User enrollment in an e-community

• US 7,827,318 B2
• Filed: 11/20/2008
• Issued: 11/02/2010
• Est. Priority Date: 12/19/2001
• Status: Expired due to Term

• Current Assignee: Activision Publishing Incorporated (Microsoft Corporation)
• Original Assignee: International Business Machines Corporation
• Inventors: Hinton, Heather Maria, Blakley, III, George Robert, Clark, Greg
• Primary Examiner(s): Donaghue, Larry
• Assistant Examiner(s): Gillis, Brian J
• Application Number:
  US12/274,869
• Publication Number:
  US 20090094383A1
• Time in Patent Office: 712 Days
• Field of Search: 709/204, 709/225, 709/227, 709/250, 709/252
• US Class Current: 709/250
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An Internet user transfers directly to a domain within an e-community without returning to a home domain or reauthenticating by providing to a web browser by a home domain server a home identity cookie with an extensible data area and an enrollment token; performing enrollment through an e-community for a web-browser user by redirecting the home identity cookie via the web browser to each affiliated domain in the e-community until each has been visited once; responsive to each visit to each affiliated domain, sending an affiliated domain identity cookie to the web browser including an enrollment successful indicator; accumulating received enrollment success indicators in the extensible data area of the home identity cookie; and subsequently, vouching for an identity of the user at an affiliated domain through exchange of a vouch-for request and vouch-for response between the home domain server and an affiliated domain server.

Claims

1. A computer memory device comprising:

a computer memory device suitable for encoding software instructions; and

one or more software instructions encoded by the computer memory device configured to cause a processor to;

provide to a web browser by a home domain server a home identity cookie having an extensible data area and an enrollment token;

perform enrollment through an e-community for a user of the web browser by redirecting the home identity cookie via the web browser to each of a plurality of affiliated domains in the e-community until each affiliated domain has been visited once by the web browser;

responsive to each visit to each affiliated domain, send an affiliated domain identity cookie to the web browser including an enrollment successful indicator;

accumulate and persistently store received enrollment success indicators in the extensible data area of the home identity cookie by the web browser; and

subsequently vouch for an identity of the user at an affiliated domain through exchange of a vouch-for request and vouch-for response between the home domain server and an affiliated domain server.

2. The computer memory device as set forth in claim 1 wherein performing enrollment comprises:

transmitting a home domain identity cookie and enrollment request by the home domain server to the web browser;

storing the home domain identity cookie and enrollment request by the web browser;

redirecting the enrollment request to an affiliated domain server;

transmitting an affiliated domain identity cookie with an enrollment response including an enrollment success indicator from the affiliated domain server to the web browser;

redirecting the enrollment response with enrollment success indicator to the home domain server;

storing the enrollment response with enrollment success indicator by the home domain server;

updating a set of user information related to the user at the home domain server to record enrollment success at the affiliated domain server thereby creating a server-maintained persistent record of the enrollment success; and

modifying the home domain identity cookie to record enrollment success at the affiliated domain server thereby creating a user-maintained persistent record of the enrollment success and allowing the user to access and use resources associated with the affiliated domain server.

3. The computer memory device as set forth in claim 2 wherein redirecting the enrollment request comprises performing a hyper text transfer protocol redirection operation.

4. The computer memory device as set forth claim 2 wherein redirecting the enrollment success indicator to the home domain server comprises performing a hyper text transfer protocol redirection operation.

5. The computer memory device as set forth claim 2 wherein modifying the home domain identity cookie to record enrollment success at the affiliated domain server comprises modifying extensible data in the home domain identity cookie to include a symbol indicating successful enrollment at the affiliated domain server.

6. The computer memory device as set forth in claim 1 wherein vouching for the identity of the user comprises:

transferring the affiliated domain identity cookie with access request for a protected resource from the web browser to the affiliated domain server;

extracting a home domain identity from the affiliated domain identity cookie;

determining where to send a vouch-for request using the extracted home domain identity;

sending a vouch-for request from the affiliated domain server to the home domain server via the web browser using redirection; and

returning a vouch-for response to the affiliated domain server from the home domain server via the web browser using redirection.

