System and method for securely accessing information from disparate data sources through a network

• US 5,884,312 A
• Filed: 02/28/1997
• Issued: 03/16/1999
• Est. Priority Date: 02/28/1997
• Status: Expired due to Term

• Current Assignee: Ent Services Development Corporation LP (DXC Technology Company)
• Original Assignee: Electronic Data Systems Corporation (Perspecta, Inc.)
• Inventors: Dustan, Robert Frederick, Vieira, Dirk A.
• Primary Examiner(s): Black, Thomas G.
• Assistant Examiner(s): HO, RUAY L
• Application Number:
  US08/810,498
• Time in Patent Office: 746 Days
• Field of Search: 707/1-10, 707/100-104, 707/200-206, 395/200.33, 395/200.36, 395/671, 395/676, 379/112, 379/115, 379/114
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 67/10 in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46

Abstract

A method for securely accessing information from disparate data sources through a network is provided. The method includes requesting a logon menu from a network server using a client and receiving a logon menu. The method further includes communicating a logon input to the network server which then communicates the logon input to a database server. Next, the method includes verifying the logon input at the database server and generating and storing a unique session identification number at the database server in response. The method continues by communicating the session identification number and a portion of the logon input to the client and storing, and communicating a menu to the client prompting the user to perform at least a first function requiring access to a first type of disparate data source. Next, the method includes requesting the first function and communicating the session identification number, the portion of the logon input, and the first function request to the network server from the client. Next, the method includes providing this information to the database server and verifying that the session identification number and the portion of the logon input are valid. Finally, the method includes exchanging information between the database server and the first type of disparate data source while performing the first function, and then generating a first output at the network server that is provided to the client in response.

Claims

1. A method for securely accessing information from disparate data sources through a network comprising the steps of:

requesting a logon menu from a network server of the network using a client;

receiving a logon menu at the client;

communicating a logon input to the network server in response to receiving the logon menu;

receiving the logon input at the network server and communicating the logon input to a database server;

verifying that the logon input is a valid logon input at the database server;

generating and storing a unique session identification number at the database server in response to successfully verifying that the logon input is a valid logon input;

communicating the session identification number and a portion of the logon input to the client;

storing the session identification number and the portion of the logon input at the client;

communicating a menu to the client prompting the user to perform at least a first function requiring access to a first type of disparate data source and a second function requiring access to a second type of data source;

requesting the first function;

communicating the session identification number, the portion of the logon input, and the first function request to the network server;

receiving the session identification number, the portion of the logon input, and the first function request at the network server and communicating to the database server;

verifying at the database server that the session identification number and the portion of the logon input are valid;

exchanging information between the database server and the first type of disparate data source while performing the first function; and

generating a first output in response to performing the first function and communicating this to the client.

2. The method of claim 1, further comprising the steps of:

requesting the second function;

communicating the session identification number, the portion of the logon input, and the second function request to the network server;

receiving the session identification number, the portion of the logon input, and the second function request at the network server and communicating this information to the database server;

verifying at the database server that the session identification number and the portion of the logon input are valid;

exchanging information between the database server and the second type of data source while performing the second function; and

generating a second output in response to performing the second function and communicating this to the client.

3. The method of claim 2, wherein the logon input includes a password and an account number, and the portion of the logon input includes the account number.

4. The method of claim 1, further comprising the steps of:

communicating a log off request, the session identification number, and the portion of the logon input to the network server from the client;

communicating the log off request, the session identification number, and the portion of the logon input from the network server to the database server;

verifying at the database server that the session identification number and the portion of the logon input are valid;

deleting the session identification number at the database server;

sending a command to the client to delete the stored session identification number and the portion of the logon input at the client.

5. The method of claim 4, wherein the client is a computer enabled with a web browser and the storing the session identification number and the portion of the logon input at the client step includes using the web browser to store the session identification number and the portion of the logon input in a portion of volatile memory, and wherein the sending a command to the client to delete the stored session identification number and the portion of the logon input step includes deleting the contents of the portion of volatile memory before the web browser writes the session identification number and the logon input to non-volatile memory.

6. The method of claim 1, wherein the client is a computer enabled with a web browser and the storing the session identification number and the portion of the logon input at the client step includes using the web browser to store the session identification number and the portion of the logon input in volatile memory.

7. The method of claim 1, wherein the database server is in continuous, direct communication with the network server and is not directly accessible through the network.

8. The method of claim 1, wherein the exchanging information between the database server and the first type of disparate data source while performing the first function step includes using a database management system, a stored procedure, and a registered procedure at the database server to access the first type of disparate data source which is not directly compatible with the database management system.

9. The method of claim 1, wherein the exchanging information between the database server and the second type of data source while performing the first function step includes using a database management system at the database server to access the second type of data source that is directly compatible with the database management system.

10. The method of claim 1, wherein a record in an activity logging table at the database server is generated after the requesting the first function step.

11. The method of claim 1, wherein the communication between the client and the network server is provided using a secure socket layer standard.

12. The method of claim 1, wherein the verifying that the logon input is a valid logon input at the database server step includes encrypting a password provided as part of the logon input and comparing the encrypted password with an encrypted password previously stored in a user table at the database server.

13. The method of claim 12, wherein an error message is generated and provided to the client if the verifying that the logon input is a valid logon input at the database server step cannot verify the logon input.

14. The method of claim 1, wherein the verifying at the database server that the session identification number and the portion of the logon input are valid step further includes verifying that a user identified by the portion of the logon input has the rights to perform the first function request.

15. The method of claim 1, wherein the generating and storing a unique session identification number at the database server step includes encrypting the session id before storing as the database server.

16. The method of claim 1, wherein the network is the Internet.

17. A system for securely accessing information from disparate data sources through a network, the system comprising:

a client having a volatile memory and enabled with a web browser, the client operable to exchange information and to communicate a request, and a session identification number and an account number that are stored in the volatile memory;

a network server operable to exchange information with the client and operable to receive the request, the session identification number, and the account number from the client, the network server enabled with a web server program that is operable to execute a script and to generate and provide information to the client in response to the request from the client;

a database server in communication with the network server and operable to receive the session identification number and the account number from the network server, the database server enabled with a database management system that is operable to execute a first function stored procedure in response to the execution of the script at the network server, the database server further including a user table, a check access stored procedure, the first function stored procedure, and a first function registered procedure, the first function stored procedure operable to execute the check access stored procedure to verify the session identification number and the account number with information in the user table and to execute the first function registered procedure to request information from a disparate data source; and

a first disparate data source operable to exchange information with the database server in response to a request from the first function registered procedure.

18. The system of claim 17, wherein the database server further includes a logon stored procedure and a log off stored procedure.

19. The system of claim 17, further comprising:

a second client implemented as an interactive voice response system and operable to receive a user request and to store a session identification number and an account number, the second client further operable to communicate the user request, the session identification number, and the account number to the database server, the database server further operable to execute the first function stored procedure in response to the user request received from the second client.

20. A database server for use in a system for securely accessing information from disparate data sources through a network, the database server comprising:

a storage medium for storing a database management system, a check access stored procedure, a first function stored procedure, a first function registered procedure, and a user table; and

a processor responsive to the database management system to;

receive a session identification number and an account number;

receive a request to execute the first function stored procedure;

execute the first function stored procedure in response to the request;

execute the check access stored procedure to verify the session identification number and the account number in the user table in response to executing the first function stored procedure; and

execute the first function registered procedure to request information from a disparate data source.