Abstract: Providing services within a network of service providers sharing an authentication service and a set of business rules. A central server receives a first request from a first server to provide a first service to a user via a client without forcing the user to present credentials. In response to the received first request, the central server stores data identifying the first service on the client. The central server further receives a second request from a second server to provide a second service to the user via the client after the user presents the credentials to the second service. After receiving the second request and the presented credentials, the central server allows the user access to the second service. In response to allowing the user access to the second service, the central server further allows the user access to the first service as a result of the stored data.

Abstract: Providing services within a network of service providers sharing an authentication service and a set of business rules. A central server receives a first request from a first server to provide a first service to a user via a client without forcing the user to present credentials. In response to the received first request, the central server stores data identifying the first service on the client. The central server further receives a second request from a second server to provide a second service to the user via the client after the user presents the credentials to the second service. After receiving the second request and the presented credentials, the central server allows the user access to the second service. In response to allowing the user access to the second service, the central server further allows the user access to the first service as a result of the stored data.

Abstract: Systems, computer-implemented methods, and computer-readable media for establishing an online account with a resource provider are provided. An authentication token including identification of a user from an authentication server is received. The identification of the user from the authentication token is utilized to establish an online account for the user with the resource provider. Additional credentialing information from the user for the online account is received. The additional information received from the user is associated with the online account for the user with the resource provider.

Abstract: Exchanging information in a multi-site authentication system. A network server receives, from an authentication server, a request by a client computing device for a service provided by the network server along with an authentication ticket. The authentication ticket includes: a session key encrypted by a public key associated with the network server, message content encrypted by the session key, and a signature for the encrypted session key and the encrypted message content. The signature includes address information of the network server. The network server identifies its own address information in the signature to validate the signature included in the authentication ticket and verifies the authentication ticket content based on the signature included in the authentication ticket. The network server decrypts the encrypted session key via a private key associated with the second network server and decrypts the encrypted message content via the decrypted session key.

Abstract: A user profile having consent information regarding a network server for a second party is created. Such consent information is received from a first party and stored in the user profile of the second party. The second party may access the network server if the consent information stored in the user profile of the second party shows that the first party has provided consent. The second party may not access the network server if the consent information stored in the user profile of the second party shows that the first party has denied consent.

Abstract: A reputation server associates feedback from previous network transactions with an account of a user in a network. A reputation score for the user is calculated based on the feedback to indicate the probability the user will abuse the network. When an online service receives a request to perform a transaction from the user, the online service performs the transaction based on the user's reputation score. Additionally, a server generates a reputation packet including the reputation score for a user for use by an online service when the user requests the online service to perform a transaction. The online service may authenticate the reputation packet with the server and, if the reputation packet is authenticated, the online service performs the transaction based on the user's reputation score.

Abstract: A security protocol for use in a multi-site authentication system. After authenticating a user, an authentication server generates a ticket including information associated with the user. The authentication server encrypts content of the ticket using a symmetric key shared with an affiliate server. The affiliate server has a public key that the authentication server uses to encrypt the shared key. The authentication server has private key for creating a signature on the ticket. The affiliate server decrypts the shared key with its private key and then decrypts the content of the ticket using the decrypted shared key. The affiliate server validates the signature with the authentication server's public key.

Abstract: Methods and arrangements are provided which associate a first user with a second user in a first device, and selectively provide information about the association of the first and second user to a second device as directed by the first user, without requiring the second user to be logged in to either the first or second device. The information about the association of the first and second user is provided to the second device via a validation code or validation protocol that essentially identifies the first user and the second user, when the first user is logged in to the second device. Here, for example, the validation code may identify the second user by an identifier and a name, and possibly provide modifications to a consent parameter associated with the second user. In certain implementations, at least a portion of the validation code may be encrypted when sent from the first device to the second device. By way of example, in certain instances, the first user may be a parent/guardian to the second user.

