# US 8,544,069 B1 · Methods systems and articles of manufacture for implementing user access to remote resources

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,544,069 B1
- Document ID: US8544069B1
- Status: Granted
- Kind: B1
- Application number: 13/097,723
- Filed: 2011-04-29
- Granted: 2013-09-24
- Earliest claimed: 2011-04-29
- Assignees: Intuit Inc.
- Applicants: Thirugnanam Subbiah; Ken Hanscom
- Inventors: Thirugnanam Subbiah; Ken Hanscom
- Web page: https://patentgrep.com/patent/US8544069B1

## CPC

- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- G06F 21/41: where a single sign-on provides access to a plurality of computers
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/0884: {by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity}
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 61/4511: using domain name system [DNS]
- H04L 63/0815: {providing single-sign-on or federations}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Methods, systems, and articles of manufacture for implementing user access to remote resources residing on an external domain. Various implementations include authenticating and authorizing a user on a first system and receiving user request to access remote resources. The first system invokes processes or modules to initiate a new session to perform auto logon on behalf of the user on a second system by using stored user's credentials and subdomain delegation techniques without user intervention. The second system authenticates and authorizes this new session to allow user access to remote resources residing thereupon. The first system further prepares the user's system to take over the new session by setting cookie(s) and also by redirecting the URL so the user may continue to use the new session to access the desired remote resources residing on the second system.

## Claims

### Claim 1

A computer implemented method for implementing user access to a remote resource, comprising:
receiving, at a first computer, a request from a user computing device through a first network to access the remote resource, wherein the remote resource resides on a second computer accessible by the first computer through a second network;
performing, at the first computer, automatic logon for the user using stored user credentials, performing automatic logon comprising:
identifying or creating a new session between the first computer and the second computer, and
causing the user to be authenticated or authorized to the second computer via the new session utilizing an aggregation process, causing the user to be authenticated or authorized comprising:
invoking the aggregation process on the first computer,
using the aggregation process to retrieve or identify a user credential stored and accessible by the first computer, and
transmitting the user credential to the second computer for authenticating or authorizing the user on the second computer, wherein the stored user credentials authenticate or authorize the user to access the remote resource on the second computer when the user uses the stored user credentials to separately log onto the second computer, the new session between the first computer and the second computer through the second network is identified or created without using a single-sign-on mechanism in which one or more tickets are passed between the first computer and the second computer to service the remote resource to the user, and authentication of the user on the first computer grants the user access to the remote resource on the second computer; and
enabling, by the first computer, the user to access the remote resource by using the new session.

### Claim 2 (depends on 1)

The computer implemented method of claim 1, in which the action of receiving the request comprises:
identifying a first session between the user and the first computer;
allowing the user to access a product or a service on the first computer upon or after authenticating or authorizing the first session; and
receiving the request from the user via the first session.

### Claim 3 (depends on 1)

The computer implemented method of claim 1, in which the action of performing the automatic logon for the user is performed without user intervention.

### Claim 4 (depends on 1)

The computer implemented method of claim 1, in which the request from the user to access the remote resource comprises a single click in a user interface on the user's computing device.

### Claim 5 (depends on 1)

The computer implemented method of claim 1, in which the action of causing the user to be authenticated or authorized to the second computer further comprises:
receiving a cookie from the second computer for authenticating or authorizing the user, wherein the action of transmitting the user credential further comprises: sending the cookie with the user credential to the second computer.

### Claim 6 (depends on 1)

The computer implemented method of claim 1, in which the action of invoking the aggregation process comprises:
causing a subdomain delegation for a subdomain of a parent domain to be created on the second computer hosting the remote resource; and
creating or configuring a zone and domain name server records for the sub domain of the parent domain to direct access to the second computer to the first computer.

### Claim 7 (depends on 6)

The computer implemented method of claim 6, in which the sub domain of the parent domain is created or configured on the first computer.

### Claim 8 (depends on 6)

The computer implemented method of claim 6, further comprising:
creating or configuring a third system for the zone and the domain name server records for the sub domain of the parent domain.

### Claim 9 (depends on 6)

The computer implemented method of claim 6, in which the action of causing the sub domain delegation for the subdomain of the parent domain to be created on the second computer comprises:
identifying or creating a parent zone in the second computer hosting the parent domain in which the remote resource reside; and
creating or modifying a DNS (domain name server) zone file for the parent domain.

### Claim 10 (depends on 9)

The computer implemented method of claim 9, in which the action of causing the sub domain delegation for the sub domain of the parent domain to be created on the second computer further comprises:
identifying or creating a sub domain zone on the first computer.

### Claim 11 (depends on 10)

The computer implemented method of claim 10, in which the action of identifying or creating the subdomain zone on the first computer comprises:
identifying or creating the subdomain zone on the first computer; and
identifying or generating a subdomain configuration file that includes configurations of the sub domain.

### Claim 12 (depends on 11)

The computer implemented method of claim 11, in which the action of causing the sub domain delegation for the sub domain of the parent domain to be created on the second computer further comprises modifying the sub domain configuration file.

### Claim 13 (depends on 9)

The computer implemented method of claim 9, in which the action of creating or modifying the DNS (domain name server) zone file for the parent domain comprises:
defining a name server for the parent domain in the DNS zone file; and
defining an address record for the name server in the DNS zone file.

### Claim 14 (depends on 13)

The computer implemented method of claim 13, in which the action of creating or modifying the DNS (domain name server) zone file for the parent domain further comprises at least one of:
defining a parent domain level server, host, or service in the DNS zone file; and
defining the sub domain configuration for the parent domain in the DNS zone file.

