Method and system for managing access to protected computer resources provided via an internet protocol network

DC CAFC

US 8,127,345 B2
Filed: 10/30/2007
Issued: 02/28/2012
Est. Priority Date: 06/11/1997
Status: Expired due to Fees

- Alert
- Pin

Associated Cases

Associated Defendants

First Claim

Patent Images

1. A method for controlling access, by at least one authentication server, to protected computer resources provided via an Internet Protocol network, the method comprising:

receiving, at the at least one authentication server from at least one access server, identity data associated with at least one client computer device, the identity data forwarded to the at least one access server from the at least one client computer device with a request from the at least one client computer device for the protected computer resources;

authenticating, by the at least one authentication server, the identity data received from the at least one access server, the identity data being stored in the at least one authentication server;

authorizing, by the at least one authentication server, the at least one client computer device to receive at least a portion of the protected computer resources requested by the at least one client computer device, based on data associated with the requested protected computer resources stored in at least one database associated with the at least one authentication server; and

permitting access, by the at least one authentication server, to the at least the portion of the protected computer resources upon successfully authenticating the identity data and upon successfully authorizing the at least one client computer device.

View all claims

3 Assignments

Timeline View

Assignment View

Litigations

0 Petitions

Accused Products

Abstract

A method and system for controlling access, by an authentication server, to protected computer resources provided via an Internet Protocol network that includes storing (i) a digital identification associated with at least one client computer device, and (ii) data associated with the protected computer resources in at least one database associated with the authentication server; authenticating, by the authentication server, the digital identification forwarded by at least one access server; authorizing, by the authentication server, the at least one client computer device to receive at least a portion of the protected computer resources requested by the at least one client computer device, based on the stored data associated with the requested protected computer resources; and permitting access, by the authentication server, to the at least the portion of the protected computer resources upon successfully authenticating the digital identification and upon successfully authorizing the at least once client computer device.

182 Citations

92 Claims

1. A method for controlling access, by at least one authentication server, to protected computer resources provided via an Internet Protocol network, the method comprising:
- receiving, at the at least one authentication server from at least one access server, identity data associated with at least one client computer device, the identity data forwarded to the at least one access server from the at least one client computer device with a request from the at least one client computer device for the protected computer resources;
  
  authenticating, by the at least one authentication server, the identity data received from the at least one access server, the identity data being stored in the at least one authentication server;
  
  authorizing, by the at least one authentication server, the at least one client computer device to receive at least a portion of the protected computer resources requested by the at least one client computer device, based on data associated with the requested protected computer resources stored in at least one database associated with the at least one authentication server; and
  
