US20020083012A1 - Method and system for account management - Google Patents

Method and system for account management Download PDF

Info

Publication number
US20020083012A1
US20020083012A1 US09/747,307 US74730700A US2002083012A1 US 20020083012 A1 US20020083012 A1 US 20020083012A1 US 74730700 A US74730700 A US 74730700A US 2002083012 A1 US2002083012 A1 US 2002083012A1
Authority
US
United States
Prior art keywords
account
user
identifier
node
computer
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US09/747,307
Inventor
Steve Bush
Edward Jung
Holly Knight
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
OpenDesign Inc
Original Assignee
Individual
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to US09/747,307 priority Critical patent/US20020083012A1/en
Application filed by Individual filed Critical Individual
Assigned to OPENDESIGN, INC. reassignment OPENDESIGN, INC. ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: BUSH, STEVE, JUNG, EDWARD, KNIGHT, HOLLY
Assigned to IMPERIAL BANK reassignment IMPERIAL BANK SECURITY AGREEMENT Assignors: OPENDESIGN, INC.
Priority to PCT/US2001/049000 priority patent/WO2002052390A2/en
Priority to JP2002553624A priority patent/JP2005502931A/en
Priority to CA002432468A priority patent/CA2432468A1/en
Priority to EP01991263A priority patent/EP1346273A2/en
Priority to AU2002231002A priority patent/AU2002231002A1/en
Publication of US20020083012A1 publication Critical patent/US20020083012A1/en
Assigned to MURDOCK, JERRY, DOBKIN ERIC S. CHARITABLE REMAINDER TRUST, NEUSTEIN, ROBIN, INTELLECTUAL VENTURES HOLDINGS, INC., WESTGATE ENTERPRISES III, CANYON GATE INVESTMENTS, LLC, HUMPHREY, ROBERT, ROBERT J. HURST FOUNDATION, HOSIER, GERALD D. reassignment MURDOCK, JERRY SECURITY INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: OPENDESIGN, INC.
Assigned to OPENDESIGN, INC reassignment OPENDESIGN, INC RELEASE Assignors: COMERICA BANK-CALIFORNIA, AS SUCCESSOR IN INTEREST TO IMPERAL BANK
Assigned to INTELLECTUAL VENTURES HOLDINGS, INC. reassignment INTELLECTUAL VENTURES HOLDINGS, INC. SECURITY INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: OPENDESIGN, INC.
Assigned to OPENDESIGN, INC. reassignment OPENDESIGN, INC. RELEASE Assignors: COMERICA BANK - CALIFORNIA, AS SUCCESSOR-IN-INTEREST TO IMPERIAL BANK
Priority to US11/541,430 priority patent/US9171308B2/en
Priority to JP2008048660A priority patent/JP4887315B2/en
Priority to JP2008048661A priority patent/JP5398155B2/en
Priority to JP2009256057A priority patent/JP5368942B2/en
Priority to US14/921,967 priority patent/US20160119352A1/en
Abandoned legal-status Critical Current

Links

Images

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/38Payment protocols; Details thereof
    • G06Q20/382Payment protocols; Details thereof insuring higher security of transaction
    • G06Q20/3821Electronic credentials
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q20/00Payment architectures, schemes or protocols
    • G06Q20/38Payment protocols; Details thereof
    • G06Q20/40Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
    • G06Q20/401Transaction verification
    • G06Q20/4012Verifying personal identification numbers [PIN]
    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06QINFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
    • G06Q30/00Commerce
    • G06Q30/02Marketing; Price estimation or determination; Fundraising
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/08Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083Network architectures or network communication protocols for network security for authentication of entities using passwords
    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00Network arrangements or protocols for supporting network services or applications
    • H04L67/2866Architectures; Arrangements
    • H04L67/30Profiles
    • H04L67/306User profiles

