United States Patent
`(12)
`(10) Patent No.:
`US 6,460,141 B1
`Olden
`(45) Date of Patent:
`Oct. 1, 2002
`
`
`US006460141B1
`
`(54) SECURITY AND ACCESS MANAGEMENT
`SYSTEM FOR WEB-ENABLED AND
`NON-WEB-ENABLED APPLICATIONS AND
`CONTENT ON A COMPUTER NETWORK
`
`(75)
`
`Inventor: Eric M. Olden, San Francisco, CA
`US
`(Us)
`(73) Assignee: RSA Security Inc., Bedford, MA (US)
`
`OTHER PUBLICATIONS
`
`USS. application No. 09/483,645, Field et al., filed Jan. 14,
`2000.
`
`User
`Guide
`for
`Bankers
`Trust, Authorization M
`, Aug.
`13.1997 eS NS
`ONOEEAEE ONE
`:
`°
`User Guide for Bankers Trust, Security Instructions Ser-
`vices, Oct. 1, 1997.
`
`(*) Notice:—Subject to any disclaimer, the term of this * cited by examiner
`
`
`patent is extended or adjusted under 35
`USC. 154(b) by 0 days.
`
`(21) Appl. No.: 09/182,265
`
`Oct. 28, 1998
`Filed:
`(22)
`(S51) Ute C1? eee eeeetceeseeteceeecensenereeaes GO6F12/14
`(52) US. Ch eee eceneteeenerteeceneneneee 713/201; 713/202
`(58) Field of Search oe 713/200, 201,
`713/202, 203
`
`(56)
`
`References Cited
`US. PATENT DOCUMENTS
`
`5,557,747 A
`9/1996 Rogerset al.
`......... 395/200.11
`5,968,176 A
`10/1999 Nessett et al.
`vee 713/201
`...
`
`5,983,270 A
`11/1999 Abraham etal.
`ve 709/224
`
`5,983,350 A
`vee 713/201
`...
`11/1999 Minearetal.
`
`6,088,451 A
`eee 380/25
`T2000 HE siesesrseseeessereesse
`6,151,606 A * 11/2000 Mendez aerreroerersesven 707/201
`12/2000 Moriconi et al.
`.......0... 713/201
`6,158,010 A
`6.205.415 Bl *
`3/2001 Butts etal
`903/27
`
`5/2001 Buttset al...
`_ 703/27
`6.233,542 B1 *
`5/2001 Butts et al. oeccceccccccee 703/27
`6,233,543 Bi *
`FOREIGN PATENT DOCUMENTS
`
`Primary Examiner—Norman M. Wright
`(74) Attorney, Agent, or Firm—Testa, Hurwitz & Thibcault,
`LLP
`
`ABSTRACT
`(57)
`A security and access management system provides unified
`access management to address the specific problems facing
`the deployment of security for the Web and non-Web envi-
`ronment. Unified access management consists of strategic
`approaches to unify all key aspects of Web and non-Web
`security policies,
`including access control, authorization,
`authentication, auditing, data privacy, administration, and
`business rules. Unified access management also addresses
`technical scalability requirements needed to successfully
`deploy a reliable unified Web and non-Websecurity system.
`The security and access management system provides the
`technology required to support these key factors as they
`relate to Web and non-Websecurity. The security and access
`management system operates in combination with nctwork
`aa
`:
`and system security tools such as firewalls, network intru-
`sion detection tools, and systems management
`tools to
`provide comprehensive security for the Web-enabled enter-
`prise.
