Systems and methods for single sign-in for multiple accounts

• US 8,201,217 B1
• Filed: 10/03/2006
• Issued: 06/12/2012
• Est. Priority Date: 10/03/2006
• Status: Active Grant

• Current Assignee: Auctane LLC (Stamps.com, Inc.)
• Original Assignee: Stamps.com, Inc.
• Inventors: Begen, Geoffrey C., Bussell, Keith D.
• Primary Examiner(s): Simitoski, Michael
• Application Number:
  US11/542,658
• Time in Patent Office: 2,079 Days
• Field of Search: 726/12, 726/14, 726/15, 726/2, 726/3
• US Class Current: 726/3
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

Systems and methods which facilitate single user sign-in for multiple accounts are shown. Embodiments create a single user base which maps users to multiple accounts. The use of a single set of credentials by the user is provided for according to embodiments irrespective of the applications associated with the various accounts having very different security protocols. A system hosting the shared user base preferably provides a single authentication point for multiple services. Embodiments an authenticator string, as may be passed between a client and bridge server and/or client and application, in order to enable user access, detect attacks with respect to a client conversation, etcetera. In addition to providing a shared user base for single sign-in, embodiments provide additional shared functionality and/or functionality not available from the applications themselves.

Claims

1. A method comprising:

receiving bridge server user credentials of a user of a client;

validating, at a bridge server, said client with said bridge server based on said received bridge server user credentials;

storing, at said bridge server, first application user credentials for validating said client to a first application and second application user credentials for validating said client to a second application;

issuing, by said bridge server, a first authentication string to said client, upon validating said client with said first application, wherein said first authentication string is used by said client to access said first application;

issuing, by said bridge server, a second authentication string to said client, upon validating said client with said second application, wherein said second authentication string is used by said client to access said second application, and wherein said first authentication string is different from said second authentication string;

establishing a session between said client and at least one of said first application and said second application;

storing a conversation record in association with said session; and

managing, by said bridge server, said session by using at least one of said first authentication string and said second authentication string to reference said at least one stored conversation record.

2. The method of claim 1 wherein said issuing a first authentication string comprises:

generating said first authentication string; and

sending said first authentication string to said client.

3. The method of claim 1 wherein said first authentication string comprises a pseudorandom number.

4. The method of claim 1 further comprising:

receiving a communication from said client, wherein said communication comprises a return first authentication string; and

validating said communication by determining said return first authentication string corresponds with said first authentication string.

5. The method of claim 4 further comprising issuing a new first authentication string comprising:

generating said new first authentication string in response to validating said communication; and

sending said new first authentication string to said client.

6. The method of claim 5 further comprising:

receiving a second communication from said client, wherein said second communication comprises a new return first authentication string; and

validating said second communication by determining said new return first authentication string corresponds with said new first authentication string.

7. The method of claim 5 further comprising:

receiving a second communication from said client, wherein said second communication comprises a new return first authentication string; and

validating said second communication by determining said new return first authentication string corresponds with one of;

said new first authentication string and said first authentication string.

8. The method of claim 1 wherein said first authentication string times-out.

9. The method of claim 8 further comprising:

receiving a communication from said client, wherein said communication comprises a return first authentication string, and wherein said communication is received after said first authentication string has timed-out; and

validating said request by determining said return first authentication string corresponds with said first authentication string that has timed-out.

10. The method of claim 1 further comprising:

redirecting a communication that is addressed for said first application to said bridge server.

11. The method of claim 1 further comprising:

taking on, by said bridge server, an electronic address of said first application.

12. The method of claim 1 wherein said first application is a postage indicia generation application.

13. A system comprising:

a bridge server configured to communicate with at least one client, a first application, and a second application and operable to store;

at least one conversation record, said conversation record associated with a user session between said client and at least one of said first application and said second application;

bridge server user credentials of a user of said client, wherein said bridge server uses said bridge server user credentials to validate said client with said bridge server;

first application user credentials of said user, wherein said bridge server uses said first application user credentials to validate said client with said first application; and

second application user credentials of said user, wherein said bridge server uses said second application user credentials to validate said client with said second application;

a first authentication string, issued by said bridge server to said client upon said bridge server validating said client with said first application, wherein said first authentication string is used by said client to access said first application; and

a second authentication string, issued by said bridge server to said client upon said bridge server validating said client with said second application, wherein said second authentication string is used by said client to access said second application, and wherein said first authentication string is different from said second authentication string;

wherein said bridge server is further operable to manage said user session by using at least one of said first authentication string and said second authentication string to reference said at least one stored conversation record.

14. The system of claim 13 wherein said bridge server issues a new authentication string for each communication received from said client that is determined to be valid.

15. The system of claim 13 wherein said bridge server authorizes a request, received from said client comprising a return authentication string, when said return authentication string corresponds with either said first authentication string or a previous first authentication string.

16. The system of claim 13 wherein said bridge server issues said first authentication string by generating said first authentication string and sending said first authentication string to said client.

17. The system of claim 13 wherein said first authentication string comprises a pseudorandom number.

18. The system of claim 13 wherein said bridge server receives a communication from said client, wherein said communication comprises a return first authentication string, and wherein said bridge server validates said communication by determining said return first authentication string corresponds with said first authentication string.

19. The system of claim 18 wherein said bridge server generates a new first authentication string in response to validating said communication, and wherein said bridge server sends said new first authentication string to said client.

20. The system of claim 19 wherein said bridge server receives a second communication from said client, and wherein said second communication comprises a new return first authentication string, and wherein said bridge server validates said second communication by determining said new return first authentication string corresponds with said new first authentication string.

21. The system of claim 19 wherein said bridge server receives a second communication from said client, and wherein said second communication comprises a new return first authentication string, and wherein said bridge server validates said second communication by determining said new return first authentication string corresponds with one of said new first authentication string and said first authentication string.

22. The system of claim 13 wherein said first authentication string times-out.

23. The system of claim 22 wherein said bridge server receives a communication from said client, wherein said communication comprises a return first authentication string, and wherein said communication is received after said first authentication string has timed-out, and wherein said bridge server validates said request by determining said return first authentication string corresponds with said first authentication string that has timed-out.

24. The system of claim 13 wherein said first application is a postage indicia generation application.

25. The system of claim 13 wherein a request addressed for said first application is redirected to said bridge server.

26. The system of claim 13 wherein said bridge server takes on an electronic address of said first application.

27. The system of claim 13 wherein said first authentication string satisfies security protocols of said first application, wherein said second authentication string satisfies security protocols of said second application, and wherein said security protocols of said first application are different from said security protocols of said second client.