Method of using an electronic ticket and distributed server computer architecture for the same

• US 6,725,376 B1
• Filed: 11/13/1997
• Issued: 04/20/2004
• Est. Priority Date: 11/13/1997
• Status: Expired due to Term

• Current Assignee: NCR Voyix Corporation
• Original Assignee: NCR Corporation
• Inventors: Sasmazel, Levent M D, Schneider, David H.
• Primary Examiner(s): Wright, Norman M.
• Application Number:
  US08/969,916
• Time in Patent Office: 2,350 Days
• Field of Search: 713/202, 713/200, 713/201, 395/186, 395/187, 380/25
• US Class Current: 726/10
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

A distributed computer system and server architecture transmitting an electronic ticket over the system, such as the Internet, enabling a user to be authenticated and authorized for a requested operation. An “eticket” architecture (including identification information) is generated by, for example, an authentication server. The information in the eticket is hashed using, for example, a Message Digest Protocol, and a hash number is generated. The hash number is then encrypted by the authentication server using a private key, and the identification information in the eticket and the encrypted hash number are concatenated by the authentication server to generate a completed “eticket” architecture. The “eticket” may then be transmitted over the Internet (i.e., a non-secure environment) from server to server without having the information in the “eticket” altered, and without having to “reauthenticate” the user at each server.

Claims

1. A distributed computer system and server architecture for transmitting an electronic ticket used for verifying user authorization and authentication to provide a session and a state environment over the distributed computer system and server architecture, comprising:

at least one storage device storing data;

at least one user computer transmitting the user authorization and authentication information and a user request, wherein the authentication information includes the IP address of the user; and

at least one server, connected to the at least one storage device and the at least one user computer, that generates the electronic ticket based on at least the authorization and authentication information, wherein the authorization and authentication information is hashed to produce a signature, the signature is encrypted to prevent unauthorized alteration of the authorization and authentication information, and the authorization and authentication information and the encrypted signature are concatenated.

2. The distributed computer system and server architecture according to claim 1, further comprising at least another server authorizing the user to access system resources upon validating the integrity of the information in the electronic ticket.

3. The distributed computer system and server architecture according to claim 1, wherein the at least one server is an authentication server authenticating the user based on authentication information to generate the electronic ticket including the authorization information.

4. A method for using an electronic ticket generated on a distributed computer system and server architecture for verifying user authorization and authentication to provide a session and a state environment, comprising the steps of:

providing a data packet having information based on at least authorization and authentication information to at least a first server connectable to the distributed computer system and server architecture, wherein the authentication information includes the IP address of the user;

producing a signature from the at least first server by hashing at least the authorization and authentication information and at least the IP address of the user;

encrypting at least the signature using the at least first server to prevent unauthorized alteration of the information in the data packet;

concatenating the information in the data packet using the at least first server with the encrypted signature to produce the electronic ticket; and

transmitting the electronic ticket over the computer system in a non-secured environment.

5. The method for using an electronic ticket according to claim 4, further comprising the steps of:

authenticating a user based on authentication information supplied by the at least first server to generate the electronic ticket including the authorization information; and

authorizing the user using at least a second server, connectable to the distributed computer system and server architecture, to access system resources upon validating the integrity of the information in the electronic ticket transmitted in the non-secured environment.

6. The method of using an electronic ticket according to claim 5, further comprising the steps of:

rehashing the information in the electronic ticket using at least a third server, connectable to the distributed computer system and server architecture; and

decrypting the information in the electronic ticket using the at least third server and a public key.

7. The method of using an electronic ticket according to claim 4, wherein the encrypting step uses a private key to encrypt the signature.

8. The method of using an electronic ticket according to claim 4, wherein the signature is a hash number generated by hashing at least the authorization information.

9. The method of using an electronic ticket according to claim 4, wherein the producing step uses MD5 protocol to hash the authorization information.

10. The method of using an electronic ticket according to claim 4, wherein the at least first server is a web server.

11. The method of using an electronic ticket according to claim 5, wherein the at least second server is a web server.

12. The method of using an electronic ticket according to claim 6, wherein the at least third server is a web server.

13. A distributed computer system and server architecture for transmitting an electronic ticket used for verifying user authorization and authentication on a transaction by transaction basis to provide a session and a state environment over the distributed computer system and server architecture, comprising:

at least one storage device storing data;

at least one user computer transmitting the user authorization and authentication information and a user transaction, wherein the authentication information includes the user IP address; and

at least one server, connectable to the at least one storage device and the at least one user computer, generating the electronic ticket based on at least the authorization and authentication information and transmitting the electronic ticket to the user, wherein the electronic ticket is transmitted at or about the same time as the user transaction to provide the session and the state environment.

14. A method for using an electronic ticket for verifying user authorization to provide a session and a state environment on a transaction by transaction basis, comprising the steps of:

generating the electronic ticket based on at least the user authorization and authentication information, wherein the authentication information includes the IP address of the user;

transmitting the electronic ticket at or about the same time as a user transaction; and

verifying the user authorization and authentication to provide the session and the state environment for each user transaction.

15. A method for using an electronic ticket generated on a distributed computer system and server architecture for verifying user authorization and authentication to provide a session and a state environment on a transaction by transaction basis, comprising the steps of:

generating the electronic ticket, via at least one server, based on at least the user authorization and authentication information wherein the authentication information includes the IP address of the user;

transmitting the electronic ticket at or about the same time as a user transaction; and

verifying the user authorization and authentication to provide the session and state environment for each user transaction.

16. A distributed computer system and server architecture for transmitting an electronic ticket used for verifying user authorization and authentication to provide a session and a state environment over the distributed computer system and server architecture, comprising:

at least one storage device storing data;

at least one user computer transmitting the user authorization and authentication information and a user request; and

at least one server, connected to the at least one storage device and the at least one user computer, that generates the electronic ticket based on at least the authorization and authentication information, the authorization and authentication information is hashed to produce a signature, only the signature is encrypted to prevent unauthorized alteration of the unencrypted authorization and authentication information, and the unencrypted authorization and authentication information and the encrypted signature are concatenated.

17. A method for using an electronic ticket generated on a distributed computer system and server architecture for verifying user authorization and authentication to provide a session and a state environment, comprising the steps of:

providing a data packet having information based on at least authorization and authentication information to at least a first server connectable to the distributed computer system and server architecture;

producing a signature from the at least first server by hashing at least the authorization and authentication information;

encrypting only the signature using the at least first server to prevent unauthorized alteration of the unencrypted information in the data packet;

concatenating the unencrypted information in the data packet using the at least first server with the encrypted signature to produce the electronic ticket; and

transmitting the electronic ticket over the computer system in a non-secured environment.

18. A distributed computer system and server architecture for transmitting an electronic ticket used for verifying user authorization and authentication on a transaction by transaction basis to provide a session and a state environment over the distributed computer system and server architecture, comprising:

at least one storage device storing data;

at least one user computer transmitting the user authorization and authentication information and a user transaction; and

at least one server, connectable to the at least one storage device and the at least one user computer, generating the electronic ticket based on at least the authorization and authentication information and transmitting the electronic ticket to the user, wherein the electronic ticket is transmitted with each user transaction to provide the session and the state environment.

19. A method for using an electronic ticket for verifying user authorization to provide a session and a state environment on a transaction by transaction basis, comprising the steps of:

generating the electronic ticket based on at least the user authorization and authentication information;

transmitting the electronic ticket with each user transaction; and

verifying the user authorization and authentication to provide the session and the state environment for each user transaction.