Definitions

  • the described technology relates generally to management of accounts; particularly, accounts for accessing computer resources from various nodes.
  • Techniques for accessing computer resources require that the accessing user be authorized to access the computer resource.
  • the authorization is typically verified using a logon procedure in which a user supplies their credentials (e.g., user identifier and password) to the system that controls access to the computer resource.
  • credentials e.g., user identifier and password
  • the system receives the credentials, it determines whether the user is authorized to access the resource (e.g., by checking capabilities associated with the user identifier). If so, then the system allows the user to access the computer resource.
  • a database program may require a user to supply their user identifier and password before accessing (e.g., reading and writing) the data in the database.
  • Such techniques for accessing computer resources are well adapted to environments in which the computer resources (e.g., data in a database) are provided by a single source.
  • a news service may require a user to logon before accessing any news stories during that logon session.
  • the news service may then bill the user on a monthly basis for all the news stories accessed during the month.
  • Each provider of computer resources typically develops their own logon procedures.
  • a problem with such development is that each provider duplicates the efforts of other providers when developing their own logon procedures.
  • Another problem with such development is that each provider may use different types of logon procedures which tends to confuse users. For example, one provider may require a password to be at least 8 characters while another provider may require that passwords be 5 to 7 characters.
  • FIG. 1A illustrates a display page for entry of the user identifier.
  • FIG. 1B illustrates a display page through which a user enters their temporary password and new password.
  • FIG. 1C illustrates a display page for identifying common accounts.
  • FIG. 2 is a block diagram illustrating the account management system in one embodiment.
  • FIG. 3 is a block diagram illustrating the tables of the accounts database in one embodiment.
  • FIG. 4 is a block diagram illustrating components of a client computer in one embodiment.
  • FIG. 5 is a flow diagram illustrating the processing of the start application component of a client computer.
  • FIG. 6 is a flow diagram of the connect node component of the client computer.
  • FIG. 7 is a flow diagram illustrating the processing of the register user component of the client computer.
  • FIG. 8 is a flow diagram illustrating the processing of the logon user component in one embodiment.
  • FIG. 9 is a flow diagram illustrating the processing of the process logon response component of the client computer.
  • FIG. 10 is a flow diagram of the processing of the register node component of the server computer.
  • FIG. 11 is a flow diagram of the processing of the connect node component of the server computer.
  • FIG. 12 is a flow diagram of the processing of the disconnect node component of the server computer.
  • FIG. 13 is a flow diagram of the processing of the register user component of the server computer.
  • FIG. 14 is a flow diagram of the processing of the process logon request component of the server computer.
  • the account management system allows providers to use a common logon procedure through an account management server.
  • the account management system dynamically creates accounts when users request to access resources.
  • a user provides their credentials (e.g., user identifier and password) through a certain location (e.g., client computer) and identifies the resource (e.g., application).
  • the account management system determines whether an account has already been created for those credentials. If not, the account management system authenticates the user, creates a new account for those credentials (i.e., registration), and associates the identified resource with the account.
  • the account management system associates the identified resource with that account.
  • the account management system then notifies the provider that the user is authorized to access the resource.
  • accounts are automatically created when a resource is accessed, and access to different resources using the same credentials automatically ties the resources to the same account.
  • the user again provides their credentials and identifies the different resource. Since an account has already been created for those credentials, the account management system simply associates the different resource with the account if not already associated.
  • Each provider can customize their logon procedures as long as the provider adheres to the procedures defined by the account management system for acceptable credentials.
  • a provider can use the account management system in such a way that their users are not even aware of the account management system. Because resources of two different providers are associated with a single account, the account management system can generate a single report (e.g., bills) for the user that reflects the user's access of both resources.
  • a single report e.g., bills
  • One aspect of the account management system provides a technique for identifying common accounts when a user provides different credentials for accessing different resources such as, for example, when the same user accesses one resource using one user identifier and then accesses another resource using another user identifier.
  • the account management system creates a separate account for each user, and the user may have multiple unique sets of credentials.
  • the account management system associates accounts with nodes or locations. It tries to identify common accounts when a user accesses a resource from one node using credentials of an account associated with another node and the node from which the user is accessing the resource already has an account associated with it.
  • the account management system When the account management system creates an account, it associates that account with the node (e.g., computer) through which the user has requested to access the resource. When the account management system receives a request from the user at that node to access a resource of another account associated with another node, it determines whether the account associated with the node and the account associated with the other node should be considered the same account. For example, a household may have two computers. One family member may have accessed a resource from one computer using their own identifier and another family member may have accessed another resource (or the same resource) from the other computer using their own identifier. The account management system would create two accounts and associate the accounts with the different computers.
  • the node e.g., computer
  • the account management system When one family member tries to access through the other computer a resource using their own identifier, the account management system detects that the account associated with the computer and the account associated with the other computer are possibly common accounts. The account management system may prompt the user to indicate whether the different user identifiers should really represent the same account. If so, then the account management system updates its records to reflect that the two user identifiers represent the same accounts. In such a case, the users will access each resource using their own user identifiers. Since the accessing of both resources is tied to a single account, information relating to such accessing (e.g., billings, notifications, and preferences) may be combined. The account management system similarly identifies common accounts when one user uses two different user identifiers.
  • the account management system authorizes access to resources based on whether that pair of credentials has already been associated with that resource. If so, the account management system authorizes access to the resource.
  • the account management system may track combinations of credentials and resources. Thus, within one account, different sets of credentials (e.g., different user name and password) can be used to access different or even the same resource. To avoid user confusion, the account management system may, however, require each resource associated with an account to have only one authorized set of credentials, even though another resource of the account may be associated with a different set of credentials. Thus, the credentials of one family member cannot be used to access a resource of the common account when that resource is associated with the credentials of the other family member.
  • Another aspect of the account management system allows users to access their accounts from different nodes.
  • a user requests to access a resource using a node and the user's account is not currently associated with that node, then the account management system associates the account with that node. If the user specifies that access through the node is only on a temporary basis, for example, because the user is visiting that node, then all information relating to the access to the resource is removed from the node after access to the resource is complete.
  • the use of a node on a temporary basis is commonly called “roaming.”
  • FIGS. 1 A- 1 C illustrate display pages provided by the account management system in one embodiment.
  • FIG. 1A illustrates a display page for entry of the user identifier. This display page is typically displayed by the application as soon as it is started.
  • Display page 100 includes a user identifier field 101 a password field 102 , an existing user button 103 , and a new user button 104 . If the existing user button is selected, the account management system attempts to log the user on to the application using the user identifier and password. If the new user button is selected, then the account management system registers the user (if not already registered), sends a temporary password to the user, so that the user can log on as an existing user using the temporary password.
  • the temporary password may be sent through a different communications channel, such as by electronic mail message or telephone.
  • a different communications channel known to be associated with that user helps ensure that an imposter is not using the user identifier.
  • user identifiers are the electronic mail addresses of the users. In this way, the account management system can send an electronic mail message to the address represented by the user identifier.
  • FIG. 1B illustrates a display page through which a user can change their temporary password.
  • Display page 110 includes a temporary password field 111 , a new password field 112 , a confirm password field 113 , and continue button 114 . After the user receives a temporary password, the user enters it into the temporary password field, enters a new password, and selects the continue button.
  • FIG. 1C illustrates a display page for identifying common accounts.
  • the account management system displays this display page when a user requests to access an application (i.e., a particular type of resource) of an account that is not already assigned to the requesting node and at least one account is already assigned to the requesting node.
  • Display page 120 includes an account selection area 121 with radio buttons and a continue button 122 .
  • the account selection area indicates that two accounts are currently assigned to the requesting node.
  • the accounts may be identified by the names of the users.
  • the user indicates whether the account associated with the application to be accessed should be the same account as one of the displayed accounts.
  • the account management system may require the user to enter a password associated with the selected account to ensure that an imposter is not indicating that the accounts should be common.
  • FIG. 2 is a block diagram illustrating the account management system in one embodiment.
  • Client computers 210 are connected to the server computer 220 via the Internet 230 .
  • the computers may include a central processing unit, memory, input devices (e.g., keyboard and pointing device), output devices (e.g., display devices), and storage devices (e.g., disk drives).
  • the memory and storage devices are computer-readable media that may contain instructions that implement the account management system.
  • the data structures and message structures may be stored or transmitted via a data transmission medium, such as a signal on a communications link.
  • Various communication channels other than the Internet may be used, such as a local area network, a wide area network, or a point-to-point, dial-up connection.
  • the server computer includes a server engine 221 , a register node component 222 , a connect node component 223 , a disconnect node component 224 , a process register request component (new user) 225 , a process logon request component (existing user) 226 , and an accounts database 227 .
  • the server engine receives requests from the client computers and invokes the appropriate component for processing the request.
  • the register node component receives requests to register a client computer with the account management system. Each node registers with the account management system before access to a resource from that node is authorized.
  • the connect node and disconnect node components control connecting client computer to the server computers.
  • the process register request component is invoked to process a registration request from a new user that is received from a client computer.
  • Registration refers to the process of assigning a new user identifier to a new account.
  • the process logon request component controls the logon of an existing user.
  • a log on refers to the process of authenticating the user to access an application, account, or resource.
  • the accounts database includes various tables for managing the accounts.
  • FIG. 3 is a block diagram illustrating the tables of the accounts database in one embodiment.
  • the accounts database includes a registered node table 301 , an account table 302 , an application table 303 , a user table 304 , and a registered connected node table 305 .
  • the registered node table contains an entry for each registered node and indicates the accounts associated with that node. For example, the first entry of the registered node table indicates that the node with the node identifier “Home” is associated with account “A1” and account “A2.” This association means that all applications associated with both accounts can be accessed from that node.
  • the account table contains an entry for each account and indicates the applications associated with that account.
  • the first entry of the account table indicates that applications “O1,” “O2,” and “O3” are associated with account “A1.” This association means that access to these three applications are tied to a common account.
  • the account table may also indicate the credentials associated with each application of each account. By providing credentials for each application, users of a common account can have their access to the applications limited to those who know the credentials associated with that application.
  • the application table contains an entry for each application that is available to be accessed by a user and may include a reference indicating where the application is stored.
  • the user table contains an entry for each user (or more precisely each user identifier) and includes the password and the associated account.
  • the first entry of the user table indicates that user “U1” is associated with account “A1.”
  • the associations in these tables means that user “U1” can access the applications of account “A1” through nodes “Home” and “Work1.”
  • the connected node table contains an lo entry for each node currently connected to the server computer. For example, the first entry indicates that node “Home” is currently connected to the server computer.
  • the node table, account table, and user table are empty; and the application table contains an entry for each available application (e.g., applications “O1,” “O2,” “O3,” and “O4”).
  • applications “O1,” “O2,” “O3,” and “O4” are available applications.
  • the account management system first adds an entry to the registered node table for node “Home” with no associated account to effect registration of the node.
  • the account management system adds an entry to the account table for account “A1” that indicates the association with application “O1,” adds an entry to the user table for user “U1” that indicates the association with account “A1,” and updates the entry for the registered node table for node “Home” to associate it with account “A1” to effect the registration of the user.
  • User “U1” may then request to access application “O2” from node “Home.”
  • the account management system notes that an entry for user “U1” is already in the user table, that the user is associated with account “A1,” and that the entry in the registered node table for node “Home” is already associated with account “A1.”
  • the account management system then updates the entry in the account table for account “A1” to associate it with application “O2.”
  • User “U1” then tries to access application “O3” from node “Work1.” Since the node “Work1” is not yet registered, the account management system adds an entry to the registered node table for node “Work1” without any association to an account.
  • the account management system determines that the user table contains an entry for user “U1” and that the user is associated with account “A1.” The account management system then updates the entry in the registered node table for node “Work1” to associate it with account “A1” and updates the entry in the account table for account “A1” to associate it with application “O3.”User “U1” can then access applications “O1,” “O2,” and “O3” from the nodes “Home” and “Work1.” User “U2” then requests to access application “O1” from node “Home.” Since user “U2” is new, the account management system adds an entry to the account table for a new account “A2” associated with application “O1,” adds an entry to the user table for user “U2” associated with account “A2,” and updates the entry in the registered node table for node “Home” to associate it with account “A2” to effect the registration of the user.
  • the person who used user identifier “U2” then requests to access application “O4” from node “Work2” using user identifier “U2′.” Since “U2” and “U2′” are not the same user identifiers, the account management system assumes the users are different. The account management system first adds an entry to the registered node table for node “Work2” without being associated to any account.
  • the account management system then adds an entry to the account table for account “A3” and associates it with application “O4,” adds an entry to the user table for user “U2′” to associate it with account “A3,” and updates the entry in the registered node table for node “Work2” to associate it with account “A3.” If the user then tries to access application “O1” from node “Work2” using user identifier “U2,” the account management system prompts the user to indicate whether account “A2” and account “A3” are common accounts.
  • the account management system (not shown in the tables) updates the entry in the user table for user “U2′” to associate it with account “A2” and disassociate it from account “A3,” updates the entry in the account table for account “A2” to associate it with application “O4,” and updates the entry in the register node table for node “Work2” to associate it with account “A2” rather than account “A3.”
  • the account management system then deletes the entry in the account table for account “A3.”
  • FIG. 4 is a block diagram illustrating components of a client computer in one embodiment.
  • the client computer includes an operating system 410 , application platform 420 and application storage area 430 .
  • the application platform includes the client-side portion of the account management system that includes a start application component 421 , a connect node component 422 , a register user component 423 , a logon user component 424 , a process logon response component 425 , and a cache 426 .
  • the start application component is invoked when a user indicates to start an application.
  • the connect node component is invoked to connect the client computer to the server computer and register the client computer with the account management system if not already registered.
  • the register user component is invoked to register a user with the account management system, and the logon user component is invoked to logon a registered user to an application.
  • the process logon response component is invoked when the client computer receives a response from the server computer to a logon request.
  • the cache may contain a copy of portions of the account database relating to that client computer. The caching of this data allows the client computer to authorize access to applications of accounts that are associated with the client computer when the server computer is unavailable.
  • FIGS. 5 - 14 are flow diagrams illustrating the processing of the account management system in one embodiment.
  • FIGS. 5 - 9 are flow diagrams of components of a client computer.
  • FIG. 5 is a flow diagram illustrating the processing of the start application component of a client computer. This component connects the client computer to the server computer and logs the user on to the application identified by the user. This component is invoked by an application that the user has launched.
  • the component connects the client computer to the server computer by invoking the connect node component. As part of the connection process, if the client computer is unregistered, it is registered with the server computer.
  • decision block 501 a if the connection failed, then the component reports an error in block 508 and completes, else the component continues at block 502 .
  • the component inputs an indication of whether the user is a new user or an existing user. If the user already exists, then the component inputs the user identifier and password.
  • decision block 502 a if this is the first time any application that uses the account management system is being launched at the client computer (then the client computer has no information about any user) or the user indicated that they were new, then the component continues at block 503 , else the component continues at block 504 .
  • the component registers the new user by invoking the register user component, which also logs the user onto the application.
  • the component logs the user on to the application by invoking the logon user component.
  • decision block 505 if the user was successfully logged on, then the component continues at block 507 , else the component reports an error to the user in block 506 and loops to block 502 to begin attempting to log the user on to the application.
  • block 507 the component launches the application program and then completes.
  • FIG. 6 is a flow diagram of the connect node component of the client computer.
  • This component determines whether the computer is registered with the account management system. If not, the component effects the registration of the client computer with the account management system. The component then connects the client computer to the server computer. The registration process automatically connects the client computer to the server computer.
  • the component retrieves a node identifier that was stored if and when the client computer was registered with the account management system. The registration of a node may be handled by a node management system that is separate from the account management system. The node identifier may be stored in a registry provided by the operating system.
  • the component validates the node identifier.
  • decision block 603 if the node identifier is valid, then the component continues at block 612 , else the component continues at block 604 .
  • the component clears the current node identifier.
  • blocks 605 - 611 the component registers the client computer with the account management system or a node management system.
  • the component sends a register node request to the server computer.
  • the component receives the response, including the node identifier, from the server computer.
  • decision 607 if the response indicates success, then the component continues at block 608 , else the component continues at block 609 .
  • the component stores the received node identifier so that it is available in block 601 when the component is next invoked and then returns an indication of success.
  • the component reports that the node could not be registered to the user.
  • decision block 610 the component determines whether the registration should be retrieved after a certain period. If so, the component continues at block 611 , else the component returns an indication of failure.
  • the component sets a timer (or uses some other delaying mechanism) and when the timer expires the component continues at block 605 to retry the registration.
  • the component sends a connection request to the server computer.
  • the connection request includes the node identifier and node address.
  • the component waits for a response from the server.
  • decision block 614 if the response indicates a successful connection, then the component returns an indication of success, else the component returns an indication of failure.
  • FIG. 7 is a flow diagram illustrating the processing of the register user component of the client computer.
  • the register user component coordinates the registration of a user that is new to the client computer. If the client computer has already encountered the user identifier, then the component prompts the user to see if the user is really the same user. If the same, then the component proceeds to log the user on to the application, else the component returns an error. If the user identifier is new to the client computer, then component registers the user with the server computer and receives the account identifier in return and proceeds to log the user on to the application. In block 701 , the component inputs the user identifier that was received through the display of FIG. 1A.
  • the component may also input some additional registration information such as the name of the user and billing information.
  • decision block 702 if the user identifier is in the cache of the client computer, then the user identifier is not new and the component continues at block 703 , else the component continues at block 707 .
  • the component asks the user if the user is really the same user who used this user identifier for another application.
  • decision block 704 if the user indicates that they are not the same, then the component reports an error to the user in block 706 because of duplicate user identifiers and then return an error, else the component continues at block 705 .
  • Block 705 the component invokes the logon user component to log the user on to the application and then returns the results of the logon.
  • Blocks 707 - 712 are performed when the user identifier is indeed new to the client computer.
  • the component sends a registration request to the server computer to register the user. The request includes the application identifier, user identifier and node identifier, but does not include an account identifier because none is known for this user.
  • the component waits for a response to the registration request from the server computer.
  • decision block 709 if the response indicates that the registration of the new user was successful, then the response includes the account identifier and the component continues at block 710 , else the component continues at block 711 .
  • the component caches the new account identifier, user identifier, and application identifier and continues at block 705 to log the user onto the application.
  • decision block 711 if the user identifier is already in use, then the component continues at block 703 to see if the user is really the same, else the component continues at block 712 to report some other error and then returns an indication of failure.
  • FIG. 8 is a flow diagram illustrating the processing of the logon user component.
  • the component coordinates the logon of a user to the application. This component is invoked after a new user has been successfully registered or a user has indicated that they are an existing user. If the user is not registered, then the component returns an error. If the user is known to the client computer, then the component sends the account identifier with the logon request to the server computer. If the user is not known to the client computer, the component sends the logon request without the account identifier. If the server computer successfully log the user on to the application, the server computer returns the account identifier.
  • the component caches the user's credentials, else the component combines accounts at the user's request. The user may choose to combine accounts or start using an account that is new to the node. If the logon is not successful, then the component clears its cache of the user identifier password for the account. This component is invoked when a user requests to access an application that has already been accessed from the client computer or when a new application is being accessed using a user identifier that has already been used at the client computer. In block 801 , the component inputs a user identifier and password. In decision block 802 , if the server computer is available, then the component continues at block 803 , else the component continues at block 817 .
  • the component requests the server computer to log the user onto the application.
  • the component sends a logon request to the server computer.
  • the logon request includes the node identifier, application identifier, user identifier, and password. This logon request does not include an account identifier that may have been cached by the client computer.
  • the component waits for the response from the server computer for that user identifier. For example, if a user identifier is being used that has not been used before at the client computer, then the logon request does not include an account identifier.
  • the response includes the account identifier associated with the user identifier.
  • the component processes the logon response by invoking the process logon response component.
  • decision block 806 if the logon was successful, then the component continues at block 807 , else the component continues at block 813 .
  • decision block 807 if the account identifier returned in the response matches an account identifier known to the client computer, then the component continues at block 808 , else the component continues at block 809 .
  • the component caches the user credentials (user identifier and password) in association with the account identifier and then returns an indication of a success.
  • the component asked the user if the returned account is actually one of the accounts that is known to the client computer by displaying the display page of FIG. 1C.
  • decision block 810 if the user selected a known account, then the component continues at block 812 , else the component continues at block 811 .
  • the component caches the new account identifier and continues at block 808 .
  • the component collapses the returned account and the user selected account into a single account and continues at block 802 to send a re-login request with the user selected account to the server computer to collapse the two accounts.
  • the server computer will detect that the user identifier is now being associated with the user selected account and is different from the returned account and will collapse the two accounts into a common account identified by the user selected account.
  • decision block 813 if no account identifier is returned in the response, then the user has not yet been registered or the user's registration has been canceled and component continues at block 815 , else the component continues at block 814 .
  • decision block 814 if the password sent in the logon request was invalid, then the component continues at block 815 , else the component continues at block 816 .
  • the component clears the cache of the invalid user identifier and password for the account and continues at block 820 to report an error.
  • block 816 the component processes the error reported by the server computer and then returns a failure indication.
  • blocks 817 - 820 the component attempts to locally authorize access (log on the user) to the identified application.
  • the component retrieves the cached credentials for the user identifier and application identifier.
  • decision block 818 if the cached credentials were found, then the component continues at block 819 , else the component continues at block 820 to report an error.
  • decision block 819 if the input password matches the cached password of the credentials, then the component returns an indication of success, else the component continues at block 820 .
  • the component reports an error to the user and returns an indication of failure.
  • FIG. 9 is a flow diagram illustrating the processing of the process logon response component of the client computer. This component is invoked when a response to a logon request is received from the server computer. In block 901 , the component retrieves the response. In decision block 902 , the component determines whether the response indicates that the logon was successful. A logon request can be unsuccessful if the account identifier sent in the request is invalid, the password sent in the request was invalid, or other server computer errors occurred. If the logon was successful, then the component returns an indication of success, else the component returns an indication of failure.
  • FIGS. 10 - 14 are flow diagrams of components of the server computer.
  • FIG. 10 is a flow diagram of the processing of the register node component of the server computer. This component is invoked when the server computer receives a request from a client computer to register a node. The component also connects the client computer to the server computer.
  • the component generates a unique node identifier.
  • the component adds the node identifier to the registered node table to register the client computer.
  • the component adds the node identifier and the node address (e.g., IP address and port address) to the connected node table to connect the client computer to the server computer.
  • the component sends a response to the client computer that includes the node identifier. The component then completes.
  • FIG. 11 is a flow diagram of the processing of the connect node component of the server computer. This component is invoked when the server computer receives a request to connect a client computer.
  • the connect request includes the node identifier of the client computer and the node address.
  • the component validates the node identifier by comparing it to the entries in the registered node table.
  • decision block 1102 if the node identifier is in the registered node table, then the component continues at block 1103 , else the component continues at block 1104 .
  • the component adds an entry for the node identifier and node address pair to the connected node table and then returns an indication of success.
  • the component sends an error message to the client computer and closes the connection and completes.
  • FIG. 12 is a flow diagram of the processing of the disconnect node component of the server computer. This component is invoked when the server computer receives a connection close request from a client computer. In block 1201 , the component removes the entry for the node identifier and node address pair from the connected node table. In block 1202 , the component closes the connection with the client computer, logs the closing and then completes.
  • FIG. 13 is a flow diagram of the processing of the register user component of the server computer. This component is invoked when the server computer receives a request to register a new user from a client computer. The request includes the user identifier and node identifier. If the user identifier is already registered, then the component sends a response that indicates the account number and that the user identifier is already in use. If the user identifiers is not registered, then the component effects registration and sends a temporary password to the user via e-mail.
  • decision block 1301 if the received node identifier is in the connected node identifier table, then the client computer is connected and the component continues at block 1303 , else the component sends an error response in block 1302 and then completes.
  • the component determines whether the user identifier is in the user identifier table.
  • block 1304 if an entry for the received the user identifier is in the user identifier table, then the user identifier is known to the server computer and the component continues at block 1305 , else the component continues at block 1309 .
  • block 1305 the component retrieves the account identifier for the user identifier from the account table.
  • the component then sends a response to indicate that the user identifier is already registered and then completes.
  • decision block 1309 if the account identifier is present in the received request, then the component continues at block 1310 , else the component continues at block 1311 .
  • the user identifier is new but the account identifier was included in the registration request.
  • the component sends a response to the client computer indicating a registration failure, which causes the client to ask the user to logon and then completes.
  • the component creates a new account identifier in the account table.
  • the component adds the application identifier, user identifier, and node identifier to the account table.
  • the component generates a temporary password.
  • the component sends an electronic mail message into the user indicating the temporary password. The component then completes.
  • FIG. 14 is a flow diagram of the processing of the process logon request component of the server computer. This component is invoked when the server computer receives a logon request from a client computer.
  • the logon request includes the application identifier, user identifier, password, node identifier, and optionally account identifier. If the account identifier is included in the request and is valid but it does not match the account identifier that the server computer has associated with the user identifier, then the server computer collapses the two accounts into a single account that is identified by the received account identifier. The account identifier is not included when that user identifier has not been previously used at the client computer.
  • decision block 1401 if the account identifier is present, then the component continues at block 1402 , else the component continues at block 1408 .
  • decision block 1402 if the account table contains an entry for the received account identifier, then the account identifier is valid and the component continues at block 1403 , else the component continues at block 1409 to report an error.
  • block 1403 if the user table contains an entry for the received user identifier, then the user identifier is valid and the component continues at block 1404 , else the component continues at block 1407 .
  • decision block 1404 if the password for the user identifier is valid, then the component continues at block 1405 , else the component continues at block 1409 to report an error.
  • the component In decision block 1405 , if the account identifier associated with the user identifier matches the received account identifier, then the component continues at block 1412 , else the component continues at block 1406 .
  • the component collapses the two accounts into a common account identified by the received account identifier and continues at block 1412 .
  • the component adds an entry to the account table that maps the application identifier and user identifier to the account identifier, and an entry to the user table that maps the user identifier to the temporary password.
  • the component sends the temporary password to the user via electronic mail and sends a response indicating failure to the client computer and then completes.
  • Blocks 1408 - 1414 are performed when no account identifier is included in the response.
  • decision block 1408 if the password is valid for the user identifier, then the component continues at block 1410 , else the component continues at block 1409 .
  • block 1409 the component sends an error response to the server computer and then completes.
  • the component retrieves from the user table the account identifier associated with the user identifier.
  • decision block 1411 if the node identifier in the request is associated with the retrieved account identifier, then the component continues at block 1414 , else the component continues at block 1412 .
  • block 1412 the component adds an entry to the account table that maps of the account identifier to the node identifier.
  • the component adds an entry to the node table that maps the node identifier to the account identifier and then continues at block 1413 .
  • the component adds the application identifier to the entry for account in the account table and then sends a response to the client computer that includes the account identifier and then completes.
  • credentials other than user identifier and password pairs can be used.
  • each user may encrypt certain information with their private key of a public and private key pair.
  • the server computer can use the public key to decrypt the information to ensure that it was encrypted with the correct private key.
  • the authentication can be performed by a separate authentication server with the results being sent back to the server computer or directly to the client computers.
  • each account can be identified by the user identifiers that are assigned to that account. Thus, an account may be considered a group of one or more user identifiers.
  • the resources need not be limited to computer resources.
  • the resources may include people, groups or communities, physical goods, communications service (e.g., phone, video), and so on. Accordingly, the claims are not limited except by the appended claims.

