KR20090106368A - Methods and systems for authentication of a user for sub-locations of a network location - Google Patents

Abstract

PURPOSE: A method and a system for authenticating a user for sub locations of a network location are provided to supply a cookie for user authentication about a sub location of a network location, thereby enabling a hacker to pretend as a user only about the same sub location that the user with ill will already accesses even though a cookie is stolen from the user with ill will. CONSTITUTION: A method for authenticating a user for at least sub locations of a network address comprises the following steps. If a cookie is effective, the second cookie for user authentication about the first sub location of a network address is provided to a user computer(308). When a computer attempts to access a network address after the first attempt, the first cookie is made effective to authenticate a user about the network address. When the computer attempts to access the first sub location after the first attempt, the second cookie is obtained and made effective from a computer to authenticate a user about the first sub location of the network address.

Description

METHODS AND SYSTEMS FOR AUTHENTICATION OF A USER FOR SUB-LOCATIONS OF A NETWORK LOCATION}

The present invention relates to authentication of a user for access to a network resource. In particular, the present invention relates to authentication of a user to one or more individual sub-locations of a network location.

Computer networks allow resources to be shared among other computers. For example, the Internet allows computers all over the world to exchange information such as e-mail. The World Wide Web provides for the exchange of audio-visual information between computers connected to the Internet. In addition, a centralized computer server may store information posted by a computer user for others to access.

Server computers allow computer users to access information stored within various sub-locations of network locations, such as Internet domains. Sub-locations of network locations may include individual servers in a server farm or separate directories of one or more servers. Specific sub-locations may be assigned to specific computer users or groups of users who post information to sub-locations for access by other computer users who are also connected to network locations. Such sharing of information over a network is advantageous for computer users, but the network must be managed to prevent unauthorized access to various network locations and sub-locations of the network locations.

To prevent unauthorized access, the user is authenticated to the network location. Authentication of a user can be performed in a variety of ways. One method is for the user to enter a username and password before access to the network location and corresponding sub-location is allowed. However, as the number of network locations that a user wants to access increases, the need for the user to enter a username and password for every location becomes cumbersome.

To address this issue, once a user enters a username and password, a cookie is issued to the user, which identifies the user at a network location, such as a domain within the World Wide Web, for all sub-locations within that network location. Can be used to authenticate. A cookie is a data file in which the server identifies a user and typically expires in some future time by including one or more long numbers that are the identification of the user. Initial login by username and password is typically performed through a trusted central network location that maintains a reference username and password, such as, for example, .NET ^™ Passport ^™ . When a user attempts to visit a network location, the user's computer proceeds to a trusted network location that issues an encrypted cookie to the user's computer for the network location. The user's computer then returns to a server at a network location, which then checks the cookie just issued to the user's computer.

The server attempts to validate the cookie by requesting a cookie from the user's computer, then decrypting the cookie with the secret key and determining if the decrypted cookie has expired. If the server of the visited network location successfully validates the cookie, the visited network location authenticates the user attempted access, since the validated cookie confirms that the user attempting to access the network location is a user of known and trusted identity. The identification can be specified by the information contained within the decrypted cookie.

For sub-locations of the network location where the user can post information, there is still a security risk for the cookies used to authenticate the user to the visited network location. A user who accesses a sub-location within a visited network location may post script information for various reasons to provide audio-visual information to others accessing the sub-location. However, a malicious user may post a script that performs malicious activities, such as stealing cookies uploaded from another user's computer when the user visits a network location.

Once the cookies of other users who have visited the network location are obtained, the malicious user who steals these cookies can then impersonate these other users to access sub-locations within the network location accessed by the impersonated user. As a result, a malicious user who steals a cookie has access to activities and sub-locations where the malicious user cannot access activities and / or sub-locations, including personal, financial, or other sensitive information about the impersonated user. Is given.

Embodiments of the present invention address these and other problems by providing a cookie for authenticating a user to a particular sub-location of the network location, in addition to using a cookie that authenticates the user to a network location that provides the sub-location. It is. When a user logs in to network locations and sub-locations, only cookies for network locations and cookies for individual sub-locations are exposed within the visited sub-locations. If these two cookies are stolen by a malicious user who has posted a malicious script in a sub-location, the malicious user who steals the cookie may impersonate the user only for the same sub-location already accessed by the stolen user. A malicious user who steals a cookie will not be able to impersonate a user for another sub-location that requires another cookie specific to that sub-location.

