EP1290568A1 - Method and system for providing an online industry hub - Google Patents
Method and system for providing an online industry hubInfo
- Publication number
- EP1290568A1 EP1290568A1 EP01933424A EP01933424A EP1290568A1 EP 1290568 A1 EP1290568 A1 EP 1290568A1 EP 01933424 A EP01933424 A EP 01933424A EP 01933424 A EP01933424 A EP 01933424A EP 1290568 A1 EP1290568 A1 EP 1290568A1
- Authority
- EP
- European Patent Office
- Prior art keywords
- user
- server
- hub
- information
- url string
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Withdrawn
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/2866—Architectures; Arrangements
- H04L67/30—Profiles
- H04L67/306—User profiles
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
- H04L63/0815—Network architectures or network communication protocols for network security for authentication of entities providing single-sign-on or federations
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/14—Session management
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2101/00—Indexing scheme associated with group H04L61/00
- H04L2101/60—Types of network addresses
- H04L2101/604—Address structures or formats
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L61/00—Network arrangements, protocols or services for addressing or naming
- H04L61/30—Managing network names, e.g. use of aliases or nicknames
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L67/00—Network arrangements or protocols for supporting network services or applications
- H04L67/01—Protocols
- H04L67/02—Protocols based on web technology, e.g. hypertext transfer protocol [HTTP]
Definitions
- the present invention relates to conducting commerce utilizing the Internet, and more particularly to a method and system that integrates the major producers of goods and services within an industry on the Internet into one "network" targeting the same customer audience.
- the system of the present invention provides an "industry hub” that enables users to navigate seamlessly between the websites of hub participants in a single sign-on session.
- Computer networking allows network computer users to share information, software applications and hardware devices and internetworking enables a set of physical networks to be connected into a single network such as the Internet.
- Today, computers connected to the Internet have almost instant access to information stored in relatively distant regions.
- computers connected to networks other than the Internet also have access to information stored on those networks.
- the World Wide Web (Web) a hypermedia system used on the Internet, enables hypertext linking, whereby documents automatically reference or link other documents located on connected computer networks around the world.
- users connected to the Internet have almost instant access to information stored in relatively distant regions.
- a page of information on the Web may include references to other Web pages and may include a broad range of multimedia data including textual, graphical, audio, and animation information.
- a website resource can be a PDF document, an image file, a CGI program with interactive forms, or a Java applet.
- Internet users retrieve information from the Internet, through the Web, by 'visiting' a website on a computer that is connected to the Internet.
- a website is, in general terms, a server application that displays information stored on a network server computer.
- the website accepts connections from client programs, such as Internet browser applications.
- Browser applications such as Microsoft Explorer TM or Netscape Internet Browser TM, allow Internet users to access information on the website.
- Most browser applications display information on computer screens and permit a user to navigate through the Web using a mouse.
- Web browsing uses the client-server paradigm.
- URL Uniform Resource Locator
- the browser application becomes a client and it contacts a server application specified in the URL to request the document.
- the browser application displays the document for the user.
- the two applications follow the Hyper-Text Transport Protocol (HTTP).
- HTTP Hyper-Text Transport Protocol
- HTTP allows the browser application to request a specific article, winch the server application then returns.
- HTTP defines the exact format for requests sent from the browser application to the server application as well as the format of replies that the server application returns.
- An Intranet uses similar protocols and has a similar user interface as the Internet, however, an Intranet is a private network that is contained within an enterprise.
- An Intranet may restrict or refuse access to its network by users outside of a defined group, such as users who are not employees of a corporation.
- An Intranet may consist of many interlinked local area networks (LAN) and may also use a wide area network (WAN).
- LAN local area networks
- WAN wide area network
- an Intranet includes connections through one or more gateway computers to the outside Internet.
- any description of the Internet is also applicable to Intranets, unless otherwise specified.
- the Internet maintains an open structure in which exchanges of information are generally made cost-free without restrictions.
- Every application or site that requires a username/password as a way of authenticating a user has its own rules for creating this user authentication information.
- Some applications make users pick their own username, others use email addresses or some combination of the user's first and last names to create a username.
- Some applications may require a password of at least 8 characters, while others will allow shorter passwords, so frequently users will have to use different passwords for different sites.
- users usually end up with multiple usernames/password combinations for the different websites they use.
- some sites may track users or may store customized information about users. For example, a document may be displayed to the user having customization options relating to news, sports, entertainment, etc. Based on the options the user selects, the document only displays content related to those selected options. The site may retain the user-selected options so that the customized information is re-displayed when the user re-accesses the resource at a later time. Storing information relating to user activity or storing customization information for a user is called "tracking" a user. Using HTTP, each request for a Web page is independent of all other requests.
- a "cookie” is a mechanism that allows the server to store its own information about a user on the user's own computer.
