Systems and methods providing interactions between multiple servers and an end use device

• US 7,010,582 B1
• Filed: 06/26/2000
• Issued: 03/07/2006
• Est. Priority Date: 06/26/2000
• Status: Expired due to Term

• Current Assignee: Entrust Corp.
• Original Assignee: Entrust Incorporated (Entrust Corp.)
• Inventors: Hillier, Stephen William, Van Oorschot, Paul C., Cheng, Ray C. H.
• Primary Examiner(s): Dinh, Dung C.
• Assistant Examiner(s): REILLY, SEAN M
• Application Number:
  US09/603,356
• Time in Patent Office: 2,080 Days
• Field of Search: 709217-219, 709/225, 709227-229, 709220-222, 713/201, 713/202, 713/183, 713/185, 705/64
• US Class Current: 709/219
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Methods and systems are provided which convey access control information from a first server to a second server through an end user device, for example in a system in which these servers and devices are all connected to the Internet. The method starts after the first server receives a message from the end user device. The first server in response to this message from the end user device sends a response message to the end user device containing the access control information to be conveyed to the second server, optionally after performing authentication. The response message also contains an instruction for the end user device to post a second message to the second server containing the information. The information is preferably contained in a content portion of the message. A hidden form may be used in the response message to contain the information. Optionally, the end user may be presented with an option to post the second message or not. This may allow conformance with data privacy laws requiring end user consent of data transfer. The instruction to post to the second server may consist of active content within the response message'"'"'s content portion. This can be used to cause an end user device to store a cookie in association with a number of servers in different domains thereby implementing a multiple domain single sign-on function.

Claims

1. A method of conveying access control information from one network device to another network device on a different domain through an end user device comprising:

the one network device in response to a first message received from the end user device containing access control information, sending a response message to the end user device containing the access control information, the response message being adapted to cause the end user device to send a second message to the another network device containing at least part of the access control information; and

presenting an option to the end user device to send the second message or not,

wherein at least part of the access control information is used to control access to a protected resource on at least one of the first and second network devices.

2. A method according to claim 1 wherein:

the response message has a header portion and a content portion and the response message contains the access control information and a network device identifier for the another network device embedded within its content portion;

the second message has a header portion and a content portion and the second message contains the at least part of the access control information embedded within its content portion.

3. A method according to claim 2 wherein the response message'"'"'s content portion is formatted as a custom content type.

4. A method according to claim 2 wherein at least part of the content portion of the response message is protected by cryptographic means.

5. A method according to claim 2 wherein a hidden content is used in the response message to contain the access control information.

6. A method according to claim 1 wherein:

the first message has a header portion and a content portion, and the access control information is contained in the header portion, the method further comprising extracting the access control information from the header portion for use in the response message.

7. A method according to claim 1 wherein:

the first message has a header portion and a content portion, and the access control information is contained in the content portion, the method further comprising extracting the access control information from the content portion for use in the response message.

8. A method according to claim 1 wherein the fist message is an HTTP Request message, and the response message is an HTTP Response message.

9. A method according to claim 1 wherein the access control information is a cookie.

10. A network device adapted to implement the method of claim 1.

11. An article of manufacture comprising:

a computer usable medium having computer readable program code means embodied therein for implementing the method of claim 1.

12. A method of conveying access control information from one network device to another network device on a different domain through an end user device comprising:

the one network device in response to a first message received from the end user device containing access control information, sending a response message to the end user device containing the access control information, response message being adapted to cause the end user device to send a second message to the another network device containing at least part of the access control information;

containing user-specific information in the response message together with instructions to include at least part of the user-specific information in the second message; and

presenting an option to the end user device to change and/or delete any of the user-specific information before sending the message to the another network device,

wherein at least part of the access control information is used to control access to a protected resource on at least one of the first and second network devices.

13. A method of conveying access control information from one network device to another network device on a different domain through an end user device comprising:

the one network device in response to a first message received from the end user device containing access control information, sending a response message to the end user device containing the access control information, the response message being adapted to cause the end user device to send a second message to the another network device containing at least part of the access control information;

containing user-specific information in the response message together with instructions to include at least part of the user-specific information in the second message; and

presenting an option to the end user device to include or not include the at least part of the user-specific information in the second message,

wherein at least part of the access control information is used to control access to a protected resource on at least one of the first and second network devices.

14. A network device implemented method comprising:

a) a network device on a first network domain receiving an input message having a header portion and a content portion, with the input message containing an access control information embedded within the content portion;

b) the network device responding with a response message having a header portion and a content portion, with the response message containing the access control information in the header portion and having a content portion containing the access control information and also containing instructions to send a subsequent message to another network device on a different network domain, the subsequent message having a content portion containing at least part of the access control information.