Abstract

A method and system for managing accounts that control access to resources of different providers. The account management system allows providers to use a common logon procedure through an account management server. The account management system dynamically creates accounts when users request to access resources. To access to a resource, a user provides their credentials (e.g., user identifier and password) through a certain location (e.g., client computer) and identifies the resource (e.g., application). The account management system determines whether an account has already been created for those credentials. If not, the account management system authenticates the user, creates a new account for those credentials (i.e., registration), and associates the identified resource with the account.

Description

    TECHNICAL FIELD
  • The described technology relates generally to management of accounts; particularly, accounts for accessing computer resources from various nodes. [0001]
  • BACKGROUND
  • Techniques for accessing computer resources (e.g., application programs and computer data) require that the accessing user be authorized to access the computer resource. The authorization is typically verified using a logon procedure in which a user supplies their credentials (e.g., user identifier and password) to the system that controls access to the computer resource. When the system receives the credentials, it determines whether the user is authorized to access the resource (e.g., by checking capabilities associated with the user identifier). If so, then the system allows the user to access the computer resource. For example, a database program may require a user to supply their user identifier and password before accessing (e.g., reading and writing) the data in the database. [0002]
  • Such techniques for accessing computer resources are well adapted to environments in which the computer resources (e.g., data in a database) are provided by a single source. For example, a news service may require a user to logon before accessing any news stories during that logon session. The news service may then bill the user on a monthly basis for all the news stories accessed during the month. Each provider of computer resources typically develops their own logon procedures. A problem with such development is that each provider duplicates the efforts of other providers when developing their own logon procedures. Another problem with such development is that each provider may use different types of logon procedures which tends to confuse users. For example, one provider may require a password to be at least 8 characters while another provider may require that passwords be 5 to 7 characters. Thus, a user who accesses the computer resources of both providers needs to remember different passwords. Even if different providers were to use the same logon procedures, a problem would still exist in that a user would receive separate bills from each provider. This problem may not be significant if a user uses the computer resources of only a few providers, but it is significant when a user (e.g., an Internet user) accesses the computer resources of many different providers (e.g., different news organizations and associations). [0003]
  • These problems could be solved if a procedure was provided by a logon organization that is not related to providers. For example, a user would logon through a logon organization with a single set of credentials and then access the computer resources for different providers. Providers, however, typically find it undesirable to have their logon procedures provided by an unrelated source for several reasons. First, providers prefer to have the displays associated with the logon of their users to be integrated with the look and feel of the user interface provided by the developer. Second, providers may prefer to have provider accounts used when accessing the providers' services and resources. It would be desirable to have a technique that would combine the advantages of the logon organization to avoid these difficulties, and yet enable providers to use established accounts and provider-supplied logon elements.[0004]
  • BRIEF DESCRIPTION OF DRAWINGS
  • FIG. 1A illustrates a display page for entry of the user identifier. [0005]
  • FIG. 1B illustrates a display page through which a user enters their temporary password and new password. [0006]
  • FIG. 1C illustrates a display page for identifying common accounts. [0007]
  • FIG. 2 is a block diagram illustrating the account management system in one embodiment. [0008]
  • FIG. 3 is a block diagram illustrating the tables of the accounts database in one embodiment. [0009]
  • FIG. 4 is a block diagram illustrating components of a client computer in one embodiment. [0010]
  • FIG. 5 is a flow diagram illustrating the processing of the start application component of a client computer. [0011]
  • FIG. 6 is a flow diagram of the connect node component of the client computer. [0012]
  • FIG. 7 is a flow diagram illustrating the processing of the register user component of the client computer. [0013]
  • FIG. 8 is a flow diagram illustrating the processing of the logon user component in one embodiment. [0014]
  • FIG. 9 is a flow diagram illustrating the processing of the process logon response component of the client computer. [0015]
  • FIG. 10 is a flow diagram of the processing of the register node component of the server computer. [0016]
  • FIG. 11 is a flow diagram of the processing of the connect node component of the server computer. [0017]
  • FIG. 12 is a flow diagram of the processing of the disconnect node component of the server computer. [0018]
  • FIG. 13 is a flow diagram of the processing of the register user component of the server computer. [0019]
  • FIG. 14 is a flow diagram of the processing of the process logon request component of the server computer.[0020]
  • DETAILED DESCRIPTION
  • A method and system for managing accounts that control access to resources of different providers is provided. In one embodiment, the account management system allows providers to use a common logon procedure through an account management server. The account management system dynamically creates accounts when users request to access resources. To access to a resource, a user provides their credentials (e.g., user identifier and password) through a certain location (e.g., client computer) and identifies the resource (e.g., application). The account management system determines whether an account has already been created for those credentials. If not, the account management system authenticates the user, creates a new account for those credentials (i.e., registration), and associates the identified resource with the account. If an account has already been created for those credentials, then the account management system associates the identified resource with that account. The account management system then notifies the provider that the user is authorized to access the resource. In this way, accounts are automatically created when a resource is accessed, and access to different resources using the same credentials automatically ties the resources to the same account. To access a different resource provided by a different provider, the user again provides their credentials and identifies the different resource. Since an account has already been created for those credentials, the account management system simply associates the different resource with the account if not already associated. Each provider can customize their logon procedures as long as the provider adheres to the procedures defined by the account management system for acceptable credentials. By customizing their logon procedures, a provider can use the account management system in such a way that their users are not even aware of the account management system. Because resources of two different providers are associated with a single account, the account management system can generate a single report (e.g., bills) for the user that reflects the user's access of both resources. [0021]
  • One aspect of the account management system provides a technique for identifying common accounts when a user provides different credentials for accessing different resources such as, for example, when the same user accesses one resource using one user identifier and then accesses another resource using another user identifier. In general, the account management system creates a separate account for each user, and the user may have multiple unique sets of credentials. The account management system associates accounts with nodes or locations. It tries to identify common accounts when a user accesses a resource from one node using credentials of an account associated with another node and the node from which the user is accessing the resource already has an account associated with it. When the account management system creates an account, it associates that account with the node (e.g., computer) through which the user has requested to access the resource. When the account management system receives a request from the user at that node to access a resource of another account associated with another node, it determines whether the account associated with the node and the account associated with the other node should be considered the same account. For example, a household may have two computers. One family member may have accessed a resource from one computer using their own identifier and another family member may have accessed another resource (or the same resource) from the other computer using their own identifier. The account management system would create two accounts and associate the accounts with the different computers. When one family member tries to access through the other computer a resource using their own identifier, the account management system detects that the account associated with the computer and the account associated with the other computer are possibly common accounts. The account management system may prompt the user to indicate whether the different user identifiers should really represent the same account. If so, then the account management system updates its records to reflect that the two user identifiers represent the same accounts. In such a case, the users will access each resource using their own user identifiers. Since the accessing of both resources is tied to a single account, information relating to such accessing (e.g., billings, notifications, and preferences) may be combined. The account management system similarly identifies common accounts when one user uses two different user identifiers. In an alternative embodiment, the account management system authorizes access to resources based on whether that pair of credentials has already been associated with that resource. If so, the account management system authorizes access to the resource. In this embodiment, the account management system may track combinations of credentials and resources. Thus, within one account, different sets of credentials (e.g., different user name and password) can be used to access different or even the same resource. To avoid user confusion, the account management system may, however, require each resource associated with an account to have only one authorized set of credentials, even though another resource of the account may be associated with a different set of credentials. Thus, the credentials of one family member cannot be used to access a resource of the common account when that resource is associated with the credentials of the other family member. [0022]
  • Another aspect of the account management system allows users to access their accounts from different nodes. When a user requests to access a resource using a node and the user's account is not currently associated with that node, then the account management system associates the account with that node. If the user specifies that access through the node is only on a temporary basis, for example, because the user is visiting that node, then all information relating to the access to the resource is removed from the node after access to the resource is complete. The use of a node on a temporary basis is commonly called “roaming.”[0023]
  • FIGS. [0024] 1A-1C illustrate display pages provided by the account management system in one embodiment. FIG. 1A illustrates a display page for entry of the user identifier. This display page is typically displayed by the application as soon as it is started. Display page 100 includes a user identifier field 101 a password field 102, an existing user button 103, and a new user button 104. If the existing user button is selected, the account management system attempts to log the user on to the application using the user identifier and password. If the new user button is selected, then the account management system registers the user (if not already registered), sends a temporary password to the user, so that the user can log on as an existing user using the temporary password. The temporary password may be sent through a different communications channel, such as by electronic mail message or telephone. The use of a different communications channel known to be associated with that user helps ensure that an imposter is not using the user identifier. In one embodiment, user identifiers are the electronic mail addresses of the users. In this way, the account management system can send an electronic mail message to the address represented by the user identifier. FIG. 1B illustrates a display page through which a user can change their temporary password. Display page 110 includes a temporary password field 111, a new password field 112, a confirm password field 113, and continue button 114. After the user receives a temporary password, the user enters it into the temporary password field, enters a new password, and selects the continue button. Assuming that the temporary password entered by the user matches the temporary password generated by the account management system, then a new account is confirmed for the user identifier and access to the identified application is authorized. This confirmation process helps with the initial authentication of the user. FIG. 1C illustrates a display page for identifying common accounts. The account management system displays this display page when a user requests to access an application (i.e., a particular type of resource) of an account that is not already assigned to the requesting node and at least one account is already assigned to the requesting node. Display page 120 includes an account selection area 121 with radio buttons and a continue button 122. The account selection area indicates that two accounts are currently assigned to the requesting node. The accounts may be identified by the names of the users. The user indicates whether the account associated with the application to be accessed should be the same account as one of the displayed accounts. In one embodiment, the account management system may require the user to enter a password associated with the selected account to ensure that an imposter is not indicating that the accounts should be common.
  • FIG. 2 is a block diagram illustrating the account management system in one embodiment. [0025] Client computers 210 are connected to the server computer 220 via the Internet 230. The computers may include a central processing unit, memory, input devices (e.g., keyboard and pointing device), output devices (e.g., display devices), and storage devices (e.g., disk drives). The memory and storage devices are computer-readable media that may contain instructions that implement the account management system. In addition, the data structures and message structures may be stored or transmitted via a data transmission medium, such as a signal on a communications link. Various communication channels other than the Internet may be used, such as a local area network, a wide area network, or a point-to-point, dial-up connection. The server computer includes a server engine 221, a register node component 222, a connect node component 223, a disconnect node component 224, a process register request component (new user) 225, a process logon request component (existing user) 226, and an accounts database 227. The server engine receives requests from the client computers and invokes the appropriate component for processing the request. The register node component receives requests to register a client computer with the account management system. Each node registers with the account management system before access to a resource from that node is authorized. The connect node and disconnect node components control connecting client computer to the server computers. The process register request component is invoked to process a registration request from a new user that is received from a client computer. Registration refers to the process of assigning a new user identifier to a new account. The process logon request component controls the logon of an existing user. A log on refers to the process of authenticating the user to access an application, account, or resource. The accounts database includes various tables for managing the accounts.
  • FIG. 3 is a block diagram illustrating the tables of the accounts database in one embodiment. The accounts database includes a registered node table [0026] 301, an account table 302, an application table 303, a user table 304, and a registered connected node table 305. The registered node table contains an entry for each registered node and indicates the accounts associated with that node. For example, the first entry of the registered node table indicates that the node with the node identifier “Home” is associated with account “A1” and account “A2.” This association means that all applications associated with both accounts can be accessed from that node. The account table contains an entry for each account and indicates the applications associated with that account. For example, the first entry of the account table indicates that applications “O1,” “O2,” and “O3” are associated with account “A1.” This association means that access to these three applications are tied to a common account. The account table may also indicate the credentials associated with each application of each account. By providing credentials for each application, users of a common account can have their access to the applications limited to those who know the credentials associated with that application. The application table contains an entry for each application that is available to be accessed by a user and may include a reference indicating where the application is stored. The user table contains an entry for each user (or more precisely each user identifier) and includes the password and the associated account. For example, the first entry of the user table indicates that user “U1” is associated with account “A1.” The associations in these tables means that user “U1” can access the applications of account “A1” through nodes “Home” and “Work1.” The connected node table contains an lo entry for each node currently connected to the server computer. For example, the first entry indicates that node “Home” is currently connected to the server computer.
  • Initially, the node table, account table, and user table are empty; and the application table contains an entry for each available application (e.g., applications “O1,” “O2,” “O3,” and “O4”). When user “U1” requests to access application “O1,” the account management system first adds an entry to the registered node table for node “Home” with no associated account to effect registration of the node. The account management system then adds an entry to the account table for account “A1” that indicates the association with application “O1,” adds an entry to the user table for user “U1” that indicates the association with account “A1,” and updates the entry for the registered node table for node “Home” to associate it with account “A1” to effect the registration of the user. User “U1” may then request to access application “O2” from node “Home.” In response, the account management system notes that an entry for user “U1” is already in the user table, that the user is associated with account “A1,” and that the entry in the registered node table for node “Home” is already associated with account “A1.” The account management system then updates the entry in the account table for account “A1” to associate it with application “O2.” User “U1” then tries to access application “O3” from node “Work1.” Since the node “Work1” is not yet registered, the account management system adds an entry to the registered node table for node “Work1” without any association to an account. The account management system determines that the user table contains an entry for user “U1” and that the user is associated with account “A1.” The account management system then updates the entry in the registered node table for node “Work1” to associate it with account “A1” and updates the entry in the account table for account “A1” to associate it with application “O3.”User “U1” can then access applications “O1,” “O2,” and “O3” from the nodes “Home” and “Work1.” User “U2” then requests to access application “O1” from node “Home.” Since user “U2” is new, the account management system adds an entry to the account table for a new account “A2” associated with application “O1,” adds an entry to the user table for user “U2” associated with account “A2,” and updates the entry in the registered node table for node “Home” to associate it with account “A2” to effect the registration of the user. The person who used user identifier “U2” then requests to access application “O4” from node “Work2” using user identifier “U2′.” Since “U2” and “U2′” are not the same user identifiers, the account management system assumes the users are different. The account management system first adds an entry to the registered node table for node “Work2” without being associated to any account. The account management system then adds an entry to the account table for account “A3” and associates it with application “O4,” adds an entry to the user table for user “U2′” to associate it with account “A3,” and updates the entry in the registered node table for node “Work2” to associate it with account “A3.” If the user then tries to access application “O1” from node “Work2” using user identifier “U2,” the account management system prompts the user to indicate whether account “A2” and account “A3” are common accounts. If the user responds affirmatively, then the account management system (not shown in the tables) updates the entry in the user table for user “U2′” to associate it with account “A2” and disassociate it from account “A3,” updates the entry in the account table for account “A2” to associate it with application “O4,” and updates the entry in the register node table for node “Work2” to associate it with account “A2” rather than account “A3.” The account management system then deletes the entry in the account table for account “A3.”[0027]
