US 7631346

US Patent 7631346, titled "Method and system for a runtime user account creation operation within a single-sign-on process in a federated computing environment," was assigned to International Business Machines Corp. The inventors are Heather Maria Hinton, Ivan Matthew Milman, Venkat Raghavan, and Shane Bradley Weeden. The patent was filed on April 1, 2005, and issued on December 8, 2009.

Abstract:
The patent describes a method, system, apparatus, and computer program product designed to enable computing systems from different enterprises to interact within a federated computing environment. It allows single-sign-on (SSO) operations to be initiated at federation partners on behalf of a user, even if the user hasn't established an account with that partner beforehand. Specifically, if an identity provider initiates an SSO operation at a service provider, and the service provider lacks a linked user account for that user, the service provider creates a local user account using information from the identity provider. The service provider can also retrieve additional user attributes from the identity provider as needed for this account creation.

Plain-Language Overview of Independent Claims:

• Claim 1: A method for supporting a single-sign-on operation.
  This claim describes a method that begins with an identity provider (IDP) sending a request to a service provider (SP) for a user to access a protected resource. The IDP includes a single-sign-on request and an alias for the user. If the SP determines there's no existing linked account for that user (identified by the alias), it creates a new local user account based on the received alias and other information from the IDP. After account creation, the SP processes the original resource access request. This means a user can get an account at the SP on the fly during an SSO process, without needing a pre-existing account.

• Claim 10: A system for supporting a single-sign-on operation.
  This claim outlines a system with similar functionality to the method in Claim 1. It includes a single-sign-on request builder at an identity provider that creates an SSO request with a user alias. A single-sign-on request handler at a service provider receives this request. If the handler finds no linked user account, it triggers a user account creation unit to create a local account using the alias and IDP information. A resource access unit then fulfills the original request for the protected resource. This claim focuses on the architectural components that enable the runtime account creation during SSO.

• Claim 19: A computer program product.
  This claim covers a computer program product that stores instructions executable by a processor to perform the method described in Claim 1. It essentially claims the software implementation of the runtime user account creation within an SSO process in a federated environment.

Litigation Status (as of April 26, 2026):
The patent US7631346B2 has been involved in several litigation cases, including those filed in the Court of Appeals for the Federal Circuit (CAFC). While specific 2026 CAFC dockets for this exact patent were not explicitly found in a current search, the Google Patents information indicates multiple CAFC cases related to this patent family filed in 2024, such as cases 24-1274, 21-2350, 24-1170, and 24-1238. Additionally, other types of litigation, including PTAB cases (IPR2022-00646, IPR2023-00259, IPR2016-00608, IPR2019-00404, IPR2018-01685, IPR2017-01158, IPR2016-00609) and US District Court cases, have been filed. The patent is currently listed as "Active," expiring on July 31, 2028.

Here is a list of known litigation involving US patent 7631346 as of April 26, 2026:

US District Court Cases:

• Jurisdiction: Washington Western District Court

  • Case Number: 2:20-cv-00851
  • Filing Date: Not explicitly stated in the provided text, but implied to be around 2020 based on the case number.
  • Status: Active
  • Plaintiff(s): Not explicitly stated.
  • Defendant(s): Not explicitly stated.

• Jurisdiction: New York Southern District Court

  • Case Number: 1:23-cv-08616
  • Filing Date: Not explicitly stated.
  • Status: Not explicitly stated (implied to be ongoing as no outcome is given).
  • Plaintiff(s): Not explicitly stated.
  • Defendant(s): Not explicitly stated.

• Jurisdiction: Delaware District Court

  • Case Number: 1:16-cv-00122
  • Filing Date: Not explicitly stated.
  • Status: Not explicitly stated (implied to be ongoing as no outcome is given).
  • Plaintiff(s): Not explicitly stated.
  • Defendant(s): Not explicitly stated.

• Jurisdiction: California Central District Court

  • Case Number: 8:19-cv-01777
  • Filing Date: Not explicitly stated.
  • Status: Not explicitly stated (implied to be ongoing as no outcome is given).
  • Plaintiff(s): Not explicitly stated.
  • Defendant(s): Not explicitly stated.

• Jurisdiction: Delaware District Court

  • Case Number: 1:22-cv-00590
  • Filing Date: Not explicitly stated.
  • Status: Not explicitly stated (implied to be ongoing as no outcome is given).
  • Plaintiff(s): Not explicitly stated.
  • Defendant(s): Not explicitly stated.