Abstract: A system and method for retrieving certificate of trust information for a certificate validation process. Fetching servers periodically retrieve certificate revocation lists (CRLs) from servers maintained by various certificate issuers. The revoked certificate data included in the retrieved CRLs are stored in a central database. An authentication server receives a request from a client for access to a secure service and initiates a validation process. The authentication server retrieves revoked certificate data from the central database and compares the retrieved revoked certificate data to certificate of trust information received from the client along with the request. The authentication server denies access to the secure information if the certificate of trust information matches revoked certificate data from the central database, allows access if the certificate of trust information does not match revoked certificate data from the central database.

Abstract: Managing a web service provided by a plurality of servers coupled to a data communication network. Two versions of the web service are executed on the plurality of servers and a selected version of the web service is identified for execution based on a request from a user for access the web service. While access to the web service is permitted via at least one server, the web service is updated on at least one other server. One or more servers providing the web service may specify a default version of the web service as the selected version if the request from the user does not specify a version of the web service for access.

Abstract: Secure site-to-site transactional communication between at least two network servers coupled to a data communication network, including secure registration by an authentication server associated with a multi-site user authentication system. A network server receives a request via a browser f of a client computer. In response, the network server initiates a transaction with the authentication server and defines a data structure, such as a query string, associated with the transaction. The network server also generates a digital signature of the data structure and then adds it to the data structure before directing the client computer from the network server to the authentication server with the data structure and the added digital signature. The network server also adds an index to the data structure. The index is associated with the transaction and unique, per transaction, to the network server initiating the transaction.

Abstract: Methods and system for routing communication between a client computer and network servers on a data communication network. In response to a request from a web server on the network to authenticate a user of the client computer, an authentication network server directs the client to a user interface network server. The user interface server provides a user interface to the user requesting login information. The authentication server, which is in a different domain than the user interface server, receives and validates the login information. The authentication server further provides a cookie to the client computer if the information retrieved from the user is valid. The cookie has a domain attribute corresponding to the domain of the authentication server.

Abstract: A computerized method and system for routing between network servers. A central database coupled to a central server on a data communication network stores information for identifying locations of a plurality of network servers on the network. Each network server provides at least one service via the network. The central server receives a request from the user for a selected service including a carry through keyword for controlling routing of the user to the selected service. The central server retrieves location information from the central database to identify the location of the network server providing the selected service and attaches the carry through keyword to the retrieved location information. The central server then routes the user with the carry through keyword to the network server, which directs the user to the selected service based on the carry through keyword.

Abstract: A security protocol for use in a multi-site authentication system. After authenticating a user, an authentication server generates a ticket including information associated with the user. The authentication server encrypts content of the ticket using a symmetric key shared with an affiliate server. The affiliate server has a public key that the authentication server uses to encrypt the shared key. The authentication server has private key for creating a signature on the ticket. The affiliate server decrypts the shared key with its private key and then decrypts the content of the ticket using the decrypted shared key. The affiliate server validates the signature with the authentication server's public key.

Abstract: Methods and arrangements are provided which associate a first user with a second user in a first device, and selectively provide information about the association of the first and second user to a second device as directed by the first user, without requiring the second user to be logged in to either the first or second device. The information about the association of the first and second user is provided to the second device via a validation code or validation protocol that essentially identifies the first user and the second user, when the first user is logged in to the second device. Here, for example, the validation code may identify the second user by an identifier and a name, and possibly provide modifications to a consent parameter associated with the second user. In certain implementations, at least a portion of the validation code may be encrypted when sent from the first device to the second device. By way of example, in certain instances, the first user may be a parent/guardian to the second user.

Abstract: A computerized method and system for routing between network servers. A central database coupled to a central server on a data communication network stores information for identifying locations of a plurality of network servers on the network. Each network server provides at least one service via the network. The central server receives a request from the user for a selected service including a carry through keyword for controlling routing of the user to the selected service. The central server retrieves location information from the central database to identify the location of the network server providing the selected service and attaches the carry through keyword to the retrieved location information. The central server then routes the user with the carry through keyword to the network server, which directs the user to the selected service based on the carry through keyword.

Abstract: A user profile having consent information regarding a network server for a second party is created. Such consent information is received from a first party and stored in the user profile of the second party. The second party may access the network server if the consent information stored in the user profile of the second party shows that the first party has provided consent. The second party may not access the network server if the consent information stored in the user profile of the second party shows that the first party has denied consent.