# US 7,610,617 B2 · Authentication system for networked computer applications

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 7,610,617 B2
- Document ID: US7610617B2
- Status: Granted
- Kind: B2
- Application number: 11/022,534
- Filed: 2004-12-22
- Published: 2005-06-23
- Granted: 2009-10-27
- Earliest claimed: 2003-12-23
- Assignees: Wells Fargo Bank, N.A.
- Inventors: Edward R. Kelly; Christopher Wayne Howser; Jonathan Francis Savage; Yuliang Zheng
- Web page: https://patentgrep.com/patent/US7610617B2

## CPC

- H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)}
- H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/0815: {providing single-sign-on or federations}
- H04L 63/126: {the source of the received data}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system such as in a networked computer system comprising a user, an application server, a gatekeeper server and an authentication server. Communication within the system is managed by the gatekeeper server, wherein the user communicates with the authentication server and the application server through the gatekeeper server. Once the user has been initially authenticated by the authentication server, the user may request application services from a plurality of application servers within the networked computer system without having to be re-authenticated.

## Claims

### Claim 1

A method of authenticating a user by an authentication server in a networked computer system, the method comprising:
presenting user credentials by a user to a gatekeeper server;
providing presented user credentials by the gatekeeper server to an authentication server;
authenticating the user by the authentication server;
creating an authentication token by the authentication server upon authentication of the user to uniquely identify the user, the authentication token being independent of the user credentials presented by the user and verifiable without a need for the user to re-present the user credentials;
encrypting the authentication token by the authentication server using a key not shared with the gatekeeper server;
transmitting the authentication token by the authentication server to an application server, wherein transmitting the authentication token to the application server comprises transmitting the authentication token by the authentication server to the gatekeeper server and then transmitting the authentication token by the gatekeeper server to the application server;
creating an outer token by the gatekeeper server;
wrapping the outer token around the authentication token to form a combined token;
encrypting the combined token by the gatekeeper server using a key not shared with the authentication server; and
sending the encrypted combined token to the authenticated user;
wherein the authenticated user is allowed to present the combined token to the gatekeeper server without having to be re-authenticated.

### Claim 2 (depends on 1)

The method of authenticating a user of claim 1, further comprising providing application services by an application server to the user.

### Claim 3 (depends on 1)

The method of authenticating a user of claim 1, further comprising digitally signing the authentication token by the authentication server.

### Claim 4 (depends on 3)

The method of authenticating a user of claim 3, further comprising utilizing the digital signature to verify by the application server that the authentication token was created by the authentication server.

### Claim 5 (depends on 4)

The method of authenticating a user of claim 4, wherein the application server verifies the authentication token.

### Claim 6 (depends on 1)

The method of authenticating a user of claim 1, further comprising verifying the authentication token by the application server.

### Claim 7 (depends on 1)

The method of authenticating a user of claim 1, wherein the authentication token comprises a plurality of data nodes stored therein representing a data structure.

### Claim 8 (depends on 7)

The method of authenticating a user of claim 7, wherein the data structure comprises:
(a) a first data node comprising data indicating the time the data structure was created;
(b) a second data node comprising data representing the user; and
(c) a third data node comprising unique data identifying the data structure.

### Claim 9 (depends on 1)

The method of authenticating a user of claim 1, further comprising encrypting the authentication token by the authentication server.

### Claim 10 (depends on 9)

The method of authenticating a user of claim 9, wherein encrypting the authentication token comprises utilizing an encryption key shared by the authentication server and application server to encrypt the authentication token wherein the encryption key is not known by the gatekeeper server.

### Claim 11 (depends on 10)

The method of authenticating a user of claim 10, further comprising decrypting the authentication token by the application server.

### Claim 12 (depends on 11)

The method of authenticating a user of claim 11, further comprising transmitting the authentication token by the application server to the gatekeeper server after transmitting the authentication token by the authentication server to the application server.

### Claim 13 (depends on 12)

The method of authenticating a user of claim 12, further comprising creating an outer token by the gatekeeper server.

### Claim 14 (depends on 1)

The method of authenticating a user of claim 1, further comprising wrapping the authentication token with the outer token using a key or key pair known only to the gatekeeper server to form a combined token and returning the combined token to the user.

### Claim 15 (depends on 1)

The method of authenticating a user of claim 1, wherein the user is an individual.

### Claim 16 (depends on 1)

The method of authenticating a user of claim 1, wherein the user is a computer.

### Claim 17 (depends on 1)

The method of authenticating a user of claim 1, wherein the user is a software function.

### Claim 18 (depends on 1)

The method of authenticating a user of claim 1, wherein the user credentials comprise a user name and password.

### Claim 19 (depends on 1)

The method of authenticating a user of claim 1, wherein authenticating the user by the authentication server comprises comparing the presented user credentials to stored user credentials.

### Claim 20 (depends on 1)

The method of authenticating a user of claim 1, wherein the user credentials comprise a digital certificate.

### Claim 21 (depends on 20)

The method of authentication a user of claim 20, wherein authenticating the user by the authentication server comprises verifying the identity of the user by exchanging messages between the authentication server and the user.

### Claim 22 (depends on 1)

The method of authenticating a user of claim 1, wherein the user credentials comprise a portable device containing data that authenticates the user.

### Claim 23 (depends on 1)

The method of authenticating a user of claim 1, wherein the user credentials comprise a user input and a value generated by a portable device that verifies the user input.

### Claim 24

An authentication system within a networked computer system, comprising:
a user;
an application server;
an authentication server separate from the application server utilized to authenticate a user; and
an authentication token generated by the authentication server to uniquely identify the user, wherein the authentication token is independent of the user credentials presented by the user and the authentication token is utilized by the application server to verify that the user has been authenticated by the authentication server, the authentication token being encrypted by the authentication server and the encrypted authentication token being wrapped by an outer token and encrypted to form a combined token, and
wherein the user is allowed to present the combined token to the gatekeeper server without having to be re-authenticated.

### Claim 25 (depends on 24)

The authentication system of claim 24, wherein the authentication server is communicatively connected to the networked computer system.

### Claim 26 (depends on 24)

The authentication system of claim 24, wherein communication to the authentication server is controlled by a protective device.

### Claim 27 (depends on 26)

The authentication system of claim 26, wherein the protective device is a firewall.

### Claim 28 (depends on 24)

The authentication system of claim 24, further comprising a gatekeeper server communicatively connected to the application server and the authentication server.

### Claim 29 (depends on 28)

The authentication system of claim 28, wherein the authentication server receives direct communication only from the gatekeeper server.

### Claim 30 (depends on 28)

The authentication system of claim 28, wherein the application server receives direct communication only from the gatekeeper server.

### Claim 31 (depends on 1)

The method of authenticating a user of claim 1, wherein the combined token is less than or equal to 2 kilobytes.

### Claim 32 (depends on 24)

The authentication system of claim 24, wherein the combined token is less than or equal to 2 kilobytes.

### Claim 33 (depends on 14)

The method of authenticating a user of claim 14, wherein the user returns the combined token to the gatekeeper server.

### Claim 34 (depends on 33)

The method of authenticating a user of claim 33, further comprising:
decrypting the combined token by the gatekeeper server,
evaluating the outer token by the gatekeeper server, and
passing the authentication token to the application server.