US 11,706,218 B2Granted

Systems and methods for controlling sign-on to web applications

AssigneeNasdaq, Inc.

InventorVladimir Mitevski

Life of this patent

Estimating the term…

Abstract

The described technology provides a single sign-on capability so that a user who is already signed on to a web application from a client application may not be required to sign-on again when he/she later needs access to the web application from the same or another client application. The technology also provides a multiple login prevention capability to detect multiple sign-on events using the same credentials and disable one or more of the associated multiple sessions.

Claims13

Dependent claims

A system comprising at least one client device, and at least one server device executing a server-side portion of a web application,

the at least one client device including a first processing system having at least one hardware processor, the first processing system being configured to execute a first client application providing a first client-side portion of the web application and a second client application providing a second client-side portion of the web application, wherein the first client application is a browser,
the at least one server including a second processing system having at least one hardware processor, the second processing system being configured to execute the server-side portion of the web application and to perform operations comprising:
in response to a first access request received from the first client application, causing the first client application to perform a sign-on process and generating a first session, wherein the first client application is subsequently provided access to application data using the first session, and wherein the application data is provided by the server-side portion of the web application;
when a second request is received from the second client application, determining, using at least one characteristic of the second request, whether the first session is useable by the second client application to access said application data, wherein the at least one characteristic includes an identifier included in the second request, and wherein the determining includes determining whether a value corresponding to the identifier is stored in a memory of the at least one server device in association with at least one of a plurality of session records;
in the event that it is determined that the first session is useable by the second client application to access said application data, providing the second client application with access to the application data using the first session;
in the event that it is determined that the first session is not useable by the second client application to access said application data, causing the second client application to perform a sign-on process and generating a second session, wherein the second client application is provided access to the application data using the second session;
generating, in relation to a sign-on by an instance of either the first client application or the second client application executing on another client device, a third session, wherein said instance is subsequently provided access to said application data using the second session;
and
in response to generating the third session, deactivating the first session.

6 more elements

A server device including at least one hardware processor configured to execute a server-side portion of a web application and to perform operations comprising:

in response to a first access request received from a first client application having a first client-side portion of the web application, causing the first client application to perform a sign-on process and generating a first session, wherein the first client application is subsequently provided access to application data using the first session, and wherein the application data is provided by the server-side portion of the web application, wherein the first client application is a browser;
when a second request is received from a second client application having a second client-side portion of the web application, determining, using at least one characteristic of the second request, whether the first session is useable by the second client application to access said application data, wherein the at least one characteristic includes an identifier included in the second request, and wherein the determining includes determining whether a value corresponding to the identifier is stored in a memory of the at least one server device in association with at least one of a plurality of session records;
in the event that it is determined that the first session is useable by the second client application to access said application data, providing the second client application with access to the application data using the first session;
in the event that it is determined that the first session is not useable by the second client application to access said application data, causing the second client application to perform a sign-on process and generating a second session, wherein the second client application is provided access to the application data using the second session;
generating, in relation to a sign-on by an instance of either the first client application or the second client application executing on another client device, a third session, wherein said instance is subsequently provided access to said application data using the third session;
and
in response to generating the third session, deactivating the first session.

4 more elements

A method performed by a server device including at least one hardware processor, the method comprising:

executing a server-side portion of a web application;
in response to a first access request received from a first client application having a first client-side portion of the web application, causing the first client application to perform a sign-on process and generating a first session, wherein the first client application is subsequently provided access to application data using the first session, and wherein the application data is provided by the server-side portion of the web application, wherein the first client application is a browser;
when a second request is received from a second client application having a second client-side portion of the web application, determining, using at least one characteristic of the second request, whether the first session is useable by the second client application to access said application data, wherein the at least one characteristic includes an identifier included in the second request, and wherein the determining includes determining whether a value corresponding to the identifier is stored in a memory of the at least one server device in association with at least one of a plurality of session records;
in the event that it is determined that the first session is useable by the second client application to access said application data, providing the second client application with access to the application data using the first session;
in the event that it is determined that the first session is not useable by the second client application to access said application data, causing the second client application to perform a sign-on process and generating a second session, wherein the second client application is provided access to the application data using the second session;
generating, in relation to a sign-on by an instance of either the first client application or the second client application executing on another client device, a third session, wherein said instance is subsequently provided access to said application data using the third session;
and
in response to generating the third session, deactivating the first session.