- a cookie is information for future use that is stored by the server on the client side of a client/server communication.
- a cookie is a small piece of information sent by a Web server to store on a Web browser so it can later be read back from that browser.
- a cookie may record user authentication information and preferences when using a particular site.
- cookies are only used to track users in non-secure areas. They may be also used to store user authentication information, such as username and password, for secure sites. By storing user authentication information, cookies may allow users to navigate multiple Web servers within the same domain without re-entering user authentication information. As the websites for a single company (or other entity) are typically all located on the same domain, it is possible to save user authentication information in a cookie for that entity. In this manner, users will only have to enter user authentication information a single time when accessing that entity's websites. However, websites that have different domain addresses cannot share a cookie, and therefore to navigate between secure websites on different domains, the user must separately enter user authentication information for each website.
- U.S. Pat. No. 5,708,780 to Levergood et al. shows a system that allows clients to access all controlled files within a protection domain without requiring further authorization.
- the server when a user requests an access-controlled file, the server subjects the request to a secondary server that determines whether the client has authorization or a valid account. While this system may be advantageous in centralized authentication models where networks of sites can be locked into a single authentication process, it does not work in a distributed authentication model.
- the bond market (and financial services industry in general) is only one example of the type of environment where the customer has to manually sift through information gathered from many different sources in order to choose a dealer for his specific needs.
- customers typically use many dealers to fulfill their requirements.
- Other such industries will be known to these skilled in the art, and are within the scope of this invention.
- Users quickly grow tired of entering user authentication information for every website they visit.
- a user may have different user authentication information for each website used, and remembering several different user names and passwords can be tedious.
- the comparison process is very difficult, as they will have to manually visit each website to obtain the needed information. This can be detrimental to the dealers in that industry, as a user may only visit one or two sites before making a purchase, rather than visiting the websites of every dealer within that industry.
- the present invention has been made in view of the above circumstances and solves these problems by providing an industry hub that allows users to easily navigate between proprietary websites and commingle the content, through a single sign-on session.
- One object of the present invention is to provide users with a single sign-on system that acts as an industry hub by allowing users to view resources on every server with whom they have accounts without signing on to each individual server.
- Another object of the present invention is to allow a first trusted server to pass user authentication information to a second trusted server so that the user does not have to enter additional sign-on information to use the resources on the second server.
- Another object of the invention is to provide a method of authenticating a user to use resources on at least two access-controlled servers through a single sign-on session.
- a further object of the present invention is to provide a data structure for the URL used to authenticate users in the disclosed single sign-on system.
- a further object of the present invention is to provide a system that commingles proprietary information and presents the commingled information to the user, such that the user is only presented with information from the entities with which he has an active account.
- one aspect of the invention includes a method for a first server to authenticate a user who is authenticated to use the resources on the first server to use the resources on at least a second server, by receiving a request to use resources on the second server from the user; generating a URL string identifying the requested resource on the second server that contains authentication information for the user; and transmitting the request to the second server.
- Another aspect of the invention includes a method of authenticating a user to use resources on at least two access-controlled servers located on different domains, where the first server receives user authentication information from the user; the first server validates the user authentication information; the first server receives a request from the user to use a resource on the second server; the first server generates a URL string identifying the requested resource on the second server; the first server provides the URL string to the second server; and the second server validates the URL string.
- a further aspect of the system includes a data structure of the URL used in the disclosed single sign-on system, where the URL data structure comprises a first field containing information to authenticate the user; and a second field identifying a requested resource.
- a further aspect of the system includes a website for an industry hub that provides an authenticated user with the capability to receive commingled information, whereby the commingled information includes information from the hub participants with whom the user has an account, by receiving a list of enabled users from each hub participant; receiving information from the hub participants to be displayed to enabled users; using the enabled user list to determine which hub participants the user is enabled with; for each enabled hub participant, commingling information into a single presentation of mformation; and displaying the commingled information to the user.
- a further aspect of the system includes a method for a user having accounts with multiple hub participants that are located on separate access-controlled servers to use resources provided by each hub participant in a single sign-on system, by entering first user authentication information at a first server; requesting a resource from a second server; and receiving the requested resource in the absence of entering additional user authentication information.
- a further aspect of the system includes a method for providing a persistent navigator that contains links to every hub participant that a user has an account with and to other sites supported by the industry hub, by determining the hub participants with whom the user has an account; and if the user has accounts with more than one hub participant displaying a navigator that contains links to only those hub participants with whom the user has an account; and continuing to display the navigator after the user links to a different site within the industry hub.
- a further aspect of the system includes a method for creating a cross-referenced list of hub participants and users in an industry hub, by receiving a list of active users from each hub participant; for each active user, determining whether the user is already in a list of users, and if so, updating the status of the user to indicate that the user is a multiple-account user.
