Method and apparatus to authenticate and authorize user access to a system

• US 7,769,998 B2
• Filed: 06/25/2004
• Issued: 08/03/2010
• Est. Priority Date: 06/26/2003
• Status: Active Grant

• Current Assignee: PayPal, Inc. (PayPal Holdings, Inc.)
• Original Assignee: eBay Inc.
• Inventors: Seth, Shashi, Lynch, Liam S.
• Primary Examiner(s): Vu; Kimyen
• Assistant Examiner(s): To; Baotran N
• Application Number:
  US10/876,866
• Publication Number:
  US 20050144452A1
• Time in Patent Office: 2,230 Days
• Field of Search: 726 2- 3, 726/6, 726/21, 726/9, 726/20, 709224-229, 713/155, 713/159, 713/161, 713168-170, 713/172
• US Class Current: 713/155
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263

Abstract

A method, apparatus, and system are provided for authenticating and authorizing user access to a system. According to one embodiment, a request for authentication and authorization of a user is received from a secondary site on behalf of the user who is seeking to access a primary site via the secondary site via a computer network. The request includes information relating to the user. The user information is then verified for authenticity, including determining whether the user satisfies the criteria for obtaining authentication and authorization as defined by the primary site. If the criteria are satisfied, a token, associated with the user, is generated at the primary site. A portion of the token is transmitted from the primary site to the secondary site on behalf of the user to permit the user to access the primary site via the secondary site, via the computer network.

Claims

1. A computer-implemented method to authenticate and authorize a user, the method comprising:

receiving a request for authentication and authorization of the user, from a client computer, via a secondary site on behalf of the user, the user seeking permission to access a primary site via the secondary site, via a computer network, wherein the request includes user information corresponding to the user;

verifying the user information for authenticity, wherein the verifying of the user information includes determining whether the user satisfies authentication and authorization criteria, defined by the primary site;

based on the determining that the user satisfies the authentication and authorization criteria, generating a token associated with the user using an authenticator residing at the primary site to authenticate and authorize the user;

transmitting a portion of the token from the primary site, the portion of the token to be stored at the secondary site on behalf of the user to permit the user, from the client computer, to access the primary site via the secondary site, via the computer network; and

storing another portion of the token at the primary site to match with the portion of the token at the secondary site to allow the user multiple future accesses to the primary site via the secondary site.

2. The computer-implemented method of claim 1, if the user is determined that the user is not registered with the primary site, redirecting the user to a community computer system of the primary site prior to generating of the token to allow the user to register with the primary site.

3. The computer-implemented method of claim 2, wherein the registering with the primary site comprises one or more of the following:

generating an identification for the user, generating a password for the user, and the user consenting to a consent agreement.

4. The computer-implemented method of claim 1, wherein the authenticating of the user comprises verifying credentials of the user at the primary site using a federated mechanism having credentials authority system, the federated mechanism residing at a transaction platform of a server of the primary site.

5. The computer-implemented method of claim 1, wherein the authorization of the user comprises providing permission to the user to access the primary site via the secondary site, via the computer network.

6. The computer-implemented method of claim 1, wherein the token comprises selective information of the user information.

7. The computer-implemented method of claim 1, wherein the token is transmitted from the primary site to the secondary site to allow the user a single access to the primary site via the secondary site.

8. The computer-implemented method of claim 1, further comprising authorizing the secondary site to access the primary site and to perform a plurality of tasks at the primary site on behalf of the user.

9. The computer-implemented method of claim 8, wherein the plurality of tasks are determined by the user by electing preferences provided at the primary site.

10. The computer-implemented method of claim 9, wherein the plurality of tasks comprises one or more of the following:

registering items for auction for the user, placing the items for the auction on behalf of the user, and bidding on auctioning items for the user.

11. The computer-implemented method of claim 1, further comprising:

determining that the user does not satisfy the authentication and authorization criteria; and

based on the determining, transmitting an error message from the primary site to the secondary site, the error message indicating authentication and authorization failure.

12. A computer-implemented system, the system comprising:

a client computer to receive a request from a user seeking to access a primary site via a secondary site, and to transmit the request to the secondary site via a computer network, wherein the request includes user information relating to the user; and

the primary site coupled with the secondary site over the computer network,

the primary site to;

receive the request from the secondary site, the request initially received by the secondary site from the client computer;

verify the user information, the verifying of the user information including determining whether the user satisfies authentication and authorization criteria, defined by the primary site;

based on the determining that the user satisfies the authentication and authorization criteria, generate a token associated with the user using an authenticator of the primary site to authenticate and authorize the user;

transmit a portion of the token from the primary site, the portion of the token to be stored at the secondary site on behalf of the user to permit the user, from the client computer, to access the primary site via the secondary site, via the computer network; and

store another portion of the token to match with the portion of the token at the secondary site to allow the user multiple future accesses to the primary site via the secondary site.