• Jurisdiction: Delaware District Court

  • Case Number: 1:15-cv-00137
  • Filing Date: Not explicitly stated.
  • Status: Not explicitly stated (implied to be ongoing as no outcome is given).
  • Plaintiff(s): Not explicitly stated.
  • Defendant(s): Not explicitly stated.

• Jurisdiction: Delaware District Court

  • Case Number: 1:21-cv-00461
  • Filing Date: Not explicitly stated.
  • Status: Not explicitly stated (implied to be ongoing as no outcome is given).
  • Plaintiff(s): Not explicitly stated.
  • Defendant(s): Not explicitly stated.

• Jurisdiction: Delaware District Court

  • Case Number: 1:17-cv-01875
  • Filing Date: Not explicitly stated.
  • Status: Not explicitly stated (implied to be ongoing as no outcome is given).
  • Plaintiff(s): Not explicitly stated.
  • Defendant(s): Not explicitly stated.

• Jurisdiction: Delaware District Court

  • Case Number: 1:20-cv-00351
  • Filing Date: Not explicitly stated.
  • Status: Not explicitly stated (implied to be ongoing as no outcome is given).
  • Plaintiff(s): Not explicitly stated.
  • Defendant(s): Not explicitly stated.

Court of Appeals for the Federal Circuit (CAFC) Cases:

• Jurisdiction: Court of Appeals for the Federal Circuit

  • Case Number: 24-1274
  • Filing Date: Not explicitly stated.
  • Status: Not explicitly stated (implied to be ongoing as no outcome is given).
  • Plaintiff(s): Not explicitly stated.
  • Defendant(s): Not explicitly stated.

• Jurisdiction: Court of Appeals for the Federal Circuit

  • Case Number: 21-2350
  • Filing Date: Not explicitly stated.
  • Status: Not explicitly stated (implied to be ongoing as no outcome is given).
  • Plaintiff(s): Not explicitly stated.
  • Defendant(s): Not explicitly stated.

• Jurisdiction: Court of Appeals for the Federal Circuit

  • Case Number: 24-1170
  • Filing Date: Not explicitly stated.
  • Status: Not explicitly stated (implied to be ongoing as no outcome is given).
  • Plaintiff(s): Not explicitly stated.
  • Defendant(s): Not explicitly stated.

• Jurisdiction: Court of Appeals for the Federal Circuit

  • Case Number: 24-1238
  • Filing Date: Not explicitly stated.
  • Status: Not explicitly stated (implied to be ongoing as no outcome is given).
  • Plaintiff(s): Not explicitly stated.
  • Defendant(s): Not explicitly stated.

PTAB Cases:

• Jurisdiction: PTAB

  • Case Number: IPR2022-00646
  • Filing Date: Not explicitly stated.
  • Status: Pending - Instituted
  • Petitioner: Not explicitly stated
  • Defendant(s): Not explicitly stated.

• Jurisdiction: PTAB

  • Case Number: IPR2023-00259
  • Filing Date: Not explicitly stated.
  • Status: Final Written Decision
  • Petitioner: Not explicitly stated
  • Defendant(s): Not explicitly stated.

• Jurisdiction: PTAB

  • Case Number: IPR2016-00608
  • Filing Date: Not explicitly stated.
  • Status: Settlement
  • Petitioner: Not explicitly stated
  • Defendant(s): Not explicitly stated.

• Jurisdiction: PTAB

  • Case Number: IPR2019-00404
  • Filing Date: Not explicitly stated.
  • Status: Not Instituted - Procedural
  • Petitioner: Not explicitly stated
  • Defendant(s): Not explicitly stated.

• Jurisdiction: PTAB

  • Case Number: IPR2018-01685
  • Filing Date: Not explicitly stated.
  • Status: Not Instituted - Merits
  • Petitioner: Not explicitly stated
  • Defendant(s): Not explicitly stated.

• Jurisdiction: PTAB

  • Case Number: IPR2017-01158
  • Filing Date: Not explicitly stated.
  • Status: Not Instituted - Merits
  • Petitioner: Not explicitly stated
  • Defendant(s): Not explicitly stated.