One embodiment is a method for authenticating a user of a computer to a lower location of a network address. The method includes providing a first cookie to a computer for user authentication for a network address and providing a second cookie to the computer for user authentication for a first sub-location of the network address. When the computer attempts to access the network address, the first cookie is validated to authenticate the user for the network address. The second cookie is validated to authenticate the user for the first sub-location of the network address.

Yet another embodiment is a computer system that includes a network interface and a processing device. The processing apparatus is configured to obtain the first cookie via the network interface and to validate the first cookie to authenticate the user for the network address. The processing apparatus is also configured to obtain a second cookie via the network interface and validate the second cookie to authenticate the user for the first sub-location of the network address.

Another embodiment is a network system that includes a server computer at a network address that provides one or more sub-locations of the network address. The client computer communicates with the server computer via the network, and the client computer stores a first cookie for the network address and a second cookie for a subordinate location of the network address. The server computer accesses and validates the first cookie to authenticate the user of the client computer for the network address, and the server computer accesses and validates the second cookie to authenticate the user of the client computer for the sub-location of the network address.

Yet another embodiment is a computer readable medium containing instructions for performing many steps when executed by a computer. The first cookie is obtained through the computer's network interface and validated for authenticating the user to the network address. The second cookie is obtained through the computer's network interface and validated to authenticate the user for the first sub-location of the network address.

According to the present invention, in addition to using a cookie that authenticates a user to a network location that provides a sub-location, the cookie is stolen from a malicious user by providing a cookie for authentication of the user to a particular sub-location of the network location. Also in this case, the user can impersonate the user only for the same sub-location already accessed by the malicious user and cannot impersonate the user for the other sub-location.

Embodiments of the present invention provide sub-location cookies, such as directory cookies for many sub-locations of network locations, as shown and discussed in FIGS. One example of a network location is a domain identified within a URL or IP address. Sub-location cookies are provided to allow a user to be authenticated for sub-locations in addition to being authenticated for network locations hosting sub-locations. Thus, a user who steals a cookie that permits incorrect authentication to the network location is also required to authenticate to subordinate locations within the network location with other cookies.

1 illustrates a typical network operating environment in which embodiments of the invention may be implemented. The client computer 102 is linked to a network 106, such as a local area network, a telecommunications network, or the global internet. Client computer 102 may communicate with many server computers that are also linked to network 106. For example, a login server 108 linked to a network allows a user to log in with a username and password, such as an email address, so that the user does not re-enter the username and password for that network location, Obtain a first server cookie that allows authentication at the location. In addition, the login server 108 issues a login cookie to the user of the client computer so that when the user attempts to visit a network location and proceeds to the login server 180 for authentication, the user does not enter another username and password. A login cookie may be obtained to authenticate the user to the login server 108.

The login server 108 can access the storage device 110 of the reference user name and password. When a user of the client computer 102 first visits the login server 108 and inputs a user name and password, the login server 108 can find the user name in the storage device 110 and compare the entered password with the stored password. have. If they match, the user of the client computer 102 is authenticated as the user who owns the username, a login cookie is provided from the login server 108 to the client computer 102, and the client computer attempts to visit the service server 112. As a result of the attempt, a server cookie may be provided when proceeding to the login server. The login cookie and the server cookie may include an identifier value corresponding to the owner of the logged in user name to obtain the cookie. In addition, these cookies can be encrypted with a secret key and / or have an expiration time. Client computer 102 stores the cookie in storage 104 such that when the client computer 102 attempts to access a corresponding network location, a server cookie in storage 104 is obtained by the server at the network location. The user can then authenticate the user by validating the server cookie in one of a variety of ways. Validation may include attempting to decrypt the server cookie with the secret key and / or verifying that the server cookie did not expire based on its expiration date. Also, when client computer 102 proceeds back to login server 108, a login cookie is obtained by login server 108 to authenticate the user of client user 102 once again without re-entering the username and password. Can be.