  permitting access, by the at least one authentication server, to the at least the portion of the protected computer resources upon successfully authenticating the identity data and upon successfully authorizing the at least one client computer device.
- View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48)
- - 2. The method of claim 1, wherein the Internet Protocol network comprises the Internet.
  - 3. The method of claim 1, wherein the Internet Protocol network comprises TCP/IP.
  - 4. The method of claim 1, wherein the Internet Protocol network comprises UDP/IP.
  - 5. The method of claim 1, further comprising deriving the identity data from at least one internal hardware component of the at least one client computer device.
  - 6. The method of claim 1, further comprising deriving the identity data from one of an external device and an external object connected to the at least one client computer device.
  - 7. The method of claim 1, further comprising deriving the identity data from one of an external device and an external object inserted into a reader.
  - 8. The method of claim 1, further comprising deriving the identity data from at least a portion of a plurality of hardware components associated with the at least one client computer device.
  - 9. The method of claim 1, further comprising generating the identity data from at least one internal hardware component of the at least one client computer device.
  - 10. The method of claim 1, further comprising generating the identity data from one of an external device and an external object inserted into a reader.
  - 11. The method of claim 1, further comprising generating the identity data from at least a portion of a plurality of hardware components associated with the at least one client computer device,
  - 12. The method of claim 1, wherein the identity data comprises a digital certificate associated with the at least one client computer device.
  - 13. The method of claim 1, wherein the identity data associated with the at least one client computer device is encrypted.
  - 14. The method of claim 13, wherein the identity data associated with the at least one client computer device is encrypted using at least one asymmetric key.
  - 15. The method of claim 13, wherein the identity data associated with the at least one client computer device encrypted using at least one symmetric key.
  - 16. The method of claim 1, wherein the identity data associated with the at least one client computer device contains at least one hash value.
  - 17. The method of claim 1, wherein the client computer device authenticates the access server.
  - 18. The method of claim 1, wherein the receiving of the identity data associated with the at least one client computer device includes the receiving of the identity data associated with the at least one client computer device and at least one of a username and a password.
  - 19. The method of claim 1, further comprising encrypting at least a portion of the identity data.
  - 20. The method of claim 1, wherein the identity data associated with the at least one client computer device is known in advance.
  - 21. The method of claim 1, wherein the identity data associated with the at least one client computer device is unique.
  - 22. The method of claim 21, wherein the identity data associated with the at least one client computer device is unique to the at least one client computer device.
  - 23. The method of claim 21, wherein the identity data associated with the at least one client computer device is unique to a group of client computer devices comprising the at least one client computer device.
  - 24. The method of claim 1, wherein the identity data being stored in the at least one authentication server is stored in at least one database associated with the at least one authentication server.
  - 25. The method of claim 1, further comprising storing the at least the portion of the protected computer resources on at least one server computer associated with the at least one access server.
  - 26. The method of claim 1, further comprising providing, by at least one server associated with the at least one access server, the at least the portion of the requested protected computer resources to the at least one client computer device upon the at least one authentication server permitting access to the at least the portion of the protected computer resources.
  - 27. The method of claim 1, further comprising storing the at least the portion of the protected computer resources in at least one of a plurality of server computers associated with the at least one access server.
  - 28. The method of claim 1, further comprising storing the at least the portion of the protected computer resources in the at least one access server.
  - 29. The method of claim 1, further comprising providing, by at least one of a plurality of multiple servers associated with the at least one access server, the at least the portion of the requested protected computer resources to the at least one client computer device upon the at least one authentication server permitting access to the at least the portion of protected computer resources.
  - 30. The method of claim 1, further comprising encrypting at least a portion of the protected computer resources.
  - 31. The method of claim 1, further comprising locating the at least one authentication server on a computer separate from the at least one access server.
  - 32. The method of claim 1, further comprising locating the at least one authentication server on the same computer as the at least one access server.
  - 33. The method of claim 1, wherein at least one of the functions of the at least one authentication server are performed by another server associated with the at least one authentication server.
  - 34. The method of claim 1, wherein authenticating, by the at least one authentication server, includes the at least one authentication server authenticating multiple client computer devices.
  - 35. The method of claim 1, wherein authenticating, by the at least one authentication server, includes the at least one authentication server authenticating multiple access servers.
  - 36. The method of claim 1, wherein authenticating, by the at least one authentication server, is performed by one of a plurality of servers associated with the at least one authentication server.
  - 37. The method of claim 1, wherein authorizing, by the at least one authentication server, is performed by one of a plurality of servers associated with the at least one authentication server.
  - 38. The method of claim 1, wherein permitting, by the at least one authentication server, is performed by one of a plurality of servers associated with the at least one authentication server.
  - 39. The method of claim 1, further comprising assigning one of a plurality of authorization levels to the at least a portion of the protected computer resources, assigning a particular authorization level to the identity data associated with the at least one client computer device, and only permitting access to particular protected computer resources by the at least one client computer device permitted by the particular authorization level.
  - 40. The method of claim 1, wherein the storing of the identity data includes storing identity data associated with the at least one access server in the at least one authentication server.
  - 41. The method of claim 40, further comprising forwarding the identity data associated with the at least one access server to the at least one authentication server.
  - 42. The method of claim 41, further comprising authenticating the identity data associated with the at least one access server by the at least one authentication server responsive to the at least one client computer device making the request for the at least a portion of the protected computer resources.
  - 43. The method of claim 42, further comprising permitting access to the requested at least a portion of the protected computer resources, wherein such permitting access includes permitting access by the at least one authentication server to the at least a portion of the protected computer resources responsive to successfully authenticating the at least one access server and the at least one client computer device making the request.
  - 44. The method of claim 1, further comprising providing, by the at least one access server, the at least the portion of the requested protected computer resources to the at least one client computer device upon the at least one authentication server permitting access to the at least the portion of the protected computer resources.
  - 45. The method of claim 1, further comprising selectively requiring the client computer device to forward its identity data to the at least one access server.
  - 46. The method of claim 1, further comprising selectively prompting the at least one client computer device to provide its identity data and at least one of a username and a password.
  - 47. The method of claim 1, further comprising selectively querying the at least one client computer device to generate the identity data associated with the at least one client computer device.
  - 48. The method of claim 1, further comprising changing, by the at least one access server, the identity data associated with the at least one client computer device, and forwarding the changed identity data to the at least one authentication server.