  • FIG. 4 is a block diagram illustrating components of a client computer in one embodiment. The client computer includes an [0028] operating system 410, application platform 420 and application storage area 430. The application platform includes the client-side portion of the account management system that includes a start application component 421, a connect node component 422, a register user component 423, a logon user component 424, a process logon response component 425, and a cache 426. The start application component is invoked when a user indicates to start an application. The connect node component is invoked to connect the client computer to the server computer and register the client computer with the account management system if not already registered. The register user component is invoked to register a user with the account management system, and the logon user component is invoked to logon a registered user to an application. The process logon response component is invoked when the client computer receives a response from the server computer to a logon request. The cache may contain a copy of portions of the account database relating to that client computer. The caching of this data allows the client computer to authorize access to applications of accounts that are associated with the client computer when the server computer is unavailable.
  • FIGS. [0029] 5-14 are flow diagrams illustrating the processing of the account management system in one embodiment. FIGS. 5-9 are flow diagrams of components of a client computer. FIG. 5 is a flow diagram illustrating the processing of the start application component of a client computer. This component connects the client computer to the server computer and logs the user on to the application identified by the user. This component is invoked by an application that the user has launched. In block 501, the component connects the client computer to the server computer by invoking the connect node component. As part of the connection process, if the client computer is unregistered, it is registered with the server computer. In decision block 501 a, if the connection failed, then the component reports an error in block 508 and completes, else the component continues at block 502. In block 502, the component inputs an indication of whether the user is a new user or an existing user. If the user already exists, then the component inputs the user identifier and password. In decision block 502 a, if this is the first time any application that uses the account management system is being launched at the client computer (then the client computer has no information about any user) or the user indicated that they were new, then the component continues at block 503, else the component continues at block 504. In block 503, the component registers the new user by invoking the register user component, which also logs the user onto the application. In block 504, the component logs the user on to the application by invoking the logon user component. In decision block 505, if the user was successfully logged on, then the component continues at block 507, else the component reports an error to the user in block 506 and loops to block 502 to begin attempting to log the user on to the application. In block 507, the component launches the application program and then completes.
  • FIG. 6 is a flow diagram of the connect node component of the client computer. This component determines whether the computer is registered with the account management system. If not, the component effects the registration of the client computer with the account management system. The component then connects the client computer to the server computer. The registration process automatically connects the client computer to the server computer. In [0030] block 601, the component retrieves a node identifier that was stored if and when the client computer was registered with the account management system. The registration of a node may be handled by a node management system that is separate from the account management system. The node identifier may be stored in a registry provided by the operating system. In block 602, the component validates the node identifier. In decision block 603, if the node identifier is valid, then the component continues at block 612, else the component continues at block 604. In block 604, the component clears the current node identifier. In blocks 605-611, the component registers the client computer with the account management system or a node management system. In block 605, the component sends a register node request to the server computer. In block 606, the component receives the response, including the node identifier, from the server computer. In block decision 607, if the response indicates success, then the component continues at block 608, else the component continues at block 609. In block 608, the component stores the received node identifier so that it is available in block 601 when the component is next invoked and then returns an indication of success. In block 609, the component reports that the node could not be registered to the user. In decision block 610, the component determines whether the registration should be retrieved after a certain period. If so, the component continues at block 611, else the component returns an indication of failure. In block 611, the component sets a timer (or uses some other delaying mechanism) and when the timer expires the component continues at block 605 to retry the registration. In block 612, the component sends a connection request to the server computer. The connection request includes the node identifier and node address. In block 613, the component waits for a response from the server. In decision block 614, if the response indicates a successful connection, then the component returns an indication of success, else the component returns an indication of failure.
  • FIG. 7 is a flow diagram illustrating the processing of the register user component of the client computer. The register user component coordinates the registration of a user that is new to the client computer. If the client computer has already encountered the user identifier, then the component prompts the user to see if the user is really the same user. If the same, then the component proceeds to log the user on to the application, else the component returns an error. If the user identifier is new to the client computer, then component registers the user with the server computer and receives the account identifier in return and proceeds to log the user on to the application. In [0031] block 701, the component inputs the user identifier that was received through the display of FIG. 1A. The component may also input some additional registration information such as the name of the user and billing information. In decision block 702, if the user identifier is in the cache of the client computer, then the user identifier is not new and the component continues at block 703, else the component continues at block 707. In block 703, the component asks the user if the user is really the same user who used this user identifier for another application. In decision block 704, if the user indicates that they are not the same, then the component reports an error to the user in block 706 because of duplicate user identifiers and then return an error, else the component continues at block 705. In block 705, the component invokes the logon user component to log the user on to the application and then returns the results of the logon. Blocks 707-712 are performed when the user identifier is indeed new to the client computer. In block 707, the component sends a registration request to the server computer to register the user. The request includes the application identifier, user identifier and node identifier, but does not include an account identifier because none is known for this user. In block 708, the component waits for a response to the registration request from the server computer. In decision block 709, if the response indicates that the registration of the new user was successful, then the response includes the account identifier and the component continues at block 710, else the component continues at block 711. In block 710, the component caches the new account identifier, user identifier, and application identifier and continues at block 705 to log the user onto the application. In decision block 711, if the user identifier is already in use, then the component continues at block 703 to see if the user is really the same, else the component continues at block 712 to report some other error and then returns an indication of failure.
  • FIG. 8 is a flow diagram illustrating the processing of the logon user component. The component coordinates the logon of a user to the application. This component is invoked after a new user has been successfully registered or a user has indicated that they are an existing user. If the user is not registered, then the component returns an error. If the user is known to the client computer, then the component sends the account identifier with the logon request to the server computer. If the user is not known to the client computer, the component sends the logon request without the account identifier. If the server computer successfully log the user on to the application, the server computer returns the account identifier. If the account identifier matches an account known to the client computer, then the component caches the user's credentials, else the component combines accounts at the user's request. The user may choose to combine accounts or start using an account that is new to the node. If the logon is not successful, then the component clears its cache of the user identifier password for the account. This component is invoked when a user requests to access an application that has already been accessed from the client computer or when a new application is being accessed using a user identifier that has already been used at the client computer. In [0032] block 801, the component inputs a user identifier and password. In decision block 802, if the server computer is available, then the component continues at block 803, else the component continues at block 817. In blocks 803-816, the component requests the server computer to log the user onto the application. In block 803, the component sends a logon request to the server computer. The logon request includes the node identifier, application identifier, user identifier, and password. This logon request does not include an account identifier that may have been cached by the client computer. In block 804, the component waits for the response from the server computer for that user identifier. For example, if a user identifier is being used that has not been used before at the client computer, then the logon request does not include an account identifier. The response includes the account identifier associated with the user identifier. In block 805, the component processes the logon response by invoking the process logon response component. In decision block 806, if the logon was successful, then the component continues at block 807, else the component continues at block 813. In decision block 807, if the account identifier returned in the response matches an account identifier known to the client computer, then the component continues at block 808, else the component continues at block 809. In block 808, the component caches the user credentials (user identifier and password) in association with the account identifier and then returns an indication of a success. In block 809, the component asked the user if the returned account is actually one of the accounts that is known to the client computer by displaying the display page of FIG. 1C. In decision block 810, if the user selected a known account, then the component continues at block 812, else the component continues at block 811. In block 811, the component caches the new account identifier and continues at block 808. In block 812, the component collapses the returned account and the user selected account into a single account and continues at block 802 to send a re-login request with the user selected account to the server computer to collapse the two accounts. The server computer will detect that the user identifier is now being associated with the user selected account and is different from the returned account and will collapse the two accounts into a common account identified by the user selected account. In decision block 813, if no account identifier is returned in the response, then the user has not yet been registered or the user's registration has been canceled and component continues at block 815, else the component continues at block 814. In decision block 814, if the password sent in the logon request was invalid, then the component continues at block 815, else the component continues at block 816. In a block 815, the component clears the cache of the invalid user identifier and password for the account and continues at block 820 to report an error. In block 816, the component processes the error reported by the server computer and then returns a failure indication. In blocks 817-820, the component attempts to locally authorize access (log on the user) to the identified application. In block 817, the component retrieves the cached credentials for the user identifier and application identifier. In decision block 818, if the cached credentials were found, then the component continues at block 819, else the component continues at block 820 to report an error. In decision block 819, if the input password matches the cached password of the credentials, then the component returns an indication of success, else the component continues at block 820. In block 820, the component reports an error to the user and returns an indication of failure.
  • FIG. 9 is a flow diagram illustrating the processing of the process logon response component of the client computer. This component is invoked when a response to a logon request is received from the server computer. In [0033] block 901, the component retrieves the response. In decision block 902, the component determines whether the response indicates that the logon was successful. A logon request can be unsuccessful if the account identifier sent in the request is invalid, the password sent in the request was invalid, or other server computer errors occurred. If the logon was successful, then the component returns an indication of success, else the component returns an indication of failure.
  • FIGS. [0034] 10-14 are flow diagrams of components of the server computer. FIG. 10 is a flow diagram of the processing of the register node component of the server computer. This component is invoked when the server computer receives a request from a client computer to register a node. The component also connects the client computer to the server computer. In block 1001, the component generates a unique node identifier. In block 1002, the component adds the node identifier to the registered node table to register the client computer. In block 1003, the component adds the node identifier and the node address (e.g., IP address and port address) to the connected node table to connect the client computer to the server computer. In block 1004, the component sends a response to the client computer that includes the node identifier. The component then completes.
  • FIG. 11 is a flow diagram of the processing of the connect node component of the server computer. This component is invoked when the server computer receives a request to connect a client computer. The connect request includes the node identifier of the client computer and the node address. In [0035] block 1101, the component validates the node identifier by comparing it to the entries in the registered node table. In decision block 1102, if the node identifier is in the registered node table, then the component continues at block 1103, else the component continues at block 1104. In block 1103, the component adds an entry for the node identifier and node address pair to the connected node table and then returns an indication of success. In block 1104, the component sends an error message to the client computer and closes the connection and completes.
  • FIG. 12 is a flow diagram of the processing of the disconnect node component of the server computer. This component is invoked when the server computer receives a connection close request from a client computer. In [0036] block 1201, the component removes the entry for the node identifier and node address pair from the connected node table. In block 1202, the component closes the connection with the client computer, logs the closing and then completes.
  • FIG. 13 is a flow diagram of the processing of the register user component of the server computer. This component is invoked when the server computer receives a request to register a new user from a client computer. The request includes the user identifier and node identifier. If the user identifier is already registered, then the component sends a response that indicates the account number and that the user identifier is already in use. If the user identifiers is not registered, then the component effects registration and sends a temporary password to the user via e-mail. In [0037] decision block 1301, if the received node identifier is in the connected node identifier table, then the client computer is connected and the component continues at block 1303, else the component sends an error response in block 1302 and then completes. In block 1303, the component determines whether the user identifier is in the user identifier table. In block 1304, if an entry for the received the user identifier is in the user identifier table, then the user identifier is known to the server computer and the component continues at block 1305, else the component continues at block 1309. In block 1305, the component retrieves the account identifier for the user identifier from the account table. The component then sends a response to indicate that the user identifier is already registered and then completes. In decision block 1309, if the account identifier is present in the received request, then the component continues at block 1310, else the component continues at block 1311. In block 1310, the user identifier is new but the account identifier was included in the registration request. As a result, the component sends a response to the client computer indicating a registration failure, which causes the client to ask the user to logon and then completes. In block 1311, the component creates a new account identifier in the account table. In block 1312, the component adds the application identifier, user identifier, and node identifier to the account table. In block 1313, the component generates a temporary password. In block 1314, the component sends an electronic mail message into the user indicating the temporary password. The component then completes.
  • FIG. 14 is a flow diagram of the processing of the process logon request component of the server computer. This component is invoked when the server computer receives a logon request from a client computer. The logon request includes the application identifier, user identifier, password, node identifier, and optionally account identifier. If the account identifier is included in the request and is valid but it does not match the account identifier that the server computer has associated with the user identifier, then the server computer collapses the two accounts into a single account that is identified by the received account identifier. The account identifier is not included when that user identifier has not been previously used at the client computer. In [0038] decision block 1401, if the account identifier is present, then the component continues at block 1402, else the component continues at block 1408. In decision block 1402, if the account table contains an entry for the received account identifier, then the account identifier is valid and the component continues at block 1403, else the component continues at block 1409 to report an error. In block 1403, if the user table contains an entry for the received user identifier, then the user identifier is valid and the component continues at block 1404, else the component continues at block 1407. In decision block 1404, if the password for the user identifier is valid, then the component continues at block 1405, else the component continues at block 1409 to report an error. In decision block 1405, if the account identifier associated with the user identifier matches the received account identifier, then the component continues at block 1412, else the component continues at block 1406. In block 1406, the component collapses the two accounts into a common account identified by the received account identifier and continues at block 1412. In block 1407, the component adds an entry to the account table that maps the application identifier and user identifier to the account identifier, and an entry to the user table that maps the user identifier to the temporary password. In block 1407 a, the component sends the temporary password to the user via electronic mail and sends a response indicating failure to the client computer and then completes. Blocks 1408-1414 are performed when no account identifier is included in the response. In decision block 1408, if the password is valid for the user identifier, then the component continues at block 1410, else the component continues at block 1409. In block 1409, the component sends an error response to the server computer and then completes. In block 1410, the component retrieves from the user table the account identifier associated with the user identifier. In decision block 1411, if the node identifier in the request is associated with the retrieved account identifier, then the component continues at block 1414, else the component continues at block 1412. In block 1412, the component adds an entry to the account table that maps of the account identifier to the node identifier. In block 1413, the component adds an entry to the node table that maps the node identifier to the account identifier and then continues at block 1413. In block 1414, the component adds the application identifier to the entry for account in the account table and then sends a response to the client computer that includes the account identifier and then completes.
  • From the above description, it will be appreciated that although specific embodiments of the technology have been described for purposes of illustration, various modifications may be made without deviating from the spirit and scope of the invention. In one embodiment, credentials other than user identifier and password pairs can be used. For example, each user may encrypt certain information with their private key of a public and private key pair. The server computer can use the public key to decrypt the information to ensure that it was encrypted with the correct private key. Also, the authentication can be performed by a separate authentication server with the results being sent back to the server computer or directly to the client computers. In another embodiment, each account can be identified by the user identifiers that are assigned to that account. Thus, an account may be considered a group of one or more user identifiers. Also, the resources need not be limited to computer resources. For example, the resources may include people, groups or communities, physical goods, communications service (e.g., phone, video), and so on. Accordingly, the claims are not limited except by the appended claims. [0039]