- Fig. 1 A illustrates a typical situation in any online industry, where customers must independently and separately sign-on to each dealer's website.
- Fig. IB illustrates the current online financial services market, where users must independently and separately sign-on to each financial services dealer's website.
- Fig. 2 A illustrates the single sign-on of the system of the present invention.
- Fig. 2B illustrates an example of commingled information presented by the system of the present invention for the financial services market.
- Fig. 2C illustrates an example of a resource on a remote server being presented to the user by the system of the present invention for the financial services market example.
- Fig. 2D illustrates an example of a resource on yet another remote server being presented to the user by the system of the present invention for the financial services market example.
- Fig. 2E illustrates commingled information displayed for a user having accounts with only two of the three financial services dealers in the financial service market example.
- Fig. 2F illustrates example comparison information for the participating dealers that is presented to the user in the system of the present invention for the financial services market example.
- Fig. 3 illustrates a network of trusted servers used in the system of the present invention.
- Fig. 4 illustrates a process for generating and using CURLs to implement a single sign-on system.
- Fig. 5 illustrates a preferred structure for a CURL.
- a key issue for the growth of business-to-business electronic commerce over the Internet is the ability of a customer or other user to easily and conveniently access the websites of competing providers of goods and services within a particular industry.
- the system of the present invention was developed to give users commingled, seamless access to proprietary information from separate and distinct websites.
- the ability to gather information from competing providers by an independent third-party into an aggregate view enables a user to make better use of the information.
- the system of the present invention provides a "hub" solution for a particular industry.
- the industry hub provided by the present invention allows a user to sign-on once, then have access to information from every participating dealer within the industry with whom the user has an account. Information from the hub participants is presented to the user in an intuitive commingled manner, so that the user can easily compare data.
- the system of the present invention is typically used in a commercial industry where there are several established dealers within the industry. However, the invention is intended to include any situation where information from several separate and distinct websites is presented to the user through a single sign-on session.
- the term "dealer” is intended to include any providers of goods, services or information and/or operators of websites that participate in the system of the present invention. These dealers may also be referred to as "hub participants”.
- the industry hub of the present invention uses a persistent navigator to provide the user with a consistent interface for visiting the various websites of the participating dealers.
- This persistent navigator allows users to have a common interface at all times, no matter whose website the user is currently accessing.
- the industry hub of the present invention provides users with better, faster and easier access to products and information within an industry.
- the industry hub of the present invention provides commingled industry content through an independent entity to ensure that the market leaders participating in the industry hub maintain, and often regain control of their content, brand name, client lists and distribution franchise.
- the system of the present invention completely integrates the websites of participating dealers. Through one website, a user is able to view the information from all the hub participants through which he has an account. Additionally, through the system of the present invention, the user can seamlessly visit any hub participant's website.
- the system of the present invention allows users to easily navigate between these proprietary websites and commingle the content, creating an industry hub that increases the impact and value of the websites to all participants of the system, both users and dealers.
- Fig. 1 A illustrates the current process for a user to obtain product information and/or services from several different online dealers in one industry.
- the user is a customer that has accounts with several dealers within the industry.
- user 100 must enter and send separate user authentication mformation to each online dealer within the industry.
- Fig 1 A illustrates the current process for almost any industry that has an Internet presence.
- the system of the present invention can be used in any industry, the system of the present invention is particularly useful for business-to-business electronic commerce.
- the system of the present invention allows the business customers easier, more convenient access to the dealers.
- the financial services market In the financial services market, the customers are institutional investors who require a great deal of research data in order to make informed buy and sell decisions. Many of these investors have accounts with many, if not all, of the major financial services dealers in the industry.
- Fig. IB illustrates the specific example of the current process in the online financial services market.
- the customer is an institutional investor.
- user 100 may use the website of a major financial services dealer, such as Goldman Sachs 110, to obtain research and trading information.
- This same user may also have accounts with and use the websites of Morgan Stanley Dean Witter 120 and Salomon Smith Barney 130.
- a major financial services dealer such as Goldman Sachs 110
- This same user may also have accounts with and use the websites of Morgan Stanley Dean Witter 120 and Salomon Smith Barney 130.
- the user must separately sign-on to each website and manually compare information.
- the system of the present invention When used in the financial services market, the system of the present invention provides a one-stop site for users to obtain current research reports and updated news. For the financial services market, the system of the present invention provides access to lists of bonds available from the various participating dealers, which makes price comparisons easier. Seamless navigation between participating dealers' sites saves the user valuable time. Consolidated headlines on research and market commentary produced by the participating financial services dealers are also available to users through the system of the present invention. As is obvious to one skilled in the art, different types of information may be consolidated for different industries, and are intended to be covered by the system of the present invention.
