Internet server access control and monitoring systems

• US 7,272,639 B1
• Filed: 01/12/1998
• Issued: 09/18/2007
• Est. Priority Date: 06/07/1995
• Status: Expired due to Fees

• Current Assignee: Soverain IP, LLC
• Original Assignee: Soverain Software LLC
• Inventors: Payne, Andrew C., Stewart, Lawrence C., Treese, George Winfield, Levergood, Thomas Mark, Morris, Stephen Jeffrey
• Primary Examiner(s): WINDER, PATRICE L
• Application Number:
  US09/005,479
• Time in Patent Office: 3,536 Days
• Field of Search: 709/217, 709/218, 709/219, 709/225, 709/229
• US Class Current: 709/218
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources

Abstract

This invention relates to methods for controlling and monitoring access to network servers. In particular, the process described in the invention includes client-server sessions over the Internet. In this environment, when the user attempts to access an access-controlled file, the server subjects the request to a secondary server which determines whether the client has an authorization or valid account. Upon such verification, the user is provided with a session identification which allows the user to access to the requested file as well as any other files within the present protection domain.

Claims

1. A method of processing service requests from a client to a server system through a network, said method comprising the steps of forwarding a service request from the client to the server system, wherein communications between the client and server system are according to hypertext transfer protocol;

returning a session identifier from the server system to the client, the client storing the session identifier for use in subsequent distinct requests to the server system; and

appending the stored session identifier to each of the subsequent distinct requests from the client to the server system.

2. A method as claimed in claim 1 wherein the session identifier includes a user identifier.

3. A method as claimed in claim 1 wherein the session identifier includes an expiration time for the session.

4. A method as claimed in claim 1 wherein the server system records information from the session identifier in a transaction log in the server system.

5. A method as claimed in claim 4 wherein the server system tracks the access history of sequences of service requests within a session of requests.

6. A method as claimed in claim 5 wherein the server system tracks the access history to determine service requests leading to a purchase made within the session of requests.

7. A method as claimed in claim 4 wherein the server system counts requests to particular services exclusive of repeated requests from a common client.

8. A method as claimed in claim 4 wherein the server system maintains a data base relating customer information to access patterns.

9. A method as claimed in claim 8 wherein the information includes customer demographics.

10. A method as claimed in claim 1 wherein the server system assigns the session identifier to an initial service request to the server system.

11. A method as claimed in claim 1 wherein the server system subjects the client to an authorization routine prior to issuing the session identifier and the session identifier is protected from forgery.

12. A method as claimed in claim 1 wherein the server system comprises plural servers including an authentication server which provides session identifiers for service requests to multiple servers.

13. A method as claimed in claim 12 wherein:

a client directs a service request to a first server which is to provide the requested service;

the first server checks the service request for a session identifier and only services a service request having a valid session identifier, and where the service request has no valid identifier;

the first server returns a response to the client, the response redirecting the service request from the client to the authentication server;

the authentication server subjects the client to an authorization routine and issues the session identifier to be appended to the service request to the first server;

the client forwards the service request appended with the session identifier to the first server; and

the first server recognizes the session identifier and services the service request to the client; and

the client appends the session identifier to subsequent service requests to the server system and is serviced without further authorization.

14. A method as claimed in claim 13 wherein the session identifier includes a user identifier.

15. A method as claimed in claim 13 wherein the session identifier includes an expiration time for the session.

16. A method as claimed in claim 13 wherein the session identifier provides access to a protected domain to which the session has access authorization.

17. A method as claimed in claim 16 wherein the session identifier is modified for access to a different protected domain.

18. A method as claimed in claim 13 wherein the session identifier provides a key identifier for key management.

19. A method as claimed in claim 13 wherein the server system records information from the session identifier in a transaction log in the server system.

20. The method of claim 1 wherein the access rights of the client are fully contained within the session identifier.

21. A method as claimed in claim 1 wherein a service request is for a document and the session identifier includes a user identification, further comprising:

returning the requested document wherein the document is customized for a particular user based on the user identification of the session identifier.

22. A method as claimed in claim 1 wherein a service request is for a document which has been purchased by a user, the session identifier comprises an authorization identifier, and further comprising:

returning the requested document if the authorization identifier indicates that the user is authorized to access the document.

23. A method as claimed in claim 1 wherein a service request is for a document wherein the session identifier comprises a user identifier, and further comprising:

returning the requested document to the client; and

charging the user identified in the identifier for access to the document.

24. The method of claim 1, wherein at least one service request comprises a request for a document which has been purchased by a user, and wherein the session identifier comprises an authorization identifier, the method further comprising:

returning the requested document if the authorization identifier indicates that the user is authorized to access the document.

25. A method as claimed in claim 24, wherein the authorization identifier is encoded within a session identifier which is appended to the request.

26. The method of claim 24 wherein the authorization identifier is provided by authentication server.

27. The method of claim 24, further comprising:

identifying the user from the authorization identifier; and

automatically charging the identified user for the document.

28. The method of claim 24, wherein the document is returned electronically.

29. The method of claim 24, wherein a physical copy of the document is sent.

30. The method of claim 24, wherein the authorization identifier in appended to uniform resource locator.

31. The method of claim 1, wherein at least one service request comprises a request for a document, wherein the session identifier is designated by the server system, said method further comprising the steps of:

returning the requested document to the client; and

charging the user identified in the session identifier for access to the document.

