Multiple identity management in an electronic commerce site

• US 8,359,396 B2
• Filed: 04/15/2011
• Issued: 01/22/2013
• Est. Priority Date: 06/17/2003
• Status: Expired due to Fees

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Chan, Victor S., Khusial, Darshanand, Mirlas, Lev
• Primary Examiner(s): Chea, Philip
• Assistant Examiner(s): ABEDIN, SHANTO
• Application Number:
  US13/087,492
• Publication Number:
  US 20110191831A1
• Time in Patent Office: 648 Days
• Field of Search: 726 1- 8, 709/204, 709225-229, 713/182, 705/56, 705/74, 705/75
• US Class Current: 709/229
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: G06Q 20/3821 Electronic credentials
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 2463/102 applying security measure for e-commerce
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

In electronic commerce (e-commerce) sites that are executed on a single e-commerce application, a user'"'"'s session is only associated with a single user identity for e-commerce site domain. Acting under a single identity across the site may not be desired. There may be requirements to associate an individual user with one or more separate identities within parts of the site. Aspects of the invention provide a method, system and computer program product for managing multiple user identities for a user of an electronic commerce (e-commerce) site. The method comprises defining the e-commerce site as one or more security domains; and in response to a user'"'"'s request to invoke an operation of the e-commerce site: determining a one of the one or more security domains to which the operation relates; performing one of a) creating a session and b) reusing a session for the user automatically in accordance with the determined security domain, said session associated with a user identity and a role indicating privileges for invoking operations of the e-commerce site in at least the determined security domain; and persisting said session for reuse. The user'"'"'s request may be received in association with one or more sessions persisted for the user and a one of the sessions selected in accordance with the determined security domain. In response, either a session may be created or reused. Persisting may comprise providing one or more cookies defining the session to the user for associating with a subsequent request. In accordance with a feature of this aspect, the e-commerce site may define each of the one or more security domains as a hierarchy of organizations and assets owned by the organizations and the determining a one of the one or more security domains to which the operation relates may comprise evaluating the user'"'"'s request in accordance with the hierarchy.

Claims

1. A method for managing multiple user identities for a user of an electronic commerce (e-commerce) site, the method comprising:

defining the e-commerce site as a plurality of security domains; and

in response to a user'"'"'s request to invoke an operation of the e-commerce site;

identifying a type of user identity being used by the user, wherein types of user identities comprise a guest identity and a registered identity, wherein the guest identity is an unique temporary user identity assigned to a user for the life of the user'"'"'s session within the security domain, and wherein the registered identity is an unique identity that is reusable across sessions within the security domain;

determining if the type of user identity is appropriate to invoke the operation;

responsive to the type of user identity being appropriate to invoke the operation, determining a security domain of the plurality of security domains to which the operation relates;

selecting a session from a plurality of sessions based on the determined security domain; and

reusing the selected session for the user automatically in accordance with the determined security domain, the selected session being associated with a user identity and a role, the user identity and the role together indicating privileges for invoking operations of the e-commerce site in the determined security domain.

2. The method of claim 1, further comprising;

invoking the requested operation with the user identity and the role of the selected session.

3. The method of claim 2 wherein the selected session comprises information indicating at least one of:

the user preference'"'"'s for invoking operations at the e-commerce site;

the user'"'"'s preferences for invoking operations at least for the determined security domain; and

a security signature for authenticating the selected session information.

4. The method of claim 1, further comprising:

evaluating the requested operation to determine an operation type; and

reusing the selected session in accordance with the operation type.

5. The method of claim 4, wherein the user identity is associated with an identity type for permitting the invocation of operations and wherein the method further comprises:

receiving the user'"'"'s request in association with the plurality of sessions persisted for the user;

retrieving the user identity for the detemined security domain from the plurality of sessions; and

reusing the selected session in response to the identity type of the retrieved user identity.

6. The method of claim 1,further comprising:

defining each of the plurality of security domains as a hierarchy of organizations and assets owned by the organizations; and

wherein the step of determining the security domain of the plurality of security domains to which the operation relates further comprises;

evaluating the user'"'"'s request in accordance with the hierarchy.

7. The method of claim 1, further comprising:

responsive to the user ending an operation of the e-commerce site, switching the user back to the inappropriate type of user identity.