15. A method according to claim 14 wherein the network device is an initial network device accessed by an end user device, the method further comprising:

prior to sending the response message,

a) the initial network device receiving an initial access request from the end user device to access a protected resource on the initial network device;

b) the initial network device performing an authentication process to determine if access should be granted and if so, responding with an access response message specifying the access control information in association with the first network domain and causing the end user device to send the input message; and

on an ongoing basis after performing the authentication process allowing subsequent access to the protected resource to requests containing the access control information.

16. A method according to claim 15 further comprising:

containing user-specific information in the response message together with instructions to include at least part of the user-specific information in the subsequent message.

17. A method according to claim 16 wherein the user-specific information comprises at least one of purchase enabling information and personal data.

18. A method according to claim 16 wherein at least part of the user-specific information is protected by cryptographic means.

19. A method according to claim 14 wherein the another network device is specified in the input message.

20. A method according to claim 14 wherein the another network device is specified by the network device.

21. A network device adapted to implement the method of claim 14.

22. A network device implemented method comprising:

the network device responding to an initial access request with a redirect message instructing a redirection to a MDSSO (multi-domain single sign-on) function on the network device, the redirect message also specifying an access control information in a header of the redirect message;

the MDSSO function receiving an input message having a header portion and a content portion, with the input message containing the access control information embedded within the header portion;

the MDSSO function responding with a response message having a header portion and a content portion, with the response message containing the access control information in the header portion and having the content portion containing the access control information and also containing instructions to send a subsequent message to another network device on a different network domain, the subsequent message having a content portion containing at least part of the access control information.

23. A method according to claim 22 further comprising performing an authentication process to determine if access should be granted, and if so responding to the initial access request message with the redirect message, and if not rejecting the initial access request.

24. A network device comprising an authentication front end and an MDSSO function, the network device being adapted to provide initial network device functionality upon receipt of a request message containing access control information only in a header portion, and adapted to provide non-initial network device functionality upon receipt of a request message containing access control information in both a header portion and a content portion;

wherein in providing the initial network device functionality;

a) the authentication front end is adapted to process an initial access request message from an end user device to access a protected resource on the network device by performing an authentication process to determine if access should be granted and if so, responding with an access response message specifying an access control information in association with the domain of the network device and causing the end user device to send a first request message to an MDSSO (multiple domain single sign-on) function on the network device specifying the access control information in a header portion of the first request message;

b) the MDSSO function is adapted to process a request message directed to it containing access control information only in a header portion by extracting the access control information from the header portion and sending to the end user device a response message containing the access control information in a header portion and having a content portion containing the access control information and also containing instructions to send a subsequent request message to another network device on a different network domain, the subsequent message having a content portion containing the at least part of access control information;

wherein in providing non-initial network device functionality;

c) the MDSSO function is adapted to process a request message directed to it containing access control information in a content portion by extracting the access control information from the content and sending to the end-user device a response message containing the access control information in a header portion and having a content portion containing the access control information and also containing instructions to send a subsequent message to another network device on a different network domain, the subsequent message having a content portion containing at least part of the access control information.

25. A multiple domain single sign-on system comprising a plurality of network devices according to claim 24.

26. The system of claim 25 wherein each of the plurality of network devices identifies a respective another network devices in the plurality of network devices.

27. The system of claim 25 wherein each response message identifies all remaining unvisited network devices in the plurality of network devices.

28. The system of claim 25 wherein each response message identifies all the network devices in the plurality of network devices.

29. An article of manufacture comprising:

a computer usable medium having computer readable program code means embodied therein for implementing a multiple domain single sign-on function, the computer readable code means in the article of manufacture comprising;

first computer readable code means adapted to receive in a first domain a first request message from a remote device, the first request message having a header portion and a content portion and containing an access control information embedded within the content portion, and to generate a response message having a header portion and a content portion, the header portion containing the access control information and the content portion containing the access control information and also containing instructions causing the remote device to access a network address in a different domain specified in the content portion with a subsequent message containing at least part of the access control information.

30. An article of manufacture according to claim 29 further comprising:

second computer readable code means adapted to receive an access request message from the remote device, to perform authentication, and to send instructions to the remote device to send the first request message to the first computer readable code means.

31. An article of manufacture according to claim 30 wherein the access control information is generated by the second computer readable code means, sent to the remote device with the instructions, and then received by the first computer readable code means in the first request message.

32. A method of conveying user-specific information from one network device to another network device on a different domain through an end user device comprising:

the one network device in response to a first message received from the end user device containing user-specific information, sending a response message to the end user device containing the user-specific information, the response message being adapted to cause the end user device to send a second message to the another network device containing at least part of the user-specific information after presenting an option to the end user device to change and/or delete any of the user-specific information;

wherein the response message has a header portion and a content portion and the response message contains the user-specific information and a network device identifier for the another network device embedded within its content portion;

the second message has a header portion and a content portion and the second message contains the at least part of the user-specific information embedded within its content portion.