# US 8,544,067 B2 · System and method for authenticating web users

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,544,067 B2
- Document ID: US8544067B2
- Status: Granted
- Kind: B2
- Application number: 12/824,024
- Filed: 2010-06-25
- Published: 2011-12-29
- Granted: 2013-09-24
- Earliest claimed: 2010-06-25
- Assignees: Google Inc.
- Applicants: Andrew A. Grieve
- Inventors: Andrew A. Grieve
- Web page: https://patentgrep.com/patent/US8544067B2

## CPC

- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- G06F 21/31: User authentication
- H04L 63/102: {Entity profiles}
- H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP]
- H04L 63/168: {above the transport layer}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Disclosed are systems and methods for authenticating web users. In one embodiment, a method includes sending the destination web page to the parent frame of the web browser, where the destination web page when processed by the web browser is operable to perform operations, including determining if the web user is authenticated with the content provider and generating a child frame associated with the parent frame if the web user is not authenticated with the content provider. The destination web page is operable to perform further operations, including requesting, by the child frame, an authentication web page from an authorization provider, receiving, by the child frame, the authentication data from the authorization provider, and receiving, by the parent frame, the authentication data.

## Claims

### Claim 1

A method of authenticating a web user, the method comprising:
receiving a request, at a content provider, for a destination web page from a parent frame of a web browser associated with the web user, wherein the content provider comprises one or more computing devices;
sending the destination web page, from the content provider, to the parent frame of the web browser, wherein the destination web page when processed by the web browser is operable to perform operations comprising:
determining if the web user is authenticated with the content provider;
generating a child frame associated with the parent frame if the web user is not authenticated with the content provider;
requesting, by the child frame, an authentication web page from an authorization provider;
receiving, by the child frame, authentication data from the authorization provider, wherein the authentication data is associated with the web user; and
receiving, by the parent frame, the authentication data; and
receiving the authentication data at the content provider.

### Claim 2 (depends on 1)

A method according to claim 1, further comprising:
receiving the authentication data from the child frame of the web browser;
determining if the authentication data grants the web user access to one or more protected resources associated with the destination web page; and
sending the one or more protected resources to the parent frame of the web browser.

### Claim 3 (depends on 2)

A method according to claim 2, wherein the one or more protected resources comprise at least one selected from the group consisting of:
one or more photos;
one or more documents;
one or more contact lists; and
one or more Uniform Resource Identifiers (“URIs”).

### Claim 4 (depends on 1)

A method according to claim 1, wherein the destination web page when processed by the web browser is operable to perform further operations comprising continuing to process data associated with the destination web page in the parent frame while the child frame is concurrently retrieving the authentication data from the authorization provider.

### Claim 5 (depends on 1)

A method according to claim 1, wherein the destination web page comprises code.

### Claim 6 (depends on 5)

A method according to claim 5, wherein the code comprises JavaScript.

### Claim 7 (depends on 1)

A method according to claim 1, wherein the child frame is an iframe.

### Claim 8 (depends on 1)

A method according to claim 1, wherein the child frame is hidden to the web user.

### Claim 9 (depends on 8)

A method according to claim 8, wherein the destination web page comprises code to make the child frame appear invisible to the web user.

### Claim 10 (depends on 8)

A method according to claim 8, wherein the destination web page comprises code to place the child frame off any visible section of the web browser .

### Claim 11 (depends on 1)

A method according to claim 1, wherein the authentication data was generated by the authorization provider using a username and password entered by the web user.

### Claim 12 (depends on 1)

A method according to claim 1, wherein the authentication data is stored in an authentication token, wherein the authentication token represents an encrypted string comprising a username and password associated with the web user.

### Claim 13 (depends on 1)

A method according to claim 1, wherein the destination web page when processed by the web browser is operable to perform operations further comprising:
determining if the authentication data is stored at the authorization provider;
displaying the child frame to the web user if the web user is not authenticated with the content provider, wherein the visible child frame comprises an input field for a username of the web user and an input field for a password of the web user; and
sending the username and the password to the authorization provider, wherein the authorization provider is operable to generate the authentication data using the username and the password.

### Claim 14 (depends on 1)

A method according to claim 1, wherein the destination web page when processed by the web browser is operable to perform operations further comprising storing a cookie, wherein the cookie comprises the authentication data.

### Claim 15 (depends on 1)

A method according to claim 1, wherein the destination web page when processed by the web browser is operable to perform operations further comprising sending, by the parent frame, a cookie to the content provider, wherein the cookie comprises the authentication data.

### Claim 16

Logic for authenticating a web user, the logic being embodied in a non-transitory computer-readable medium and when executed operable to:
process data associated with a content provider in a parent frame of a web browser associated with a web user;
determine if the web user is authenticated with the content provider;
generate a child frame associated with the parent frame if the web user is not authenticated with the content provider;
request, by the child frame, an authentication web page from an authorization provider;
receive, by the child frame, authentication data from the authorization provider, wherein the authentication data is associated with the web user; and
receive, by the parent frame, the authentication data.

### Claim 17 (depends on 16)

The logic according to claim 16, wherein the logic is further operable to:
receive one or more protected resources, wherein the one or more protected resources are sent by the content provider if the web user is authenticated; and
display one or more protected resources in the parent frame.

