US 9,319,399 B2Granted

Consolidated authentication

AssigneeInternational Business Machines Corporation

InventorsYaser K. Doleh, Christopher G. Kalamaras, Mauro Marzorati

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method and system for authenticating a user at a first computer to first and second applications installed in a second computer. The second computer receives from the user a first request to access the first application, and in response, the second computer redirects the first request to a third computer, and in response, the third computer determines that the user was previously authenticated and so notifies the second computer, and in response, the second computer returns a first session key to the third computer. The first session key enables a session with the first application but not with the second application. The second computer receives from the user a second request with a second session key to access the first and/or second application, and in response the second computer determines that the user is authentic and notifying the first and/or second application that the user is authentic.

Claims18

Dependent claims

A method for authenticating a user at a first computer to first and second applications installed in a second computer, the method comprising:

said second computer receiving from the user a first request to access the first application, and in response, the second computer redirecting the first request to a third computer, and in response, the third computer determining that the user was previously authenticated and notifying the second computer that the user is authentic, and in response, the second computer returning a first session key to the third computer, said first session key enabling a session with the first application but not with the second application, said first, second, and third computers being three different computers, said first and second applications installed in the second computer being different applications;
and
said second computer receiving from the user a second request with a second session key to access the first application, the second application, or both the first application and the second application, and in response the second computer determining that the user is authentic and notifying the first application, the second application, or both the first application and the second application that the user is authentic so that the first application, the second application, or both the first application and the second application can send, to the first computer, a response to the second request,
wherein the second session key was generated by the third computer, and sent by the third computer to the first computer, prior to the second computer having received the second request and in response to the third computer having received the first session key, and
wherein the second session key enables a session with both the first application and the second application.

2 more elements

A computer program product, comprising one or more computer readable tangible storage devices and program instructions stored on the one or more storage devices, said program instructions configured to be executed by one or more processors to implement a method for authenticating a user at a first computer to first and second applications installed in a second computer, said method comprising:

said second computer receiving from the user a first request to access the first application, and in response, the second computer redirecting the first request to a third computer, and in response, the third computer determining that the user was previously authenticated and notifying the second computer that the user is authentic, and in response, the second computer returning a first session key to the third computer, said first session key enabling a session with the first application but not with the second application, said first, second, and third computers being three different computers, said first and second applications installed in the second computer being different applications;
and
said second computer receiving from the user a second request with a second session key to access the first application, the second application, or both the first application and the second application, and in response the second computer determining that the user is authentic and notifying the first application, the second application, or both the first application and the second application that the user is authentic so that the first application, the second application, or both the first application and the second application can send, to the first computer, a response to the second request,
wherein the second session key was generated by the third computer, and sent by the third computer to the first computer, prior to the second computer having received the second request and in response to the third computer having received the first session key, and
wherein the second session key enables a session with both the first application and the second application.

2 more elements

A computer system comprising one or more processors, one or more computer readable memories, and one or more computer readable tangible storage devices, and program instructions stored on the one or more storage devices, said program instructions configured to be executed by the one or more processors via the one or more memories to implement a method for authenticating a user at a first computer to first and second applications installed in a second computer, said method comprising:

said second computer receiving from the user a first request to access the first application, and in response, the second computer redirecting the first request to a third computer, and in response, the third computer determining that the user was previously authenticated and notifying the second computer that the user is authentic, and in response, the second computer returning a first session key to the third computer, said first session key enabling a session with the first application but not with the second application, said first, second, and third computers being three different computers, said first and second applications installed in the second computer being different applications;
and
said second computer receiving from the user a second request with a second session key to access the first application, the second application, or both the first application and the second application, and in response the second computer determining that the user is authentic and notifying the first application, the second application, or both the first application and the second application that the user is authentic so that the first application, the second application, or both the first application and the second application can send, to the first computer, a response to the second request,
wherein the second session key was generated by the third computer, and sent by the third computer to the first computer, prior to the second computer having received the second request and in response to the third computer having received the first session key, and
wherein the second session key enables a session with both the first application and the second application.

2 more elements

Dependencies are inferred from the claim text.

Facts

Application: 14/505,520Filed 3 Oct 2014 · continuation
Priority: 7 May 2008
Published: US 2015/0020184 A115 Jan 2015
Granted: 19 Apr 2016
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 63/0815
For authentication of entities: providing single-sign-on or federations
G06F 21/335
Using certificates: for accessing specific resources, e.g. using Kerberos tickets
G06F 21/41
User authentication: where a single sign-on provides access to a plurality of computers
H04L 63/083
For authentication of entities: using passwords

Family

Application12/116,616Parent of this continuation · filed 7 May 2008
Application13/480,038Parent of this continuation · filed 24 May 2012
US 8,219,802 B2Parent of this continuation · filed 10 Jul 2012
US 2015/0020184 A1Pre-grant publication · published 15 Jan 2015
US 8,880,872 B2Parent of this continuation
US 2009/0282239 A1Published application
US 2012/0291141 A1Published application
US 9,319,399 B2This patent

From the US filing history. Foreign family members aren’t listed.