7. The computer memory device as set forth in claim 6 wherein sending a vouch-for request from the affiliated domain server to the home domain server comprises determining a home domain server for the user by evaluation of the affiliated domain identity cookie.

8. The computer memory device as set forth in claim 6 wherein sending a vouch-for request from the affiliated domain server to the home domain server comprises performing a hyper text transfer protocol redirection operation.

9. The computer memory device as set forth in claim 6 wherein returning a vouch-for response to the affiliated domain server from the home domain server comprises performing a hyper text transfer protocol redirection operation.

10. A system comprising:

at least one processor, electronic circuit or combination of processor and electronic circuit configured to perform a logical process, the logical process comprising;

providing to a web browser by a home domain server a home identity cookie having an extensible data area and an enrollment token;

performing enrollment through an e-community for a user of the web browser by redirecting the home identity cookie via the web browser to each of a plurality of affiliated domains in the e-community until each affiliated domain has been visited once by the web browser;

responsive to each visit to each affiliated domain, sending an affiliated domain identity cookie to the web browser including an enrollment successful indicator;

accumulating and persistently storing received enrollment success indicators in the extensible data area of the home identity cookie by the web browser; and

subsequently vouching for an identity of the user at an affiliated domain through exchange of a vouch-for request and vouch-for response between the home domain serve.

11. The system as set forth in claim 10 wherein performing enrollment comprises:

transmitting a home domain identity cookie and enrollment request by the home domain server to the web browser;

storing the home domain identity cookie and enrollment request by the web browser;

redirecting the enrollment request to an affiliated domain server;

transmitting an affiliated domain identity cookie with an enrollment response including an enrollment success indicator from the affiliated domain server to the web browser;

redirecting the enrollment response with enrollment success indicator to the home domain server;

storing the enrollment response with enrollment success indicator by the home domain server;

updating a set of user information related to the user at the home domain server to record enrollment success at the affiliated domain server thereby creating a server-maintained persistent record of the enrollment success; and

modifying the home domain identity cookie to record enrollment success at the affiliated domain server thereby creating a user-maintained persistent record of the enrollment success and allowing the user to access and use resources associated with the affiliated domain server.

12. The system as set forth in claim 11 wherein redirecting the enrollment request comprises performing a hyper text transfer protocol redirection operation.

13. The system as set forth claim 11 wherein redirecting the enrollment success indicator to the home domain server comprises performing a hyper text transfer protocol redirection operation.

14. The system as set forth claim 11 wherein modifying the home domain identity cookie to record enrollment success at the affiliated domain server comprises modifying extensible data in the home domain identity cookie to include a symbol indicating successful enrollment at the affiliated domain server.

15. The system as set forth in claim 10 wherein vouching for the identity of the user comprises:

transferring the affiliated domain identity cookie with access request for a protected resource from the web browser to the affiliated domain server;

extracting a home domain identity from the affiliated domain identity cookie;

determining where to send a vouch-for request using the extracted home domain identity;

sending a vouch-for request from the affiliated domain server to the home domain server via the web browser using redirection; and

returning a vouch-for response the affiliated domain server from the home domain server via the web browser using redirection.

16. The system as set forth in claim 15 wherein sending a vouch for request from the affiliated domain server to the home domain server comprises determining a home domain server for the user by evaluation of the affiliated domain identity cookie.

17. The system as set forth in claim 15 wherein sending a vouch-for request from the affiliated domain server to the home domain server comprises performing a hyper text transfer protocol redirection operation.

18. The system as set forth in claim 15 wherein returning a vouch-for response to the affiliated domain server from the home domain server comprises performing a hyper text transfer protocol redirection operation.