`
`wo
`
`WO 00/25214
`
`5/2000
`
`3 Claims, 36 Drawing Sheets
`
`
`
`
`
` COMMUNICATIONS KEY
`
`‘API CLIENT
`
`(JAVAIC)
`
`
`
`
` ENTITLEMENTS
`SERVER
`
`AUTHORIZATION
`SERVER
`
`248
`248
`
`—ORB
`
`ree
`SOCKET
`
`—=
`SQL'NET
`
`Zynga Ex. 1005,p. 1
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 1
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 1 of 36
`
`US 6,460,141 B1
`
`18a 188°C
`
`least MANAGER
`
`y- 10
`
`INTERNET
`
`20a 298°C
`
`
`
` 32
`
`16
`
`- 14
`
`
`
`24C
`|
`| (AUTHORIZATION)|H-248
`I SERVER
`y 24A
`
`NON-WEB
`SERVER
`
`anne[aN
`ORB
`SOCKET
`SQL'NET
`
`COMMUNICATIONS KEY
`
`FIG. 1
`
`Zynga Ex. 1005,p. 2
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 2
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 2 of 36
`
`US 6,460,141 B1
`
`WEB SERVERS
`
`4
`
`—
`
`26
`
`1
`
`SERVER
`DISPATCHER
`
`20A, 20B, 20C PROTECTED
`
`ENTITLEMENTS
`DATABASE
`
`FIG. 1A
`
`Zynga Ex. 1005,p. 3
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 3
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 3 of 36
`
`US 6,460,141 B1
`
`20A, 20B, 20C
`
`PROTECTED
`WEB SERVER
`
`——~ 4
`
`E-MAIL NOTIFICATION
`oo
`
`DISPATCHER
`
`3
`
`3
`
`ERVER
`
`32
`
`ENTITLEMENTS
`DATABASE
`
`FIG. 1B
`
`Zynga Ex. 1005,p. 4
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 4
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 4 of 36
`
`US 6,460,141 Bl
`
`¢—_—_—__—_>%BeazYSANZSGa
`
`
`
`D02‘802“vOZ
`
`Q3aL05L0dd
`
`
`
`
`
`YSHOLVdSIGYSAYSSNIdO¥ANNOY
`
`NOLLVZIHOHLWY—NOLLVZIYOHLN
`YaAUaSYaAYaS
`
`\v
`NOILVZINMOHLNV
`NOILWZIHOHLNY
`
`JLSls
`
`ASVavlvd
`
`SLNAWATLILNA
`
`YSAMAS
`
`YsdAYss
`
`Zynga Ex. 1005, p. 5
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 5
` Zynga v. IGT
` IPR2022-00199
`
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 5 of 36
`
`US 6,460,141 Bl
`
`
`
`
`
`NOLLVOIILONIWN-3902‘g0z‘voz
`
`92C_nYaAUaSGam
`
`daLdaL0ud
`
`
`
`YSHOLVdSICHSANASLLaonGNnOw
`
`ppyb+
`
`NETSEISSETAE
`
`
`NOILYZIMOHLNYNOILVZINOHLNV
`
`NOLLVZIMOHLAYNOLLVZINOHLNVG
`
`
`
`YSAMaSYSAYAS
`
`CI‘Old
`
`ASVavVLVa
`
`SLNAWSTLULNA
`
`Zynga Ex. 1005,p. 6
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 6
` Zynga v. IGT
` IPR2022-00199
`
`
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 6 of 36
`
`US 6,460,141 Bl
`
`NOILLVYLSININGYISMLIE9|SSAIOVISMLee|D AYNLOALIHONV
`
`
`
`
`
`
`
`
`=FYeNLOSLIHOYV|SALLVALSININGYaamNOILVOMIdd¥LYVASJISVdYSWASNOODSYANIVLNOOD
`
`
`
`
`ADYNOSAY}snLJe9|DSSADOVISNLe9|9ADYNOSAYISNLes|DsSdNOddAYNLOALIHDYVNOILINIS3ACAYNLOALIHOYYNOILINISSOAYNLOSLIHOYVYAWNSNOOD JALLVYLSININGY
`
`
`
`
`
`
`
`
`
`AYNLOALIHONVAYNLOALIHOYVTONLNOS
`+410YsUSAYAS=FYNLOALIHOYVed1NY=xLNAWSATLILNS
`
`
`SAONVISNILOAPAOSALONAY43sn¢Ola
`
`
`
`
`
`
`SALNGILIV LOardO xdNOYDMN4asn43SN|||«NOILONNA
`
`
`sNOILVONdd¥=NOILVONddVYAWNSNOODYANNSNOO|poo——_Wiv3u
`
`
`
`TACOWVLVd3Sn1_LJe9|9
`
`ALWAdOud
`
`sALYSdOud
`
`Zynga Ex. 1005,p. 7
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 7
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 7 of 36
`
`US 6,460,141 B1
`
`ClearTrust BASIC ENTITLEMENTS ACCESS CONTROL
`
`[>
`
`REALM
`
`APPLICATION
`
`GROUP
`
`BASIC ENTITLEMENT
`
`USER
`
`APPLICATION
`FUNCTION
`
`FIG. 3
`
`Zynga Ex. 1005, p. 8
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 8
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 8 of 36
`
`US 6,460,141 B1
`
`ClearTrust SMART RULE ACCESS CONTROL
`
`nlen
`
`USER
`
`USER PROPERTY
`DEFINITION
`
`APPLICATION
`
`USER
`PROPERTY
`
`SMART RULE
`
`
`
`APPLICATION
`FUNCTION
`
`FIG. 4
`
`Zynga Ex. 1005, p. 9
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 9
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 9 of 36
`
`US 6,460,141 B1
`
`LOG IN AS
`
`
`
`
`
`LOGINAS
`
`[ADMIN ROLEX
`
`GROUP
`
`ADMINISTRATION_
`
`
`
`FIG. 5
`
`Zynga Ex. 1005, p. 10
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 10
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 10 of 36
`
`US 6,460,141 B1
`
`| ClearTrust Manager
`
`ClearTrust
`4
`SecureControl
`
`Password [|
`
`Clear Trust Manager
`Version 2 Release 00
`Copyright 1996-1997. Sirrus Internet
`Solutions
`http:/Awww.sirrus.com
`Time Remaining
`55
`UserID [
`Trees Remaining
`3
`
`FIG. 6
`
`Zynga Ex. 1005,p. 11
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 11
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 11 of 36
`
`US 6,460,141 B1
`
`+. Administration Role Choice
`
`|_(OLX!