Service server 112 is linked to network 106 and from a network location to many sub-locations, such as individual servers in a server farm, or directories 116, 118, and 120 of network locations established by server 112. Provide the client computer 102 with a service comprising providing access. Individual servers or individual directories 116, 118, 120 in a server farm can provide a lot of information useful to client computers 102, such as documents, and access personal or sensitive information. For example, if a user is authenticated to a sub-location, the user does not re-enter the information when the user makes a purchase, but purchases online through the sub-location where billing information for the user authenticated by the sub-location is stored and applied. Can be.

To prevent unauthorized access to the network location provided by the service server 112, the server 112 obtains a server cookie from the client computer 102 attempting to access the server 112. Authenticate users attempting to access certain sub-locations and other services provided by). The server 112 validates the server cookie as described above by attempting to decrypt with a particular key in storage 114 and / or verifying that the server cookie has not expired. In addition to the initial authentication, if access to the network location requires authentication, the identifier information of the cookie can be compared with the identifier information maintained in the storage 114.

When the client computer 102 accesses the network location of the service server 112, if the user of the client computer 102 has not yet obtained a server cookie for the network location, the client computer 102 may log in to the login server 108. Proceed to). After authentication, client computer 102 proceeds to service server 112 with a server cookie and a message in a query string from login server 108 to service server 112. This message indicates whether the user has just been authenticated at the login server 180 and indicates that the user has legitimately obtained it without stealing the server cookie. When the service server 112 receives the message and authenticates the user through validation of the server cookie just received, the service server 112 generates a sub-location cookie for the authenticated user for one or more sub-locations requiring authentication. do.

The lower position cookie is provided from the service server 112 to the user's client computer 102 and stored in a storage 104 such as mass storage. The lower location cookie is encrypted and / or expired value such that the service server 112 can decrypt the lower location cookie with another secret key in storage 114 and / or validate the cookie by checking expiration. May have In any embodiment where authentication is determined for sub-locations for an authenticated user, identifier information for the user may also be included in these sub-location cookies and the matching identifier may be combined with authentication for one or more various sub-locations to service servers. It is stored in the storage device 114 of 112. If the user does not have a server cookie and cannot be authenticated when the user accesses a network location, the service server 112 advances the client computer 102 back to the login server 108 or as described above. 102 may simply be denied access.

If the user of client computer 102 attempts to access a particular sub-location within the network location of service server 112 after being authenticated through the validation of a server cookie, service server 112 may request a corresponding sub-location from client computer 102. Obtain a location cookie. The service server 112 attempts to validate the subordinate location cookie, such as by decryption and / or checking the expiration date, to authenticate the user of the client computer 102 to the subordinate location being accessed. The sub-location cookie may include an identifier of the sub-location to which the sub-location cookie applies, and may include a lot of other information including the identifier also used in the server cookie for the user. For embodiments in which user identification information is included, the lower location cookie may include other identifiers associated with the user by the service server 112 than the identifier of the user included in the server cookie.

If a user steals the user's server cookie after the user has accessed the network location, the stolen server cookie will not provide the authentication necessary to access the child location of the network location that requires the child location cookie. If a legitimate user is authenticated for a sublocation with a sublocation cookie obtained from the user's computer 102 and someone steals the sublocation cookie while the user is visiting the sublocation, the stolen sublocation cookie is transferred to another sublocation of the network location. Will not provide the necessary authentication for access. Stolen sub-location cookies will only allow authentication for sub-locations the cookie thief has already accessed.

2 and the following description are intended to provide a brief, general description of a suitable computing environment in which the present invention may be implemented in a service server computer 112. While the invention will be described in the general context of program modules that execute in conjunction with application programs that execute operating systems on server computers, those skilled in the art will recognize that the invention may be implemented in combination with other program modules. Generally, program modules include routines, programs, components, data structures, and other types of structures that perform particular tasks or implement particular abstract data types.

Those skilled in the art will also appreciate that the present invention may be practiced with other computer system configurations, including hand-held devices, multiprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, mainframe computers, and the like. I will understand. The invention, applied to the server computer 112 of FIG. 1, may also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network rather than on a single computer. In a distributed computing environment, program modules may be located in both local and remote memory storage devices.