- the commingled information provided by the system of the present invention is supplied by the hub participants.
- the system of the present invention does not change any of this information; it simply presents the information in a commingled fashion to the user.
- the system of the present invention treats the hub participants as competitors, while still allowing information to be combined.
- information provided by the administrator of the industry hub or an independent third-party may also be presented to the user in an commingled manner.
- the system of the present invention acts as a trusted third party, which allows industry market leaders to commingle their proprietary content and services without compromising their existing distribution channels.
- the system of the present invention only makes a hub participant's information available to users holding accounts with that hub participant, and not to other users or to other hub participants. Hub participants benefit from increased interaction with their customers while still maintaining control of their data.
- the customers using the system of the present invention benefit from the seamless navigation and content integration.
- the system of the present invention preserves the proprietary nature of the commingled information. Hub participants cannot see other hub participants' information. This is different from an Infonnation Exchange where everyone sees all of the information. In the system of the present invention, hub participants maintain control over their information.
- each hub participant sends a list of users enabled to use that hub participant's website to the administrator of the industry hub. Typically, this is a list of customers that have active accounts with that hub participant. The information provided in the lists should have a sufficient number of attributes to uniquely identify the user.
- the administrator of the industry hub compares lists from each hub participant to determine which users have accounts with more than one hub participant. These users are flagged as "multiple- account" users.
- a multiple-account user is a user that has access to the websites of at least two hub participants.
- a multiple-account user is a user that is enabled to use the industry hub of the present invention.
- the process to identify multiple-account users may be manual, automated, or some semi-automated combination.
- users are matched based on user information in the lists provided by the hub participants, such as name, email address and mailing address. For every user in each of the lists, the administrator of the industry hub tries to find matching records from lists provided by the other hub participants. If matching records are found, the accounts of these users get "matched", and the user is flagged as a multiple-account user.
- a hub participant provides the administrator of the system of the present invention with an enabled user list. For every user in this list, the administrator of the system of the present invention compares the user's information with information maintained in a master user list. First at step 615, the first user record is retrieved. The master user list is searched for a match between this user and a user already in the master user list at step 620. If the user matches a user in the master user list, then the user in the master user list is updated and flagged as a multi- account user at step 630.
- the user's information in the master user list is updated to contain the account information provided by this hub participant for this user in the hub participant's enabled user list.
- the hub participant is notified at step 635 that this user is a multiple-account user and is therefore enabled to user the hub of the present invention. If the user does not match up with any of the users on the master user list, then the user is added to the master user list along with the information provided by this hub participant for this user in the hub participant's enabled user list at step 640. In this case, the user is not flagged as a multi-account user as this is the only account for this user in the master user list. This process is continued for every user in the hub participant's list as indicated by the loop 650-660-620.
- the hub participant replaces or updates the user's account with an "account" containing user authentication information valid for all the sites this user has access to through the system of the present invention.
- the user is then notified that he can now use one username and password to access all sites participating in the industry hub of the present invention. This notification can be through e-mail, or any other method known to those skilled in the art.
- hub participants may provide the industry hub of the present invention with information to be presented to users when they sign- onto the system of the present invention. For example, in the financial services industry, each dealer sends a list of headlines and associated URL links to the industry hub so that it can commingle the headlines for the user. As will be obvious to one skilled in the art, different types of information may be supplied by the hub participants to the system of the present invention for commingling.
- the system of the present invention allows a user to use a single sign-on to access the websites of all hub participants with whom he has an account, and view commingled information through the system of the present invention.
- FIG. 2A An example of a single sign-on screen presented by the system of the present invention for the financial services market is shown in Fig. 2A.
- commingled information for the financial services market is displayed to the user.
- commingled information for a user who is enabled to use three financial services dealers is shown in Fig. 2B.
- section 210 displays commingled headlines.
- the users can tell the source of each headline by the abbreviation listed to the left of each headline, as shown in section 211.
- the first headline "US
- the system of the present invention links the user directly to this website; he is not required to enter the specific Goldman Sachs user authentication information.
- the system of the present invention transmits the user's authentication information to the dealer's secure website as part of the document transaction request. Because this occurs in the background, the user is seamlessly authenticated with the dealer.
- Section 220 displays the article that user wants to view.
- Section 225 contains the toolbar that is regularly shown to all users who access the Goldman Sachs Website.
- Section 227 contains a Navigator bar that enables the user to link to various websites and "navigate" the system of the present invention.
- Section 229 in this example contains advertising banners.
- the navigator bar in section 227 of Fig. 2C is the same as the one in section 220 of Fig. 2B.
- This navigator bar is persistently displayed as the user moves from site to site.
- the "Home", "Headlines”, “Indications”, “Messages” and “Search” links in the Navigator bar allow the user to link to these parts of the system of the present invention.
