Single sign-on for access to a central data repository

• US 7,016,875 B1
• Filed: 10/09/2001
• Issued: 03/21/2006
• Est. Priority Date: 10/06/2000
• Status: Expired due to Term

• Current Assignee: CXT Systems, Inc. (Quest Patent Research Corporation)
• Original Assignee: Enfo Trust Networks, Inc.
• Inventors: Hawkins, Stan, Steele, Nick, Bradnan, Andrew, Maranville, Joe
• Primary Examiner(s): CANGIALOSI, SALVATORE A
• Application Number:
  US09/974,766
• Time in Patent Office: 1,624 Days
• Field of Search: 705/44, 705/67, 709/205, 713/155
• US Class Current: 705/44
• CPC Class Codes: G06Q 10/00 Administration; Management
• CPC Class Codes: G06Q 20/3674 involving authentication
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists

Abstract

Systems and methods for providing access to an information account stored in a central data repository. The information account is associated with a consumer and is subject to the consumer'"'"'s control and management. Consumer authentication information is input by the consumer in connection with a first request for access to the information account via a first web-site. Responsive to authentication of the consumer, a single sign-on feature may be activated for automatically managing subsequent authentications of the consumer so that the consumer will not be required to again input the consumer authentication information upon initiating a second request for access to the information account while interacting with a subsequent web-site that is configured to provide access to the information account upon authentication of the consumer. The single sign-on function may be deactivated upon the occurrence of a terminating event, such as the expiration of a time-out interval.

Claims

1. A computer-implemented method for providing access to an information account stored in a central data repository that is accessible via a distributed network and is coupled to a database management system the information account containing consumer information elements that are changed by the consumer, the method comprising the steps of:

receiving, over the distributed electronic network, a first request from a network device for access to the information account and consumer authentication information in response to the consumer inputting the consumer authentication information while interacting with a first web-site;

in response to the request, authenticating the consumer with the database management system based on the consumer authentication information, thereby providing the consumer with access to the information account stored in the central data repository, a first consumer information element of the information account comprising one or more name fields to identify the consumer, a second consumer information element of the information account comprising one or more geographic address fields associated with the consumer;

in response to authenticating the consumer, automatically managing subsequent authentications of the consumer with the database management system so that the consumer will not be required to again input the consumer authentication information upon initiating a second request for access to the information account while interacting with a subsequent web-site that is configured to provide access to the information account upon authentication of the consumer;

in response to the first, second, and subsequent requests for access to the information account stored in the central data repository, retrieving one or more consumer information element from the information account by filtering data from the information account with the database management system based on an identification of a web-site being accessed by the consumer;

sending the retrieved consumer information elements over the distributed electronic network;

parsing the retrieved consumer information elements; and

auto-populating input fields of a displayed web page file of the web-site being accessed by the consumer with the consumer information elements.

2. The method of claim 1, wherein automatically managing subsequent authentications of the consumer comprises determining that a previous authentication of the consumer for access to the information account remains valid and generating a message to cause the subsequent website to by-pass a sign-on interface that would otherwise prompt the consumer to input the consumer authentication information when the consumer initiates the second request for access to the information account.

3. The method of claim 2, wherein the previous authentication of the consumer remains valid if the consumer initiates the second request for access to the information account prior to the occurrence of a terminating event.

4. The method of claim 3, wherein said terminating event comprises expiration of a time-out interval.

5. The method of claim 4, wherein the time-out interval comprises a determined duration of time;

and

wherein the timeout interval is considered to have expired if a difference between a current time and a time of the previous authentication is greater than the determined duration of time.

6. The method of claim 3, wherein said terminating event comprises termination of a browser session at the network device.

7. The method of claim 1, wherein the network device comprises a client device executing a browser;

and

wherein the single sign-on function is implemented by one or more temporary client-side applications.

8. The method of claim 7, wherein said one or more client-side applications execute a communication protocol for communicating with a database management system at a host server that manages the central data repository.

9. The method of claim 7, wherein the network device executes a browser that displays a web page file that has been retrieved from a vendor server, the web page file including an instruction that causes the browser to request transmission of said one or more client-side applications.

10. The method of claim 7, wherein said one or more client-side applications are further configured to receive selected consumer information elements from the information account in response to authentication of the consumer and to integrate the consumer information elements into a vendor'"'"'s business process on behalf of the consumer.