5 more elements

A non-transitory computer-readable storage medium, having stored thereon program instructions which, when executed by a computer of a server device, causes the server device to perform operations comprising:

executing a server-side portion of a web application;
in response to a first access request received from a first client application having a first client-side portion of the web application, causing the first client application to perform a sign-on process and generating a first session, wherein the first client application is subsequently provided access to application data using the first session, and wherein the application data is provided by the server-side portion of the web application, wherein the first client application is a browser;
when a second request is received from a second client application having a second client-side portion of the web application, determining, using at least one characteristic of the second request, whether the first session is useable by the second client application to access said application data, wherein the at least one characteristic includes an identifier included in the second request, and wherein the determining includes determining whether a value corresponding to the identifier is stored in a memory of the at least one server device in association with at least one of a plurality of session records;
in the event that it is determined that the first session is useable by the second client application to access said application data, providing the second client application with access to the application data using the first session;
in the event that it is determined that the first session is not useable by the second client application to access said application data, causing the second client application to perform a sign-on process and generating a second session, wherein the second client application is provided access to the application data using the second session;
generating, in relation to a sign-on by an instance of either the first client application or the second client application executing on another client device, a third session, wherein said instance is subsequently provided access to said application data using the third session;
and
in response to generating the second session, deactivating the first session.

5 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/136,097Filed 29 Dec 2020 · continuation
Priority: 6 Nov 2015
Published: US 2021/0119999 A122 Apr 2021
Granted: 18 Jul 2023
Term ends: Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 67/02
Protocols: based on web technology, e.g. hypertext transfer protocol [HTTP]
H04L 63/0815
For authentication of entities: providing single-sign-on or federations
H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources
H04L 67/141
Session management: setup of application sessions

Family

Application62/252,295Us provisional application · filed 6 Nov 2015
Application15/342,923Parent of this continuation · filed 3 Nov 2016
Application15/973,771Parent of this continuation · filed 8 May 2018
US 9,985,972 B2Parent of this continuation · filed 29 May 2018
Application16/526,490Parent of this continuation · filed 30 Jul 2019
US 10,412,091 B2Parent of this continuation · filed 10 Sep 2019
US 2021/0119999 A1Pre-grant publication · published 22 Apr 2021
US 10,887,313 B2Parent of this continuation
US 2017/0134385 A1Published application
US 2018/0262507 A1Published application
US 2019/0356665 A1Published application
US 11,706,218 B2This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

patentgrep

Loading patent…

Abstract

A system comprising at least one client device, and at least one server device executing a server-side portion of a web application,

the at least one client device including a first processing system having at least one hardware processor, the first processing system being configured to execute a first client application providing a first client-side portion of the web application and a second client application providing a second client-side portion of the web application, wherein the first client application is a browser,
the at least one server including a second processing system having at least one hardware processor, the second processing system being configured to execute the server-side portion of the web application and to perform operations comprising:
in response to a first access request received from the first client application, causing the first client application to perform a sign-on process and generating a first session, wherein the first client application is subsequently provided access to application data using the first session, and wherein the application data is provided by the server-side portion of the web application;
when a second request is received from the second client application, determining, using at least one characteristic of the second request, whether the first session is useable by the second client application to access said application data, wherein the at least one characteristic includes an identifier included in the second request, and wherein the determining includes determining whether a value corresponding to the identifier is stored in a memory of the at least one server device in association with at least one of a plurality of session records;
in the event that it is determined that the first session is useable by the second client application to access said application data, providing the second client application with access to the application data using the first session;
in the event that it is determined that the first session is not useable by the second client application to access said application data, causing the second client application to perform a sign-on process and generating a second session, wherein the second client application is provided access to the application data using the second session;
generating, in relation to a sign-on by an instance of either the first client application or the second client application executing on another client device, a third session, wherein said instance is subsequently provided access to said application data using the second session;
and
in response to generating the third session, deactivating the first session.

6 more elements

Facts

Application

17/136,097Filed 29 Dec 2020 · continuation

Priority

6 Nov 2015

Published

US 2021/0119999 A122 Apr 2021

Granted

18 Jul 2023

Term ends

Not estimatedThe source records don’t support an estimate.

Classification7 codes

H04L 67/02
Protocols: based on web technology, e.g. hypertext transfer protocol [HTTP]
H04L 63/0815
For authentication of entities: providing single-sign-on or federations
H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources
H04L 67/141
Session management: setup of application sessions

Family

Application62/252,295Us provisional application · filed 6 Nov 2015

Application15/342,923Parent of this continuation · filed 3 Nov 2016

Application15/973,771Parent of this continuation · filed 8 May 2018

US 9,985,972 B2Parent of this continuation · filed 29 May 2018

Application16/526,490Parent of this continuation · filed 30 Jul 2019

US 10,412,091 B2Parent of this continuation · filed 10 Sep 2019

US 2021/0119999 A1Pre-grant publication · published 22 Apr 2021

US 10,887,313 B2Parent of this continuation

US 2017/0134385 A1Published application

US 2018/0262507 A1Published application

US 2019/0356665 A1Published application

US 11,706,218 B2This patent

From the US filing history. Foreign family members aren’t listed.