`
`ClearTrust Administrator
`
`Marketing Department Admin Gro|Application Administrator
`ClearTrust Admin Group
`
`FIG. 7
`
`Zynga Ex. 1005, p. 12
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 12
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 12 of 36
`
`US 6,460,141 Bl
`
`jonuojeunaas
`
`1293/9a
`i djeHebeg
`
`8Olas
`
`‘mupsealg“ojos!
`
`nijieag}sqqog|
`nipyeag)=Aliey)
`
`npeag|ulwpy
`
`mLea|g}Ayiey,o
`niea|9yuay
`nipleadMe]
`mesg;Held
`
`miLe9|g}jepuey
`ndLJe9}9|Wequny
`}Snl|Jeaj9
`Ld
`
`wajyskssobeuey
`O¢JabeueyjsLes9
`
`sqqopq|smpseajgiulwpe|
`
`Jabeuesmi}
`
`rsnibeubj}Ajjiauo!
`YIEID4=JUDY|Wequny|squuNuu|gog;
`uosyoerme|l
`Malpuy|||epuele
`
`uaweq}yeldp
`
`egeg:Ajjiaiog
`
`ueH} ojosy
`
`Zynga Ex. 1005, p. 13
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 13
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 13 of 36
`
`US 6,460,141 B1
`
`Create User
`
`User ID
`
`First Name
`
`Last Name
`
`|
`
`Email Address
`
`DN
`
`Account Start
`
`Account Expiry
`[ Super User
`[ Private
`|Property=
`
`__ChangeProperty Value _||Cancel|
`
`FIG. 9
`
`Zynga Ex. 1005, p. 14
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 14
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 14 of 36
`
`US 6,460,141 B1
`
`2 Change Account StartDate
`Month
`iy
`
`«3 ER Ce
`
`FIG. 10
`
`te Change Account Expiry Date
`
`I Ler
`
`FIG. 11
`
`Zynga Ex. 1005, p. 15
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 15
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 15 of 36
`
`US 6,460,141 B1
`
`|. Set Password
`
`Password
`
`Zynga Ex. 1005, p. 16
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 16
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 16 of 36
`
`US 6,460,141 Bl
`
`payosjasWeayoN
`
`[-“ujeayjoajas
`
`jojuoyeunoas
`
`JsnJ|J29|9
`
`
`
`djaHa6eywayskssebeuey
`
`Jefeuey
`
`
`
`
`
`[4]sdnoio}[aieiea][Aion][aie8i0]
`
`ismLies
` i
`
`
`
`
`
`lm}15)UIP}sn|Je9|9
`
`JS)ulupyJsnijJeay|
`
`J5ulwpyJsn[Je9|D|
`Jc)Ulupysn[Je9|9|
`J€)UIPISNLIBa]y|
`IS)uiupysnJe9|9
`ISulupysn[se9|9
`ISulwipy}snd[e989
`
`
`JQ)ulupyjsnsJe9|4
`
`
`IS)uluipyJsnu[uea|9)
`
`19UIUpY}snu{yea}
`
`JISulupysn[ye9|9
`J)ulupyISM[e919
`
`salipowwosydnolssouel|dwod||dnolg
`
`
`
`ANONJUBLUWBAOS|
`
`
`Buyunoosy|dnaigAawony|dnous)
`
`suoneleyJOJSOAU|
`
`dnolsBuneayeyy
`
`dnolgaaqnoexy
`
`dnolsyJayOlg|
`
`dnolsJapesy
`dnoWRN
`dnolgYHI
`NODOdi|
`
`gzJabeueywsnJea|5
`
`elOla
`
`Zynga Ex. 1005, p. 17
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 17
` Zynga v. IGT
` IPR2022-00199
`
`
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 17 of 36
`
`US 6,460,141 B1
`
`£t Create Group
`
`| Name
`
`| Description
`
`[
`
`C1 Private
`
`FIG. 14
`
`Zynga Ex. 1005, p. 18
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 18
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 18 of 36
`
`US 6,460,141 B1
`
`| Create Realm
`
`| Name
`
`| Description OD Privat
`
`[cancel] |
`
`FIG. 15
`
`Zynga Ex. 1005, p. 19
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 19
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 19 of 36
`
`US 6,460,141 Bl
`
`jsmpieag&
`
`}sM1239
`
`jualNg-JuNOVOY
`
`
`
`Sajeypuog
`