- the navigator bar also allows the user to link directly to the websites of any of the participating dealers that the user is enabled to use, as shown by the links "GS", “MSDW” and "SSB".
- FIGs. 2B and 2C show the navigator in the form of a particular navigator bar, it should be obvious to one skilled in the art that another form of a navigator, such as a pop-up window or menu bar, could be used. Other navigator methods are known to those skilled in the art and are within the scope of this invention.
- the user can use the navigator to seamlessly move to the information that he needs, whether it is comparison information offered by the system of the present invention, or specific information from one of the hub participants. Because it is persistent throughout the system of the present invention, the user always knows exactly how to go the information he needs, no matter which site he is currently using.
- FIG. 2D the user has clicked on the "MSDW" hotlink in the navigator bar.
- the system of the present invention links the user directly to the home page of the Morgan Stanley Dean Witter. Accessing this website normally requires a user to enter his Morgan Stanley Dean Witter user authentication information, but because the user is using the system of the present invention to link to the site, no additional user authentication information is needed.
- this screen contains the same Navigator bar of the present invention as is shown in Figs. 2B and 2C.
- a user may sign-on to a hub participant's website, and then link to the system of the present invention.
- the user will still only be required to enter user authentication information once - at the first hub participant's website.
- the user can then seamlessly go to or use the resources on the websites of other hub participants with whom he has an account.
- the system of the present invention uses a CURL mechanism (described below) to seamlessly link from one webserver to another.
- the system of the present invention may display commingled information. Examples of the types of commingled information displayed by the system of the present invention for the financial services market are shown in Figs. 2B and 2E.
- the user is enabled to use Goldman Sachs, Morgan Stanley Dean Witter, and Salomon Smith Barney systems. When this user clicks on the "Headline" hotlink in the Navigator bar, headlines from all three dealers are presented. As shown, headlines from all three dealers are commingled together so that the user can see and compare all of them.
- Fig. 2E the user only has accounts with Morgan Stanley Dean Witter (MSDW) and Salomon Smith Barney (SSB).
- the user is only enabled to use MSDW and SSB systems, and only headlines from these dealers are shown to the user.
- the process is the same, however.
- the system of the present invention can order the commingled information in any logical order, so that the user can easily compare the commingled information.
- the user need only click on a headline to seamlessly link to that hub participant's website if he desires more specific information. Again, he is not required to enter hub participant- specific user authentication information to link to that hub participant's website from the commingled information screen.
- An additional feature of the system of the present invention allows a user to compare product information. For the financial services market, this feature is accessed through the "Indications" hotlink on the navigator bar. An example of a search screen for product information from participating dealers that is displayed to the user in the financial services market is shown in Fig. 2F. This feature allows a user to easily compare potential investments with different dealers. As one skilled in the art can understand, a similar feature can be developed for other industries that present comparison information for that industry. A number of methods have been used to allow for a single sign-on for different websites; however, none are geared toward diverse, multi-domain websites. The conventional methods do not attempt to integrate the websites of competitors targeting the same customer audience.
- the system of the present invention creates a "network" within a multiple website enviromnent where users can seamlessly navigate these sites and use their resources without having to re-enter user authentication information for each website.
- One of the most important features of the system of the present invention is the "single sign-on" ability.
- Single sign-on allows users to seamlessly navigate diverse sites and use their resources without having to re-enter user authentication information for each website, websites belonging to different companies usually have different domain addresses, and therefore, use of cookies to store user authentication information is ineffective because cookies cannot be shared between websites on different domains.
- the present invention solves these problems by implementing "CURLs".
- a CURL is a "cooked URL” that allows websites to utilize a single sign-on for a network of related sites without using cookies. Instead of storing user authentication information in a cookie, the system of the present invention attaches user authentication information to a URL.
- the system of the present invention uses the CURL mechanism to combine a variety of websites into a single sign-on network of trusted servers, as shown in Fig. 3.
- these servers are capable of running HTTPD server software and support HTTP v 1.0 or higher and/or HTTPS (HTTP over Secure Sockets Layer).
- the Web servers also support dynamic content technologies, such as CGI, Servlet, ASP, etc. Other technologies will be known to those skilled in the art, and are within the scope of the present invention.
- a CURL is a protocol that allows one access-controlled Web server 310 to create hyperlinks to resources available on another access-controlled Web server 320.
- "Access-controlled" means that the user must authenticate himself to use the resources on the Webserver.
- the servers may implement access control through username/password authentication, digital certificates, biometric authentication or any other method known to those skilled in the art.
- the CURL of the present invention is implemented by issuing a cross-server request 330 that contains user information and requested resource information from a first, local Web server 310 to a second, remote Web server 320 within the network of trusted servers.