### Claim 18 (depends on 17)

The logic according to claim 17, wherein the one or more protected resources comprise at least one selected from the group consisting of:
one or more photos;
one or more documents;
one or more contact lists; and
one or more Uniform Resource Identifiers (“URIs”).

### Claim 19 (depends on 16)

The logic according to claim 16, wherein the logic is further operable to continue to process the data associated with the destination web page in the parent frame while the child frame is concurrently requesting the authentication data from the authorization provider.

### Claim 20 (depends on 16)

The logic according to claim 16, wherein the destination web page comprises code.

### Claim 21 (depends on 20)

The logic according to claim 20, wherein the code comprises JavaScript.

### Claim 22 (depends on 16)

The logic according to claim 16, wherein the child frame is an iframe.

### Claim 23 (depends on 16)

The logic according to claim 16, wherein the child frame is hidden to the web user.

### Claim 24 (depends on 23)

The logic according to claim 23, wherein the logic is further operable to make the child frame appear invisible to the web user.

### Claim 25 (depends on 23)

The logic according to claim 23, wherein the logic is further operable to place the child frame off any visible section of the web browser .

### Claim 26 (depends on 16)

The logic according to claim 16, wherein the authentication data was generated by the authorization provider using a username and password entered by the web user.

### Claim 27 (depends on 16)

The logic according to claim 16, wherein the authentication data is stored in an authentication token, wherein the authentication token represents an encrypted string comprising a username and password associated with the web user.

### Claim 28 (depends on 16)

The logic according to claim 16, wherein the logic is further operable to:
determine if the authentication data is stored at the authorization provider;
display the child frame to the web user if the web user is not authenticated with the content provider, wherein the visible child frame comprises an input field for a username of the web user and an input field for a password of the web user; and
send the username and the password to the authorization provider, wherein the authorization provider is operable to generate the authentication data using the username and the password.

### Claim 29 (depends on 16)

The logic according to claim 16, wherein the logic is further operable to store a cookie, wherein the cookie comprises the authentication data.

### Claim 30 (depends on 16)

The logic according to claim 16, wherein the logic is further operable to send, by the parent frame, a cookie to the content provider, wherein the cookie comprises the authentication data.

### Claim 31

A system for authenticating a web user, the system comprising:
a content provider comprising one or more computing devices, wherein the content provider is operable to:
receive a request for a destination web page from a parent frame of a web browser associated with the web user;
send the destination web page to the parent frame of the web browser, wherein the destination web page when processed by the web browser is operable to perform operations comprising:
determining if the web user is authenticated with the content provider;
generating a child frame associated with the parent frame if the web user is not authenticated with the content provider;
requesting, by the child frame, an authentication web page from an authorization provider;
receiving, by the child frame, authentication data from the authorization provider, wherein the authentication data is associated with the web user; and
receiving, by the parent frame, the authentication data; and
receive the authentication data.

### Claim 32 (depends on 31)

A system according to claim 31, wherein the content provider is further operable to:
receive the authentication data from the child frame of the web browser;
determine if the authentication data grants the web user access to one or more protected resources associated with the destination web page; and
send the one or more protected resources to the parent frame of the web browser.

### Claim 33 (depends on 32)

A system according to claim 32, wherein the one or more protected resources comprise at least one selected from the group consisting of:
one or more photos;
one or more documents;
one or more contact lists; and
one or more Uniform Resource Identifiers (“URIs”).

### Claim 34 (depends on 31)

A system according to claim 31, wherein the destination web page when processed by the web browser is operable to perform further operations comprising continuing to process data associated with the destination web page in the parent frame while the child frame is concurrently requesting the authentication data from the authorization provider.

### Claim 35 (depends on 31)

A system according to claim 31, wherein the destination web page comprises code.

### Claim 36 (depends on 35)

A system according to claim 35, wherein the code comprises JavaScript.

### Claim 37 (depends on 31)

A system according to claim 31, wherein the child frame is an iframe.

### Claim 38 (depends on 31)

A system according to claim 31, wherein the child frame is hidden to the web user.

### Claim 39 (depends on 38)

A system according to claim 38, wherein the destination web page comprises code to make the child frame appear invisible to the web user.

### Claim 40 (depends on 38)

A system according to claim 38, wherein the destination web page comprises code to place the child frame off any visible section of the web browser.

### Claim 41 (depends on 31)

A system according to claim 31, wherein the authentication data was generated by the authorization provider using a username and password entered by the web user.

### Claim 42 (depends on 31)

A system according to claim 31, wherein the authentication data is stored in an authentication token, wherein the authentication token represents an encrypted string comprising a username and password associated with the web user.

### Claim 43 (depends on 31)

A system according to claim 31, wherein the destination web page when processed by the web browser is operable to perform operations further comprising:
determining if the authentication data is stored at the authorization provider;
displaying the child frame to the web user if the web user is not authenticated with the content provider, wherein the visible child frame comprises an input field for a username of the web user and an input field for a password of the web user; and
sending the username and the password to the authorization provider, wherein the authorization provider is operable to generate the authentication data using the username and the password.

### Claim 44 (depends on 31)

A system according to claim 31, wherein the destination web page when processed by the web browser is operable to perform operations further comprising storing a cookie, wherein the cookie comprises the authentication data.

### Claim 45 (depends on 31)

A system according to claim 31, wherein the destination web page when processed by the web browser is operable to perform operations further comprising sending, by the parent frame, a cookie to the content provider, wherein the cookie comprises the authentication data.