System and method for user enrollment in an e-community

• US 20060031592A1
• Filed: 10/06/2005
• Published: 02/09/2006
• Est. Priority Date: 12/19/2001
• Status: Active Grant

• Current Assignee: Activision Publishing Incorporated (Microsoft Corporation)
• Original Assignee: George Robert Iii Blakley, Greg Clark, Heather M. Hinton
• Inventors: Hinton, Heather Maria, Blakley, George Robert III, Clark, Greg
• Granted Patent: US 7,484,012 B2
• Time in Patent Office: Days
• US Class Current: 709/250
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

An Internet user transfers directly to a domain within an e-community without returning to a home domain or re-authenticating. The user'"'"'s home domain server prepares and forwards a home domain identity cookie (DIDC) with an enrollment request to a user'"'"'s browser, with the enrollment request being redirected to an affiliated domain server in the e-community. The affiliated domain server prepares and sends an affiliated DIDC with an enrollment confirmation to the user'"'"'s browser, redirecting the enrollment confirmation to the home domain server. The home domain server modifies the home DIDC to include a symbol which indicates successful enrollment at the affiliated site. The process may be repeated for a plurality of affiliated domains to achieve automatic enrollment a portion of or an entire e-community.

Claims

1. A method comprising:

providing to a user'"'"'s web browser a home identity cookie having an extensible data area and an enrollment token;

performing enrollment through an e-community for said user by redirecting said home identity cookie via said user'"'"'s web browser to each affiliated domain in said e-community until each affiliated domain has been visited once;

responsive to each visit to each affiliated domain, sending an affiliated domain identity cookie to said user'"'"'s browser including an enrollment successful indicator;

accumulating and persistently storing received enrollment success indicators in said extensible data area of said home identity cookie by said user'"'"'s browser; and

subsequently vouching for the identity of said user at an affiliated domain through exchange of a vouch-for request and vouch-for response between said home domain server and an affiliated domain server.

2. The method as set forth in claim 1 wherein said step of enrolling the user at an affiliated domain comprises the steps of:

transmitting a home domain identity cookie and enrollment request by said home domain server to a user'"'"'s browser where it may be stored;

redirecting said enrollment request to an affiliated domain server;

transmitting an affiliated domain identity cookie with an enrollment response including an enrollment success indicator from said affiliated domain server to said user'"'"'s browser;

redirecting said enrollment response with enrollment success indicator to said home domain server where it may be stored;

updating a set of user information at said home domain to record enrollment success at said affiliated domain server such that there is a server-maintained persistent record of the user'"'"'s enrollment; and

modifying said home domain identity cookie to record enrollment success at said affiliated domain server such that there is a user-maintained persistent record of the user'"'"'s enrollment so that the user may access and use resources associated with the affiliated domain server.

3. The method as set forth claim 2 wherein said step of redirecting said enrollment request comprises performing a hyper text transfer protocol redirection operation.

4. The method as set forth claim 2 wherein said step of redirecting said enrollment success indicator to said home domain server comprises performing a hyper text transfer protocol redirection operation.

5. The method as set forth claim 2 wherein said step of modifying said home domain identity cookie to record enrollment success at said affiliated domain server comprises modifying extensible data in the home domain identity cookie to include a symbol indicating successful enrollment at said affiliated domain server.

6. The method as set forth in claim 1 wherein said step of vouching for the identity of the user comprises the steps of:

transferring said affiliated domain identity cookie with access request for a protected resource from said user'"'"'s browser to said affiliated domain server;

extracting the user'"'"'s home domain identity from the affiliated domain identity cookie in order to determine where to send a vouch-for request;

sending a vouch-for request from said affiliated domain server to said home domain server via the user'"'"'s browser using redirection; and

returning a vouch-for response to said affiliated domain server from said home domain server via the user'"'"'s browser using redirection.

7. The method as set forth in claim 6 wherein said step of sending a vouch-for request from said affiliated domain server to said home domain comprises the step of determining the user'"'"'s home domain server by evaluation of the user'"'"'s affiliated domain identity cookie.

8. The method as set forth in claim 6 wherein said step of sending a vouch-for request from said affiliated domain server to said home domain server comprises performing a hyper text transfer protocol redirection operation.

9. The method as set forth in claim 6 wherein said step of returning a vouch-for response to said affiliated domain server from said home domain server comprises performing a hyper text transfer protocol redirection operation.

10. A computer-readable medium encoded with software for performing steps comprising:

providing to a user'"'"'s web browser a home identity cookie having an extensible data area and an enrollment token;

performing enrollment through an e-community for said user by redirecting said home identity cookie via said user'"'"'s web browser to each affiliated domain in said e-community until each affiliated domain has been visited once;

responsive to each visit to each affiliated domain, sending an affiliated domain identity cookie to said user'"'"'s browser including an enrollment successful indicator;

accumulating and persistently storing received enrollment success indicators in said extensible data area of said home identity cookie by said user'"'"'s browser; and

subsequently vouching for the identity of said user at an affiliated domain through exchange of a vouch-for request and vouch-for response between said home domain server and an affiliated domain server.