• Jurisdiction: PTAB

  • Case Number: IPR2016-00609
  • Filing Date: Not explicitly stated.
  • Status: Final Written Decision
  • Petitioner: Not explicitly stated
  • Defendant(s): Not explicitly stated.

The USPTO Open Data Portal API reports no AIA trial proceedings on file for US Patent 7631346 as of the most recent ingest. However, the provided patent information from Google Patents explicitly lists several PTAB cases related to this patent. This analysis will proceed by leveraging the case numbers identified in the Google Patents data, acknowledging the discrepancy with the ODP API's current ingest.

Proceedings overview

US Patent 7631346 has been the subject of seven Inter Partes Review (IPR) proceedings. Of these, two have reached a Final Written Decision, one is currently pending and instituted, one concluded with a settlement, and four petitions were not instituted (one for procedural reasons and three on the merits). All identified petitions were filed by Unified Patents. This history demonstrates a consistent effort to challenge the patent's validity, but without specific claim-level outcomes from the Final Written Decisions readily available in the provided search results, the precise defensive posture regarding specific claims remains unclarified.

Note on data source: The USPTO Open Data Portal API reports no AIA trial proceedings on file for this patent. However, the Google Patents record for US7631346 explicitly lists the following PTAB proceedings [cite: https://patents.google.com/patent/US7631346/en]. This analysis relies on the Google Patents information for the existence and general status of these proceedings.

IPR2023-00259 — Unified Patents, LLC v. International Business Machines Corp.

• Type: Inter Partes Review
• Filed: Details not available in provided search results.
• Status: Final Written Decision [cite: https://patents.google.com/patent/US7631346/en]
• Judge panel: Details not available in provided search results.
• Petitioner: Unified Patents, LLC [cite: https://patents.google.com/patent/US7631346/en]
• Patent Owner: International Business Machines Corp.
• Petition grounds: Details not available in provided search results.
• Institution decision: Details not available in provided search results.
• Final Written Decision (if issued): A Final Written Decision was issued [cite: https://patents.google.com/patent/US7631346/en]. However, the specific verdict at a claim-level granularity (e.g., which claims were canceled or sustained) and the panel's reasoning are not available in the provided search results.
• Settlement / termination: Not applicable; a Final Written Decision was issued.
• Appeal: Details not available in provided search results.
• Defensive value: The existence of a Final Written Decision indicates a full PTAB review was conducted. However, without the FWD's specific outcome, the impact on a defendant facing assertion of this patent is currently unknown.

IPR2016-00609 — Unified Patents, LLC v. International Business Machines Corp.

• Type: Inter Partes Review
• Filed: Details not available in provided search results.
• Status: Final Written Decision [cite: https://patents.google.com/patent/US7631346/en]
• Judge panel: Details not available in provided search results.
• Petitioner: Unified Patents, LLC [cite: https://patents.google.com/patent/US7631346/en]
• Patent Owner: International Business Machines Corp.
• Petition grounds: Details not available in provided search results.
• Institution decision: Details not available in provided search results.
• Final Written Decision (if issued): A Final Written Decision was issued [cite: https://patents.google.com/patent/US7631346/en]. However, the specific verdict at a claim-level granularity and the panel's reasoning are not available in the provided search results.
• Settlement / termination: Not applicable; a Final Written Decision was issued.
• Appeal: Details not available in provided search results.
• Defensive value: Similar to IPR2023-00259, a Final Written Decision was rendered. Without the specific outcomes, the defensive implications for current assertions are unclear.

IPR2022-00646 — Unified Patents, LLC v. International Business Machines Corp.

• Type: Inter Partes Review
• Filed: Details not available in provided search results.
• Status: Pending - Instituted [cite: https://patents.google.com/patent/US7631346/en]
• Judge panel: Details not available in provided search results.
• Petitioner: Unified Patents, LLC [cite: https://patents.google.com/patent/US7631346/en]
• Patent Owner: International Business Machines Corp.
• Petition grounds: Details not available in provided search results.
• Institution decision: The petition was instituted [cite: https://patents.google.com/patent/US7631346/en]. The date and reasoning are not available in the provided search results.
• Final Written Decision (if issued): Not yet issued, as the case is pending.
• Settlement / termination: Not applicable; the case is pending.
• Appeal: Not applicable; the case is pending.
• Defensive value: This active proceeding indicates that at least some claims of US7631346 are currently under review for patentability at the PTAB. The outcome, when known, will directly impact the validity of the challenged claims.

