User enrollment in an e-community

• US 7,484,012 B2
• Filed: 10/06/2005
• Issued: 01/27/2009
• Est. Priority Date: 12/19/2001
• Status: Expired due to Fees

• Current Assignee: Activision Publishing Incorporated (Microsoft Corporation)
• Original Assignee: International Business Machines Corporation
• Inventors: Hinton, Heather Maria, Clark, Greg, Blakley, III, George Robert
• Primary Examiner(s): Cardone, Jason
• Assistant Examiner(s): Gillis, Brian J
• Application Number:
  US11/245,296
• Publication Number:
  US 20060031592A1
• Time in Patent Office: 1,209 Days
• Field of Search: 709/204, 709/225, 709/227, 709/250, 709/252
• US Class Current: 709/250
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An Internet user transfers directly to a domain within an e-community by providing a home identity cookie having an extensible data area and enrollment token to a web browser by a home domain server, and enrolling through an e-community for a user of the web browser by redirecting the home identity cookie via the web browser to each of the affiliated domains in the e-community until each affiliated domain has been visited once by the web browser. Upon each visit to each affiliated domain, an affiliated domain identity cookie is sent to the web browser including an enrollment successful indicator. Enrollment success indicators are accumulated and persistently stored received in the extensible data area of said home identity cookie. Subsequently, the identity of the user is vouched for at an affiliated domain through exchange of a vouch-for request and vouch-for response between the home domain server and an affiliated domain server.

Claims

1. A method comprising:

providing to a web browser by a home domain server a home identity cookie having an extensible data area and an enrollment token;

performing enrollment through an e-community for a user of said web browser by redirecting said home identity cookie via said web browser to each of a plurality of affiliated domains in said e-community until each affiliated domain has been visited once by said web browser;

responsive to each visit to each affiliated domain, sending an affiliated domain identity cookie to said web browser including an enrollment successful indicator;

accumulating and persistently storing received enrollment success indicators in said extensible data area of said home identity cookie by said web browser; and

subsequently vouching for an identity of said user at an affiliated domain through exchange of a vouch-for request and vouch-for response between said home domain server and an affiliated domain server.

2. The method as set forth in claim 1 wherein performing enrollment comprises:

transmitting a home domain identity cookie and enrollment request by said home domain server to said web browser;

storing said home domain identity cookie and enrollment request by said web browser;

redirecting said enrollment request to an affiliated domain server;

transmitting an affiliated domain identity cookie with an enrollment response including an enrollment success indicator from said affiliated domain server to said web browser;

redirecting said enrollment response with enrollment success indicator to said home domain server;

storing said enrollment response with enrollment success indicator by said home domain server;

updating a set of user information related to said user at said home domain server to record enrollment success at said affiliated domain server thereby creating a server-maintained persistent record of said enrollment success; and

modifying said home domain identity cookie to record enrollment success at said affiliated domain server thereby creating a user-maintained persistent record of said enrollment success and allowing said user to access and use resources associated with the affiliated domain server.

3. The method as set forth claim 2 wherein redirecting said enrollment request comprises performing a hyper text transfer protocol redirection operation.

4. The method as set forth claim 2 wherein redirecting said enrollment success indicator to said home domain server comprises performing a hyper text transfer protocol redirection operation.

5. The method as set forth claim 2 wherein modifying said home domain identity cookie to record enrollment success at said affiliated domain server comprises modifying extensible data in the home domain identity cookie to include a symbol indicating successful enrollment at said affiliated domain server.

6. The method as set forth in claim 1 wherein vouching for the identity of the user comprises:

transferring said affiliated domain identity cookie with access request for a protected resource from said web browser to said affiliated domain server;

extracting a home domain identity from the affiliated domain identity cookie;

determining where to send a vouch-for request using said extracted home domain identity;

sending a vouch-for request from said affiliated domain server to said home domain server via said web browser using redirection; and

returning a vouch-for response to said affiliated domain server from said home domain server via said web browser using redirection.

7. The method as set forth in claim 6 wherein sending a vouch-for request from said affiliated domain server to said home domain comprises determining a home domain server for said user by evaluation of the said affiliated domain identity cookie.

8. The method as set forth in claim 6 wherein sending a vouch-for request from said affiliated domain server to said home domain server comprises performing a hyper text transfer protocol redirection operation.

9. The method as set forth in claim 6 wherein returning a vouch-for response to said affiliated domain server from said home domain server comprises performing a hyper text transfer protocol redirection operation.