11. The method of claim 10, wherein the step of integrating the selected consumer information elements into a vendor'"'"'s business process comprises the steps of:

allowing the consumer to interact with the browser in order to edit the selected consumer information elements, if desired, and to submit the web page file to the vendor server for processing of the selected consumer information elements.

12. The method of claim 1, wherein the information account comprises a plurality of consumer information elements stored in a tagged data format.

13. The method of claim 1, further comprising receiving from the network device a first determined equipment identifier that uniquely identifies the network device and storing the first-determined equipment identifier in an authentication table in association with the consumer authentication information;

and

wherein automatically managing subsequent authentications of the consumer comprises recording in the authentication table in association with the consumer authentication information and the first-determined equipment identifier an indication that a single sign-on feature is activated.

14. The method of claim 13, further comprising the steps of:

receiving from the network device a second-determined equipment identifier in response to the consumer initiating a second request for access to the information account;

in response to receiving the second-determined equipment identifier, consulting the authentication table based on the second-determined equipment identifier and determining that the second-determined equipment identifier matches the first-determined equipment identifier, based on the first-determined equipment identifier, determining from the authentication table that the single sign-on feature is activated; and

transmitting to the network device a message to cause a sign-on interface that would prompt the consumer to input the consumer authentication information to be bypassed.

15. The method of claim 14, wherein automatically managing subsequent authentications of the consumer further comprises:

recording in the authentication table in association with the consumer authentication information and the first-determined equipment identifier, a time at which the consumer was authenticated to access the information account;

in response to determining that the single sign-on feature is activated, determining from the authentication table the time at which the consumer was authenticated; and

prior to transmitting the message to by-pass the sign-on interface, determining that a difference between a current time and the dime at which the consumer was authenticated is not less than a time out interval.

16. The method of claim 1, wherein automatically managing subsequent authentications of the consumer is performed in response to an input command supplied by the consumer to indicate that a single sign-on feature should be activated.

17. A computer-implemented method for accessing an information account stored in a central data repository that is accessible via a distributed network and is coupled to a host servers the information account containing consumer information elements that are changed by the consumer, the method comprising the steps of:

transmitting to a host server, over the distributed electronic network, a first request for access to the information account and consumer authentication information in response to the consumer inputting the consumer authentication information while interacting with a first web-site hosted by a vendor server;

receiving an acknowledgment indicating that the host server authenticated the consumer based on the consumer authentication information, thereby providing the consumer with access to the information account stored in the central data repository, a first consumer information element of the information account comprising one or more name fields to identify the consumer, a second consumer information element of the information account comprising one or more geographic address fields associated with the consumer;

in response to the acknowledgment, automatically managing subsequent authentications of the consumer with the host server so that the consumer will not be required to again input the consumer authentication information upon initiating a second request for access to the information account while interacting with a subsequent website that is configured to provide access to the information account upon authentication of the consumer;

in response to the first, second, and subsequent requests for access to the information account stored in the central data repository, retrieving one or more consumer information elements from the information account by filtering data from the information account based on identification of a web-site being accessed by the consumer;

sending the retrieved consumer information elements over the distributed electric network;

parsing the retrieved consumer information elements; and

auto-populating input fields of a displayed web nale file of the web-site being accessed by the consumer with the consumer information elements.

18. The method of claim 17, wherein the consumer interacts with the first web-site using a browser;

wherein the first web-site includes an instruction that causes the browser to download from the host server one or more client-side applications configured for automatically managing subsequent authentications of the consumer.

19. The method of claim 18, wherein the one or more client-side applications are configured to perform the steps comprising:

determining a plurality of selected consumer information elements that are to be input into input fields of the first web-site;

transmit to the host server a request for retrieval of the selected consumer information elements; and

in response to receiving the selected consumer information elements from the host server, auto-populating the selected consumer information elements into the input fields of the first web-site.

20. The method of claim 17, wherein the consumer interacts with the first web-site using a network device;

and

wherein automatically managing subsequent authentications of the consumer comprises;

determining a first-determined equipment identifier that uniquely identifies the network device and transmitting the first-determined equipment identifier to the host server for storage in an authentication table in association with the consumer authentication information,

in response to the consumer initiating a second request for access to the information account, determining a second-determined equipment identifier and transmitting the second-determined equipment identifier to the host server, wherein the host server consults the authentication table based on the second-determined equipment identifier to determine that the second-determined equipment identifier matches the first-determined equipment identifier and, by association, that the consumer has previously been authenticated and that a single sign-on feature is activated, and

receiving from the host server a message to cause the subsequent website to by-pass a sign-on interface that would otherwise prompt the consumer to input the consumer authentication information.