IPR2016-00608 — Unified Patents, LLC v. International Business Machines Corp.

• Type: Inter Partes Review
• Filed: Details not available in provided search results.
• Status: Settlement [cite: https://patents.google.com/patent/US7631346/en]
• Judge panel: Details not available in provided search results.
• Petitioner: Unified Patents, LLC [cite: https://patents.google.com/patent/US7631346/en]
• Patent Owner: International Business Machines Corp.
• Petition grounds: Details not available in provided search results.
• Institution decision: Details not available in provided search results.
• Final Written Decision (if issued): Not issued due to settlement.
• Settlement / termination: The proceeding was terminated due to a settlement [cite: https://patents.google.com/patent/US7631346/en]. The terms of the settlement are confidential and not available in the provided search results.
• Appeal: Not applicable.
• Defensive value: Settlement usually means the parties reached an agreement, often involving a license or other resolution. Without knowing the terms, it's hard to assess direct impact on claims, but it shows a willingness to resolve disputes outside of a full PTAB decision.

IPR2019-00404 — Unified Patents, LLC v. International Business Machines Corp.

• Type: Inter Partes Review
• Filed: Details not available in provided search results.
• Status: Not Instituted - Procedural [cite: https://patents.google.com/patent/US7631346/en]
• Judge panel: Details not available in provided search results.
• Petitioner: Unified Patents, LLC [cite: https://patents.google.com/patent/US7631346/en]
• Patent Owner: International Business Machines Corp.
• Petition grounds: Details not available in provided search results.
• Institution decision: The petition was not instituted for procedural reasons [cite: https://patents.google.com/patent/US7631346/en]. The date and specific reasoning are not available in the provided search results.
• Final Written Decision (if issued): Not applicable, as the petition was not instituted.
• Settlement / termination: The proceeding was terminated due to non-institution.
• Appeal: Not applicable.
• Defensive value: This non-institution means the patent's claims were not substantively reviewed in this particular IPR. Procedural denials can be due to various reasons (e.g., timeliness, standing, improper filing).

IPR2018-01685 — Unified Patents, LLC v. International Business Machines Corp.

• Type: Inter Partes Review
• Filed: Details not available in provided search results.
• Status: Not Instituted - Merits [cite: https://patents.google.com/patent/US7631346/en]
• Judge panel: Details not available in provided search results.
• Petitioner: Unified Patents, LLC [cite: https://patents.google.com/patent/US7631346/en]
• Patent Owner: International Business Machines Corp.
• Petition grounds: Details not available in provided search results.
• Institution decision: The petition was not instituted on the merits [cite: https://patents.google.com/patent/US7631346/en]. The date and specific reasoning (e.g., failure to show a reasonable likelihood of prevailing) are not available in the provided search results.
• Final Written Decision (if issued): Not applicable, as the petition was not instituted.
• Settlement / termination: The proceeding was terminated due to non-institution.
• Appeal: Not applicable.
• Defensive value: Non-institution on the merits suggests the PTAB found the petition failed to demonstrate a sufficient basis for unpatentability, thus providing a degree of hardening for the patent against the specific grounds raised in this petition.

IPR2017-01158 — Unified Patents, LLC v. International Business Machines Corp.

• Type: Inter Partes Review
• Filed: Details not available in provided search results.
• Status: Not Instituted - Merits [cite: https://patents.google.com/patent/US7631346/en]
• Judge panel: Details not available in provided search results.
• Petitioner: Unified Patents, LLC [cite: https://patents.google.com/patent/US7631346/en]
• Patent Owner: International Business Machines Corp.
• Petition grounds: Details not available in provided search results.
• Institution decision: The petition was not instituted on the merits [cite: https://patents.google.com/patent/US7631346/en]. The date and specific reasoning are not available in the provided search results.
• Final Written Decision (if issued): Not applicable, as the petition was not instituted.
• Settlement / termination: The proceeding was terminated due to non-institution.
• Appeal: Not applicable.
• Defensive value: Similar to IPR2018-01685, this non-institution on the merits also suggests the PTAB did not find compelling arguments for unpatentability in this petition, strengthening the patent against the specific art presented.