### Claim 15 (depends on 1)

The computer implemented method of claim 1, in which the action of enabling the user to access the remote resource by using the first session comprises:
identifying a URL (uniform resource locator) redirection and a cookie that is received by the first computer from the second computer;
setting a browser cookie for a user browser on a parent domain of the second system; and
redirecting the user browser to a parent domain hosting the remote resource on the second computer via the new session.

### Claim 16 (depends on 15)

The computer implemented method of claim 15, in which the action of setting the browser cookie for the user browser comprises:
identifying content of the cookie;
identifying a session identifier for the new session based at least in part upon the content of the cookie; and
generating or modifying the browser cookie by using at least the session identifier.

### Claim 17 (depends on 16)

The computer implemented method of claim 16, in which the action of setting the browser cookie for the user browser further comprises:
determining whether or not to decompress or decrypt at least a portion of the content of the cookie, in which the portion comprises at least data of the new session;
identifying user preference from the cookie; and
setting the user preference in the browser cookie.

### Claim 18

A system for implementing user access to a remote resource, comprising a first computer that communicates with a user through a first network and is configured to at least
receive at the first computer, a request from the user through the first network to access the remote resource, wherein the remote resource resides on a second computer accessible by the first computer through a second network,
perform, at the first computer, automatic logon for the user using stored user credentials, which authenticate or authorize the user to access the remote resource on the second computer when the user uses the stored user credentials to separately log onto the second computer, and a new session between the first computer and the second computer through the second network without using a single-sign-on mechanism in which one or more tickets are passed between the first computer and the second computer to service the remote resource to the user, and authentication of the user on the first computer grants the user access to the remote resource on the second computer, and enable, by the first computer, the user to access the remote resource by using the new session, the first computer being further configured to identify or create the new session between the first computer and the second computer, cause the user to be authenticated or authorized to the second computer via the new session by using an aggregation process, invoke the aggregation process on the first computer, use the aggregation process to retrieve or identify a user credential that is stored and accessible by the first computer, transmit the user credential to the second computer for authenticating or authorizing the user on the second computer, cause a sub domain delegation for a sub domain of a parent domain to be created on the second computer hosting the remote resource, wherein the first computer that is configured to cause the subdomain delegation to be created is further configured to: create or configure a zone and domain name server records for the sub domain of the parent domain; and create or configure a third system for the zone and the domain name server records for the sub domain of the parent domain.

### Claim 19 (depends on 18)

The system of claim 18, in which the first computer that is configured to receive the request is further configured to identify a first session between the user and the first computer, allow the user to access a product or a service on the first system upon or after authenticating or authorizing the first session, and receive the request from the user via the first session.

### Claim 20 (depends on 18)

The system of claim 18, the first computer being further configured for performing the action of causing the user to be authenticated or authorized to the second computer, the action of causing the user to be authenticated or authorized to the second computer further comprising identifying or creating a parent zone in the second computer hosting the parent domain in which the remote resource reside, creating or modifying a DNS (domain name server) zone file for the parent domain, and identifying or creating a sub domain zone on the first computer.

### Claim 21 (depends on 18)

The system of claim 18, the first computer being further configured for performing the action of causing the user to be authenticated or authorized to the second computer, the action of causing the user to be authenticated or authorized to the second computer further comprising receiving a cookie from the second computer for authenticating or authorizing the user, wherein the action of transmitting the user credential further comprises sending the cookie with the user credential to the second computer.

### Claim 22

An article of manufacture comprising a non-transitory computer accessible storage medium having one or more instructions which, when executed by at least one processor, cause the at least one processor to perform a process for implementing user access to a remote resource, the process comprising: receiving, at the first computer, a request from a user through a first network to access the remote resource, wherein the remote resource resides on a second computer accessible by the first computer through a second network, performing, at the first computer, automatic logon for the user using stored user credentials, which authenticate or authorize the user to access the remote resource on the second computer when the user uses the stored user credentials to separately log onto the second computer, and a new session between the first computer and the second computer through the second network without using a single-sign-on mechanism in which one or more tickets are passed between the first computer and the second computer to service the remote resource to the user, and authentication of the user on the first computer grants the user access to the remote resource on the second computer, and enabling, by the first computer, the user to access the remote resource by using the new session, the action of performing the automatic logon for the user further comprising: identifying or creating the new session between the first computer and the second computer, causing the user to be authenticated or authorized to the second computer via the new session by using an aggregation process, invoking the aggregation process on the first computer, using the aggregation process to retrieve or identify a user credential that is stored and accessible by the first computer, transmitting the user credential to the second computer for authenticating or authorizing the user on the second computer, causing a subdomain delegation for a sub domain of a parent domain to be created on the second computer hosting the remote resource, the action of causing the subdomain delegation to be created comprising: creating or configuring a zone and domain name server records for the sub domain of the parent domain, and creating or configuring a third system for the zone and the domain name server records for the subdomain of the parent domain.

### Claim 23 (depends on 22)

The article of manufacture of claim 22, the action of receiving the request comprises further comprising: identifying a first session between the user and the first computer, allowing the user to access a product or a service on the first computer upon or after authenticating or authorizing the first session, and receiving the request from the user via the first session.

### Claim 24 (depends on 22)

The article of manufacture of claim 22, the action of causing the user to be authenticated or authorized to the second computer further comprising: identifying or creating a parent zone in the second computer hosting the parent domain in which the remote resource reside, creating or modifying a DNS (domain name server) zone file for the parent domain, and identifying or creating a subdomain zone on the first computer.

### Claim 25 (depends on 22)

The article of manufacture of claim 22, the action of causing the user to be authenticated or authorized to the second computer further comprising: receiving a cookie from the second computer for authenticating or authorizing the user, wherein the action of transmitting the user credential further comprises sending the cookie with the user credential to the second computer.