21. The method of claim 17, wherein the step of automatically managing subsequent authentications of the consumer is performed in response to detecting an input command supplied by the consumer to indicate that a single sign-on feature should be activated.

22. The method of claim 17, wherein automatically managing subsequent authentications of the consumer comprises communicating with the host server to determine that a previous authentication of the consumer for access to the information account remains valid and to instruct the subsequent web-site to by-pass a sign-on interface that would prompt the consumer to input the consumer authentication information when the consumer initiates the second request for access to the information account.

23. The method of claim 22, wherein the previous authentication of the consumer remains valid if the consumer initiates the second request for access to the information account prior to the occurrence of a terminating event.

24. The method of claim 23, wherein said terminating event comprises expiration of a time-out interval.

25. The method of claim 24, wherein the time-out interval comprises a determined duration of time;

and

wherein the time-out interval is considered to have expired if a difference between a current time and a time of the previous authentication is greater than the determined duration of time.

26. The method of claim 23, wherein said terminating event comprises termination of a browser session.

27. A system storing, managing and distributing consumer information via a distributed network, comprising:

a central data repository accessible via the distributed electronic network for storing an information account, the information account containing consumer information elements that are changed by the consumer, a first consumer information element of the information account comprising one or more name fields to identify the consumer, a second consumer information element of the information account comprising one or more geographic address fields associated with the consumer; and

a host server for communicating with the central data repository and with a network device via the distributed electronic network and for executing computer-executable instructions for;

receiving with the host server, over the distributed electronic network, a first request from the network device for access to the information account and consumer authentication information in response to the consumer manually inputting the consume authentication information while interacting with a first web-site;

in response to the request, authenticating the consumer with the host server based on the consumer authentication information, thereby providing the consumer with access to the information account stored in the central data repository;

in response to authenticating the consumer, automatically managing subsequent authentications of the consumer with the host server so that the consumer will not be required to again input the consumer authentication information upon initiating a second request for access to the information account while interacting with a subsequent web-site that is configured to provide access to the information account upon authentication of the consumer;

in response to the first, second, and subsequent requests for access to the information account stored in the central data repository, retrieving one or more consumer information elements from the information account with the host server by filtering data from the information account with the database management system based on an identification of a web-site being accessed be the consumer;

sending the retrieved consumer information elements over the distributed electronic network;

parsing the retrieved consumer information elements; and

auto-populating input fields of a displayed web page file of the web-site being accessed by the consumer with the consumer information elements.

28. The system of claim 27, wherein automatically managing subsequent authentications of the consumer comprises determining that a previous authentication of the consumer for access to the information account remains valid and generating a message to cause the subsequent web-site to by-pass a sign-on interface that would otherwise prompt the consumer to input the consumer authentication information when the consumer initiates the second request for access to the information account.

29. The system of claim 28, wherein the previous authentication of the consumer remains valid if the consumer initiates the second request for access to the information account prior to the occurrence of a terminating event.

30. The system of claim 29, wherein said terminating event comprises expiration of a time-out interval.

31. The system of claim 30, wherein the time-out interval comprises a determined duration of time, and

wherein the time-out interval is considered to have expired if a difference between a current time and a time of the previous authentication is greater than the determined duration of time.

32. The system of claim 29, wherein said terminating event comprises termination of a browser session at the network device.

33. The system of claim 27, wherein the network device comprises a client device executing a browser;

wherein the host server further comprises a memory for storing one or more client-side applications configured to manage communications with the host server and to automatically manage subsequent authentications of the consumer on behalf of the client device; and

wherein the host server executes further computer-executable instructions for transmitting to the client device said one or more client-side applications prior to receiving the first request for access to the information account.

34. The system of claim 33, wherein the browser displays a web page file that has been retrieved from a vendor server, the web page file including an instruction that causes the browser to request transmission of said one or more client-side applications from the host server.

35. The system of claim 27, wherein the information account comprises a plurality of consumer information elements stored in a tagged data format.

