Client account generation and authentication system for a network server

• US 6,292,904 B1
• Filed: 12/16/1998
• Issued: 09/18/2001
• Est. Priority Date: 12/16/1998
• Status: Expired due to Term

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Broomhall, Matthew, Landau, Lauri Jackson
• Primary Examiner(s): Lee, Thomas
• Assistant Examiner(s): PEYTON, TAMMARA R
• Application Number:
  US09/213,029
• Time in Patent Office: 1,007 Days
• Field of Search: 709/223, 709/217, 709/225, 713/201, 713/202, 713/200, 714/1, 714/6
• US Class Current: 714/1
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets

Abstract

A system and method are described for providing secure user account identifiers and passwords to facilitate sharing by users of data between a secure internal server and an external server accessible over the Internet. A user account identifier is generated in accordance with a request from a user having access to the internal server, and a password associated with the account identifier is assigned. The account identifier and password are stored in a database on the internal server. A user account identifier database for an external user is replicated to the external server. The external user may obtain access to data replicated from the internal server to the external server. To provide a unique account identifier for each user, the account identifiers have different formats. When the user account identifier is for the requestor'"'"'s own use, the user account identifier has a format determined by a type of user account (such as Lotus Notes) already owned by the requester. When the user account identifier is requested for an external user, the user account identifier has a format determined by the external user'"'"'s Internet identifier.

Claims

1. A method for providing secure user account identifiers and passwords to facilitate sharing by users of data between a secure internal server and an external server accessible over the Internet, the method comprising the steps of:

receiving a request for a user account identifier and password from a requester, the request including a requestor identifier;

retrieving information regarding the requestor from a directory on the internal server, in accordance with said requestor identifier;

generating a user account identifier in accordance with the request;

assigning a user account password associated with the user account identifier;

communicating the user account identifier and user account password to the requestor;

storing the user account identifier and user account password in a user account identifier database on the internal server; and

replicating the user account identifier database to the external server when the database contains a user account identifier for an external user not in said directory and communicating with the external server, so that the external user may obtain access to data replicated from the internal server to the external server,

wherein

when the user account identifier is for the requestor'"'"'s own use, the user account identifier has a format determined by a type of user account already owned by the requester, and when the user account identifier is requested for an external user, the user account identifier has a format determined by the external user'"'"'s Internet identifier, thereby providing a unique user account identifier for each of said users.

2. A method according to claim 1, wherein the user account identifier database is separate from the directory.

3. A method according to claim 1, wherein a separate user account identifier database for each user account identifier format is stored on the internal server.

4. A method according to claim 1, wherein the user account password is assigned and stored by an automated process.

5. A method according to claim 4, wherein the user account password is stored so as to prevent retrieval thereof in a human-readable form.

6. A method according to claim 1, further comprising the step of performing a two-way replication of data between the internal server and the external server, where the data is accessed by both a user of the internal server and the external user.

7. A method according to claim 1, wherein the data has associated therewith a list of records each including a user account identifier and an associated user account password, and further comprising the steps of:

receiving a request for access to the data from a user;

receiving the user account identifier and user account password from the user; and

granting access to the data only if a record in the list matches the user account identifier and user account password received from the user.

8. A system for providing secure user account identifiers and passwords to facilitate sharing by users of data between a secure internal server and an external server accessible over the Internet, the system comprising:

said internal server, including

a processor;

a storage device having stored therein a directory, a user account identifier database and instructions for execution by the processor; and

means for communicating with a requestor of a user account identifier and a user account password; and

means for communicating with the external server,

wherein

said instructions define a process comprising the steps of receiving a request for the user account identifier and user account password from the requestor, the request including a requester identifier, retrieving information regarding the requester from the directory in accordance with said requestor identifier, generating a user account identifier in accordance with the request, assigning a user account password associated with the user account identifier, communicating the user account identifier and user account password to the requester, storing the user account identifier and user account password in the user account identifier database, and replicating the user account identifier database to the external server when the database contains a user account identifier for an external user not in said directory and communicating with the external server, so that the external user may obtain access to data replicated from the internal server to the external server, and

when the user account identifier is for the requestor'"'"'s own use, the user account identifier has a format determined by a type of user account already owned by the requester, and when the user account identifier is requested for an external user, the user account identifier has a format determined by the external user'"'"'s Internet identifier, thereby providing a unique user account identifier for each of said users.

9. A system according to claim 8, wherein the user account identifier database is separate from the directory.

10. A system according to claim 8, wherein a separate user account identifier database for each user account identifier format is stored in the storage device of the internal server.

11. A system according to claim 8, wherein the user account password is stored so as to prevent retrieval thereof in a human-readable form.

12. A system according to claim 8, wherein the internal server replicates data to the external server and stores replicated data received from the external server, where the data is accessed by both a user of the internal server and the external user.

13. A system according to claim 8, wherein the data has associated therewith a list of records each including a user account identifier and an associated user account password, and said instructions further define a process comprising the steps of receiving a request for access to the data from a user, receiving the user account identifier and user account password from the user, and granting access to the data only if a record in the list matches the user account identifier and user account password received from the user.

14. A computer-readable medium having stored therein instructions for execution of a process for providing secure user account identifiers and passwords to facilitate sharing by users of data between a secure internal server and an external server accessible over the Internet, the process comprising the steps of:

receiving a request for a user account identifier and password from a requester, the request including a requestor identifier;

retrieving information regarding the requestor from a directory on the internal server, in accordance with said requester identifier;

generating a user account identifier in accordance with the request;

assigning a user account password associated with the user account identifier;

communicating the user account identifier and user account password to the requester;

storing the user account identifier and user account password in a user account identifier database on the internal server; and

replicating the user account identifier database to the external server when the database contains a user account identifier for an external user not in said directory and communicating with the external server, so that the external user may obtain access to data replicated from the internal server to the external server,

wherein

when the user account identifier is for the requestor'"'"'s own use, the user account identifier has a format determined by a type of user account already owned by the requestor, and when the user account identifier is requested for an external user, the user account identifier has a format determined by the external user'"'"'s Internet identifier, thereby providing a unique user account identifier for each of said users.

15. A computer-readable medium according to claim 14, wherein the user account identifier database is separate from the directory.

16. A computer-readable medium according to claim 14, wherein a separate user account identifier database for each user account identifier format is stored on the internal server.

17. A computer-readable medium according to claim 14, wherein the user account password is stored so as to prevent retrieval thereof in a human-readable form.

18. A computer-readable medium according to claim 14, wherein said process further comprises the steps of:

replicating data from the internal server to the external server; and

storing replicated data received from the external server, where the data is accessed by both a user of the internal server and the external user.

19. A computer-readable medium according to claim 14, wherein the data has associated therewith a list of records each including a user account identifier and an associated user account password, and said process further comprises the steps of:

receiving a request for access to the data from a user;

receiving the user account identifier and user account password from the user; and

granting access to the data only if a record in the list matches the user account identifier and user account password received from the user.