Single universal authentication system for internet services

• US 8,484,333 B2
• Filed: 08/22/2001
• Issued: 07/09/2013
• Est. Priority Date: 08/22/2001
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: AOL Inc. (Apollo Global Management, Inc.)
• Inventors: Roskind, Jim, Ward, Rory
• Primary Examiner(s): Nguyen, Thu
• Assistant Examiner(s): WIDHALM, ANGELA M
• Application Number:
  US09/935,439
• Publication Number:
  US 20030041240A1
• Time in Patent Office: 4,339 Days
• Field of Search: 709223-229, 715/507, 713/172, 713/201
• US Class Current: 709/224
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A single universal authentication system for Internet services provides a trusted server that is activated when a user clicks on the login or helper button on a third party'"'"'s site, which submits a request to the trusted server. The client properly identifies itself to the trusted server through pre-authorization techniques such as cookies, logging on, or going through the AOL service wherein the service knows the user'"'"'s identity. The trusted server sends a user/site specific authentication token to the third party, initiating the authentication process with the third party which checks to see that the authentication token is valid and sends its own authentication token back to the trusted server. The trusted server verifies from its partner database that the third party'"'"'s authentication token is valid. If it is valid, then the trusted server fills in the third party'"'"'s form using the information from the user database and filtering the information through a filter that contains the user preferences concerning his personal information and then returns the form to the third party. The trusted server can fill in fields of a form from an unknown third party that the user feels are not threats to his security. The user is then queried as to whether the information can be released. The filter tells the system which information that the user feels is a low security threat.

Claims

1. A process for an authentication and form-filling system that is transparent to users in a computer environment, comprising the steps of:

providing a trusted server;

receiving an authentication token from a third party site;

the trusted server authenticating said third party site as a partner site; and

the trusted server filling in user registration forms from said third party site with a user'"'"'s information if said third party site is a partner;

providing a user database;

wherein said user database contains user personal information;

wherein said form filling step looks up the user'"'"'s information from said user database;

wherein said user database contains user filter preferences, said filter preferences defining what user information is allowed to be released and under the conditions of any release of information;

wherein said form filling step uses the user'"'"'s filter preferences from said user database to determine what information is entered into said third party'"'"'s form; and

wherein said form filling step fills in information that the user has deemed to be a low security risk if said third party is not a partner.

2. The process of claim 1, wherein a user clicks on a login or helper button on said third party'"'"'s site causing said trusted server to send an authentication token to said third party.

3. The process of claim 2, wherein said third party sends its own authentication token in response to said trusted server'"'"'s token.

4. The process of claim 1, further comprising the step of:

providing a partner database;

wherein said partner database contains the valid partners and their associated authentication tokens; and

wherein said authentication step compares said third party'"'"'s authentication token with said database to determine if said third party is a partner.

5. The process of claim 1, further comprising the step of:

sending said forms to the user; and

wherein the user approves the form before forwarding said form to said third party.

6. The process of claim 1, further comprising the step of:

sending said forms to said third party.

7. The process of claim 1, wherein said third party sends a session cookie to the user.

8. The process of claim 1, wherein said forms are passed via the POST method (form data) rather than the GET method (query arguments), so that the data are not exposed in browser histories and webserver logs.

9. A non-transitory program storage medium readable by a computer, tangibly embodying a program of instructions executable by the computer to perform method steps for an authentication and form-filling system that is transparent to users in a computer environment, comprising the steps of:

providing a trusted server;

receiving an authentication token from a third party site;

authenticating said third party site as a partner site; and

the trusted server filling in user registration forms from said third party site with a user'"'"'s information if said third party site is a partner;

providing a user database,

wherein said user database contains user personal information;

wherein said form filling step looks up the user'"'"'s information from said user database;

wherein said user database contains user filter preferences, said filter preferences defining what user information is allowed to be released and under the conditions of any release of information;

wherein said form filling step uses the user'"'"'s filter preferences from said user database to determine what information is entered into said third party'"'"'s form;

wherein said form filling step fills in information that the user has deemed to be a low security risk if said third party is not a partner.

10. The method of claim 9, wherein a user clicks on a login or helper button on said third party'"'"'s site causing said trusted server to send an authentication token to said third party.

11. The method of claim 10, wherein said third party sends its own authentication token in response to said trusted server'"'"'s token.