8. A non-transitory computer readable medium tangibly embodying computer executable code for managing multiple user identities for a user of an electronic commerce (e-commerce) site defined using a plurality of security domains, wherein the computer executable code, when executed on a computing device, causes the computing device to:

in response to a user'"'"'s request to invoke an operation of the e-commerce site;

identify a type of user identity being used by the user, wherein types of user identities comprise a guest identity and a registered identity, wherein the guest identity is an unique temporary user identity assigned to a user for the life of the user'"'"'s session within the security domain, and wherein the registered identity is an unique identity that is reusable across sessions within the security domain;

determine if the type of user identity is appropriate to invoke the operation;

responsive to the type of user identity being appropriate to invoke the operation, determine a security domain of the plurality of security domains to which the operation relates;

select a session from a plurality of sessions based on the determined security domain; and

reuse the selected session for the user automatically in accordance with the determined security domain, the selected session being associated with a user identity and a role, the user identity and the role together indicating privileges for invoking operations of the e-commerce site in the determined security domain.

9. The computer readable medium of claim 8, wherein the computer executable code further causes the computing device to:

invoke the requested operation with the user identity and the role of the selected session.

10. The computer readable medium of claim 9 wherein the selected session comprises information indicating at least one of:

the user preference'"'"'s for invoking operations at the c-commerce site;

the user'"'"'s preferences for invoking operations at least for the determined security domain; and

a security signature for authenticating the selected session information.

11. The computer readable medium of claim 8, wherein the computer executable code further causes the computing device to:

evaluate the requested operation to determine an operation type; and

reuse the selected session in accordance with the operation type.

12. The computer readable medium of claim 11, wherein the user identity is associated with an identity type for permitting the invocation of operations and wherein the computer executable code further causes the computer device to:

receive the user'"'"'s request in association with plurality of sessions persisted for the user;

retrieve user identity for the determined security domain from the plurality of sessions; and

reuse the selected session in response to the identity type of the retrieved user identity.

13. The computer readable medium of claim 8, wherein the computer executable code further causes the computing device to:

define each of the plurality of security domains as a hierarchy of organizations and assets owned by the organizations; and

wherein the computer executable code for determining the security domain of the plurality of security domains to which the operation relates further causes the computing device to;

evaluate the user'"'"'s request in accordance with the hierarchy.

14. The computer readable medium of claim 8, wherein the computer executable code further causes the computing device to:

responsive to the user ending an operation of the e-commerce site, switch the user back to the inappropriate type of user identity.

15. A system for managing multiple user identities for a user of an electronic commerce (e-commerce) site defined using a plurality of security domains, the system comprising:

a processor; and

a memory coupled to the processor, wherein the memory stores instructions which, when executed by the processor, cause the processor to;

in response to a user'"'"'s request to invoke an operation of the e-commerce site;

identify a type of user identity being used by the user, wherein types of user identities comprise a guest identity and a registered identity, wherein the guest identity is an unique temporary user identity assigned to a user for the life of the user'"'"'s session within the security domain, and wherein the registered identity is an unique identity that is reusable across sessions within the security domain;

determine if the type of user identity is appropriate to invoke the operation;

responsive to the type of user identity being appropriate to invoke the operation, determine a security domain of the plurality of security domains to which the operation relates;

select a session from a plurality of sessions based on the determined security domain; and

reuse the selected session for the user automatically in accordance with the determined security domain, the selected session being associated with a user identity and a role, the user identity and the role together indicating privileges for invoking operations of the e-commerce site in the determined security domain.

16. The system of claim 15, wherein the instructions further cause the processor to:

invoke the requested operation with the user identity and the role of the selected session.

17. The system of claim 16 wherein the selected session comprises information indicating at least one of the user preference'"'"'s for invoking operations at the e-commerce site;

the user'"'"'s preferences for invoking operations at least for the determined security domain; and

a security signature for authenticating the selected session information.

18. The system of claim 15, wherein the instructions further cause the processor to:

evaluate the requested operation to determine an operation type; and

reuse the selected session in accordance with the operation type.

19. The system of claim 18 wherein the user identity is associated with an identity type for permitting the invocation of operations and wherein the instructions further cause the processor to:

receive the user'"'"'s request in association with the plurality of sessions persisted for the user;

retrieve the user identity for the determined security domain from the plurality of sessions, and

reuse the selected session in response to the identity type of the retrieved user identity.

20. The system of claim 15, wherein the instructions further cause the processor to:

responsive to the user ending an operation of the e-commerce site, switch the user back to the inappropriate type of user identity.