49. A method for controlling access, by at least one authentication server, to protected computer resources provided via an Internet Protocol network, the method comprising:
- receiving, at the at least one authentication server from at least one access server, identity data of the at least one access server and identity data associated with at least one client computer device, the identity data associated with the at least one client computer device forwarded to the at least one access server from the at least one client computer device with a request from the at least one client computer device for the protected computer resources;
  
  authenticating, by the at least one authentication server, the identity data of the at least one access server and the identity data associated with the at least one client computer device received from the at least one access server, the identity data of the at least one access server and the identity data associated with the at least on client computer device being stored in the at least one authentication server;
  
  authorizing, by the at least one authentication server, the at least one client computer device to receive at least a portion of the protected computer resources requested by the at least one client computer device, based on data associated with the requested protected computer resources stored in at least one database associated with the at least one authentication server; and
  
  permitting access, by the at least one authentication server, to the at least the portion of the protected computer resources upon successfully authenticating the identity data of the at least one access server and the identity data of the at least one client computer device and upon successfully authorizing the at least one client computer device.
- View Dependent Claims (50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92)
- - 50. The method of claim 49, wherein the Internet Protocol network comprises the Internet.
  - 51. The method of claim 49, wherein the Internet Protocol network comprises TCP/IP.
  - 52. The method of claim 49, wherein the Internet Protocol network comprises UDP/IP.
  - 53. The method of claim 49, further comprising deriving the identity data associated with the at least one client computer device from at least one internal hardware component of the at least one client computer device.
  - 54. The method of claim 49, further comprising deriving the identity data associated with the at least one client computer device from one of an external device and an external object connected to the at least one client computer device.
  - 55. The method of claim 49, further comprising deriving the identity data associated with the at least one client computer device from one of an external device and an external object inserted into a reader.
  - 56. The method of claim 49, further comprising deriving the identity data associated with the at least one client computer device from at least a portion of a plurality of hardware components associated with the at least one client computer device.
  - 57. The method of claim 49, further comprising generating the identity data associated with the at least one client computer device from at least one internal hardware component of the at least one client computer device.
  - 58. The method of claim 49, further comprising generating the identity data associated with the at least one client computer device from one of an external device and an external object inserted into a reader.
  - 59. The method of claim 49, further comprising generating the identity data associated with the at least one client computer device from at least a portion of a plurality of hardware components associated with the at least one client computer device.
  - 60. The method of claim 49, wherein the identity data associated with the at least one client computer device comprises a digital certificate associated with the at least one client computer device.
  - 61. The method of claim 49, wherein the identity data associated with the at least one client computer device is encrypted.
  - 62. The method of claim 61, wherein the identity data associated with the at least one client computer device is encrypted using at least one asymmetric key.
  - 63. The method of claim 61, wherein the identity data associated with the at least one client computer device encrypted using at least one symmetric key.
  - 64. The method of claim 49, wherein the identity data associated with the at least one client computer device contains at least one hash value.
  - 65. The method of claim 49, wherein the client computer device authenticates the access server.
  - 66. The method of claim 49, wherein the receiving of the identity data associated with the at least one client computer device includes the receiving of the identity data associated with the at least one client computer device and at least one of a username and a password.
  - 67. The method of claim 49, further comprising encrypting at least a portion of the identity data associated with the at least one client computer device.
  - 68. The method of claim 49, wherein the identity data associated with the at least one client computer device is known in advance.
  - 69. The method of claim 49, wherein the identity data associated with the at least one client computer device is unique.
  - 70. The method of claim 69, wherein the identity data associated with the at least one client computer device is unique to the at least one client computer device.
  - 71. The method of claim 69, wherein the identity data associated with the at least one client computer device is unique to a group of client computer devices comprising the at least one client computer device.
  - 72. The method of claim 49, wherein the identity data associated with the at least one client computer device being stored in the at least one authentication server is stored in at least one database associated with the at least one authentication server.
  - 73. The method of claim 49, further comprising storing the at least the portion of the protected computer resources on at least one server computer associated with the at least one access server.
  - 74. The method of claim 49, further comprising providing, by at least one server associated with the at least one access server, the at least the portion of the requested protected computer resources to the at least one client computer device upon the at least one authentication server permitting access to the at least the portion of the protected computer resources.
  - 75. The method of claim 49, further comprising storing the at least the portion of the protected computer resources in at least one of a plurality of server computers associated with the at least one access server.
  - 76. The method of claim 49, further comprising storing the at least the portion of the protected computer resources in the at least one access server.
  - 77. The method of claim 49, further comprising providing, by at least one of a plurality of multiple servers associated with the at least one access server, the at least the portion of the requested protected computer resources to the at least one client computer device upon the at least one authentication server permitting access to the at least the portion of protected computer resources.
  - 78. The method of claim 49, further comprising encrypting at least a portion of the protected computer resources.
  - 79. The method of claim 49, further comprising locating the at least one authentication server on a computer separate from the at least one access server.
  - 80. The method of claim 49, further comprising locating the at least one authentication server on the same computer as the at least one access server.
  - 81. The method of claim 49, wherein at least one of the functions of the at least one authentication server are performed by another server associated with the at least one authentication server.
  - 82. The method of claim 49, wherein authenticating, by the at least one authentication server, includes the at least one authentication server authenticating multiple client computer devices.
  - 83. The method of claim 49, wherein authenticating, by the at least one authentication server, includes the at least one authentication server authenticating multiple access servers.
  - 84. The method of claim 49, wherein authenticating, by the at least one authentication server, is performed by one of a plurality of servers associated with the at least one authentication server.
  - 85. The method of claim 49, wherein authorizing, by the at least one authentication server, is performed by one of a plurality of servers associated with the at least one authentication server.
  - 86. The method of claim 49, wherein permitting, by the at least one authentication server, is performed by one of a plurality of servers associated with the at least one authentication server.
  - 87. The method of claim 49, further comprising assigning one of a plurality of authorization levels to the at least a portion of the protected computer resources, assigning a particular authorization level to the identity data associated with the at least one client computer device, and only permitting access to particular protected computer resources by the at least one client computer device permitted by the particular authorization level.
  - 88. The method of claim 49, further comprising providing, by the at least one access server, the at least the portion of the requested protected computer resources to the at least one client computer device upon the at least one authentication server permitting access to the at least the portion of the protected computer resources.
  - 89. The method of claim 49, further comprising selectively requiring the client computer device to forward its identity data associated with the at least one client computer device to the at least one access server.
  - 90. The method of claim 49, further comprising selectively prompting the at least one client computer device to provide its identity data and at least one of a username and a password.
  - 91. The method of claim 49, further comprising selectively querying the at least one client computer device to generate the identity data associated with the at least one client computer device.
  - 92. The method of claim 49, further comprising changing, by the at least one access server, the identity data associated with the at least one client computer device, and forwarding the changed identity data to the at least one authentication server.

