SEAMLESS CROSS-SITE USER AUTHENTICATION STATUS DETECTION AND AUTOMATIC LOGIN

• US 20100064355A1
• Filed: 08/28/2009
• Published: 03/11/2010
• Est. Priority Date: 07/02/2002
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Cahill, Conor, Toomey, Christopher Newell
• Granted Patent: US 8,719,899 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213

Abstract

A system and method for determining in a global network the user network authentication status as the user goes from site to site within the network is provided. Additionally, the system and method provides for transparent or implicit multi-site logon functionality, including automatic introduction from one site to the other using a baseline authentication agency (102). The system and method provides an architecture for a core global network (100) (referred to herein as NET) that incorporates some or all of the following features and components: a set of baseline authentication agencies responsible for the core global network (NET) services, such as login and user-selected service-provider lookup; a shared NET domain and associated DNS records (106) used for cookie (110) sharing, login routing, and the like; and a collection of partner sites (108) accessible via the NET.

Claims

1-12. -12. (canceled)

13. A computer-implemented method for a baseline authentication agency allowing for seamless login of a user as the user accesses a site of a collection of sites within a network, the method comprising:

retrieving computer-executable instructions from computer storage of a server of a baseline authentication agency; and

executing the computer-executable instructions on at least one computer processor of the server, thereby causing computer hardware of the server to perform operations comprising;

receiving a request from a browser of a user who has been previously been authenticated by the baseline authentication agency with respect to the network, the request comprising a site identifier related to the site, and a cookie related to the user and including a reference designating the baseline authentication agency, the baseline authentication agency one of a set of baseline authentication agencies and associated with the user, wherein the cookie is stored on a global network domain used for cookie sharing and the collection of sites have access to cookies on the global network domain;

determining whether the cookie is valid;

if the cookie is valid,

determining whether a trust relationship is established between the user and the site indicating that the site is one of a group of partner sites for which the user has defined login parameters; and

generating a login ticket for the site and sending the login ticket to the user'"'"'s browser to allow for seamless login of the user to the site if the trust relationship is established.

14. The method of claim 13, further comprising checking if the site identifier is known or valid.

15. The method of claim 13, further comprising generating JavaScript code writing out an HTML form comprising the login ticket as a hidden field and writing out a partner Web site global network login handler as an action URL, and auto-submitting said form such that the browser posts the form to a partner Web site global network login handler URL on the partner site.

16. The method of claim 13, wherein the cookie includes a set of user information.

17. The method of claim 13, wherein the site is one of a collection of partner sites.

18. The method of claim 13, wherein generating the login ticket for the site comprises generating JavaScript code that stores the login ticket.

19. The method of claim 18, wherein sending the login ticket for the site comprises sending the JavaScript code.

20. The method of claim 13, further comprising:

if the cookie is valid,

receiving the ticket from the site;

determining whether the ticket is valid; and

if the ticket is valid, sending user identification information to the site, the user identification information to be used by the site to login the user.

21. A computer-implemented method for a baseline authentication agency that determines a user'"'"'s login permission for a site, the method comprising:

retrieving computer-executable instructions from computer storage of a server of a baseline authentication agency; and

executing the computer-executable instructions on at least one computer processor of the server, thereby causing computer hardware of the server to perform operations comprising;

receiving a request from a user'"'"'s browser, the request comprising a site identifier related to a site, and a user status identifier related to a user and including a reference designating the baseline authentication agency, the baseline authentication agency one of a set of baseline authentication agencies and associated with the user;

determining whether the user status identifier is valid;

if the user status identifier is valid,

determining whether the user has authorized seamless login for the site, the site selected the by the user to establish the site as one of a group of partner sites for which the user has defined login parameters; and

generating a login ticket for the site and sending the login ticket to the user'"'"'s browser if the user has authorized seamless login for the site;

wherein the user status identifier is stored on a global network domain used for sharing user status identifiers and the site is one of a collection of sites with access to cookies on the global network domain.

22. The method of claim 21, further comprising:

checking if the site identifier is known or valid.

23. The method of claim 21, further comprising:

generating JavaScript code writing out an HTML form comprising the login ticket as a hidden field and writing out a partner Web site global network login handler as an action URL, and auto-submitting said form such that the browser posts the form to a partner Web site global network login handler URL on the partner site.

24. The method of claim 21, wherein the user status identifier includes a set of user information.

25. The method of claim 21, wherein the site is one of a collection of partner sites.

26. The method of claim 21, wherein generating the login ticket for the site comprises generating JavaScript code that stores the login ticket.

27. The method of claim 26, wherein sending the login ticket for the site comprises sending the JavaScript code.

28. The method of claim 21, further comprising:

if the user status identifier is valid,

receiving the ticket from the site;

determining whether the ticket is valid; and

if the ticket is valid, sending user identification information to the site, the user identification information to be used by the site to login the user.