`189||saadoldJasp|SIOeysIUUpY siansagGanjoUuojainoesg
`
`
`
`sginyWes|sjuewepnUyaseg|suoneayddy
`
`
` pasojd-sjunosoy_i[asea)[ion][5°25]
`
`djeaHebeywajshssabeuey
`
`g'zJabeuepysnu[se9|9
`JaBeuey
`
`
`
`sepel|ApowLuo%
`aouel|dwos
`aul]pay
`
`abueuoxyAouauns
`
`VaS-Sueo]|dyeaer|
`
`
`
`
`BuryuegAuejauop
`
`sayeyebebyoyy
`
`ddyop|Sepel|SUOIICO
`
`91“Ols
`
`Zynga Ex. 1005, p. 20
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 20
` Zynga v. IGT
` IPR2022-00199
`
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 20 of 36
`
`US 6,460,141 Bl
`
`ysmipiesg
`Jabeuey seBeuey
`
`Paw][easya)fa
`
`
`
`382|saniedoidJes|SIOJENSIUILUIDY suanuagga|SeinyHEU|sjuawanquyaiseg|suoqeayddysusp|jouoDendagG}snd
`Cag|aasaa|S|To
`
`
`
`suoloun4uojeoiddy|a1919q||Auagimoyy|sjuawanjuyoIseg
`
`Le9}D
`
`djeHabegweajsks
`
`ZtOla
`
`
`
`O¢JabeueyJsnJ[Je3|9
`
`Zynga Ex. 1005,p. 21
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 21
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 21 of 36
`
`US 6,460,141 Bl
`
`ysniLieag
`jojuOyeuNIaSG\sruLdea|5
`
`
`||anjea|soyesedg|awenAiedag|adh|
`
`ZOOL=STIVNO3Ansell=MOTIV]
`
`diayabegwajskssabeueyy
`
`g'zJoBeuewjsnpiea|y
`sebeuey
`
`8bOla
`
`NV¥31004
`
`NV3100d
`
`ALVd
`
`INI
`
`Zynga Ex. 1005, p. 22
`Zyngav. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 22
` Zynga v. IGT
` IPR2022-00199
`
`

`

`auyaq LN:9/NYWEWSMOU
`
`~Sea50y
`
`Joy9jnJ
`
`aJeayD|G
`
`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 22 of 36
`
`US 6,460,141 Bl
`
`Joyeiado
`
`Auadoud
`
`
`
`]-yonduosag
`
`6bOld
`
`Zynga Ex. 1005, p. 23
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 23
` Zynga v. IGT
` IPR2022-00199
`
`

`

`ysmiealgSy
`S801]J8AI8S[28180||SIPOW|[212819]sal
`
`joyuojaunaesGsnLJe9}9
`8WOdJaAIESIpJaNEegqey[|od|OH|owen|
`
`
`
`
`
`djaHoa6eywayskssebeue\
`
`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 23 of 36
`
`US 6,460,141 Bl
`
`sebeuey
`
`0cSls
`
`
`
`gzJobeueyjsnuLes|D
`
`Zynga Ex. 1005, p. 24
`Zyngav. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 24
` Zynga v. IGT
` IPR2022-00199
`
`
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 24 of 36
`
`US 6,460,141 B1
`
`|. Create Web Server
`
`Description: [) Private
`
`| Name
`
`| Hostname
`
`| Port
`
`FIG. 21
`
`Zynga Ex. 1005, p. 25
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 25
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 25 of 36
`
`US 6,460,141 B1
`
`| Create new tree
`
`URI
`
`| Description
`
`[ Private
`
`FIG. 22
`
`Zynga Ex. 1005, p. 26
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 26
` Zynga v. IGT
` IPR2022-00199
`
`

`

`CTeum[er]
`
`B[OYSIU)JO}SOBA
`snd[Jea|9ueysM[ea]|
`L_[aveiea|Mipow|ppv
`
`clusiauMGaA|Sejoysngegsiuiupy
`|ouyuODeINoaS
`
`ysmLies&
`
`
`
`
`
`djeHo6egweajsksJabeueyy
`
`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 26 of 36
`
`US 6,460,141 Bl
`
`gjoydnag
`
`
`
`}smu[4ea|9
`
`s1asy
`
`
`
`yseaqgAoueliny
`
`aANIEXy
`
`
`
`9'zsaBeueyJsnJ|Jea}9
`
`Zynga Ex. 1005, p. 27
`Zynga v. IGT
`IPR2022-00199
`
`JoBeuep
`
`Zynga Ex. 1005, p. 27
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 27 of 36
`
`US 6,460,141 B1
`
`|. Create Administrative Group
`|
`| Administrative Group...
