Single sign-on with common access card

• US 20060031683A1
• Filed: 06/27/2005
• Published: 02/09/2006
• Est. Priority Date: 06/25/2004
• Status: Active Grant

• Current Assignee: Accenture Global Services Limited (Accenture PLC)
• Original Assignee: Accenture Global Services GmbH (Accenture PLC)
• Inventors: Jewell, Andrew W., Marion, Donald E.
• Granted Patent: US 7,818,582 B2
• Time in Patent Office: Days
• US Class Current: 713/185
• CPC Class Codes: G06F 21/335 for accessing specific resources, e.g. using Kerberos tickets
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

A mechanism eliminates the number of times a user must login to individual services after initially logging into a computer system. A user only logs once into a computer system, and subsequent login requests by multiple services are handled automatically and transparently by the system. In one implementation, a user need only present a card to a card reader and enter a PIN, and the user is logged-in after presenting the card and a valid PIN. The system generates a token that is valid for this particular login session of the user, and when the user accesses a permissioned service, the system automatically logs-in the user to the application using the token. The system can perform the automatic login the user to a variety of applications including legacy applications, web-enabled applications, and commercial, off-the-shelf applications.

Claims

1. A computer system comprising:

a module that verifies information supplied by a user attempting to gain access to a computer system;

a token generator coupled to the module, the token generator creating a token for the user after the information is verified;

a portal coupled to the token generator and receiving the token, the portal presenting application information to the user for applications that the user is allowed to access and allowing the user to select an application;

a first application interface coupled to the portal and accessing the token, the application interface validating the token;

a web-based application coupled to the application interface, the application providing the user access to the application after the application interface validates the token;

a second application interface coupled to the portal and accessing the token, the second application interface validating the token; and

a non-web-based application coupled to the second application interface, the second application providing the user access to the second application after the second application interface validates the token.

2. A method comprising:

accessing user information pertaining to a user;

logging-in a user to a computer system based on the user information;

receiving a request from the user to access an application on the computer system, the application ordinarily requiring users to login in order to access the application; and

providing the user access to the application in an automated manner such that the user does not have to enter login information in order to access the application.

3. The method of claim 2 wherein providing the user access comprises bypassing the application'"'"'s ordinary requirement that users login.

4. The method of claim 2 wherein providing the user access comprises using stored user information to login the user to the application.

5. The method of claim 2 further comprising:

receiving a second request from the user to access a second application on the computer system, the second application ordinarily requiring users to login in order to access the second application;

providing the user access to the second application in an automated manner such that the user does not have to enter login information in order to access the second application,

wherein the application is provided by a first manufacturer and the second application is provided by a second manufacturer.

6. The method of claim 5 wherein the application is a web-enabled application and the second application is a non-web-enabled application.

7. The method of claim 2 wherein accessing user information pertaining to the user comprises accessing information from a CAC.

8. The method of claim 7 further comprising providing the user a single sign-on feature for all applications that the user has rights to access on the computer system.

9. A computer system comprising:

a module that verifies information supplied by a user attempting to gain access to a computer system;

a token generator coupled to the module, the token generator creating a token for the user after the information is verified;

a portal coupled to the token generator and receiving the token, the portal presenting application information to the user for applications that the user is allowed to access and allowing the user to select an application;

an application interface coupled to the portal and accessing the token, the application interface validating the token; and

an application coupled to the application interface, the application interface dynamically providing the user access to the application in real time after the application interface validates the token.

10. The system of claim 9 further comprising:

a second application interface coupled to the portal and accessing the token, the second application interface validating the token; and

a second application coupled to the second application interface, the second application providing the user access to the second application after the second application interface validates the token.

11. The system of claim 10 wherein the application is a web-enabled application and the second application is a non-web-enabled application.

12. The system of claim 9 wherein the application interface bypasses a login requirement of the application.

13. The system of claim 9 wherein the application interface logs-in the user to the application.

14. A system comprising one or more computer-readable media, the media collectively having instructions that when executed on one or more machines result in at least the following:

accessing user information pertaining to a user;

verifying the user information;

logging-in the user to a computer system based on the verified user information;

creating a token for the user after logging-in the user; and

providing, based on the token, the user access to an application in an automated manner such that the user does not have to enter login information in order to access the application.

15. The system of claim 14 wherein the instructions, when executed on the one or more machines, result in providing, based on the token, the user access to a multiplicity of applications provided by a multiplicity of manufacturers.

16. The system of claim 15 wherein accessing user information comprises accessing user information provided from a CAC.