Strategic summary

Based on the available information, the claim-level status of US7631346 remains largely opaque. While two IPRs (IPR2023-00259 and IPR2016-00609) resulted in Final Written Decisions, the outcomes regarding which claims, if any, were canceled or sustained are not detailed in the provided search results. One IPR (IPR2022-00646) is currently pending and instituted, indicating ongoing scrutiny of at least some claims. Conversely, four IPR petitions were denied institution, three of them on the merits (IPR2018-01685, IPR2017-01158), suggesting that the PTAB found the specific invalidity arguments presented in those petitions unconvincing. One IPR (IPR2016-00608) settled, the terms of which are unknown. Therefore, without the FWDs and institution decisions, it is currently impossible to list specific canceled, sustained, or untested claims.

The estoppel landscape for future petitioners is primarily shaped by the non-instituted and FWD proceedings. For the three IPRs denied on the merits, the petitioner (Unified Patents, LLC) and its privies would be estopped from raising the same grounds or any grounds that could have reasonably been raised in those petitions under 35 U.S.C. § 315(e)(2). The same estoppel would apply to the two IPRs that went to Final Written Decision, covering any claims and grounds adjudicated. The IPR that was denied procedurally would likely not trigger merits-based estoppel.

The clear pattern signal here is the consistent challenging of the patent by Unified Patents, LLC. As a defensive aggregator, Unified Patents initiates IPRs to deter unsubstantiated or invalid patent assertions against its members. The multiple IPRs, including those that were denied institution on the merits, suggest that while Unified Patents has aggressively targeted this patent, the PTAB has not uniformly found all of its challenges to be meritorious. The fact that an IPR is still pending and instituted (IPR2022-00646) indicates that new challenges or new art might have been found persuasive, or that the previous non-institutions did not cover all claims or grounds.

Recommended next steps

For a defendant currently facing assertion of US7631346:

• Obtain Final Written Decisions: Immediately acquire and review the Final Written Decisions for IPR2023-00259 and IPR2016-00609. These decisions are crucial to understand which claims, if any, were found unpatentable and the specific reasoning. This information will directly impact any infringement theories. These documents can be found on the USPTO PTAB E2E portal.
• Monitor Active Proceeding: Closely monitor IPR2022-00646, which is currently pending post-institution. The institution decision and any subsequent developments, including a potential Final Written Decision (due within one year of institution, absent good cause for extension), will be critical.
• Review Non-Institution Decisions: Review the decisions to deny institution for IPR2018-01685, IPR2017-01158 (denied on merits), and IPR2019-00404 (denied procedurally). Understanding the PTAB's reasoning for these denials can inform new invalidity arguments or highlight the strength of the patent owner's positions on those specific prior art grounds.
• Analyze Settlement: While the terms are confidential, consider if the settlement in IPR2016-00608 offers any indirect insights into the patent's strength or the patent owner's enforcement strategy, perhaps by analyzing the parties involved if publicly available.

Inventors

• Heather Maria Hinton (International Business Machines Corp.)
• Ivan Matthew Milman (International Business Machines Corp.)
• Venkat Raghavan (International Business Machines Corp.)
• Shane Bradley Weeden (International Business Machines Corp.)

The initial assignment from the inventors to International Business Machines Corp. occurred on April 20, 2005, shortly after the patent's filing date of April 1, 2005. This is a standard practice for employee-inventors, and no unusual patterns regarding inventor departures are determinable from the provided information.

Original assignee

The original assignee on the issued patent is International Business Machines Corp (IBM). IBM is a global information technology company that designs, develops, manufactures, and sells computer hardware, software, infrastructure, and provides consulting services. The company ships numerous products that would embody the claims of this patent, particularly in the areas of enterprise security, identity management, and single-sign-on solutions. IBM is currently an active, operating company.

Assignment timeline

Based on the provided full patent text:

• 2005-04-20 (executed) / recorded N/A — Reel N/A
  • Conveyance: Assignment of Assignors Interest
  • Assignor: Raghavan, Venkat; Weeden, Shane Bradley; Hinton, Heather Maria; Milman, Ivan Matthew
  • Assignee: International Business Machines Corporation
  • Correspondent: Not specified in the provided text.
  • Context: Initial assignment from individual inventors to the corporate employer (International Business Machines Corporation).