`[Name (
`
`| Description:
`
`FIG. 24
`
`Zynga Ex. 1005, p. 28
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 28
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 28 of 36
`
`US 6,460,141 B1
`
`|. Untitled
`| Administrative Role... _
`
`| Name
`
`FIG. 25
`
`Zynga Ex. 1005, p. 29
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 29
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 29 of 36
`
`US 6,460,141 Bl
`
`[JE9|D|pIeaD|JIE9|9|[Je9|9|[Je9|9|[IBS||[JEalD|JJe9{9|[JBOD|
`
`}ea|9|LdJea|Q|
`
`9¢Old
`
`joyuojainoag
`
`
`
`jsnu[Je9|9
`
`Jabeuey Jebeuey
` siesq) idjayo6egwaysks
`
`380|SaladoidJaS/)|SIOJENSIUILUPY
`
` sientagGaqSaInyEWS|sJuawaNUysIseg|Suoneoiyddy
`
`ALVd
`
`LNI
`
`LNI
`
`ONIELS
`
`NV31004
`
`
`ysnjieajD@
`
`
`
`salvadoldJasp)
`
`I4O9
`
`syoesuo9saunjn4
`
`ysaqAouewng09pnsd
`wedoldg
`
`NV310049
`
`LVO14
`
`ALVd
`
`INI
`
`
`
`NVI1008
`
`NIYLS
`
`
`sjnokngebeiaa7
`
`yseqsuondg
`a}e}sy|esy
`
`
`Ainseal|
`
`dO”!
`
`PlOoS
`
`
`
`9'zsaBeuew}smLe9|9
`
`Zynga Ex. 1005, p. 30
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 30
` Zynga v. IGT
` IPR2022-00199
`
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 30 of 36
`
`US 6,460,141 B1
`
`|.2 Create User Property Definition
`| Property Names [|
`
`| Property Type:=£— BOOLEAN | | |
`Property Owner:
`f[ CreateTrust Admin Group
`|
`— ——-———- Ownership Security >
`|
`|| Public
`©
`
`ReadOnly
`
`Zynga Ex. 1005, p. 31
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 31
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 31 of 36
`
`or”iNSINTLLULNG
`
`
`“WOIDOTSHL[FSWyasn
`
`SHLS30d
`
`@)
`
`
`
`
`
`SS300VMOTI-QNS
`
` ,
`
`
`(3103104TNH
`
`—LOAMan3H
`
`JIS3A
`
`
`
`SS500UdNOILVZINOHLNV
`
`LYVLS
`
`Suv
`INSINALLUNGV4ULEUSNANY3U3HiANAC,-sSINSWATLIINYaSNalL~~
`
`
`
`
`Wol80LyAYSHL
`
`
`
`éS.LNIWSTLEENS
`
`dNOYDANYSYSHL
`
`
`
`“iSINSWFTILENG
`
`US 6,460,141 Bl
`
`
`SINSWSLLNSWIvaewRANYFVaN
`
`oiXNAoINGI
`
`|on
`
`8cOld
`
`Zynga Ex. 1005, p. 32
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 32
` Zynga v. IGT
` IPR2022-00199
`
`
`
`
`
`
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 32 of 36
`
`US 6,460,141 B1
`
`USER VALIDATION
`
`START: IS THE USER VALID?
`
`}
`
`DOES
`THE USER EXIST? >
`
`YES |
`—— THE PASSWORD—~N° @
`
`
`
`is
`
`CORRECT? er
`
`
`
`
`
`
`
`TODAY? oem" YES|
`
`—~
`
`IS
`THE START DATE
`BEFORE TODAY?
`
`IS
`THE END DATE AFTER}
`
`
`
`
`END: THE USERIS VALID
`
`}
`
`END: THE USER IS NOTVALID }
`
`FIG. 29
`
`Zynga Ex. 1005, p. 33
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 33
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 33 of 36
`
`US 6,460,141 B1
`
` WEB
`
`BROWSER
`
`WEB SERVER
`20A
`
`
`
`OC7
`
`7B
`
`WEB SERVER
`20B
`
`
`
`
`
`ClearTrust
`ENTITLEMENTS
`DATABASE
`
`
`1. BROWSER REQUEST SECURED CONTENT FROM CT PROTECTED
`WEB SERVER ‘A’.
`2. CT PLUG-IN CHECKS FOR COOKIE.
`3. BECAUSETHIS IS FIRST AUTHENTICATION, USER PROVIDES
`
`USERNAME AND PASSWORD.
`
`4 USER PERMISSIONS CHECKED.
`9. BUILD COOKIE AND SET FOR BROWSER.
`6. WEB USER ACCESSES CT PROTECTED WEB SERVER 'B'.
`
`7, PLUG-IN ON WEB SERVER B USES COOKIE FOR AUTHENTICATION.
`8. PERMISSIONS ARE CHECKED FOR USER BASED ON CREDENTIALS
`IN COOKIE.