Claims (73)

1. A computer-based method for identifying common accounts, the method comprising:
assigning a first user identifier to a first account, the first account being associated with a first node;
assigning a second user identifier to a second account, the second account being associated with a second node;
receiving a request from the second node that includes the first user identifier,
when the first account is not already associated to the second node,
determining whether the first and second accounts represent the same account; and
when it is determined that the first and second accounts represent the same account, combining the first and second accounts into a single account.
2. The method of claim 1 wherein the determining includes requesting a user to indicate whether the first and second accounts represent the same account.
3. The method of claim 2 including identifying the second account to the user by specifying a user name associated with the second account.
4. The method of claim 2 wherein when the user indicates that the first and second accounts represent the same account, requesting that the user provide credentials associated with the second account.
5. The method of claim 1 wherein each account has a user and the user of the first account is the same as the user of the second account.
6. The method of claim 1 wherein each account has a user and the user of the first account is not the same as the user of the second account.
7. A method of claim 1 wherein the combining includes deleting one of the accounts and assigning the user identifier assigned to the deleted account to the remaining account.
8. The method of claim 7 including associating with the remaining account a resource that was associated with the deleted account.
9. The method of claim 1 including:
when it is determined that the first and second accounts do not represent the same account, associating the first account with the second node.
10. A computer-based method of generating a common account, one account being associated with a node, the method comprising:
receiving at the node information relating to an account; and
when the account to which the information is related is not currently associated with the node,
determining whether the account associated with the node and the node not currently associated with the node should be common accounts; and
when it is determined that the accounts should be common accounts, directing the combining the accounts into a single account.
11. The method of claim 10 wherein the determining includes requesting a user to indicate whether the accounts are common accounts.
12. The method of claim 11 wherein the determining includes identifying the account associated with the node to the user by specifying a user name associated with that account.
13. The method of claim 10 wherein each account is associated with one or more user identifiers.
14. The method of claim 13 wherein the information relating to the account is a user identifier associated with the account.
15. The method of claim 10 including determining that the account to which the information is related is not currently associated with the node by receiving an indication of that account from another computer.
16. A method in a computer system for identifying common accounts, the method comprising:
receiving a user identifier from a user;
sending a log on request to a server computer, the request including the received user identifier, but not including an account identifier;
receiving a log on response from the server, the response including an account identifier associated with the received user identifier; and
when the received account identifier does not match an account identifier previously stored at the node, prompting the user to indicate whether the account identified by the received account identifier should be the same account as an account identified by an account identifier previously stored at the node.
17. The method of claim 16 including when the user indicates that the accounts should be common accounts, sending a log on request to the server computer, the request including the received user identifier and an account identifier previously stored at the node.
18. The method of claim 16 wherein the prompting occurs only if at least one account identifier was previously stored at the node.
19. A method in a computer system for authorizing access to applications, each application having an application identifier, the method comprising:
receiving a plurality of user identifier and application identifier pairs;
for each pair received, storing the user identifier in association with the application identifier;
receiving a request to access an application, the request including a user identifier and application identifier pair, the application identifier identifying the application to be accessed; and
when the user identifier and application identifier pair of the request match a stored user identifier and application identifier pair, indicating that access to the application is authorized.
20. The method of claim 19 wherein the requested access is execution of the application.
21. The method of claim 19 wherein the plurality of user identifier and application identifier pairs are received in requests to access the application identified by the application identifier of the pair.
22. The method of claim 19 including when the user identifier and application identifier pair of the request does not match a stored user identifier and application identifier pair, indicating that access to the application is not authorized.
23. The method of claim 19 wherein access is authorized for applications developed by different application developers.
24. The method of claim 19 wherein the request is received and the authorization is indicated before starting execution of the requested application.
25. The method of claim 19 wherein received requests are sent by a plurality of client computers.
26. The method of claim 19 wherein each application identifier and user identifier pair includes a password and indicating that access to the application is authorized only when the request includes a password that matches the password for the application identifier and user identifier pair of the plurality of application identifier and user identifier pairs.
27. A method in a computer system for authorizing access to different applications, each application having an application identifier, the method comprising:
receiving a plurality of user identifier and application identifier pairs; and
for each pair received,
sending the received user identifier and application identifier pair to an authorization system;
receiving from the authorization system an indication whether access to the application identified by the application identifier is authorized.
28. The method of claim 27 wherein the authorization system maintains user identifier and application identifier pairs that indicate the user identified by the user identifier is authorized to access the application identified by the application identifier.
29. The method of claim 27 wherein the receiving includes receiving a password that is sent to the authorization system wherein authorization is indicated only when the sent password matches a password stored at the authorization system for the sent user identifier and application identifier pair.
30. A method in a computer system for authorizing access to a resource, each resource having a resource identifier, the method comprising:
providing a plurality of user identifier and resource identifier pairs, each user identifier and resource identifier pair indicating that the identified user is authorized to access the identified resource;
receiving a request to access a resource, the request including a user identifier and resource identifier pair, the resource identifier identifying the resource to be accessed; and
when the user identifier and resource identifier pair of the received request match a provided user identifier and resource identifier pair, indicating that access to the resource is authorized.
31. The method of claim 30 wherein the resource is computer data.
32. The method of claim 30 wherein the resource is a communications channel.
33. The method of claim 30 wherein the indicating that access to the resource is authorized occurs after performing authentication for the identified user.
34. The method of claim 33 wherein the authentication includes comparing a received password with a password associated with the matched user identifier and resource identifier pair.
35. A method in a computer system for managing accounts, the method comprising:
assigning an account to a node;
receiving from the node a request to access a computer resource that is associated with an account that is not assigned to the node; and
in response to receiving the request, assigning the account associated with the computer resource to the node so that the computer resource can be accessed from the node.
36. The method of claim 35 wherein the computer resource is an application.
37. The method of claim 35 including after access to the computer resource is complete, un-assigning the account associated with the computer resource from the node.
38. The method of claim 35 wherein the accounts associated with the node represent accounts of different users.
39. The method of claim 35 wherein the nodes are computers.
40. The method of claim 35 wherein the computer resource is computer data.
41. The method of claim 35 wherein the computer resource is a user.
42. The method of claim 35 wherein the computer resource is a communications channel.
43. A method in a computer system accessing a computer resource, the method comprising:
assigning a different account to each of a plurality of nodes;
receiving from a node a notification that a user has requested to access a computer resource that is associated with an account that is assigned to another node; and
in response to receiving the notification, temporarily assigning the account associated with the computer resource to the node so that the user can access the computer resource from the node.
44. The method of claim 43 wherein after access to the computer resource is complete, all information relating to the temporarily assigned account is removed from the node.
45. The method of claim 43 wherein after access to the computer resource is complete, un-assigning the account from the node.
46. A method in a computer system for tracking use of applications, the method comprising:
receiving from a client computer a request to access an application, the requests including an application identifier and user identifier;
determining whether the user identifier is associated with an account;
when the user identifier is associated with an account,
sending to an authorization computer a request to authorize access to the application, the request including the user identifier; and
upon receiving a response indicating that access is authorized, sending to the client computer a response indicating that access is authorized.
47. The method of claim 46 wherein the request received from the client computer includes a password that is sent to the authorization system.
48. The method of claim 46 including sending the application identifier to the authorization system.
49. A method in a computer system for managing account, the method comprising:
receiving a plurality of user identifiers;
associating the user identifiers with a single account;
receiving attributes when a user is logged on with one of the user identifiers associated with the single account; and
providing those received attributes when a user is logged on with another of the user identifiers associated with the single account.
50. The method of claim 49 wherein the attributes includes preferences relating to access to an application.
51. The method of claim 51 whereby the attributes are associated with the single account rather than an single user identifier.
52. A computer-readable medium containing instructions for causing a computer system to generate common account, one account being associated with a node, by a method comprising:
receiving at the node information relating to an account; and
when the account to which the information is related is not currently associated with the node,
determining whether the account associated with the node and the node not currently associated with the node should be common accounts; and
when it is determined that the accounts should be common accounts, directing the combining the accounts into a single account.
53. The computer-readable medium of claim 52 wherein the determining includes requesting a user to indicate whether the accounts are common accounts.
54. The computer-readable medium of claim 53 wherein the determining includes identifying the account associated with the node to the user by specifying a user name associated with that account.
55. The computer-readable medium of claim 52 wherein each account is associated with one or more user identifiers.
56. The computer-readable medium of claim 55 wherein the information relating to the account is a user identifier associated with the account.
57. The computer-readable medium of claim 52 including determining that the account to which the information is related is not currently associated with the node by receiving an indication of that account from another computer.
58. A computer system for generating a common account, one account being associated with a node, comprising:
means for receiving at the node information relating to an account; and
means for, when the account to which the information is related is not currently associated with the node, determining whether the account associated with the node and the node not currently associated with the node should be common accounts; and when it is determined that the accounts should be common accounts, directing the combining the accounts into a single account.
59. The computer system of claim 58 wherein the means for determining includes requesting a user to indicate whether the accounts are common accounts.
60. The computer system of claim 59 wherein the means for determining includes means for identifying the account associated with the node to the user by specifying a user name associated with that account.
61. The computer system of claim 58 wherein each account is associated with one or more user identifiers.
62. The computer system medium of claim 61 wherein the information relating to the account is a user identifier associated with the account.
63. The computer system medium of claim 58 including means for determining that the account to which the information is related is not currently associated with the node by receiving an indication of that account from another computer.
64. A computer-readable medium containing instructions for controlling a computer system to authorize access to different applications, each application having an application identifier, by a method comprising:
receiving a plurality of user identifier and application identifier pairs; and
for each pair received,
sending the received user identifier and application identifier pair to an authorization system;
receiving from the authorization system an indication whether access to the application identified by the application identifier is authorized.
65. The computer-readable medium of claim 64 wherein the authorization system maintains user identifier and application identifier pairs that indicate the user identified by the user identifier is authorized to access the application identified by the application identifier.
66. The computer-readable medium of claim 64 wherein the receiving includes receiving a password that is sent to the authorization system wherein authorization is indicated only when the sent password matches a password stored at the authorization system for the sent user identifier and application identifier pair.
67. A computer-readable medium for controlling a computer system to authorize access to a resource, each resource having a resource identifier, by a method comprising:
providing a plurality of user identifier and resource identifier pairs, each user identifier and resource identifier pair indicating that the identified user is authorized to access the identified resource;
receiving a request to access a resource, the request including a user identifier and resource identifier pair, the resource identifier identifying the resource to be accessed; and
when the user identifier and resource identifier pair of the received request match a provided user identifier and resource identifier pair, indicating that access to the resource is authorized.
68. The computer-readable medium of claim 67 wherein the resource is computer data.
69. The computer-readable medium of claim 67 wherein the resource is a communications channel.
70. The computer-readable medium of claim 67 wherein the indicating that access to the resource is authorized occurs after performing authentication for the identified user.
71. The computer-readable medium of claim 67 wherein the authentication includes comparing a received password with a password associated with the matched user identifier and resource identifier pair.
72. A method in a client computer for coordinating registration of a user with a server computer, comprising:
receiving a user identifier and an indication that the user is a new user;
when the client computer has previously cached that user identifier,
prompting the user to indicate whether the user is the same as the user associated with the previously cached user identifier;
when the user indicates that the user is not the same, allowing the user to enter a new user identifier; and
when the user indicates that the user is the same user, coordinating log on of the user; and
when the client computer has not previously cached that user identifier,
registering the user;
when the registration is successful, caching the user identifier and coordinating log on of the user.
73. A method in a client computer for log on of a user, comprising:
receiving a user identifier and password;
sending a log on request to a server computer, the request including an account identifier when the client computer has an account identifier associated with the received user identifier;
when a response indicating that the log on was successful is received, the response including an account identifier,
when the account identifier does not match an account identifier previously cached at the client computer, prompting the user whether the received account identifier and a previously cached account identifier represent the same account; and
when the user indicates that the accounts represent the same account, combining the accounts.
US09/747,307 2000-11-16 2000-12-22 Method and system for account management Abandoned US20020083012A1 (en)

Priority Applications (11)