The provided full patent text from Google Patents lists only this single assignment event from the inventors to International Business Machines Corporation in its "Timeline" section. No further assignment records that would indicate subsequent transfers of ownership for US7631346 (with corresponding reel/frame details from the USPTO Assignment Center) are present in the provided information.

Timeline diagram

timeline
    title Ownership of US 7631346
    2005 : Filed and assigned to IBM by inventors
    2009 : Issued

NPE / troll-pattern signals

1. Shell-entity transfer — Not present. The only recorded assignee in the provided text is International Business Machines Corporation, which is an operating company.
2. Known asserter in the chain — Not present. International Business Machines Corporation is not identified as a known Non-Practicing Entity (NPE).
3. Repeat correspondent across the chain — Insufficient data. Only one assignment event is detailed in the provided text, and no correspondent information is specified for it.
4. Cascading transfers — Not present. Only one assignment event is detailed.
5. Pre-litigation transfer — Not present. The only recorded assignment is the initial inventor-to-company assignment in 2005. While litigation is ongoing, no subsequent transfers of ownership prior to these suits are indicated in the provided text.
6. Bankruptcy fire-sale — Not present. International Business Machines Corporation is an active, operating company, and there is no indication of bankruptcy.
7. Privateering — Not present. No transfer to an NPE on behalf of an operating company is indicated in the provided text.
8. Defensive aggregator (anti-NPE) — Not present. The patent remains with International Business Machines Corporation, an operating company, as per the provided information.

Verdict

Operating-company assertion
The patent remains with International Business Machines Corporation, the original operating company, according to the assignment records present in the provided patent text. There are no indications of any transfers to shell entities or known NPEs in the record. The reported litigation is consistent with an operating company like IBM asserting its intellectual property. You can verify the latest assignment records on the USPTO Assignment Center by searching for patent number 7631346.

I am unable to provide a detailed list of patent citations for US7631346B2, along with their publication/filing dates, brief descriptions, and potential anticipation analysis under 35 U.S.C. § 102, because the specific "References Cited" section listing patent citations is not present in the full patent text provided to me.

While the Google Patents overview for US7631346B2 indicates there are "Patent citations (21)", the actual list of these cited patents is not included in the provided authoritative patent text. Without access to this list, I cannot perform the requested analysis for each cited patent.

The provided patent text does, however, mention some non-patent prior art, such as:

• Liberty Alliance ID-FF specifications: These are noted as prior art solutions requiring a user to have an authenticatable account at both an identity provider and a service provider as a prerequisite to a federated single-sign-on operation.
• Kohl et al., “The Kerberos Network Authentication Service (V5)”, Internet Engineering Task Force (IETF) Request for Comments (RFC) 1510, 09/1993: This document provides information on Kerberos, an authentication token mentioned in the patent.
• “Assertions and Protocol for the OASIS Security Assertion Markup Language (SAML)”, Committee Specification 01, May 31, 2002: This specification describes SAML, a type of assertion used in the context of the invention.

These non-patent references describe existing technologies and solutions related to single-sign-on and federated environments that the patent aims to improve upon, particularly by introducing runtime user account creation.

The obviousness analysis under 35 U.S.C. § 103 requires identifying prior art references that, when combined, would render the claimed invention obvious to a person having ordinary skill in the art (PHOSITA), along with a motivation for such a combination.

The core innovation of US Patent 7631346 is a method and system for creating a user account at a service provider (SP) at runtime, during a single-sign-on (SSO) process initiated by an identity provider (IDP), when no pre-existing linked account for that user is found at the SP. This addresses a limitation in prior art SSO solutions which required an account to exist at both the IDP and SP beforehand.

Identified Prior Art References (as described in US7631346):

1. Reference A (Prior Art SSO Prerequisite): "Various prior art single-sign-on solutions, e.g., such as those described in the Liberty Alliance ID-FF specifications, require that a user have an authenticatable account at both an identity provider and a service provider as a prerequisite to a federated single-sign-on operation."
2. Reference B (Prior Art A Priori Account Creation): "Some federated solutions support an a priori user account creation event across domains to be used to establish these accounts, thereby satisfying a requirement that a user have an authenticatable account at both an identity provider and a service provider as a prerequisite to a federated single-sign-on operation."
3. Reference C (Prior Art Federated User Lifecycle Management): "Some federated solutions provide a robust set of federated user lifecycle management operations, such as user account creation, user account management, user attribute management, account suspension, and account deletion, these federated management systems do not provide a lightweight solution that is suitable for certain federation partners or for certain federated purposes."
4. Reference D (Prior Art SSO Dataflow): FIG. 8, which "depicts a typical prior art HTTP-redirection-based single-sign-on operation that is initiated by a federated identity provider to obtain access to a protected resource at a federated service provider." Notably, step 802 explicitly states that "the user of a client... has already established a user account not only at the identity provider but also at the service provider."