`
`
`
`
`
`
`
`
`
`Zynga Ex. 1005, p. 34
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 34
` Zynga v. IGT
` IPR2022-00199
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 34 of 36
`
`US 6,460,141 Bl
`
`$a|SNOWOV|aunoianoo|S4¥Od34|ainotanoo
`GYOMSSVd NINGY
`
`
`INnODdyTaysiaos|G3IN3QSS300V|«ZSS300"CAZINOHLAYNN
`
`innonoyPave'CHOMSS¥dLOFUNOON|ZMOVLLW
`
`
`
`
`NIWGYTVW(eQSINS0SS3090V|SS3QOWG3ZINOHLAYNN|
`NINGYTVW(4||a
`
`
`TIvWa(cpomsfeCHOMSSVdLOZHNOON||HOWLIVGYOMSsvd
`
`beSls
`
`Zynga Ex. 1005, p. 35
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 35
` Zynga v. IGT
` IPR2022-00199
`
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 35 of 36
`
`NOILOV
`
`SWIL
`
`NOILOSTSS-LINW
`NMOCTINd|
`
`NMOGTInd|#
`
`XO
`
`|
`
`MOVLLV
`
`AONANOAYA
`
`
`ddALLNAAS
`SWVN
`
`
`
`NMOG7T1Nd
`
`|GTaI41X3L|
`
`US 6,460,141 Bl
`
`ceOlas
`
`Zynga Ex. 1005, p. 36
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 36
` Zynga v. IGT
` IPR2022-00199
`
`
`

`

`U.S. Patent
`
`Oct. 1, 2002
`
`Sheet 36 of 36
`
`US 6,460,141 B1
`
`
`CONFIGURE|CONFIGURE
`REPORTS
`POLICY
`
`
`FAILED PASSWORDS
`
`
`BLAH BLAH BLAH BLAH BLAH
`BLAH BLAH BLAH BLAH BLAH
`BLAH BLAH BLAH BLAH BLAH
`BLAH BLAH BLAH BLAH BLAH
`
`
`
`ENGINE
`
`
`BLAH BLAH BLAH BLAH BLAH
`
`
`
`
`
`
`
`
`LAUNCH:
`FAILED PASSWORDS
`ATTACKED APPLICATIONS
`REPORT C
`REPORT D
`
`ATTACKED APPLICATIONS
`
`BLAH BLAH BLAH BLAH BLAH
`BLAH BLAH BLAH BLAH BLAH
`BLAH BLAH BLAH BLAH BLAH
`BLAH BLAH BLAH BLAH BLAH
`BLAH BLAH BLAH BLAH BLAH
`
`FIG. 33
`
`
`
`Zynga Ex. 1005, p. 37
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 37
` Zynga v. IGT
` IPR2022-00199
`
`

`

`US 6,460,141 B1
`
`1
`SECURITY AND ACCESS MANAGEMENT
`SYSTEM FOR WEB-ENABLED AND
`NON-WEB-ENABLED APPLICATIONS AND
`CONTENT ON A COMPUTER NETWORK
`FIELD OF THE INVENTION
`
`The present invention relates to computer networks and,
`moreparticularly, to a computer network in which execution
`of applications and use of content by users of the computer
`network is controlled. Specifically, one embodiment of the
`present invention provides a comprehensive and efficient
`unified security and access management system for enter-
`prise security and access control, so that the availability of
`intranet, extranet, and electronic commerce (“e-commerce”)
`applications and content to users of the computer network
`can be effectively controlled and the integrity of the appli-
`cations and content can be assured by the owner of the
`enterprise.
`BACKGROUND OF THE INVENTION
`
`Enterprise owners continue to develop intranet and extra-
`net applications for local and wide area computer networks.
`These enterprise owners have in many instancesalso devel-
`oped Web-enabled applications and content, as well as
`e-commerce solutions, that are available to customers over
`the Internet. A major challenge to these enterprise owners is
`to secure the integrity of Web-enabled, as well as non-Web-
`enabled,intranet, extranet, and e-commerce applications and
`content. Consequently, there is a need by both enterprise
`owners and customers in the field of computer network
`security and access control for applications and content.
`At the present time, the growth of computer networks has
`strained the capabilities of known security architectures.
`Major concerns have arisen regarding control of access to
`critical applications and content and to process access
`requests, which requires a security architecture to enable
`network authentication and to provide secure access control.
`Network security management tools such as perimeter
`protection, anti-viral protection, encryption, and intrusion
`detection have been deployed to secure communications
`between and across networks. System security management
`tools secure the systems upon which applications execute,
`including operating system level security and access control
`for traditional client/server database applications or file
`systems. While Web applications are accessed across net-
`works and operate on managed systems, due to their highly
`distributed nature, Web applications have specific security
`requirements which are not protected by network and sys-
`tems management products.
`Unauthorized users can cause incredible damage in a very
`short time. They can break into the supply chain applications
`of an enterprise and disrupt the flow of production lines.
`They can cause the Internet to place unauthorized orders on
`an e-commerce system and steal goods or cause havoc by
`shipping, unauthorized orders to important customers. Elec-
`tronic banking applications are also primetargets for unau-
`thorized users. Competitors can use the Internet to access
`sensitive marketing plans, customerlists, or product plans
`intended for legitimate partners on the extranet.
`The internal network presents many additional risks.