12. The method of claim 9, further comprising the step of:

providing a partner database;

wherein said partner database contains the valid partners and their associated authentication tokens; and

wherein said authentication step compares said third party'"'"'s authentication token with said database to determine if said third party is a partner.

13. The method of claim 9, further comprising the step of:

sending said forms to the user; and

wherein the user approves the form before forwarding said form to said third party.

14. The method of claim 9, further comprising the step of:

sending said forms to said third party.

15. The method of claim 9, wherein said third party sends a session cookie to the user.

16. The method of claim 9, wherein said forms are passed via the POST method (form data) rather than the GET method (query arguments), so that the data are not exposed in browser histories and webserver logs.

17. A process for an authentication and form-filling system that is transparent to users in a computer environment, comprising the steps of:

providing a trusted server;

receiving an authentication token from a third party site;

the trusted server authenticating said third party site as a partner site;

the trusted server filling in user registration forms from said third party site with a user'"'"'s information if said third party site is a partner; and

sending said user registration forms to the user;

wherein the user approves a registration form before forwarding said registration form to said third party.

18. The process of claim 17, wherein a user clicks on a login or helper button on said third party'"'"'s site causing said trusted server to send an authentication token to said third party.

19. The process of claim 18, wherein said third party sends its own authentication token in response to said trusted server'"'"'s token.

20. The process of claim 17, further comprising the step of:

providing a partner database;

wherein said partner database contains the valid partners and their associated authentication tokens; and

wherein said authentication step compares said third party'"'"'s authentication token with said database to determine if said third party is a partner.

21. The process of claim 17, further comprising the step of:

providing a user database;

wherein said user database contains user personal information; and

wherein said form filling step looks up the user'"'"'s information from said user database.

22. The process of claim 21, wherein said user database contains user filter preferences, said filter preferences define what user information is allowed to be released and under the conditions of any release of information, and wherein said form filling step uses the user'"'"'s filter preferences from said user database to determine what information is entered into said third party'"'"'s form.

23. The process of claim 22, wherein said form filling step fills in information that the user has deemed to be a low security risk if said third party is not a partner.

24. The process of claim 17, further comprising the step of:

sending said forms to said third party.

25. The process of claim 17, wherein said third party sends a session cookie to the user.

26. The process of claim 17, wherein said forms are passed via the POST method (form data) rather than the GET method (query arguments), so that the data are not exposed in browser histories and webserver logs.

27. A non-transitory program storage medium readable by a computer, tangibly embodying a program of instructions executable by the computer to perform method steps for an authentication and form-filling system that is transparent to users in a computer environment, comprising the steps of:

providing a trusted server;

receiving an authentication token from a third party site;

authenticating said third party site as a partner site; and

the trusted server filling in user registration forms from said third party site with a user'"'"'s information if said third party site is a partner;

sending said user registration forms to the user; and

wherein the user approves a registration form before forwarding said registration form to said third party.

28. The method of claim 27, wherein a user clicks on a login or helper button on said third party'"'"'s site causing said trusted server to send an authentication token to said third party.

29. The method of claim 28, wherein said third party sends its own authentication token in response to said trusted server'"'"'s token.

30. The method of claim 27, further comprising the step of:

providing a partner database;

wherein said partner database contains the valid partners and their associated authentication tokens; and

wherein said authentication step compares said third party'"'"'s authentication token with said database to determine if said third party is a partner.

31. The method of claim 27, further comprising the step of:

providing a user database;

wherein said user database contains user personal information; and

wherein said form filling step looks up the user'"'"'s information from said user database.

32. The method of claim 31, wherein said user database contains user filter preferences, said filter preferences define what user information is allowed to be released and under the conditions of any release of information, and wherein said form filling step uses the user'"'"'s filter preferences from said user database to determine what information is entered into said third party'"'"'s form.

33. The method of claim 32, wherein said form filling step fills in information that the user has deemed to be a low security risk if said third party is not a partner.

34. The method of claim 27, further comprising the step of:

sending said forms to said third party.

35. The method of claim 27, wherein said third party sends a session cookie to the user.

36. The method of claim 27, wherein said forms are passed via the POST method (form data) rather than the GET method (query arguments), so that the data are not exposed in browser histories and webserver logs.