Obviousness Combination and Motivation:

A PHOSITA in the field of federated identity management would be familiar with the concepts of single-sign-on and user account management in federated environments. The problem addressed by US7631346 is clearly articulated within the patent itself: prior art SSO solutions, such as those described in the Liberty Alliance ID-FF specifications (Reference A), mandated that a user must have an existing account at both the identity provider and the service provider as a precondition for a successful federated SSO operation. This prerequisite creates an administrative burden and can hinder user adoption and a seamless user experience.

The motivation to combine existing prior art references would stem from the desire to overcome this known "prerequisite" problem and to provide a more flexible and "user-friendly" federated access experience, especially for "lightweight" federation scenarios (as alluded to in Reference C).

A PHOSITA, faced with the requirement of pre-existing accounts for SSO (Reference A, Reference D), and knowing that federated user account creation (provisioning) mechanisms already existed (References B and C), would be motivated to integrate these functionalities. Specifically, upon a user attempting a federated SSO operation from an identity provider to a service provider (as depicted in Reference D), if the service provider's existing check for a linked user account (which would normally fail without the prerequisite, as in step 802 of FIG. 8) determines that such an account does not exist, the PHOSITA would find it obvious to initiate a user account creation process at that moment.

This on-demand account creation would leverage the existing knowledge and techniques for user account creation and attribute management in federated environments (References B and C), utilizing the user identity information (such as an alias, a known concept for uniquely identifying a user in federated systems) that is naturally transmitted by the identity provider as part of the SSO request.

Addressing the Independent Claims:

• Claim 1 (Method):

  • The steps of "an identity provider sending a request to a service provider for a user to access a protected resource" and "the identity provider including in the request a single-sign-on request" are clearly taught by prior art SSO mechanisms (Reference A and D, specifically steps 806-814 of FIG. 8).
  • The concept of including an "alias for the user" in the SSO request aligns with known practices in federated identity for referring to a user's identity across domains.
  • The service provider "determining that a linked user account for the user, as identified by the alias, does not exist at the service provider" is an inherent part of the prior art SSO prerequisite (Reference A, D), where such a check would precede authentication.
  • The inventive step of "the service provider creating a new local user account for the user... in response to determining that the linked user account does not exist, wherein the new local user account is created based at least in part on information from the identity provider" is a direct combination of the known account creation functionality (References B and C) with the SSO process. The motivation is to overcome the explicit "prerequisite" outlined in Reference A and D by leveraging existing tools to automatically onboard the user.
  • "the service provider processing the request... for the user to access the protected resource in response to creating the new local user account" naturally follows the successful establishment of a local account, enabling the standard resource access (Reference D, step 818).

• Claim 10 (System):

  • The "single-sign-on request builder at an identity provider" and "single-sign-on request handler at a service provider" are components inherent in any federated SSO system (Reference A and D).
  • The "user account creation unit at the service provider configured to create a local user account for the user... when the single-sign-on request handler determines that a linked user account... does not exist" is the system embodiment of the combined method. The motivation for implementing such a unit and its conditional activation is, as discussed, to provide a more flexible SSO by integrating existing account creation (References B and C) into the runtime flow to overcome the prior art's explicit requirement of pre-existing accounts (Reference A, D).
  • The "resource access unit at the service provider" is also a standard component of any system providing access to protected resources (Reference D, step 818).

• Claim 19 (Computer Program Product):

  • Since the method of Claim 1 would be obvious to a PHOSITA, the computer program product storing instructions to perform this obvious method would likewise be obvious.

In conclusion, a PHOSITA, motivated to eliminate the administrative burden and enhance the user experience associated with the pre-existing account prerequisite in federated SSO (a known problem in the art), would find it obvious to integrate existing federated user account creation capabilities into the runtime SSO flow when an account is not found at the service provider.