Application Number Priority Date Filing Date Title
US09/747,307 US20020083012A1 (en) 2000-11-16 2000-12-22 Method and system for account management
PCT/US2001/049000 WO2002052390A2 (en) 2000-12-22 2001-12-19 Method and system for account management
JP2002553624A JP2005502931A (en) 2000-12-22 2001-12-19 Method and system for account management
CA002432468A CA2432468A1 (en) 2000-12-22 2001-12-19 Method and system for account management
EP01991263A EP1346273A2 (en) 2000-12-22 2001-12-19 Method and system for account management
AU2002231002A AU2002231002A1 (en) 2000-12-22 2001-12-19 Method and system for account management
US11/541,430 US9171308B2 (en) 2000-11-16 2006-09-28 Method and system for account management
JP2008048661A JP5398155B2 (en) 2000-12-22 2008-02-28 Method and system for account management
JP2008048660A JP4887315B2 (en) 2000-12-22 2008-02-28 Method and system for account management
JP2009256057A JP5368942B2 (en) 2000-12-22 2009-11-09 Method and system for account management
US14/921,967 US20160119352A1 (en) 2000-11-16 2015-10-23 Method and system for account management

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US24941200P 2000-11-16 2000-11-16
US09/747,307 US20020083012A1 (en) 2000-11-16 2000-12-22 Method and system for account management

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US11/541,430 Continuation US9171308B2 (en) 2000-11-16 2006-09-28 Method and system for account management

Publications (1)

Publication Number Publication Date
US20020083012A1 true US20020083012A1 (en) 2002-06-27

Family

ID=25004533

Family Applications (3)

Application Number Title Priority Date Filing Date
US09/747,307 Abandoned US20020083012A1 (en) 2000-11-16 2000-12-22 Method and system for account management
US11/541,430 Expired - Fee Related US9171308B2 (en) 2000-11-16 2006-09-28 Method and system for account management
US14/921,967 Abandoned US20160119352A1 (en) 2000-11-16 2015-10-23 Method and system for account management

Family Applications After (2)

Application Number Title Priority Date Filing Date
US11/541,430 Expired - Fee Related US9171308B2 (en) 2000-11-16 2006-09-28 Method and system for account management
US14/921,967 Abandoned US20160119352A1 (en) 2000-11-16 2015-10-23 Method and system for account management

Country Status (6)

Country Link
US (3) US20020083012A1 (en)
EP (1) EP1346273A2 (en)
JP (4) JP2005502931A (en)
AU (1) AU2002231002A1 (en)
CA (1) CA2432468A1 (en)
WO (1) WO2002052390A2 (en)

Cited By (50)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040225604A1 (en) * 2003-04-29 2004-11-11 Foss Sheldon H. System for providing a checkless checking account
US20050027713A1 (en) * 2003-08-01 2005-02-03 Kim Cameron Administrative reset of multiple passwords
US20050044017A1 (en) * 2003-08-22 2005-02-24 Foss Sheldon H. System and method for dynamically managing a financial account
US20050098624A1 (en) * 2003-10-14 2005-05-12 Foss Sheldon H.Jr. Family stored value card program
US20060158335A1 (en) * 2005-01-20 2006-07-20 Jung Edward K Permanent electronic paper
US20060161977A1 (en) * 2005-01-20 2006-07-20 Jung Edward K Notarizable electronic paper
US20060163347A1 (en) * 2003-10-14 2006-07-27 Compucredit Customer enrollment in a stored value card program
US20060282903A1 (en) * 2005-06-08 2006-12-14 Jung Edward K User accessibility to electronic paper
US20060289621A1 (en) * 2003-10-14 2006-12-28 Compucredit Dynamic fee structuring in a stored valude card program
US20070043713A1 (en) * 2005-08-12 2007-02-22 Videonary, L.L.C. Video directory
US20070056024A1 (en) * 2005-09-05 2007-03-08 Ho-Hsiung Hsu Method for remote server login
US7233927B1 (en) * 2002-11-27 2007-06-19 Microsoft Corporation Method and system for authenticating accounts on a remote server
US20070143621A1 (en) * 2005-01-20 2007-06-21 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Write accessibility for electronic paper
US20070180252A1 (en) * 2005-01-20 2007-08-02 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Write accessibility for electronic paper
US20080120711A1 (en) * 2006-11-16 2008-05-22 Steven Dispensa Multi factor authentication
US20080148396A1 (en) * 2005-01-20 2008-06-19 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Notarizable electronic paper
US20080263643A1 (en) * 2007-04-19 2008-10-23 International Business Machines Corporation Method and system for password application
US20090300745A1 (en) * 2006-11-16 2009-12-03 Steve Dispensa Enhanced multi factor authentication
US7643005B2 (en) 2005-01-20 2010-01-05 Searete, Llc Semi-permanent electronic paper
US7676829B1 (en) * 2001-10-30 2010-03-09 Microsoft Corporation Multiple credentials in a distributed system
US20100185451A1 (en) * 2009-01-16 2010-07-22 Oracle International Corporation Business-responsibility-centric identity management
US7865734B2 (en) 2005-05-12 2011-01-04 The Invention Science Fund I, Llc Write accessibility for electronic paper
US20110055587A1 (en) * 2005-01-20 2011-03-03 Jung Edward K Y Alert options for electronic-paper verification
US20110145904A1 (en) * 2009-12-14 2011-06-16 Erix Pizano Enterprise biometric authentication system for a windows biometric framework
US20120151091A1 (en) * 2009-10-23 2012-06-14 Prasanth Jose Network address allocation using a user identity
US20120271951A1 (en) * 2011-04-19 2012-10-25 Samsung Electronics Co., Ltd. Control method for providing storage space of application and terminal and server therefor
CN103051449A (en) * 2012-12-10 2013-04-17 鸿富锦精密工业(深圳)有限公司 Access right managing and controlling system and access right managing and controlling method
US20140195314A1 (en) * 2001-03-29 2014-07-10 Propulsion Remote Holdings, Llc System and method for networked loyalty program
JP2015511356A (en) * 2012-02-01 2015-04-16 アマゾン テクノロジーズ インク Account management for multiple network sites
US20160028924A1 (en) * 2014-07-28 2016-01-28 Kyocera Document Solutions Inc. Electronic apparatus
US20160180413A1 (en) * 2014-12-23 2016-06-23 Abbyy Development Llc Methods and systems that aggregate multi-media reviews of products and services
US9450941B2 (en) 2012-02-01 2016-09-20 Amazon Technologies, Inc. Recovery of managed security credentials
US9692740B2 (en) 2012-02-01 2017-06-27 Amazon Technologies, Inc. Account management for network sites
US9767262B1 (en) 2011-07-29 2017-09-19 Amazon Technologies, Inc. Managing security credentials
US9817967B1 (en) * 2017-01-13 2017-11-14 Accenture Global Solutions Limited Integrated robotics and access management for target systems
US20170331799A1 (en) * 2016-05-12 2017-11-16 Ricoh Company, Ltd. Service providing system, service providing apparatus, and service providing method
US20180041499A1 (en) * 2016-08-03 2018-02-08 American Megatrends, Inc. System and method for securing ipmi remote authenticated key-exchange protocol (rakp) over hash cracks
CN109478134A (en) * 2016-06-30 2019-03-15 亚马逊技术有限公司 With the on-demand network code of across account nickname execution
US10362019B2 (en) 2011-07-29 2019-07-23 Amazon Technologies, Inc. Managing security credentials
US10475018B1 (en) 2013-11-29 2019-11-12 Amazon Technologies, Inc. Updating account data for multiple account providers
CN112104612A (en) * 2020-08-24 2020-12-18 宁波奥克斯电气股份有限公司 Account number merging method and device and server
US11082422B2 (en) 2009-08-12 2021-08-03 Amazon Technologies, Inc. Authentication manager
US11444936B2 (en) 2011-07-29 2022-09-13 Amazon Technologies, Inc. Managing security credentials
US11550713B1 (en) 2020-11-25 2023-01-10 Amazon Technologies, Inc. Garbage collection in distributed systems using life cycled storage roots
US11593270B1 (en) 2020-11-25 2023-02-28 Amazon Technologies, Inc. Fast distributed caching using erasure coded object parts
US11714682B1 (en) 2020-03-03 2023-08-01 Amazon Technologies, Inc. Reclaiming computing resources in an on-demand code execution system
US11714675B2 (en) 2019-06-20 2023-08-01 Amazon Technologies, Inc. Virtualization-based transaction handling in an on-demand network code execution system
US11836516B2 (en) 2018-07-25 2023-12-05 Amazon Technologies, Inc. Reducing execution times in an on-demand network code execution system using saved machine states
US11861386B1 (en) 2019-03-22 2024-01-02 Amazon Technologies, Inc. Application gateways in an on-demand network code execution system
US11875173B2 (en) 2018-06-25 2024-01-16 Amazon Technologies, Inc. Execution of auxiliary functions in an on-demand network code execution system

Families Citing this family (65)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7623476B2 (en) * 2004-06-29 2009-11-24 Damaka, Inc. System and method for conferencing in a peer-to-peer hybrid communications network
US8050272B2 (en) * 2004-06-29 2011-11-01 Damaka, Inc. System and method for concurrent sessions in a peer-to-peer hybrid communications network
US7570636B2 (en) 2004-06-29 2009-08-04 Damaka, Inc. System and method for traversing a NAT device for peer-to-peer hybrid communications
US7623516B2 (en) * 2004-06-29 2009-11-24 Damaka, Inc. System and method for deterministic routing in a peer-to-peer hybrid communications network
US7656870B2 (en) * 2004-06-29 2010-02-02 Damaka, Inc. System and method for peer-to-peer hybrid communications
US20060095365A1 (en) * 2004-06-29 2006-05-04 Damaka, Inc. System and method for conducting an auction in a peer-to peer network
US20070078720A1 (en) * 2004-06-29 2007-04-05 Damaka, Inc. System and method for advertising in a peer-to-peer hybrid communications network
US7778187B2 (en) * 2004-06-29 2010-08-17 Damaka, Inc. System and method for dynamic stability in a peer-to-peer hybrid communications network
US7933260B2 (en) * 2004-06-29 2011-04-26 Damaka, Inc. System and method for routing and communicating in a heterogeneous network environment
US20060206310A1 (en) * 2004-06-29 2006-09-14 Damaka, Inc. System and method for natural language processing in a peer-to-peer hybrid communications network
US8009586B2 (en) * 2004-06-29 2011-08-30 Damaka, Inc. System and method for data transfer in a peer-to peer hybrid communication network
US20070208619A1 (en) * 2005-09-30 2007-09-06 Bellsouth Intellectual Property Corporation Methods, systems, and computer program products for providing targeted advertising to communications devices
US7890552B2 (en) * 2005-09-30 2011-02-15 At&T Intellectual Property I, L.P. Methods, systems, and computer program products for implementing media content analysis, distribution, and re-allocation services
US8804695B2 (en) * 2005-09-30 2014-08-12 At&T Intellectual Property I, L.P. Methods, systems, and computer program products for providing alerts and notifications
US20070209065A1 (en) * 2005-09-30 2007-09-06 Bellsouth Intellectual Property Corporation Methods, systems, and computer program products for providing network convergence of applications and devices
US20070209054A1 (en) * 2005-09-30 2007-09-06 Bellsouth Intellectual Property Corporation Methods, systems, and computer program products for providing communications services
US8223938B2 (en) 2005-09-30 2012-07-17 At&T Intellectual Property I, L.P. Methods, systems, and computer program products for providing caller identification services
US7991695B2 (en) * 2007-06-14 2011-08-02 Harold Chanin Interactive financial card system uniquely suited for conducting financial transactions on the internet
CA2701894C (en) 2007-09-03 2015-11-17 Damaka, Inc. Device and method for maintaining a communication session during a network transition
US8862164B2 (en) 2007-09-28 2014-10-14 Damaka, Inc. System and method for transitioning a communication session between networks that are not commonly controlled
WO2009070718A1 (en) 2007-11-28 2009-06-04 Damaka, Inc. System and method for endpoint handoff in a hybrid peer-to-peer networking environment
US20090281833A1 (en) * 2008-05-09 2009-11-12 Tele Video Md, Inc. System and method for secure multi-party medical conferencing
US9501635B2 (en) 2008-06-25 2016-11-22 Microsoft Technology Licensing, Llc Isolation of services or processes using credential managed accounts
EP2359525B1 (en) * 2008-09-10 2013-01-23 Nec Corporation Method for enabling limitation of service access
US9047458B2 (en) * 2009-06-19 2015-06-02 Deviceauthority, Inc. Network access protection
US9047450B2 (en) * 2009-06-19 2015-06-02 Deviceauthority, Inc. Identification of embedded system devices
US20100333213A1 (en) * 2009-06-24 2010-12-30 Craig Stephen Etchegoyen Systems and Methods for Determining Authorization to Operate Licensed Software Based on a Client Device Fingerprint
US8726407B2 (en) 2009-10-16 2014-05-13 Deviceauthority, Inc. Authentication of computing and communications hardware
US8874785B2 (en) 2010-02-15 2014-10-28 Damaka, Inc. System and method for signaling and data tunneling in a peer-to-peer environment
US8892646B2 (en) 2010-08-25 2014-11-18 Damaka, Inc. System and method for shared session appearance in a hybrid peer-to-peer environment
US8725895B2 (en) 2010-02-15 2014-05-13 Damaka, Inc. NAT traversal by concurrently probing multiple candidates
US8689307B2 (en) * 2010-03-19 2014-04-01 Damaka, Inc. System and method for providing a virtual peer-to-peer environment
US9043488B2 (en) 2010-03-29 2015-05-26 Damaka, Inc. System and method for session sweeping between devices
US9191416B2 (en) 2010-04-16 2015-11-17 Damaka, Inc. System and method for providing enterprise voice call continuity
US9628583B2 (en) 2010-04-29 2017-04-18 Nokia Technologies Oy Method and apparatus for coordinating service information across multiple server nodes
US8352563B2 (en) 2010-04-29 2013-01-08 Damaka, Inc. System and method for peer-to-peer media routing using a third party instant messaging system for signaling
US8446900B2 (en) 2010-06-18 2013-05-21 Damaka, Inc. System and method for transferring a call between endpoints in a hybrid peer-to-peer network
US8611540B2 (en) 2010-06-23 2013-12-17 Damaka, Inc. System and method for secure messaging in a hybrid peer-to-peer network
US8468010B2 (en) 2010-09-24 2013-06-18 Damaka, Inc. System and method for language translation in a hybrid peer-to-peer environment
US8743781B2 (en) 2010-10-11 2014-06-03 Damaka, Inc. System and method for a reverse invitation in a hybrid peer-to-peer environment
AU2011100168B4 (en) 2011-02-09 2011-06-30 Device Authority Ltd Device-bound certificate authentication
US8407314B2 (en) 2011-04-04 2013-03-26 Damaka, Inc. System and method for sharing unsupported document types between communication devices
US8694587B2 (en) 2011-05-17 2014-04-08 Damaka, Inc. System and method for transferring a call bridge between communication devices
AU2011101295B4 (en) 2011-06-13 2012-08-02 Device Authority Ltd Hardware identity in multi-factor authentication layer
US8478890B2 (en) 2011-07-15 2013-07-02 Damaka, Inc. System and method for reliable virtual bi-directional data stream communications with single socket point-to-multipoint capability
AU2011101297B4 (en) 2011-08-15 2012-06-14 Uniloc Usa, Inc. Remote recognition of an association between remote devices
ES2867100T3 (en) * 2011-11-11 2021-10-20 Soprano Design Ltd Secure messaging
US8819795B2 (en) 2012-02-01 2014-08-26 Amazon Technologies, Inc. Presenting managed security credentials to network sites
US8776194B2 (en) 2012-02-01 2014-07-08 Amazon Technologies, Inc. Authentication management services
US8745705B2 (en) 2012-02-01 2014-06-03 Amazon Technologies, Inc. Account management for multiple network sites
US9160816B2 (en) * 2012-02-02 2015-10-13 Apple Inc. Methods and systems for fast account setup
US9282098B1 (en) 2013-03-11 2016-03-08 Amazon Technologies, Inc. Proxy server-based network site account management
US9143496B2 (en) 2013-03-13 2015-09-22 Uniloc Luxembourg S.A. Device authentication using device environment information
US9286466B2 (en) 2013-03-15 2016-03-15 Uniloc Luxembourg S.A. Registration and authentication of computing devices using a digital skeleton key
US9027032B2 (en) 2013-07-16 2015-05-05 Damaka, Inc. System and method for providing additional functionality to existing software in an integrated manner
US9357016B2 (en) 2013-10-18 2016-05-31 Damaka, Inc. System and method for virtual parallel resource management
US9838424B2 (en) 2014-03-20 2017-12-05 Microsoft Technology Licensing, Llc Techniques to provide network security through just-in-time provisioned accounts
CN104954330B (en) * 2014-03-27 2018-03-16 华为软件技术有限公司 A kind of methods, devices and systems to be conducted interviews to data resource
CA2956617A1 (en) 2014-08-05 2016-02-11 Damaka, Inc. System and method for providing unified communications and collaboration (ucc) connectivity between incompatible systems
US10257185B2 (en) * 2014-12-12 2019-04-09 Visa International Service Association Automated access data provisioning
US9853981B2 (en) * 2015-04-11 2017-12-26 International Business Machines Corporation Handling potential service load interruptions by presenting action items for service requester to complete to increase time to address potential service load interruption
US10636085B1 (en) * 2015-09-11 2020-04-28 Wells Fargo Bank, N.A. Contextual graphical user interfaces
US10091025B2 (en) 2016-03-31 2018-10-02 Damaka, Inc. System and method for enabling use of a single user identifier across incompatible networks for UCC functionality
CN109978033B (en) * 2019-03-15 2020-08-04 第四范式(北京)技术有限公司 Method and device for constructing same-operator recognition model and method and device for identifying same-operator
SG11202108626QA (en) * 2019-05-17 2021-09-29 Visa Int Service Ass Virtual access credential interaction system and method