`Employees can use the intranet to access sensitive employee
`data on humanresource applications. Trusted users, such as
`employees, represent more than forty percent of documented
`attacks. Organizations erroneously assume that critical
`information assets, both inside and outside, are fully pro-
`tected and secure. Most enterprises are far from secure, yet
`remain unaware of exactly where they are vulnerable.
`
`20
`
`30
`
`40
`
`50
`
`60
`
`2
`There are fundamental challenges associated with provid-
`ing effective Web security. Discontinuity exists between the
`Internet/Web technologies of today and traditional security
`systems. Security policy is fragmented across platforms,
`vendors, and point solutions. Integration of Web security
`infrastructure with existing infrastructure is not in place.
`Current security approaches are not scalable.
`Therefore, there is a need for an improved security and
`access control system. The present invention satisfies this
`need by providing a unified security and access management
`system for computer networks.
`
`SUMMARYOF THE INVENTION
`
`invention provides a sccurity and access
`The present
`management system for Web-enabled and non-Web-enabled
`applications and content on a computer network. One
`embodimentof the security and access management system
`in accordance with the present
`invention is based on a
`management model which brings together disparate infra-
`structure components, consolidates multiple security
`policies, and embraces both Web and emerging Internet
`technologies to properly address the security requirements
`of the Web.
`
`The security and access management system of the
`present invention provides a uniform access management
`model to address the specific problems facing the deploy-
`ment of security for the Web and non-Web environment.
`Unified access managementconsists of strategic approaches
`to unify all key aspects of Web and non-Web security
`policies,
`including access control, authorization,
`authentication, auditing, data privacy, administration, and
`business rules. Unified access management also addresses
`technical scalability requirements needed to successfully
`deploy a reliable unified Web and non-Websecurity system.
`The security and access management system in accordance
`with a preferred embodiment of the present invention pro-
`vides the technology required to support these key factors as
`they relate to Web and non-Websecurity. The security and
`access Management! system of the present invention operates
`in combination with network and system security tools such
`as firewalls, network intrusion detection tools, and systems
`managementtools to provide comprehensivesecurity for the
`Web-enabled enterprise.
`
`BRIEF DESCRIPTION OF THE DRAWINGS
`
`The above and other objectives and features and the
`concomitant advantages of the present invention will be
`better understood and appreciated by those skilled in the art
`in view of the description of the preferred embodiments
`given below in conjunction with the accompanying draw-
`ings. In the drawings:
`FIG. 1 illustrates one embodimentof the architecture of
`the security and access management system in accordance
`with the present invention;
`FIGS. 1A-1D illustrate various configurations of the
`security and access management system shown in ['IG. 1
`during normaloperation and in alternative fail-over modes;
`FIG. 2 illustrates the data model architecture of the
`
`security and access management system of the present
`invention;
`VIG. 3 illustrates the data model architecture of the
`security and access management system for basic user
`entitlements;
`FIG. 4 illustrates the data model architecture of the
`
`security and access management system for one embodi-
`
`Zynga Ex. 1005, p. 38
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 38
` Zynga v. IGT
` IPR2022-00199
`
`

`

`US 6,460,141 B1
`
`3
`mentof business rules to process user requests for access to
`application functions;
`FIG.5 illustrates the administrative structure of the secu-
`rity and access management system in accordance with the
`present invention;
`FIGS. 6-27illustrate screens or panels that are displayed
`by the security and access management system of the
`present invention to provide security and access manage-
`ment;
`FIG. 28 is a flow chart of an authorization method in
`
`accordance with one embodiment of the present invention;
`FIG. 29 is a flow chart of the user validation step shown
`in FIG. 28;
`FIG. 30 illustrates a configuration of the security and
`access management system shown in FIG. 1 to enable a
`single sign on by a user; and
`FIGS. 31-33 illustrate panels that are displayed by the
`security and access management system of the present
`invention to monitor attempts at unauthorized access.
`DETAILED DESCRIPTION OF THE
`PREFERRED EMBODIMENTS
`
`The following description provides a system administra-
`tor with information on understanding, administering, and
`maintaining servers incorporated into the security and access
`management system of the invention. The following
`description also provides a security architect with informa-
`tion for effectively developing and managing the
`application-access security model for an organization.
`The following description is divided into two main sec-
`tions: architecture and administration. The architecture sec-
`tion provides an overview of the architecture of the security
`and access management system in accordance with the
`invention and the data model. The administration section
`details administration of the server-side components,includ-
`ing starting and stopping of the server components and
`descriptions of the server log files.
`The security and access management system of the
`present invention, generally indicated by the numeral 10 in
`FIG. 1,
`is a highly scalable, reliable, and configurable
`securily architecture. As shown in FIG. 1, the architecture
`for the security and access management system 10 com-
`prises five main components: at
`least one authorization
`component 12; an entitlements (database) server component
`14; an API server 16; an administrative client (graphical user
`interface) 18; and at
`least one enabled Web server 20
`connected to the remainder of the computer network, for
`example, over the Internet. The first three components are
`server-side components. Each of the server-side components
`will now be described in more detail.