13. The computer-implemented system of claim 12, wherein the authenticating of the user comprises verifying credentials of the user at the primary site using a federated mechanism having credentials authority system, the federated mechanism residing at a transaction platform of a server of the primary site.

14. The computer-implemented system of claim 12, wherein the token comprises selective information of the user information.

15. The computer-implemented system of claim 12, wherein the token is transmitted from the primary site to the secondary site to allow the user a single access to the primary site via the secondary site.

16. The computer-implemented system of claim 12, wherein the secondary site and the primary site each support one or more of the following:

a Website, an application, and a tool.

17. The computer-implemented system of claim 12, further comprising:

determining that the user does not satisfy the authentication and authorization criteria; and

based on the determining transmitting an error message from the primary site to the secondary site, the error message indicating authentication and authorization failure.

18. The computer-implemented system of claim 12, wherein the computer network includes one or more of the following:

a local area network (LAN), a wide area network (WAN), a metro area network (MAN), an intranet, and the Internet.

19. A machine-readable medium having stored thereon data representing sets of instructions which, when executed by a machine, cause the machine to perform operations comprising:

receive a request for authentication and authorization of a user, from a client computer, via a secondary site on behalf of the user seeking permission to access a primary site via the secondary site, via a computer network, wherein the request includes user information corresponding to the user;

verify the user information for authenticity, wherein the verifying of the user information includes determining whether the user satisfies authentication and authorization criteria, defined by the primary site;

based on the determining that the user satisfies the authentication and authorization criteria, generate a token associated with the user by utilizing an authenticator of the primary site to authenticate and authorize the user;

transmit a portion of the token from the primary site, the portion of the token to be stored at the secondary site on behalf of the user to permit the user, from the client computer, to access the primary site via the secondary site, via the computer network; and

store another portion of the token at the primary site to match with the portion of the token at the secondary site to allow the user multiple future accesses to the primary site via the secondary site.

20. The machine-readable medium of claim 19, wherein the sets of instructions which, when executed by the machine further cause the machine to perform operations comprising:

determine that the user is not registered with the primary site; and

based on the determining, redirect the user to a community computer system of the primary site prior to generating of the token to allow the user to register with the primary site.

21. The machine-readable medium of claim 20, wherein the registering with the primary site comprises one or more of the following:

generating an identification for the user, generating a password for the user, and the user consenting to a consent agreement.

22. The machine-readable medium of claim 19, wherein the authenticating of the user comprises verifying credentials of the user at the primary site using a federated mechanism having credentials authority system, the federated mechanism residing at a transaction platform of a server of the primary site.

23. An apparatus, comprising:

means for receiving a request from a user, the user seeking to access a primary site via a client computer;

means for transmitting the request to the primary site via a computer network, the request including user information relating to the user;

means for receiving the request from the client computer via the secondary site;

means for verifying the user information, the verifying of the user information including determining whether the user satisfies authentication and authorization criteria, defined by the primary site;

based on the determining that the user satisfies the authentication and authorization criteria, means for generating a token associated with the user by utilizing an authenticator of the primary site to authenticate and authorize the user;

means for transmitting a portion of the token from the primary site, the portion of the token to be stored at the secondary site on behalf of the user to permit the user to access the primary site via the secondary site, via the computer network; and

means for storing another portion of the token to match with the portion of the token at the secondary site to allow the user multiple future accesses to the primary site via the secondary site.

24. The apparatus of claim 23, further comprising means for verifying credentials of the user at the primary site using a federated mechanism having credentials authority system, the federated mechanism residing at a transaction platform of a server of the primary site.

25. The apparatus of claim 23, wherein the token comprises selective information of the user information.

26. The apparatus of claim 23, wherein means for transmitting the token from the primary site to the secondary site to allow the user a single access to the primary site via the secondary site.

27. The apparatus of claim 23, wherein the secondary site and the primary site each support one or more of the following:

a Website, an application, and a tool.

28. The apparatus of claim 23, further comprising:

means for determining that the user does not satisfy the authentication and authorization criteria; and

means for transmitting an error message to the secondary site based on the determining that the user does not satisfy the authentication and authorization criteria, the error message indicating authentication and authorization failure.

29. The apparatus of claim 23, wherein the computer network includes one or more of the following:

a local area network (LAN), a wide area network (WAN), a metro area network (MAN), an intranet, and the Internet.