Citations (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5534855A (en) * 1992-07-20 1996-07-09 Digital Equipment Corporation Method and system for certificate based alias detection
US5768519A (en) * 1996-01-18 1998-06-16 Microsoft Corporation Method and apparatus for merging user accounts from a source security domain into a target security domain
US5774551A (en) * 1995-08-07 1998-06-30 Sun Microsystems, Inc. Pluggable account management interface with unified login and logout and multiple user authentication services
US6035404A (en) * 1997-09-09 2000-03-07 International Business Machines Corporation Concurrent user access control in stateless network computing service system
US6044465A (en) * 1997-07-07 2000-03-28 International Business Machines Corporation User profile storage on and retrieval from a non-native server domain for use in a client running a native operating system
US20010054155A1 (en) * 1999-12-21 2001-12-20 Thomas Hagan Privacy and security method and system for a World-Wide-Web site
US20020049655A1 (en) * 2000-06-28 2002-04-25 Michael Bennett Financial information portal
US20020049806A1 (en) * 2000-05-16 2002-04-25 Scott Gatz Parental control system for use in connection with account-based internet access server
US20020055909A1 (en) * 2000-03-01 2002-05-09 Passgate Corporation Method, system and computer readable medium for Web site account and e-commerce management from a central location
US20020069122A1 (en) * 2000-02-22 2002-06-06 Insun Yun Method and system for maximizing credit card purchasing power and minimizing interest costs over the internet
US20020138728A1 (en) * 2000-03-07 2002-09-26 Alex Parfenov Method and system for unified login and authentication
US20030115463A1 (en) * 2000-08-04 2003-06-19 First Data Corporation Requesting Execution of Instructions on Accounts in ABDS System
US20040045031A1 (en) * 2000-05-11 2004-03-04 Gautier Taylor S. Automatic identification of a set-top box user to a network
US6704714B1 (en) * 1999-05-03 2004-03-09 The Chase Manhattan Bank Virtual private lock box

Family Cites Families (44)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5235642A (en) 1992-07-21 1993-08-10 Digital Equipment Corporation Access control subsystem and method for distributed computer system using locally cached authentication credentials
US6193155B1 (en) * 1996-12-09 2001-02-27 Walker Digital, Llc Method and apparatus for issuing and managing gift certificates
JPH10177552A (en) * 1996-12-17 1998-06-30 Fuji Xerox Co Ltd Authentication answer method and authentication answer device using the answer method
US5864830A (en) * 1997-02-13 1999-01-26 Armetta; David Data processing method of configuring and monitoring a satellite spending card linked to a host credit card
JPH10240687A (en) * 1997-02-28 1998-09-11 Tec Corp Network system
US5950174A (en) * 1997-04-25 1999-09-07 At&T Corp. Affiliation-based arrangement for billing
US6032135A (en) * 1997-04-29 2000-02-29 Diebold, Incorporated Electronic purse card value system terminal programming system and method
US6330544B1 (en) * 1997-05-19 2001-12-11 Walker Digital, Llc System and process for issuing and managing forced redemption vouchers having alias account numbers
US6105009A (en) * 1997-06-16 2000-08-15 Cuervo; Vincent Automated teller machine dispenser of debit cards
US6363361B1 (en) * 1997-07-22 2002-03-26 Patent & Trademark Fee Management, Llc Computerized patent and trademark fee payment method and system for law firms
US6144959A (en) * 1997-08-18 2000-11-07 Novell, Inc. System and method for managing user accounts in a communication network
JP3483441B2 (en) * 1997-10-16 2004-01-06 富士通株式会社 Electronic money management and ownership device and management and ownership method
US6636833B1 (en) * 1998-03-25 2003-10-21 Obis Patents Ltd. Credit card system and method
US7050996B1 (en) * 1998-04-24 2006-05-23 First Data Corporation Method for linking accounts corresponding to different products together to create a group
US6315196B1 (en) * 1998-04-28 2001-11-13 Citibank, N.A. Method and system for debt deferment
JP3445153B2 (en) * 1998-06-04 2003-09-08 富士通株式会社 Device and method for temporary use of telephone numbers
US6615189B1 (en) * 1998-06-22 2003-09-02 Bank One, Delaware, National Association Debit purchasing of stored value card for use by and/or delivery to others
US6282523B1 (en) * 1998-06-29 2001-08-28 Walker Digital, Llc Method and apparatus for processing checks to reserve funds
US6393411B1 (en) * 1998-07-21 2002-05-21 Amdahl Corporation Device and method for authorized funds transfer
US6343279B1 (en) * 1998-08-26 2002-01-29 American Management Systems, Inc. System integrating credit card transactions into a financial management system
MXPA01004945A (en) * 1998-11-17 2003-03-10 Prenet Corp Electronic payment system utilizing intermediary account.
US6032136A (en) * 1998-11-17 2000-02-29 First Usa Bank, N.A. Customer activated multi-value (CAM) card
US6032134A (en) * 1998-11-18 2000-02-29 Weissman; Steven I. Credit card billing system for identifying expenditures on a credit card account
JP3563619B2 (en) * 1998-12-04 2004-09-08 株式会社東芝 Application function designating device and storage medium
US6478976B1 (en) * 1998-12-30 2002-11-12 Stmicroelectronics, Inc. Apparatus and method for contacting a conductive layer
JP3402247B2 (en) * 1999-03-17 2003-05-06 日本電気株式会社 Security integrated management device, security integrated management method, and recording medium recording security integrated management program
JP2000293490A (en) * 1999-04-05 2000-10-20 Nec Informatec Systems Ltd Password automatic input substitution system
US6609113B1 (en) * 1999-05-03 2003-08-19 The Chase Manhattan Bank Method and system for processing internet payments using the electronic funds transfer network
US6575361B1 (en) * 1999-08-19 2003-06-10 E-2 Interactive, Inc. System and method for managing stored-value card data
US7222097B2 (en) * 2000-01-18 2007-05-22 Bellosguardo Philippe A Anonymous credit card
US6615190B1 (en) * 2000-02-09 2003-09-02 Bank One, Delaware, National Association Sponsor funded stored value card
US6867789B1 (en) * 2000-02-15 2005-03-15 Bank One, Delaware, National Association System and method for generating graphical user interfaces
US6941279B1 (en) * 2000-02-23 2005-09-06 Banke One Corporation Mutual fund card method and system
US6915277B1 (en) * 2000-05-10 2005-07-05 General Electric Capital Corporation Method for dual credit card system
US6769605B1 (en) * 2000-07-21 2004-08-03 Jason P. Magness Money transfer system
WO2002011027A1 (en) * 2000-07-28 2002-02-07 Union Carbide Chemicals & Plastics Technology Corporation Transport logistics systems and methods
US6578761B1 (en) * 2000-08-18 2003-06-17 Donald Spector Method for issuance of satellite credit and debit cards
US6631849B2 (en) * 2000-12-06 2003-10-14 Bank One, Delaware, National Association Selectable multi-purpose card
US7899742B2 (en) * 2001-05-29 2011-03-01 American Express Travel Related Services Company, Inc. System and method for facilitating a subsidiary card account
US7249092B2 (en) * 2001-05-29 2007-07-24 American Express Travel Related Services Company, Inc. System and method for facilitating a subsidiary card account with controlled spending capability
US6796497B2 (en) * 2002-04-23 2004-09-28 American Express Travel Related Services Company, Inc. System and method for facilitating a subsidiary card account
US20030004876A1 (en) * 2001-06-29 2003-01-02 David Jacobson Mobile terminal incorporated with a credit card
US6945453B1 (en) * 2001-08-13 2005-09-20 Bank One Delaware N.A. System and method for funding a collective account by use of an electronic tag
US6805287B2 (en) * 2002-09-12 2004-10-19 American Express Travel Related Services Company, Inc. System and method for converting a stored value card to a credit card

Patent Citations (14)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5534855A (en) * 1992-07-20 1996-07-09 Digital Equipment Corporation Method and system for certificate based alias detection
US5774551A (en) * 1995-08-07 1998-06-30 Sun Microsystems, Inc. Pluggable account management interface with unified login and logout and multiple user authentication services
US5768519A (en) * 1996-01-18 1998-06-16 Microsoft Corporation Method and apparatus for merging user accounts from a source security domain into a target security domain
US6044465A (en) * 1997-07-07 2000-03-28 International Business Machines Corporation User profile storage on and retrieval from a non-native server domain for use in a client running a native operating system
US6035404A (en) * 1997-09-09 2000-03-07 International Business Machines Corporation Concurrent user access control in stateless network computing service system
US6704714B1 (en) * 1999-05-03 2004-03-09 The Chase Manhattan Bank Virtual private lock box
US20010054155A1 (en) * 1999-12-21 2001-12-20 Thomas Hagan Privacy and security method and system for a World-Wide-Web site
US20020069122A1 (en) * 2000-02-22 2002-06-06 Insun Yun Method and system for maximizing credit card purchasing power and minimizing interest costs over the internet
US20020055909A1 (en) * 2000-03-01 2002-05-09 Passgate Corporation Method, system and computer readable medium for Web site account and e-commerce management from a central location
US20020138728A1 (en) * 2000-03-07 2002-09-26 Alex Parfenov Method and system for unified login and authentication
US20040045031A1 (en) * 2000-05-11 2004-03-04 Gautier Taylor S. Automatic identification of a set-top box user to a network
US20020049806A1 (en) * 2000-05-16 2002-04-25 Scott Gatz Parental control system for use in connection with account-based internet access server
US20020049655A1 (en) * 2000-06-28 2002-04-25 Michael Bennett Financial information portal
US20030115463A1 (en) * 2000-08-04 2003-06-19 First Data Corporation Requesting Execution of Instructions on Accounts in ABDS System