- each Web server in the network of trusted servers implements two CURL interfaces: a CURL "malce” point and a CURL "entry” point.
- the "make” point is located on the Web server making the request.
- the "malce” point is responsible for creating a valid CURL and sending it via URL redirection to the CURL "entry” point on a second server that has the requested resource.
- the "entry” point is located on the second server and is responsible for reading and validating an incoming CURL and serving the requested resource.
- the "entry” point replaces the website's local authentication mechanism while the "make” point replaces the need for a client to enter user authentication information.
- the same mechanisms apply to each trusted server. There are no limits on how many sites may participate in the system of the present invention as long as they provide CURL interfaces.
- At least one portion of the CURL is encrypted. Encrypting a portion of a CURL allows user authentication information to be passed securely from one Web server to another.
- regular symmetric encryption keys are used so that the same key is used for encryption as well as decryption.
- public/private keys may also be used to encrypt/decrypt the secret potion of each CURL.
- Other encryption methods are known to those skilled in the art and are within the scope of this invention.
- different encryption keys are used to encrypt CURLs for each Web server pair. For example, Key #1 may only be used to encrypt CURLs when a user is moving between site A and site B (or from site B to site A), and Key #2 may only be used to encrypt CURLs going from site B to site C, and vice versa. In this manner, any particular key may only be known to two parties.
- the CURL architecture works through a network, such as the Internet.
- the request from Make point to Entry point, is a regular HTTP redirection request with a valid URL.
- the request may use external secure systems such as SSL.
- SSL Secure Sockets Layer
- the process for a user requesting a resource located on a remote website through the system of the present invention is shown in Fig. 4.
- the user signs on to a first access- controlled website, and then requests a resource from a second, access-controlled website by clicking on a hyperlink on the first website at step 410. It is transparent to the user that the resource is on a different Web server. However, using the single sign-on of the present invention, he will be able to receive the requested resource, or link to the requested site, without re-entering any user authentication information.
- the user's request is sent to the CURL make point on the first Web server, and the make point creates a CURL at step 420.
- the CURL is then sent to the CURL entry point on the second Web server at steps 430 - 440.
- the entry point on the second Web server reads the CURL, validates it and authenticates the user at step 460. After the user is authenticated, the requested resource is then returned, or the user is redirected to the requested resource using URL redirection at step 470.
- These steps 420-460 are transparent to the user. The user only sees the request in step 410 and the resource in step 470.
- CURL requests are sent via URL (HTTP) redirection.
- the first Web server generates a CURL and uses any acceptable method of URL redirection known to one skilled in the art to send the CURL request to the user's Internet browser at step 430.
- the browser then automatically acts on the redirection to relay the request to the CURL entry point on the second Web server at step 440.
- the CURL is validated by the second Web server at step 460, and if validated, the resource is returned to the user at step 470.
- the CURL validation process of step 460 requires time verification.
- Time verification requires a CURL to contain a timestamp of when it was generated.
- the time contained inside the CURL is compared with the current time on the machine. If the difference is greater than an allowed interval, the CURL is not validated and the user is presented with an appropriate error message, as shown at step 475.
- a smaller allowable time interval results in more secure protection.
- time synchronization between trusted Web servers becomes crucial, since the CURL validation process depends on accurate timestamps.
- the time on Web servers performing user authentication through CURLs should be synchronized.
- participating Web servers should have an infrastructure that supports time synchronization with precise time sources, such as the Network Time Protocol (NTP).
- NTP Network Time Protocol
- CURLs are simply formatted strings that identify the user's identity and a resource on a separate, remote Web server. This identification is preferably through a user reference such as name, location and user attributes. Alternatively, the user reference4 can be a social security number or any other means of identification.
- CURLS are preferably formatted as standard HTTP URLs, as defined in the Request for Comment 1738 [4] by the Internet Engineering Task Force (IETF).
- IETF Internet Engineering Task Force
- a CURL is composed of a static portion 510, which contains a URL to the CURL entry point, and a dynamic portion 530, which contains user authentication data, a URL of the requested resource, and originator information.
- the static portion 510 of the URL specifies the CURL entry point on the Web server that contains the requested resource. This portion is static because the CURL entry point on a server is always the same and is known to all trusted servers.
- this static portion of the CURL consists of a protocol 511, host 512, port 513, and local path 514.
- Protocol 511 preferably supports HTTP or HTTPS.
- Domain or host 512 identifies the network host for the Web server that has the requested resource.
- domain 512 contains either the fully qualified domain name or the IP address as a set of four decimal digit groups separated by ".”.
- Port 513 identifies the port number to connect to, and is optional.
- the Local path 514 identifies the path to the CURL entry point on the Web server that contains the requested resource.