32. A method as claimed in claim 31, wherein a user identifier is encoded within a session identifier which is appended to the request.

33. The method of claim 1 wherein the session identifier is cryptographically generated.

34. The method of claim 1 further comprising:

returning a response to the client, the response redirecting an initial service request to an authentication server, the authentication server providing the session identifier.

35. The method of claim 1, wherein the session identifier is appended to at least one path name in a document returned by the server system.

36. The method of claim 35, wherein the at least one path name is in a link in the returned document.

37. The method of claim 36 wherein the link is an absolute link.

38. The method of claim 36 wherein the link comprises a uniform resource locator.

39. The method of claim 35 wherein the step of appending the session identifier comprises filtering the requested document.

40. The method of claim 35 wherein the session identifier is cryptographically generated.

41. The method of claim 35 wherein the session identifier is directed to an accessible domain.

42. The method of claim 35 wherein the session identifier comprises an expiration time.

43. The method of claim 35 wherein the session identifier comprises a date.

44. The method of claim 35 wherein the session identifier comprises a key identifier.

45. The method of claim 35 wherein the session identifier comprises an address of the client.

46. The method of claim 35 wherein the session identifier comprises a digital signature.

47. The method of claim 1, wherein the session identifier is designated by the server system, furthers comprising the steps of:

validating, at the server system, the appended session identifier; and

returning a controlled document if the appended session identifier is valid.

48. The method of claim 47 wherein the session identifier is cryptographically generated.

49. The method of claim 47 wherein the session identifier is directed to an accessible domain.

50. The method of claim 47 wherein the session identifier comprises an expiration time.

51. The method of claim 47 wherein the session identifier comprises a date.

52. The method of claim 47 wherein the session identifier comprises a key identifier.

53. The method of claim 47 wherein the session identifier comprises an address of the client.

54. The method of claim 47 wherein the session identifier comprises an unforgeable digital signature.

55. The method of claim 47 wherein the session identifier facilitates authenticated accesses across multiple content servers.

56. The method of claim 47 wherein the document is customized for a particular user based on a user identification of the session identifier.

57. The method of claim 47, wherein the session identifier is appended to at least one path name in a document returned by the server system.

58. The method of claim 57 wherein the step of appending the session identifier comprises filtering the requested document.

59. The method of claim 1, further comprising:

servicing a request; and

automatically charging a user identified by the session identifier for the service provided.

60. The method of claim 1, wherein at least one service request comprises a purchase request, the purchase request including an associated user identifier, the method further comprising:

accessing, upon receipt of the purchase request at the server system, user information associated with the user identifier sufficient to charge to an account associated with the user, the purchase price of the product identified by the purchase request;

charging the user for the product identified by the purchase request according to the user information; and

fulfilling the purchase request based on the user information.

61. The method of claim 60, wherein the client includes the user identifier in a session identifier appended to the purchase request.

62. The method of claim 1, further comprising:

under control of a client system, displaying information identifying a product; and

in response to a user selection of a hyperlink associated with a product desired to be purchased, sending a request to purchase the item along with an identifier of a purchaser of the item to a server system; and

under control of the server system, upon receiving the request, retrieving additional information previously stored for the purchaser identified by the identifier in the received request;

charging the user the purchase price of the product; and

fulfilling the request for the product.

63. The method of claim 1, wherein the session identifier is appended by the client.

64. The method of claim 63, wherein the session identifier is cryptographically generated.

65. The method of claim 1, wherein a service request comprises a request to purchase a product.

66. The method of claim 65, wherein the product is transmitted over the network.

67. The method of claim 66, wherein the product is a newspaper/newsletter article.

68. The method of claim 65, wherein the product is a durable product.

69. An information system on a network, comprising:

means for receiving service requests from a client and for determining whether a service request includes a session identifier, wherein communications to and from the client are according to hypertext transfer protocol;

means for providing the session identifier in response to an initial service request from the client in a session of requests;

means for storing, at the client, the session identifier for use in each communication to the server system;

means for appending the stored session identifier to each of subsequent communications from the client to the server system; and

means for servicing the subsequent service requests.

70. The information system of claim 69 wherein access rights of the client are fully contained within the session identifier.

71. An information system as claimed in claim 69 wherein the means for providing the session identifier is in a server system which services the requests.

72. An information system as claimed in claim 69 further comprising an authorization routine for authorizing the client prior to issuing the session identifier and means for protecting the session identifier from forgery.

73. An information server system as claimed in claim 69 further comprising a transaction log for recording information from the session identifier.

74. An information system as claimed in claim 69 further comprising means for tracking access history of sequences of service requests within the session of requests.

75. An information system as claimed in claim 69 further comprising means for counting requests to particular services exclusive of repeated requests from a common client.

76. An information system as claimed in claim 69 further comprising a data base relating customer information to access patterns.

77. An information system as claimed in claim 76 wherein the information includes customer demographics.

78. A method of processing, in a server system, service requests from a client to the server system through a network, said method comprising the steps of:

receiving, from the client, a service request to which a session identifier stored at the client has been appended by the client, wherein communications between the client and server system are according to hypertext transfer protocol;

validating the session identifier appended to the service request; and

servicing the service request if the appended session identifier is valid.

79. The method of claim 78, further comprising, in the server system:

receiving an initial service request from the client;

creating, responsive to the initial service request, the session identifier; and

returning the session identifier to the client for storage by the client for use in subsequent distinct requests to the server system.