2 illustrates an example computer architecture for a server computer 112 implementing various embodiments of the present invention. The computer architecture shown in FIG. 2 is a system memory 206, memory including a central processing unit 204 (" CPU "), random access memory 208 (" RAM ") and read only memory 210 (" ROM "). To a conventional server computer including a system bus 212 that couples the CPU 204 to the CPU 204. A basic input / output system is stored in ROM 210 that includes a basic routine that assists in transferring information between elements in a computer during startup. The server computer 112 also includes a mass storage 214 that stores an operating system 216 and application programs, such as a cookie application program 218 that performs login and sub-location cookie authentication functions. The mass storage 214 also stores two components of the cookie application program 218 including a cookie generator 224 for generating sub-location cookies and a cookie checker 226 for validating sub-location cookies and logins from the user's computer. do. Validation may use the cookie decryption key information 228 of the mass store 214 and / or check the expiration value of the cookie to authenticate the user. Mass storage 214 may also include sub-location data 230 for various sub-locations provided at network locations.

Mass storage 214 is connected to CPU 214 via a mass storage controller (not shown) connected to bus 212. Mass storage 214 and its associated computer readable medium provide non-volatile storage to server computer 112. Although descriptions of computer readable media included herein refer to mass storage devices, such as hard disks or CD-ROM drives, those of ordinary skill in the art will appreciate that any computer readable medium may be used by any server computer 112 that can be accessed. It will be appreciated that it may be a medium.

By way of example, and not limitation, computer readable media may comprise computer storage media and communication media. Computer storage media includes non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media may be RAM, ROM, EPROM, EEPROM, flash memory or other solid state memory technology, CD-ROM, DVD, or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage device, or computer. Including, but not limited to, any other medium that can be accessed by and used to store desired information.

Communication media generally embody any other data transmission medium and implement other data in a modulated data signal, such as computer readable instructions, data structures, program modules or carriers or other transmission mechanisms. The term "modulated data signal" means a signal that has one or more of its characteristics set or changed to encode information in the signal. By way of example, communication media includes, but is not limited to, wired media such as a wired network or direct wired connection and wireless media such as acoustic, RF, infrared, and other wireless media. Combinations of any of the above should also be included within the scope of computer readable media. Computer readable media is also referred to as computer readable product.

According to various embodiments of the present invention, server computer 112 may operate in a networked environment using logical connections to remote computers via a network 106 such as the Internet. The server computer 112 may be connected to the network 106 via a network interface unit 220 connected to the bus 212. Network interface unit 220 may also be used to connect to other types of networks and remote computer systems. Server computer 112 may also include an input / output controller 222 that receives and processes input from a number of devices including a keyboard or mouse (not shown). Similarly, input / output controller 222 may provide output to a display screen, printer, or other type of output device.

As briefly described above, a number of program modules and data files, including an operating system 216 suitable for controlling the operation of the networked server computer 112, may be stored in the RAM of the mass storage 214 and the server computer 112. 208 can be stored. Mass storage 214 and RAM 208 may also include one or more application programs, such as cookie application 218 and cookie generator 224, cookie checker 226, and cookie decryption key information 228. You can save the component.

An embodiment of the present invention provides a program module for use in combination with the cookie application program 218. The program module implements logical operations to authenticate users attempting to access various sub-locations of the network location. Various embodiments of the logical operation of the program module for the cookie application program 218 are described below with reference to FIGS. 3 and 4. 3 illustrates that client computer 102, login server 108, and service server 112 interact to authenticate a user of client computer 102 to a sub-location of the network location of service server 112. Represents a logical operation implemented within the network environment of FIG. 4 illustrates a logical operation implemented within cookie application 218 to generate and check sub-location cookies for authentication of a user.

The example logical operation of FIG. 3 for one embodiment begins with a login operation 302, where the client computer 102 proceeds from a service server 112 that the user attempts to visit and enters a username and password. By logging in to the login server 108. The login server 108 compares the username and password with a reference username and password for the user. If the comparison indicates matching the login credentials, the login server 108 provides a server cookie (first cookie) to the client computer 102. As mentioned above, this server cookie may include an expiration value and / or may be encrypted with a known key by the service server 112 so that the server cookie can be validated. In addition, as described above, if the user proceeds back to the login server 108 in the future, the login server 108 may also provide a login cookie that authenticates the user to the login server 108.