- the second, dynamic portion of the CURL is generated by the CURL make point and is attached to the static portion of the CURL.
- the dynamic portion of the CURL preferably consists of several arguments identifying the user, the requested resource and the originator. As shown in Fig. 5, these arguments are preferably name/value pairs.
- the arguments shown in Fig. 5 may include a Reference, Path and Originator.
- Reference 540 is preferably a secret portion that contains arguments in an encrypted form to be used by the CURL processor.
- the Reference string preferably consists of version information, timestamp, reference arguments, zero padding as needed, and a checksum.
- the reference arguments in the Reference portion of the dynamic portion of the CURL contain user information. These reference arguments may also contain user credentials. By default, a reference argument may contain a numeric user id that is shared across all trusted websites.
- the Reference portion of the CURL is secret, and is preferably encrypted. It may also be URL encoded. Other methods of encoding and encrypting are known to those skilled in the art, and are within the scope of this invention.
- the specific algorithm used to encrypt the secret portion of the CURL depends on the sensitivity of the data and the security requirements of all the trusted websites.
- the websites preferably rotate or change their encryption keys on a periodic basis.
- Originator 533 specifies the site that originated the CURL. This may be used to determine which encryption key to use to decrypt the encrypted portion of the CURL.
- Path 532 contains the URL of the requested resource. Preferably, the requested resource URL is transmitted as an encoded string. If encoded, the CURL processor decodes the value of the Path in order to properly interpret the request.
- the length of the entire CURL string is limited to 4k.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Information Transfer Between Computers (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
Description
Claims
Applications Claiming Priority (3)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US57092500A | 2000-05-15 | 2000-05-15 | |
US570925 | 2000-05-15 | ||
PCT/US2001/040720 WO2001088733A1 (en) | 2000-05-15 | 2001-05-15 | Method and system for providing an online industry hub |
Publications (2)
Publication Number | Publication Date |
---|---|
EP1290568A1 true EP1290568A1 (en) | 2003-03-12 |
EP1290568A4 EP1290568A4 (en) | 2005-05-11 |
Family
ID=24281623
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
EP01933424A Withdrawn EP1290568A4 (en) | 2000-05-15 | 2001-05-15 | Method and system for providing an online industry hub |
Country Status (5)
Country | Link |
---|---|
EP (1) | EP1290568A4 (en) |
JP (1) | JP2003536128A (en) |
AU (1) | AU2001259852A1 (en) |
CA (1) | CA2409280A1 (en) |
WO (1) | WO2001088733A1 (en) |
Families Citing this family (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20040128542A1 (en) * | 2002-12-31 | 2004-07-01 | International Business Machines Corporation | Method and system for native authentication protocols in a heterogeneous federated environment |
JP4878530B2 (en) * | 2006-09-22 | 2012-02-15 | 株式会社三共 | Server system |
GB0802585D0 (en) | 2008-02-12 | 2008-03-19 | Mtld Top Level Domain Ltd | Determining a property of communication device |
GB2465138B (en) | 2008-10-10 | 2012-10-10 | Afilias Technologies Ltd | Transcoding web resources |
US9141724B2 (en) | 2010-04-19 | 2015-09-22 | Afilias Technologies Limited | Transcoder hinting |
US20110289316A1 (en) * | 2010-05-19 | 2011-11-24 | Mtld Top Level Domain Limited | User authentication |
GB2481843A (en) | 2010-07-08 | 2012-01-11 | Mtld Top Level Domain Ltd | Web based method of generating user interfaces |
Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5708780A (en) * | 1995-06-07 | 1998-01-13 | Open Market, Inc. | Internet server access control and monitoring systems |
US5875296A (en) * | 1997-01-28 | 1999-02-23 | International Business Machines Corporation | Distributed file system web server user authentication with cookies |
EP0940960A1 (en) * | 1998-03-02 | 1999-09-08 | Hewlett-Packard Company | Authentication between servers |
JP2000106552A (en) * | 1998-09-29 | 2000-04-11 | Hitachi Ltd | Authentication method |
WO2001015377A1 (en) * | 1999-08-23 | 2001-03-01 | Encommerce, Inc. | Multi-domain access control |
EP1089516A2 (en) * | 1999-09-24 | 2001-04-04 | Citicorp Development Center, Inc. | Method and system for single sign-on user access to multiple web servers |
Family Cites Families (2)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5544322A (en) * | 1994-05-09 | 1996-08-06 | International Business Machines Corporation | System and method for policy-based inter-realm authentication within a distributed processing system |
US6052785A (en) * | 1997-11-21 | 2000-04-18 | International Business Machines Corporation | Multiple remote data access security mechanism for multitiered internet computer networks |