`
`The authorization component 12 performs authorization
`processing, on behalf of either an enabled Web server 20 or
`an APIclient 22. The authorization component 12 comprises
`an authorization server 24. Preferably, as shown in FIG. 1,
`the authorization component 12 comprises a plurality of
`authorization servers 24A, 24B, 24C and at least one autho-
`rization dispatcher 26. In order to avoid a single point source
`of failure, a plurality of authorization dispatchers 26A, 26B
`also preferably comprises the authorization component 12.
`In the case in which the authorization component 12
`comprises a single authorization server 24, no authorization
`dispatcher 26 is required, and the single authorization server
`processesall authorization requests. If the single authoriza-
`tion server 24 goes down, authorization requests cannot be
`processed.
`
`10
`
`20
`
`30
`
`40
`
`50
`
`60
`
`4
`Consequently, the preferred configuration is as shown in
`FIG. 1, in which the security and access management system
`10 comprises the plurality of authorization servers 24A,
`24B, 24C and authorization dispatchers 26A, 26B, which
`operate in conjunction to provide efficient scalability of
`authorization requests. For example, it is possible to start
`many authorization servers 24A, 24B, 24C on different
`machines, allowing for load balancing and fail-over of
`authorization requests.In order to manage the various autho-
`rization servers 24A, 24B, 24C,the authorization dispatch-
`ers 26A and 26B contain a
`repository of all available
`authorization servers.
`One of the authorization servers 24A, 24B, 24C commu-
`nicates with an enabled Web server 20A, 20B, 20C and the
`authorization dispatchers 26A and 26B over a socket con-
`nection. The authorization servers 24A, 24B, 24C commu-
`nicate with the entitlements server component 14 over a
`CORBA ORB(Object Request Broker).
`Additionally, each authorization server 24A, 24B, 24C
`preferably contains several caches to maximize performance
`of authorization requests. As informationis retrieved during
`authorization processing, the information is stored in various
`caches. This allows for quick retrieval when information is
`re-requested. Each cache preferably has a defined maximum
`size to contain memory growth. Consequently, as a cache
`reaches its maximum size, information contained within the
`cache is aged out.
`The entitlements server component 14 performs database
`processing on behalf of at lcast one entitlements manager
`administrative client 18 and the API server 16. In addition,
`the entitlements server component 14 also forwards requests
`from the entitlements manager administrative client 18 and
`API server 16 to the authorization servers 24A, 24B, 24C
`comprising the authorization component 12.
`Communications between the entitlements server compo-
`nent 14 and both administrative clients 18A, 18B, 18C and
`authorization servers 24A, 24B, 24C occur over a CORBA
`ORB. In order for the authorization servers 24A, 24B, 24C
`and administrative clients 18A, 18B, 18C to establish a
`communication channel with the entitlements server com-
`ponent 14, the entitlements server componentis assigned a
`name that uniquely identifies it to the ORB. In contrast to the
`preferred configuration in which there is a plurality of
`authorization servers 24A, 24B, 24C, there is preferably
`only a single entitlements server component 14.
`‘The API server component 16, in conjunction with the
`entitlements server component 14, performs database pro-
`cessing on behalf of an API client 22. Unlike an authoriza-
`tion server 24A, 24B, 24C or administrative client 18, the
`API server component 16 is preferably an clement within the
`entitlements server component 14, as shown in FIG. 1.
`Communications between the API server component 16 and
`an APIclient 22A, 22B, 22C occur over a socket connection
`from an assigned port.
`As shown in FIG. 1, the Web servers 20A, 20B, 20C
`provide Web-enabled applications and content to computer
`network users. Also, the security and access management
`system 10 provides the capability to provide security and
`access management to non-Web-enabled applications. Such
`non-Web-enabled applications can be provided through the
`API clicnts 22A, 22B, 22C on at Icast onc non-Web server
`30, as shown in FIG. 1. Communications between the API
`server component 16 and the non-Webserver 30 occur over
`a socket connection.
`
`The security and access management system 10 is selec-
`tively operated in one of two modes, namely, standard mode
`or distributed mode. Each mode hasfail-over capabilities.
`
`Zynga Ex. 1005, p. 39
`Zynga v. IGT
`IPR2022-00199
`
`Zynga Ex. 1005, p. 39
` Zynga v. IGT
` IPR2022-00199
`
`

`

`US 6,460,141 B1
`
`5
`On the one hand, standard mode meansthat the security
`and access management system 10 is running the authori-
`zation servers 24A, 24B, 24C on a single machine with a
`primary authorization server and a stand-by authorization
`server. The primary authorization server 24A, 24B, or 24C
`handles all of the access requests for all of the Web servers
`20A,20B, 20C. It is only if the primary authorization server
`24A, 24B, or 24C is unava