After client computer 102 logs in to obtain a server cookie, and then returns from login server 108 back to service server 112, client computer 102 may access service server 112 in access operation 306. Attempt to access a network location. Upon resumption, the query string includes a message from login server 108 indicating that the user of client computer 102 with the server cookie has just been authenticated. At this time, the service server 112 obtains a message from the query string and a server cookie from the client computer 102 and attempts to validate the server cookie. The service server 112 validates the server cookie by verifying that it has not been decrypted and / or expired to authenticate the user in the authentication operation 308. Upon authentication, the service server 112 receives a message from the login server 108 that the user has just authenticated at the login server 108, so that the service server 112 for each of the sub-locations provided to the service server 112. Generate and provide sublocation cookies to the user.

Once the sub-location cookie has been provided to the client computer 102 for a particular server cookie, the service server 112 may issue the issued sub-location for the sub-location to which the client computer 102 authenticated with the same server cookie attempted to access the user. Require to have cookies. This allows the service server 112 to attempt to validate the lower location cookie by decrypting with another secret key and / or verifying that it has not expired to authenticate the user for the lower location accessed in the lower location operation 310. If the user with the server cookie does not have a lower location cookie, the service server 112 may cause the user to be authenticated again at the login server 108.

In certain embodiments, service server 112 may also provide additional authentication checks once the user has been authenticated to determine if the authenticated user has authorization to access a particular sub-location. Although the lower location cookie authenticates the user for the lower location in the network location, the user may not have authentication for a given lower location and may deny access to it.

4 illustrates an example logical operation of one embodiment of a cookie application 218 for authenticating a user. The logical operation begins at an access operation 402, where the service server 112 receives an access attempt from the client computer 102, and the access attempt is a replay date from the login server 108 to the service server 112. Can be. Upon receiving the access attempt, the service server 112 attempts to obtain a server cookie (first cookie) from the client computer 102 that can be validated through decryption and / or verification that it has not expired. At this time, the service server 112 may also obtain any message from the login server 108 indicating that the user has just been authenticated at the login server 108.

Query operation 406 detects whether the server cookie has been successfully validated. If query operation 406 detects that server cookie validation has not occurred because the server cookie could not be decrypted or has expired, service server 112 causes re-run operation 408 in which client computer 102 determines that login server ( 108). Alternatively, service server 112 may simply deny access to the user. In query operation 406, if it detects that the server cookie has been successfully validated, the operation proceeds to query operation 410.

In query operation 410, service server 112 tests whether the lower location cookie has already been provided to client computer 102 for the server cookie currently obtained. This can be done by referring to the message in the query string returned from the login server 108 to the service server 112. If a message from the login server 108 is received, the service server 112 recognizes that the user has just been authenticated at the login server 108 for the network location of the service server 112 and that a directory cookie has not yet been provided. do. This message also indicates that the user granting the server cookie is a legitimate user, not a malicious user who can steal the server cookie. If no message has been granted from the login server 108, then the service server 112 proceeds as if the lower location cookie was already provided for this server cookie and prevents the lower location cookie from being issued to the malicious user.

In query operation 410, if it is detected that a lower location cookie has not already been provided for this server cookie because a message in the query string from login server 108 is granted, then service server 112 generates an action 412. Generates a sublocation cookie to be used in relation to the current server cookie. As noted, each of these generated sub-location cookies may include an identifier of the corresponding sub-location and may also include an identifier of the user for which further authentication checks are required for access. These generated lower location cookies are then sent to client computer 102 in a transfer operation 414. Thereafter, authentication for the current user for the subordinate location being accessed is granted in authentication operation 416.