-
2001
- 2001-05-15 CA CA002409280A patent/CA2409280A1/en not_active Abandoned
- 2001-05-15 AU AU2001259852A patent/AU2001259852A1/en not_active Abandoned
- 2001-05-15 EP EP01933424A patent/EP1290568A4/en not_active Withdrawn
- 2001-05-15 JP JP2001585061A patent/JP2003536128A/en not_active Withdrawn
- 2001-05-15 WO PCT/US2001/040720 patent/WO2001088733A1/en active Application Filing
Patent Citations (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5708780A (en) * | 1995-06-07 | 1998-01-13 | Open Market, Inc. | Internet server access control and monitoring systems |
US5875296A (en) * | 1997-01-28 | 1999-02-23 | International Business Machines Corporation | Distributed file system web server user authentication with cookies |
EP0940960A1 (en) * | 1998-03-02 | 1999-09-08 | Hewlett-Packard Company | Authentication between servers |
JP2000106552A (en) * | 1998-09-29 | 2000-04-11 | Hitachi Ltd | Authentication method |
WO2001015377A1 (en) * | 1999-08-23 | 2001-03-01 | Encommerce, Inc. | Multi-domain access control |
EP1089516A2 (en) * | 1999-09-24 | 2001-04-04 | Citicorp Development Center, Inc. | Method and system for single sign-on user access to multiple web servers |
Non-Patent Citations (2)
Title |
---|
PATENT ABSTRACTS OF JAPAN vol. 2000, no. 07, 29 September 2000 (2000-09-29) & JP 2000 106552 A (HITACHI LTD), 11 April 2000 (2000-04-11) * |
See also references of WO0188733A1 * |
Also Published As
Publication number | Publication date |
---|---|
AU2001259852A1 (en) | 2001-11-26 |
EP1290568A4 (en) | 2005-05-11 |
JP2003536128A (en) | 2003-12-02 |
CA2409280A1 (en) | 2001-11-22 |
WO2001088733A1 (en) | 2001-11-22 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US9900305B2 (en) | Internet server access control and monitoring systems | |
AU694367B2 (en) | Internet server access control and monitoring systems | |
EP1461718B1 (en) | Distributed network identity | |
Rose et al. | Current technological impediments to business-to-consumer electronic commerce | |
US8635327B1 (en) | Web advertising method | |
US7930411B1 (en) | Network-based verification and fraud-prevention system | |
US5708780A (en) | Internet server access control and monitoring systems | |
US7814537B2 (en) | Method, software program, and system for managing access to information and the transfer thereof | |
US5867667A (en) | Publication network control system using domain and client side communications resource locator lists for managing information communications between the domain server and publication servers | |
US5884035A (en) | Dynamic distributed group registry apparatus and method for collaboration and selective sharing of information | |
US6594766B2 (en) | Method and apparatus for providing and maintaining a user-interactive portal system accessible via internet or other switched-packet-network | |
US5870562A (en) | Universal domain routing and publication control system | |
US20060173985A1 (en) | Enhanced syndication | |
US20020120573A1 (en) | Secure extranet operation with open access for qualified medical professional | |
US20060026692A1 (en) | Network resource access authentication apparatus and method | |
EP1290568A1 (en) | Method and system for providing an online industry hub | |
AU2007216771A1 (en) | Method and system for providing an online industry hub | |
KR20020033891A (en) | unified web-page access system and its method | |
WO2001052076A1 (en) | Method and apparatus for automatically filling on-line forms by a third-party server | |
Barber | The Internet and electronic commerce | |
Byron et al. | e-Business & e-Commerce (on CD) |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
PUAI | Public reference made under article 153(3) epc to a published international application that has entered the european phase |
Free format text: ORIGINAL CODE: 0009012 |
|
17P | Request for examination filed |
Effective date: 20021121 |
|
AK | Designated contracting states |
Kind code of ref document: A1 Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LI LU MC NL PT SE TR Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LI LU MC NL PT SE TR |
|
AX | Request for extension of the european patent |
Extension state: AL LT LV MK RO SI |
|
RIN1 | Information on inventor provided before grant (corrected) |
Inventor name: SHINKAR, SERGE Inventor name: SCHLINKERT, LEO, R. Inventor name: REIFMAN, GARY Inventor name: LEFLER, STEVEN,C/O COMMUNICATOR, INC. |
|
RIC1 | Information provided on ipc code assigned before grant |
Ipc: 7H 04L 29/08 B Ipc: 7H 04L 29/06 A |
|
A4 | Supplementary search report drawn up and despatched |
Effective date: 20050323 |
|
17Q | First examination report despatched |
Effective date: 20050506 |
|
STAA | Information on the status of an ep patent application or granted ep patent |
Free format text: STATUS: THE APPLICATION IS DEEMED TO BE WITHDRAWN |
|
18D | Application deemed to be withdrawn |
Effective date: 20081202 |