Specification

Resources

Litigation Campaign Assessment

Litigation Data

Current Assignee
Prism Technologies LLC (Prism Technologies Group, Inc.)
Original Assignee
Prism Technologies LLC (Prism Technologies Group, Inc.)
Inventors
Gregg, Richard L., Giri, Sandeep, Goeke, Timothy C.
Primary Examiner(s)
Zand, Kambiz
Assistant Examiner(s)
WYSZYNSKI, AUBREY H

Application Number

US11/978,919
Publication Number

US 20080066168A1
Time in Patent Office

1,582 Days
Field of Search

726/7, 726/4, 726/5
US Class Current

726/7
CPC Class Codes

G06F 21/335   for accessing specific reso...

G06F 21/44   Program or device authentic...

G06F 2221/2101   Auditing as a secondary aspect

G06F 2221/2129   Authenticate client device ...

G06F 2221/2135   Metering

G06F 2221/2141   Access rights, e.g. capabil...

G06F 2221/2149   Restricted operating enviro...

G06Q 2220/00   Business processing using c...

H04L 2463/102   applying security measure f...

H04L 63/08   for authentication of entit...

H04L 63/0823   using certificates cryptogr...

H04L 63/083   using passwords cryptograph...

H04L 63/0853   using an additional device,...

H04L 63/10   for controlling access to d...

Method and system for managing access to protected computer resources provided via an internet protocol network

First Claim

3 Assignments

Litigations

0 Petitions

Accused Products

Abstract

182 Citations

92 Claims

Specification

Solutions

Use Cases

Quick Links

Method and system for managing access to protected computer resources provided via an internet protocol network

First Claim

3 Assignments

Subscription Required

Subscription Required

Litigations

0 Petitions

Subscription Required

Accused Products

Subscription Required

Abstract

182 Citations

92 Claims

Specification

Subscription Required

Solutions

Use Cases

Quick Links