Single universal authentication system for internet services

• US 20030041240A1
• Filed: 08/22/2001
• Published: 02/27/2003
• Est. Priority Date: 08/22/2001
• Status: Active Grant

• Current Assignee: Verizon Patent and Licensing Incorporated (Verizon Communications Inc.)
• Original Assignee: AOL Inc. (Apollo Global Management, Inc.)
• Inventors: Ward, Rory, Roskind, Jim
• Granted Patent: US 8,484,333 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A single universal authentication system for Internet services provides a trusted server that is activated when a user clicks on the login or helper button on a third party'"'"'s site, which submits a request to the trusted server. The client properly identifies itself to the trusted server through pre-authorization techniques such as cookies, logging on, or going through the AOL service wherein the service knows the user'"'"'s identity. The trusted server sends a user/site specific authentication token to the third party, initiating the authentication process with the third party which checks to see that the authentication token is valid and sends its own authentication token back to the trusted server. The trusted server verifies from its partner database that the third party'"'"'s authentication token is valid. If it is valid, then the trusted server fills in the third party'"'"'s form using the information from the user database and filtering the information through a filter that contains the user preferences concerning his personal information and then returns the form to the third party. The trusted server can fill in fields of a form from an unknown third party that the user feels are not threats to his security. The user is then queried as to whether the information can be released. The filter tells the system which information that the user feels is a low security threat.

Claims

1. A process for an authentication and form-filling system that is transparent to users in a computer environment, comprising the steps of:

providing a trusted server;

receiving an authentication token from a third party site;

authenticating said third party site as a partner site; and

filling in forms from said third party site with a user'"'"'s information if said third party site is a partner.

2. The process of claim 1, wherein a user clicks on a login or helper button on said third party'"'"'s site causing said trusted server to send an authentication token to said third party.

3. The process of claim 2, wherein said third party sends its own authentication token in response to said trusted server'"'"'s token.

4. The process of claim 1, further comprising the step of:

providing a partner database;

wherein said partner database contains the valid partners and their associated authentication tokens; and

wherein said authentication step compares said third party'"'"'s authentication token with said database to determine if said third party is a partner.

5. The process of claim 1, further comprising the step of:

providing a user database;

wherein said user database contains user personal information; and

wherein said form filling step looks up the user'"'"'s information from said user database.

6. The process of claim 5, wherein said user database contains user filter preferences, said filter preferences define what user information is allowed to be released and under the conditions of any release of information, and wherein said form filling step uses the user'"'"'s filter preferences from said user database to determine what information is entered into said third party'"'"'s form.

7. The process of claim 6, wherein said form filling step fills in information that the user has deemed to be a low security risk if said third party is not a partner.

8. The process of claim 1, further comprising the step of:

sending said forms to the user; and

wherein the user approves the form before forwarding said form to said third party.

9. The process of claim 1, further comprising the step of:

sending said forms to said third party.

10. The process of claim 1, wherein said third party sends a session cookie to the user.

11. The process of claim 1, wherein said forms are passed via the POST method (form data) rather than the GET method (query arguments), so that the data are not exposed in browser histories and webserver logs.

12. An apparatus for an authentication and form-filling system that is transparent to users in a computer environment, comprising:

a trusted server;

a module for receiving an authentication token from a third party site;

a module for authenticating said third party site as a partner site; and

a module for filling in forms from said third party site with a user'"'"'s information if said third party site is a partner.

13. The apparatus of claim 12, wherein a user dicks on a login or helper button on said third party'"'"'s site causing said trusted server to send an authentication token to said third party.

14. The apparatus of claim 13, wherein said third party sends its own authentication token in response to said trusted server'"'"'s token.

15. The apparatus of claim 12, further comprising:

a partner database;

wherein said partner database contains the valid partners and their associated authentication tokens; and

wherein said authentication module compares said third party'"'"'s authentication token with said database to determine if said third party is a partner.

16. The apparatus of claim 12, further comprising:

a user database;

wherein said user database contains user personal information; and

wherein said form filling module looks up the user'"'"'s information from said user database.

17. The apparatus of claim 16, wherein said user database contains user filter preferences, said filter preferences define what user information is allowed to be released and under the conditions of any release of information, and wherein said form filling module uses the user'"'"'s filter preferences from said user database to determine what information is entered into said third party'"'"'s form.

18. The apparatus of claim 17, wherein said form filling module fills in information that the user has deemed to be a low security risk if said third party is not a partner.

19. The apparatus of claim 12, further comprising:

a module for sending said forms to the user; and

wherein the user approves the form before forwarding said form to said third party.

20. The apparatus of claim 12, further comprising:

a module for sending said forms to said third party.

21. The apparatus of claim 12, wherein said third party sends a session cookie to the user.

22. The apparatus of claim 12, wherein said forms are passed via the POST method (form data) rather than the GET method (query arguments), so that the data are not exposed in browser histories and webserver logs.

23. A program storage medium readable by a computer, tangibly embodying a program of instructions executable by the computer to perform method steps for an authentication and form-filling system that is transparent to users in a computer environment, comprising the steps of:

providing a trusted server;

receiving an authentication token from a third party site;

authenticating said third party site as a partner site; and

filling in forms from said third party site with a user'"'"'s information if said third party site is a partner.

24. The method of claim 23, wherein a user clicks on a login or helper button on said third party'"'"'s site causing said trusted server to send an authentication token to said third party.

25. The method of claim 24, wherein said third party sends its own authentication token in response to said trusted server'"'"'s token.

26. The method of claim 23, further comprising the step of:

providing a partner database;

wherein said partner database contains the valid partners and their associated authentication tokens; and

wherein said authentication step compares said third party'"'"'s authentication token with said database to determine if said third party is a partner.

27. The method of claim 23, further comprising the step of:

providing a user database;

wherein said user database contains user personal information; and

wherein said form filling step looks up the user'"'"'s information from said user database.

28. The method of claim 27, wherein said user database contains user filter preferences, said filter preferences define what user information is allowed to be released and under the conditions of any release of information, and wherein said form filling step uses the user'"'"'s filter preferences from said user database to determine what information is entered into said third party'"'"'s form.

29. The method of claim 28, wherein said form filling step fills in information that the user has deemed to be a low security risk if said third party is not a partner.

30. The method of claim 23, further comprising the step of:

sending said forms to the user; and

wherein the user approves the form before forwarding said form to said third party.

31. The method of claim 23, further comprising the step of:

sending said forms to said third party.

32. The method of claim 23, wherein said third party sends a session cookie to the user.

33. The method of claim 23, wherein said forms are passed via the POST method (form data) rather than the GET method (query arguments), so that the data are not exposed in browser histories and webserver logs.