In query operation 410, if no message is received from the login server 108 for the access attempt and it is detected that a lower location cookie has already been received for this server cookie, the service server 112 performs a cookie operation 418. Attempts to obtain a sublocation cookie for the sublocation currently accessed. As discussed above with respect to the server cookie, the subordinate location cookie of the client computer 102 may be encrypted with a key known to the service server 112 so that the key can be used to decrypt the subordinate location cookie. In addition, relevant sub-locations are identified in sub-location cookies. The query operation 420 then detects whether the sub-location cookie for the current sub-location has been validated by verifying that the sub-location cookie has not been decrypted and / or expired and comparing the sub-location being accessed with the sub-location identified in the cookie.

If in query operation 420 it is detected that there is no lower location cookie that can be validated for this lower location, the service server 112 rejects the user for authentication to the lower location in rejection operation 422 and the current user. Does not allow this sublocation to be accessed. This prevents a malicious user from stealing the server cookie and possibly a directory cookie to another sub-location from accessing the current sub-location. In query operation 420, if the lower location cookie is detected as authenticated for this lower location, service server 112 grants the user authentication for the lower location in authentication operation 416. FIG. If necessary, an authenticated user can be referenced against the authentication rules for the subordinate location to determine if it allows the authenticated user to access the subordinate location of interest.

While the invention has been illustrated and described with reference to exemplary embodiments, those skilled in the art will recognize that various other changes in form and detail may be made without departing from the spirit and scope of the invention.

1 illustrates a network operating environment for an embodiment of the invention.

2 illustrates a component of a server computer at a network location in accordance with one embodiment of the present invention.

3 illustrates the logical operation of interactions occurring within the network of FIG. 1 between a server, a service server, and a client computer to authenticate a user of a client computer in accordance with an embodiment of the present invention.

4 illustrates a logical operation performed by a service server to authenticate a user of a client computer to one or more sub-locations in accordance with one embodiment of the present invention.

* Description of the symbols for the main parts of the drawings *

102: client computer

106: network

108: login server

110: storage device

112: service server

Claims (36)