11. The computer readable medium as set forth in claim 10 wherein said software for enrolling the user at an affiliated domain comprises software for performing steps of:

transmitting a home domain identity cookie and enrollment request by said home domain server to a user'"'"'s browser where it may be stored;

redirecting said enrollment request to an affiliated domain server;

transmitting an affiliated domain identity cookie with an enrollment response including an enrollment success indicator from said affiliated domain server to said user'"'"'s browser;

redirecting said enrollment response with enrollment success indicator to said home domain server where it may be stored;

updating a set of user information at said home domain to record enrollment success at said affiliated domain server such that there is a server-maintained persistent record of the user'"'"'s enrollment; and

modifying said home domain identity cookie to record enrollment success at said affiliated domain server such that there is a user-maintained persistent record of the user'"'"'s enrollment so that the user may access and use resources associated with the affiliated domain server.

12. The computer readable medium as set forth in claim 11 wherein said software for redirecting said enrollment request comprises software for performing a hyper text transfer protocol redirection operation.

13. The computer readable medium as set forth in claim 11 wherein said software for redirecting said enrollment success indicator to said home domain server comprises software for performing a hyper text transfer protocol redirection operation.

14. The computer readable medium as set forth in claim 11 wherein said software for modifying said home domain identity cookie to record enrollment success at said affiliated domain server comprises software for modifying extensible data in the home domain identity cookie to include a symbol indicating successful enrollment at said affiliated domain server.

15. The computer readable medium as set forth in claim 10 wherein said software for vouching for the identity of the user comprises software for performing the steps of:

transferring said affiliated domain identity cookie with access request for a protected resource from said user'"'"'s browser to said affiliated domain server;

extracting the user'"'"'s home domain identity from the affiliated domain identity cookie in order to determine where to send a vouch-for request;

sending a vouch-for request from said affiliated domain server to said home domain server via the user'"'"'s browser using redirection; and

returning a vouch-for response to said affiliated domain server from said home domain server via the user'"'"'s browser using redirection.

16. The computer readable medium as set forth in claim 15 wherein said software for sending a vouch-for request from said affiliated domain server to said home domain comprises software for determining the user'"'"'s affiliated domain server by evaluation of the user'"'"'s home domain identity cookie.

17. The computer readable medium as set forth in claim 15 wherein said software for sending a vouch-for request from said affiliated domain server to said home domain server comprises software for performing a hyper text transfer protocol redirection operation.

18. The computer readable medium as set forth in claim 15 wherein said software for returning a vouch-for response to said affiliated domain server from said home domain server comprises software for performing a hyper text transfer protocol redirection operation.

19. A system comprising:

a home identity cookie having an extensible data area and an enrollment token provided to a user'"'"'s web browser;

one or more enrollment agents adapted to perform enrollment through an e-community for said user by redirecting said home identity cookie via said user'"'"'s web browser to each affiliated domain in said e-community until each affiliated domain has been visited once, and to, responsive to each visit to each affiliated domain, send an affiliated domain identity cookie to said user'"'"'s browser including an enrollment successful indicator;

one or more accumulated received enrollment success indicators in said extensible data area of said home identity cookie persistently stored by said user'"'"'s browser; and

one or more identity voucher agents adapted to subsequently vouch for the identity of said user at an affiliated domain through exchange of a vouch-for request and vouch-for response between said home domain server and an affiliated domain server.

20. The system as set forth in claim 19 further comprising:

an enrollment request redirector for redirecting said enrollment request from said home domain server to an affiliated domain server via said browser;

an enrollment response redirector for redirecting said enrollment response with enrollment success indicator to said home domain server from said affiliated domain server via said browser;

a user information manager operable by said home domain adapted to record enrollment success at said affiliated domain server such that there is a server-maintained persistent record of the user'"'"'s enrollment; and

a home domain identity cookie modifier adapted to record enrollment success at said affiliated domain server such that there is a client-maintained persistent record of the user'"'"'s enrollment so that the user may access and use resources associated with the affiliated domain server.

21. The system as set forth claim 20 wherein said enrollment request redirector comprises a hyper text transfer protocol command.

22. The system as set forth claim 20 wherein said enrollment response redirector comprises a hyper text transfer protocol redirection command.

23. The system as set forth claim 20 wherein said home domain identity cookie modifier is adapted to modify extensible data in the home domain identity cookie to include a symbol indicating successful enrollment at said affiliated domain server.

24. The system as set forth in claim 19 further comprising an affiliated domain identity cookie evaluator for extracting the user'"'"'s home domain identity from said affiliated domain identity cookie in order to determine where to send a vouch-for request.