Cited By (85)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20180165702A1 (en) * 2001-03-29 2018-06-14 Liberty Peak Ventures, Llc System and method for networked loyalty program
US20140195314A1 (en) * 2001-03-29 2014-07-10 Propulsion Remote Holdings, Llc System and method for networked loyalty program
US9842345B2 (en) * 2001-03-29 2017-12-12 Gula Consulting Limited Liability Company System and method for networked loyalty program
US7676829B1 (en) * 2001-10-30 2010-03-09 Microsoft Corporation Multiple credentials in a distributed system
US7233927B1 (en) * 2002-11-27 2007-06-19 Microsoft Corporation Method and system for authenticating accounts on a remote server
US20040225604A1 (en) * 2003-04-29 2004-11-11 Foss Sheldon H. System for providing a checkless checking account
US20050027713A1 (en) * 2003-08-01 2005-02-03 Kim Cameron Administrative reset of multiple passwords
US20050044017A1 (en) * 2003-08-22 2005-02-24 Foss Sheldon H. System and method for dynamically managing a financial account
US8626642B2 (en) 2003-08-22 2014-01-07 Compucredit Intellectual Property Holdings Corp. Iii System and method for dynamically managing a financial account
US20050098624A1 (en) * 2003-10-14 2005-05-12 Foss Sheldon H.Jr. Family stored value card program
US20060289621A1 (en) * 2003-10-14 2006-12-28 Compucredit Dynamic fee structuring in a stored valude card program
US7204412B2 (en) * 2003-10-14 2007-04-17 Compucredit Intellectual Property Holdings Corp. Iii Family stored value card program
US20060163347A1 (en) * 2003-10-14 2006-07-27 Compucredit Customer enrollment in a stored value card program
US7387238B2 (en) 2003-10-14 2008-06-17 Foss Jr Sheldon H Customer enrollment in a stored value card program
US20080109319A1 (en) * 2003-10-14 2008-05-08 Foss Sheldon H Family stored value card program
US7856555B2 (en) 2005-01-20 2010-12-21 The Invention Science Fund I, Llc Write accessibility for electronic paper
US20060161977A1 (en) * 2005-01-20 2006-07-20 Jung Edward K Notarizable electronic paper
US20080134324A1 (en) * 2005-01-20 2008-06-05 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Notarizable electronic paper
US20070143621A1 (en) * 2005-01-20 2007-06-21 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Write accessibility for electronic paper
US20080148396A1 (en) * 2005-01-20 2008-06-19 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Notarizable electronic paper
US8281142B2 (en) 2005-01-20 2012-10-02 The Invention Science Fund I, Llc Notarizable electronic paper
US20060158335A1 (en) * 2005-01-20 2006-07-20 Jung Edward K Permanent electronic paper
US7643005B2 (en) 2005-01-20 2010-01-05 Searete, Llc Semi-permanent electronic paper
US8640259B2 (en) 2005-01-20 2014-01-28 The Invention Science Fund I, Llc Notarizable electronic paper
US8063878B2 (en) 2005-01-20 2011-11-22 The Invention Science Fund I, Llc Permanent electronic paper
US9734354B2 (en) 2005-01-20 2017-08-15 Invention Science Fund I, Llc Notarizable electronic paper
US7774606B2 (en) 2005-01-20 2010-08-10 The Invention Science Fund I, Inc Write accessibility for electronic paper
US8621224B2 (en) 2005-01-20 2013-12-31 The Invention Science Fund I, Llc Alert options for electronic-paper verification
US20110215161A1 (en) * 2005-01-20 2011-09-08 Jung Edward K Y Write accessibility for Electronic paper
US20110055587A1 (en) * 2005-01-20 2011-03-03 Jung Edward K Y Alert options for electronic-paper verification
US8880890B2 (en) 2005-01-20 2014-11-04 The Invention Science Fund I, Llc Write accessibility for electronic paper
US20070180252A1 (en) * 2005-01-20 2007-08-02 Searete Llc, A Limited Liability Corporation Of The State Of Delaware Write accessibility for electronic paper
US7865734B2 (en) 2005-05-12 2011-01-04 The Invention Science Fund I, Llc Write accessibility for electronic paper
US20060282903A1 (en) * 2005-06-08 2006-12-14 Jung Edward K User accessibility to electronic paper
US7669245B2 (en) 2005-06-08 2010-02-23 Searete, Llc User accessibility to electronic paper
US20070043713A1 (en) * 2005-08-12 2007-02-22 Videonary, L.L.C. Video directory
US20070056024A1 (en) * 2005-09-05 2007-03-08 Ho-Hsiung Hsu Method for remote server login
US20090300745A1 (en) * 2006-11-16 2009-12-03 Steve Dispensa Enhanced multi factor authentication
US10122715B2 (en) 2006-11-16 2018-11-06 Microsoft Technology Licensing, Llc Enhanced multi factor authentication
US9762576B2 (en) * 2006-11-16 2017-09-12 Phonefactor, Inc. Enhanced multi factor authentication
US8365258B2 (en) * 2006-11-16 2013-01-29 Phonefactor, Inc. Multi factor authentication
US20120017268A9 (en) * 2006-11-16 2012-01-19 Steve Dispensa Enhanced multi factor authentication
US20080120711A1 (en) * 2006-11-16 2008-05-22 Steven Dispensa Multi factor authentication
US20080263643A1 (en) * 2007-04-19 2008-10-23 International Business Machines Corporation Method and system for password application
US7996885B2 (en) 2007-04-19 2011-08-09 International Business Machines Corporation Password application
US20100185451A1 (en) * 2009-01-16 2010-07-22 Oracle International Corporation Business-responsibility-centric identity management
US9026456B2 (en) * 2009-01-16 2015-05-05 Oracle International Corporation Business-responsibility-centric identity management
US11082422B2 (en) 2009-08-12 2021-08-03 Amazon Technologies, Inc. Authentication manager
US20120151091A1 (en) * 2009-10-23 2012-06-14 Prasanth Jose Network address allocation using a user identity
US8959586B2 (en) * 2009-12-14 2015-02-17 Ceelox Patents, LLC Enterprise biometric authentication system
US20110145904A1 (en) * 2009-12-14 2011-06-16 Erix Pizano Enterprise biometric authentication system for a windows biometric framework
US20140047529A1 (en) * 2009-12-14 2014-02-13 Ceelox Patents, LLC Enterprise biometric authentication system
US8566904B2 (en) * 2009-12-14 2013-10-22 Ceelox Patents, LLC Enterprise biometric authentication system for a windows biometric framework
US20120271951A1 (en) * 2011-04-19 2012-10-25 Samsung Electronics Co., Ltd. Control method for providing storage space of application and terminal and server therefor
US11444936B2 (en) 2011-07-29 2022-09-13 Amazon Technologies, Inc. Managing security credentials
US9767262B1 (en) 2011-07-29 2017-09-19 Amazon Technologies, Inc. Managing security credentials
US10362019B2 (en) 2011-07-29 2019-07-23 Amazon Technologies, Inc. Managing security credentials
JP2015511356A (en) * 2012-02-01 2015-04-16 アマゾン テクノロジーズ インク Account management for multiple network sites
US9450941B2 (en) 2012-02-01 2016-09-20 Amazon Technologies, Inc. Recovery of managed security credentials
US11381550B2 (en) 2012-02-01 2022-07-05 Amazon Technologies, Inc. Account management using a portable data store
US9692740B2 (en) 2012-02-01 2017-06-27 Amazon Technologies, Inc. Account management for network sites
US10505914B2 (en) 2012-02-01 2019-12-10 Amazon Technologies, Inc. Sharing account information among multiple users
US9660982B2 (en) * 2012-02-01 2017-05-23 Amazon Technologies, Inc. Reset and recovery of managed security credentials
CN103051449A (en) * 2012-12-10 2013-04-17 鸿富锦精密工业(深圳)有限公司 Access right managing and controlling system and access right managing and controlling method
US10475018B1 (en) 2013-11-29 2019-11-12 Amazon Technologies, Inc. Updating account data for multiple account providers
US11004054B2 (en) 2013-11-29 2021-05-11 Amazon Technologies, Inc. Updating account data for multiple account providers
US9363418B2 (en) * 2014-07-28 2016-06-07 Kyocera Document Solutions Inc. Electronic apparatus
US20160028924A1 (en) * 2014-07-28 2016-01-28 Kyocera Document Solutions Inc. Electronic apparatus
US20160180413A1 (en) * 2014-12-23 2016-06-23 Abbyy Development Llc Methods and systems that aggregate multi-media reviews of products and services
US20170331799A1 (en) * 2016-05-12 2017-11-16 Ricoh Company, Ltd. Service providing system, service providing apparatus, and service providing method
US10805280B2 (en) * 2016-05-12 2020-10-13 Ricoh Company, Ltd. Service providing system configured to manage a default profile, service providing apparatus, and service providing method
CN109478134A (en) * 2016-06-30 2019-03-15 亚马逊技术有限公司 With the on-demand network code of across account nickname execution
US10116653B2 (en) * 2016-08-03 2018-10-30 American Megatrends, Inc. System and method for securing IPMI remote authenticated key-exchange protocol (RAKP) over hash cracks
US20180041499A1 (en) * 2016-08-03 2018-02-08 American Megatrends, Inc. System and method for securing ipmi remote authenticated key-exchange protocol (rakp) over hash cracks
US10521582B2 (en) * 2017-01-13 2019-12-31 Accenture Global Solutions Limited Integrated robotics and access management for target systems
US20180203994A1 (en) * 2017-01-13 2018-07-19 Accenture Global Solutions Limited Integrated robotics and access management for target systems
US9817967B1 (en) * 2017-01-13 2017-11-14 Accenture Global Solutions Limited Integrated robotics and access management for target systems
US11875173B2 (en) 2018-06-25 2024-01-16 Amazon Technologies, Inc. Execution of auxiliary functions in an on-demand network code execution system
US11836516B2 (en) 2018-07-25 2023-12-05 Amazon Technologies, Inc. Reducing execution times in an on-demand network code execution system using saved machine states
US11861386B1 (en) 2019-03-22 2024-01-02 Amazon Technologies, Inc. Application gateways in an on-demand network code execution system
US11714675B2 (en) 2019-06-20 2023-08-01 Amazon Technologies, Inc. Virtualization-based transaction handling in an on-demand network code execution system
US11714682B1 (en) 2020-03-03 2023-08-01 Amazon Technologies, Inc. Reclaiming computing resources in an on-demand code execution system
CN112104612A (en) * 2020-08-24 2020-12-18 宁波奥克斯电气股份有限公司 Account number merging method and device and server
US11593270B1 (en) 2020-11-25 2023-02-28 Amazon Technologies, Inc. Fast distributed caching using erasure coded object parts
US11550713B1 (en) 2020-11-25 2023-01-10 Amazon Technologies, Inc. Garbage collection in distributed systems using life cycled storage roots

Also Published As

Publication number Publication date
US20070078785A1 (en) 2007-04-05
US9171308B2 (en) 2015-10-27
WO2002052390A2 (en) 2002-07-04
AU2002231002A1 (en) 2002-07-08
JP2010033601A (en) 2010-02-12
JP5368942B2 (en) 2013-12-18
EP1346273A2 (en) 2003-09-24
JP2005502931A (en) 2005-01-27
JP2008146682A (en) 2008-06-26
WO2002052390A8 (en) 2003-03-27
JP5398155B2 (en) 2014-01-29
JP2008192161A (en) 2008-08-21
US20160119352A1 (en) 2016-04-28
JP4887315B2 (en) 2012-02-29
CA2432468A1 (en) 2002-07-04

Similar Documents

Publication Publication Date Title
US9171308B2 (en) Method and system for account management
JP4757430B2 (en) Access control method for Internet site
US7483988B2 (en) Information transmission method and system
US5815665A (en) System and method for providing trusted brokering services over a distributed network
JP4551369B2 (en) Service system and service system control method
US20070277235A1 (en) System and method for providing user authentication and identity management
WO2003036412A2 (en) Method and system for getting on-line status, authentication, verification, authorization, communication and transaction services for web-enabled hardware and software, based on uniform telephone address related applications
JP2005538434A (en) Method and system for user-based authentication in a federated environment
EP1015985A1 (en) Method and apparatus for providing physical security for a user account and providing access to the user's environment and preferences
JP2728033B2 (en) Security method in computer network
JP2007188184A (en) Access control program, access control method, and access control device
US6877094B1 (en) Method and apparatus for authentication and payment for devices participating in Jini communities
JP4551367B2 (en) Service system and service system control method
WO2001055841A1 (en) Method and system for distributing program, server and client terminals for executing program, device for obtaining program, and recording medium
JP2002288139A (en) Single sign-on system and method for portable phone
JP2003323407A (en) Authentication system for sharing authentication information between servers, and memory and authentication request device used for system thereof
JP4454826B2 (en) Server computer that manages e-mail addresses
JP2023120720A (en) Authentication apparatus and authentication method
JP4551368B2 (en) Service system and service system control method
JP2004265094A (en) Authentication information management method, and authentication information management system
KR20000049385A (en) Method to provide service of authenticating in user's place for Internet sites
WO2003005226A1 (en) User authentication system and method using the same
JP2001195373A (en) Agent execution device, agent management device, agent processing system, agent execution method and agent management method
KR20010000650A (en) Security System and the Same Method providing Domain Name Service for Each Closed User Group
JP2001134500A (en) Device and method for managing mailing list and recording medium for the same

Legal Events

Date Code Title Description
AS Assignment

Owner name: OPENDESIGN, INC., WASHINGTON

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:BUSH, STEVE;JUNG, EDWARD;KNIGHT, HOLLY;REEL/FRAME:011703/0184

Effective date: 20010320

AS Assignment

Owner name: IMPERIAL BANK, WASHINGTON

Free format text: SECURITY AGREEMENT;ASSIGNOR:OPENDESIGN, INC.;REEL/FRAME:011983/0019

Effective date: 20000228

AS Assignment

Owner name: WESTGATE ENTERPRISES III, CALIFORNIA

Free format text: SECURITY INTEREST;ASSIGNOR:OPENDESIGN, INC.;REEL/FRAME:013660/0693

Effective date: 20011120

Owner name: HUMPHREY, ROBERT, WASHINGTON

Free format text: SECURITY INTEREST;ASSIGNOR:OPENDESIGN, INC.;REEL/FRAME:013660/0693

Effective date: 20011120

Owner name: CANYON GATE INVESTMENTS, LLC, NEVADA

Free format text: SECURITY INTEREST;ASSIGNOR:OPENDESIGN, INC.;REEL/FRAME:013660/0693

Effective date: 20011120

Owner name: DOBKIN ERIC S. CHARITABLE REMAINDER TRUST, NEW YOR

Free format text: SECURITY INTEREST;ASSIGNOR:OPENDESIGN, INC.;REEL/FRAME:013660/0693

Effective date: 20011120

Owner name: HOSIER, GERALD D., NEVADA

Free format text: SECURITY INTEREST;ASSIGNOR:OPENDESIGN, INC.;REEL/FRAME:013660/0693

Effective date: 20011120

Owner name: INTELLECTUAL VENTURES HOLDINGS, INC., WASHINGTON

Free format text: SECURITY INTEREST;ASSIGNOR:OPENDESIGN, INC.;REEL/FRAME:013660/0693

Effective date: 20011120

Owner name: MURDOCK, JERRY, NEW YORK

Free format text: SECURITY INTEREST;ASSIGNOR:OPENDESIGN, INC.;REEL/FRAME:013660/0693

Effective date: 20011120

Owner name: INTELLECTUAL VENTURES HOLDINGS, INC., WASHINGTON

Free format text: SECURITY INTEREST;ASSIGNOR:OPENDESIGN, INC.;REEL/FRAME:015888/0144

Effective date: 20011120

Owner name: NEUSTEIN, ROBIN, NEW YORK

Free format text: SECURITY INTEREST;ASSIGNOR:OPENDESIGN, INC.;REEL/FRAME:013660/0693

Effective date: 20011120

Owner name: OPENDESIGN, INC, WASHINGTON

Free format text: RELEASE;ASSIGNOR:COMERICA BANK-CALIFORNIA, AS SUCCESSOR IN INTEREST TO IMPERAL BANK;REEL/FRAME:013703/0724

Effective date: 20020520

Owner name: ROBERT J. HURST FOUNDATION, NEW YORK

Free format text: SECURITY INTEREST;ASSIGNOR:OPENDESIGN, INC.;REEL/FRAME:013660/0693

Effective date: 20011120

AS Assignment

Owner name: OPENDESIGN, INC., WASHINGTON

Free format text: RELEASE;ASSIGNOR:COMERICA BANK - CALIFORNIA, AS SUCCESSOR-IN-INTEREST TO IMPERIAL BANK;REEL/FRAME:015880/0848

Effective date: 20020520

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION