name and address.

10. The computer according to claim 9 where there is no user profile record corresponding to said one of said second plurality of users.

11. The computer according to claim 9, where said form also includes a method of payment.

12. The computer according to claim 8, where said profile record contains the user'"'"'s name and address.