36. The system of claim 27, wherein the host server further executes computer-executable instructions for:

receiving from the network device a first-determined equipment identifier that uniquely identifies the network device and storing the first-determined equipment identifier in an authentication table in association with the consumer authentication information; and

wherein automatically managing subsequent authentications of the consumer comprises recording in the authentication table in association with the consumer authentication information and the first-determined equipment identifier an indication that the single sign-on function is activated.

37. The system of claim 36, wherein automatically managing subsequent authentications of the consumer further comprises:

receiving from the network device a second-determined equipment identifier in response to the consumer initiating a second request for access to the information account;

in response to receiving the second-determined equipment identifier, consulting the authentication table based on the second-determined equipment identifier and determining that the second-determined equipment identifier matches the first-determined equipment identifier;

based on the first-determined equipment identifier, determining from the authentication table that the single sign-on function is activated; and

transmitting to the network device a message to cause a sign-on interface that would prompt the consumer to input the consumer authentication information to be by-passed.

38. The system of claim 37, wherein automatically managing subsequent authentications of the consumer further comprises:

recording in the authentication table in association with the consumer authentication information and the first-determined equipment identifier, a time at which the consumer was authenticated to access the information account;

in response to determining that the single sign-on function is activated, determining from the authentication table the time at which the consumer was authenticated; and

prior to transmitting the message to by-pass the sign-on interface, determining that a difference between a current time and the time at which the consumer was authenticated is not less than a time out interval.

39. A system for providing access to an information account stored in a central data repository that is accessible via a distributed network, the information account containing consumer information elements that are changed by the consumer, the system comprising:

a client-side application configured for automatically managing authentication of the consumer at a network device so that the consumer will not be required to input the consumer authentication information upon initiating a request for access to the information account while interacting with a web-site that is configured to provide access to the information account upon authentication of the consumer, a first consumer information element of the information account comprising one or more name fields to identify the consumer, a second consumer information element of the information account comprising one or more geographic address fields associated with the consumer;

wherein the client-side application automatically manages authentication of the consumer by communicating with a host server to determine that a previous authentication of the consumer providing the consumer with access to the information account remains valid and to instruct the web-site to by-pass a sign-on interface that would otherwise prompt the consumer to input the consumer authentication information when the consumer initiates the request for access to the information account;

wherein the host server in response to the request for access to the information account, retrieves one or more consumer information elements from the information account by filtering data from the information account based on an identification of the web-site being accessed by the consumer;

the host server sends the retrieved consumer information elements over the distributed electronic network to the client-side application;

wherein the client-side application parses the retrieved consumer information elements, and auto-populates input fields of a displayed web page file of the web-site being accessed by the consumer with the consumer information elements.

40. The propagated signal of claim 39, wherein the previous authentication of the consumer remains valid if the consumer initiates the second request for access to the information account prior to the occurrence of a terminating event.

41. The propagated signal of claim 40, wherein said terminating event comprises expiration of a time-out interval.

42. The propagated signal of claim 41, wherein the time-out interval comprises a determined duration of time;

and

wherein the time-out interval is considered to have expired if a difference between a current time and a time of the previous authentication is greater than the determined duration of time.

43. The propagated signal of claim 40, wherein said terminating event comprises termination of a browser session at the network device.

44. The propagated signal of claim 39, wherein the client-side application is configured for determining an equipment identifier that uniquely identifies the network device and transmitting the equipment identifier to the host server;

wherein, response to receiving the equipment identifier, the host server determines that the previous authentication of the consumer remains valid by consulting an authentication table to determine that the equipment identifier matches a previously-stored equipment identifier, that an indication that a single sign-on feature is activated is stored in association with the previously-stored equipment identifier and that a terminating event has not occurred; and

wherein, in response to determining that the previous authentication of the consumer remains valid, the host server transmits to the client-side application a message to cause the web-site to by-pass a sign-on interface that would prompt the consumer to input the consumer authentication information.

45. The propagated signal of claim 44, wherein the client-side application is further, configured to receive selected consumer information elements from the information account in response to authentication of the consumer and to integrate the consumer information elements into a vendor'"'"'s business process on behalf of the consumer.

46. The propagated signal of claim 45, wherein integrating the selected consumer information elements into a vendor'"'"'s business process comprises the step of:

allowing the consumer to interact with the browser in order to edit the selected consumer information elements, if desired, and to submit the web page file to the vendor server for processing of the selected consumer information elements.

47. The propagated signal of claim 39, wherein the information account comprises a plurality of consumer information elements stored in a tagged data format.