A method of authenticating a user of a computer to one or more sub-locations of a network address, the method comprising: Providing a first cookie to a computer for user authentication to a network address; When the user attempts to access the first sub-location for the first time after the user computer receives the first cookie, validating the first cookie for user authentication to the first sub-location of the network address. Providing a second cookie to the user computer; When the computer attempts to access the network address after the first attempt, validating the first cookie to authenticate the user against the network address; And When the computer attempts to access the first sub-location after the first attempt, obtaining and validating the second cookie from the computer to authenticate the user to the first sub-location of the network address. How to include. The method of claim 1, wherein the second cookie is validated when the computer attempts to access the first sub-location of the network address. The method of claim 1 wherein the network address is a domain of the world wide web. The method of claim 1, wherein the second cookie is encrypted with a key known to a server hosting the network address and the sub-location within the network address. The method of claim 1, wherein the second cookie specifies a user identifier and an identifier of the first sub-location of the network address. The method of claim 1, wherein the second cookie comprises an expiration value. The method of claim 1, Providing additional cookies to the computer for user authentication of additional sub-locations of the network address; And Validating the additional cookie to authenticate the user with respect to the additional sub-location of the network address How to include more. The method of claim 1, Retrieving additional cookies that may be validated for further sub-locations of the network address; And If the additional cookie is not found, denying authentication of the user to the additional sub-location of the network address How to include more. The method of claim 1, Obtaining a username and password from the user computer; Comparing the username and password with a reference username and password; And Providing the first cookie if the user name and password match the reference user name and password How to include more. The method of claim 9, Comparing the username and password with the reference username and password occurs at a second network location, and wherein the first cookie is provided to the user computer from the second network location. Network interface; And Processing unit Including; The processing device is configured to obtain a first cookie through the network interface for user authentication to a network address, to validate the first cookie to authenticate a user to the network address, The processing apparatus may also further include, when the first cookie is obtained for the first time through the network interface, upon validating the first cookie, the second cookie through the network interface for user authentication to a first sub-location of the network address. Providing a cookie, and when the first cookie is obtained through the network interface after the first attempt, obtaining and validating the second cookie through the network interface to provide the cookie with respect to the first sub-location of the network address. A computer system configured to authenticate a user. The method of claim 11, The processing device to validate the second cookie immediately after receiving an attempt to access the first sub-location of the network address. 12. The computer system of claim 11 wherein the network address is a domain of the world wide web. 12. The computer system of claim 11 further comprising a storage device comprising a key to decrypt the second cookie. 12. The computer system of claim 11 wherein the second cookie specifies a user identifier and an identifier of the first sub-location of the network address. 12. The computer system of claim 11 wherein the second cookie comprises an expiration value. 12. The apparatus of claim 11, wherein the processing device is further configured to obtain an additional cookie for the further sub-location of the network address via the network interface and to validate the additional cookie to the additional sub-location of the network address. A computer system configured to authenticate the user to the user. 12. The apparatus of claim 11, wherein the processing device is further configured to retrieve, via the network interface, additional cookies that may be validated for additional sub-locations, and if the additional cookies are not found. And deny authentication of the user to subordinate locations. 12. The computer system of claim 11 wherein the subordinate location is a directory of a server at the network address. A server computer of a network address providing one or more sub-locations of the network address; And Client computer communicating with the server computer over a network Including, The client computer stores a first cookie for the network address, a second cookie for a lower position of the network address, The server computer Access and validate the first cookie to authenticate a user of the client computer against the network address, When the client computer attempts to access the network location for the first time after receiving the first cookie, validating the first cookie provides the second cookie to the client computer, When the client computer attempts to access the network location after the first attempt, the second cookie is obtained and validated from the client computer to inform the user of the client computer with respect to the first sub-location of the network address. Certified network system. The method of claim 20, The server computer validates the second cookie when the client computer attempts to access the first sub-location of the network address. 21. The network system of claim 20 wherein the network address is a domain of the world wide web. 21. The network system of claim 20, wherein said second cookie is encrypted with a key known to said server computer. 21. The network system of claim 20 wherein the second cookie specifies a user identifier and an identifier of the first sub-location of the network address. 21. The network system of claim 20 wherein the second cookie comprises an expiration value. 21. The server of claim 20, wherein the client computer stores additional cookies for user authentication for additional sub-locations of the network address, and the server computer accesses and validates the additional cookies to add the network addresses. A network system for authenticating the user with respect to subordinate locations of. 21. The server of claim 20, wherein the server computer retrieves from the client computer an additional cookie that can be validated for an additional sub-location of the network address, and if the additional cookie is not found, for the additional sub-location. A network system that refuses to authenticate a user. 21. The method of claim 20, further comprising: obtaining a user name and password from the client computer, comparing the user name and password with a reference user name and password, and if the user name and password match the reference user name and password; And a second server computer for providing a cookie to the client computer. When run by computer, Obtaining a first cookie for authenticating a user to a network address through a network interface of the computer; Validating the first cookie to authenticate a user against the network address; When the computer receives the first cookie for the first time and receives an attempt to access the first sub-location for the first time, providing a second cookie through the network interface upon validating the first cookie; And When the user attempts to access the first sub-location after the first attempt, acquiring and validating the second cookie via the network interface to authenticate the user to the first sub-location of the network address. step Computer-readable media comprising instructions for causing a computer to perform. 30. The computer readable medium of claim 29, wherein the network address is a domain of the world wide web. 30. The computer readable medium of claim 29, wherein the second cookie is encrypted with a key known to the computer executing the instructions. 30. The computer readable medium of claim 29, wherein the second cookie specifies a user identifier and an identifier of the first sub-location of the network address. 30. The computer readable medium of claim 29, wherein the second cookie comprises an expiration value. The computer-readable medium of claim 29, wherein when executed by the computer, the instructions are: Obtaining an additional cookie for an additional lower location of the network address via the network interface; And Validating the additional cookie to authenticate a user with respect to the additional sub-location of the network address A computer readable medium for causing a computer to perform the additional step of. The computer-readable medium of claim 29, wherein when executed by the computer, the instructions are: Retrieving, via the network interface, additional cookies that can be validated for additional sub-locations; And If the additional cookie is not found, denying authentication of the user to the additional sub-location of the network address A computer readable medium for causing a computer to perform the additional step of. 30. The computer readable medium of claim 29, wherein the sub-location is a server computer in a farm of server computers at the network address of the computer executing the instructions.

Images